1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * Security plug functions
5 * Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com>
6 * Copyright (C) 2001-2002 Greg Kroah-Hartman <greg@kroah.com>
7 * Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com>
8 * Copyright (C) 2016 Mellanox Technologies
9 * Copyright (C) 2023 Microsoft Corporation <paul@paul-moore.com>
12 #define pr_fmt(fmt) "LSM: " fmt
14 #include <linux/bpf.h>
15 #include <linux/capability.h>
16 #include <linux/dcache.h>
17 #include <linux/export.h>
18 #include <linux/init.h>
19 #include <linux/kernel.h>
20 #include <linux/kernel_read_file.h>
21 #include <linux/lsm_hooks.h>
22 #include <linux/integrity.h>
23 #include <linux/ima.h>
24 #include <linux/evm.h>
25 #include <linux/fsnotify.h>
26 #include <linux/mman.h>
27 #include <linux/mount.h>
28 #include <linux/personality.h>
29 #include <linux/backing-dev.h>
30 #include <linux/string.h>
31 #include <linux/msg.h>
34 #define MAX_LSM_EVM_XATTR 2
36 /* How many LSMs were built into the kernel? */
37 #define LSM_COUNT (__end_lsm_info - __start_lsm_info)
40 * These are descriptions of the reasons that can be passed to the
41 * security_locked_down() LSM hook. Placing this array here allows
42 * all security modules to use the same descriptions for auditing
45 const char *const lockdown_reasons
[LOCKDOWN_CONFIDENTIALITY_MAX
+ 1] = {
46 [LOCKDOWN_NONE
] = "none",
47 [LOCKDOWN_MODULE_SIGNATURE
] = "unsigned module loading",
48 [LOCKDOWN_DEV_MEM
] = "/dev/mem,kmem,port",
49 [LOCKDOWN_EFI_TEST
] = "/dev/efi_test access",
50 [LOCKDOWN_KEXEC
] = "kexec of unsigned images",
51 [LOCKDOWN_HIBERNATION
] = "hibernation",
52 [LOCKDOWN_PCI_ACCESS
] = "direct PCI access",
53 [LOCKDOWN_IOPORT
] = "raw io port access",
54 [LOCKDOWN_MSR
] = "raw MSR access",
55 [LOCKDOWN_ACPI_TABLES
] = "modifying ACPI tables",
56 [LOCKDOWN_DEVICE_TREE
] = "modifying device tree contents",
57 [LOCKDOWN_PCMCIA_CIS
] = "direct PCMCIA CIS storage",
58 [LOCKDOWN_TIOCSSERIAL
] = "reconfiguration of serial port IO",
59 [LOCKDOWN_MODULE_PARAMETERS
] = "unsafe module parameters",
60 [LOCKDOWN_MMIOTRACE
] = "unsafe mmio",
61 [LOCKDOWN_DEBUGFS
] = "debugfs access",
62 [LOCKDOWN_XMON_WR
] = "xmon write access",
63 [LOCKDOWN_BPF_WRITE_USER
] = "use of bpf to write user RAM",
64 [LOCKDOWN_DBG_WRITE_KERNEL
] = "use of kgdb/kdb to write kernel RAM",
65 [LOCKDOWN_RTAS_ERROR_INJECTION
] = "RTAS error injection",
66 [LOCKDOWN_INTEGRITY_MAX
] = "integrity",
67 [LOCKDOWN_KCORE
] = "/proc/kcore access",
68 [LOCKDOWN_KPROBES
] = "use of kprobes",
69 [LOCKDOWN_BPF_READ_KERNEL
] = "use of bpf to read kernel RAM",
70 [LOCKDOWN_DBG_READ_KERNEL
] = "use of kgdb/kdb to read kernel RAM",
71 [LOCKDOWN_PERF
] = "unsafe use of perf",
72 [LOCKDOWN_TRACEFS
] = "use of tracefs",
73 [LOCKDOWN_XMON_RW
] = "xmon read and write access",
74 [LOCKDOWN_XFRM_SECRET
] = "xfrm SA secret",
75 [LOCKDOWN_CONFIDENTIALITY_MAX
] = "confidentiality",
78 struct security_hook_heads security_hook_heads __ro_after_init
;
79 static BLOCKING_NOTIFIER_HEAD(blocking_lsm_notifier_chain
);
81 static struct kmem_cache
*lsm_file_cache
;
82 static struct kmem_cache
*lsm_inode_cache
;
85 static struct lsm_blob_sizes blob_sizes __ro_after_init
;
87 /* Boot-time LSM user choice */
88 static __initdata
const char *chosen_lsm_order
;
89 static __initdata
const char *chosen_major_lsm
;
91 static __initconst
const char *const builtin_lsm_order
= CONFIG_LSM
;
93 /* Ordered list of LSMs to initialize. */
94 static __initdata
struct lsm_info
**ordered_lsms
;
95 static __initdata
struct lsm_info
*exclusive
;
97 static __initdata
bool debug
;
98 #define init_debug(...) \
101 pr_info(__VA_ARGS__); \
104 static bool __init
is_enabled(struct lsm_info
*lsm
)
109 return *lsm
->enabled
;
112 /* Mark an LSM's enabled flag. */
113 static int lsm_enabled_true __initdata
= 1;
114 static int lsm_enabled_false __initdata
= 0;
115 static void __init
set_enabled(struct lsm_info
*lsm
, bool enabled
)
118 * When an LSM hasn't configured an enable variable, we can use
119 * a hard-coded location for storing the default enabled state.
123 lsm
->enabled
= &lsm_enabled_true
;
125 lsm
->enabled
= &lsm_enabled_false
;
126 } else if (lsm
->enabled
== &lsm_enabled_true
) {
128 lsm
->enabled
= &lsm_enabled_false
;
129 } else if (lsm
->enabled
== &lsm_enabled_false
) {
131 lsm
->enabled
= &lsm_enabled_true
;
133 *lsm
->enabled
= enabled
;
137 /* Is an LSM already listed in the ordered LSMs list? */
138 static bool __init
exists_ordered_lsm(struct lsm_info
*lsm
)
140 struct lsm_info
**check
;
142 for (check
= ordered_lsms
; *check
; check
++)
149 /* Append an LSM to the list of ordered LSMs to initialize. */
150 static int last_lsm __initdata
;
151 static void __init
append_ordered_lsm(struct lsm_info
*lsm
, const char *from
)
153 /* Ignore duplicate selections. */
154 if (exists_ordered_lsm(lsm
))
157 if (WARN(last_lsm
== LSM_COUNT
, "%s: out of LSM slots!?\n", from
))
160 /* Enable this LSM, if it is not already set. */
162 lsm
->enabled
= &lsm_enabled_true
;
163 ordered_lsms
[last_lsm
++] = lsm
;
165 init_debug("%s ordered: %s (%s)\n", from
, lsm
->name
,
166 is_enabled(lsm
) ? "enabled" : "disabled");
169 /* Is an LSM allowed to be initialized? */
170 static bool __init
lsm_allowed(struct lsm_info
*lsm
)
172 /* Skip if the LSM is disabled. */
173 if (!is_enabled(lsm
))
176 /* Not allowed if another exclusive LSM already initialized. */
177 if ((lsm
->flags
& LSM_FLAG_EXCLUSIVE
) && exclusive
) {
178 init_debug("exclusive disabled: %s\n", lsm
->name
);
185 static void __init
lsm_set_blob_size(int *need
, int *lbs
)
192 offset
= ALIGN(*lbs
, sizeof(void *));
193 *lbs
= offset
+ *need
;
197 static void __init
lsm_set_blob_sizes(struct lsm_blob_sizes
*needed
)
202 lsm_set_blob_size(&needed
->lbs_cred
, &blob_sizes
.lbs_cred
);
203 lsm_set_blob_size(&needed
->lbs_file
, &blob_sizes
.lbs_file
);
205 * The inode blob gets an rcu_head in addition to
206 * what the modules might need.
208 if (needed
->lbs_inode
&& blob_sizes
.lbs_inode
== 0)
209 blob_sizes
.lbs_inode
= sizeof(struct rcu_head
);
210 lsm_set_blob_size(&needed
->lbs_inode
, &blob_sizes
.lbs_inode
);
211 lsm_set_blob_size(&needed
->lbs_ipc
, &blob_sizes
.lbs_ipc
);
212 lsm_set_blob_size(&needed
->lbs_msg_msg
, &blob_sizes
.lbs_msg_msg
);
213 lsm_set_blob_size(&needed
->lbs_superblock
, &blob_sizes
.lbs_superblock
);
214 lsm_set_blob_size(&needed
->lbs_task
, &blob_sizes
.lbs_task
);
217 /* Prepare LSM for initialization. */
218 static void __init
prepare_lsm(struct lsm_info
*lsm
)
220 int enabled
= lsm_allowed(lsm
);
222 /* Record enablement (to handle any following exclusive LSMs). */
223 set_enabled(lsm
, enabled
);
225 /* If enabled, do pre-initialization work. */
227 if ((lsm
->flags
& LSM_FLAG_EXCLUSIVE
) && !exclusive
) {
229 init_debug("exclusive chosen: %s\n", lsm
->name
);
232 lsm_set_blob_sizes(lsm
->blobs
);
236 /* Initialize a given LSM, if it is enabled. */
237 static void __init
initialize_lsm(struct lsm_info
*lsm
)
239 if (is_enabled(lsm
)) {
242 init_debug("initializing %s\n", lsm
->name
);
244 WARN(ret
, "%s failed to initialize: %d\n", lsm
->name
, ret
);
248 /* Populate ordered LSMs list from comma-separated LSM name list. */
249 static void __init
ordered_lsm_parse(const char *order
, const char *origin
)
251 struct lsm_info
*lsm
;
252 char *sep
, *name
, *next
;
254 /* LSM_ORDER_FIRST is always first. */
255 for (lsm
= __start_lsm_info
; lsm
< __end_lsm_info
; lsm
++) {
256 if (lsm
->order
== LSM_ORDER_FIRST
)
257 append_ordered_lsm(lsm
, " first");
260 /* Process "security=", if given. */
261 if (chosen_major_lsm
) {
262 struct lsm_info
*major
;
265 * To match the original "security=" behavior, this
266 * explicitly does NOT fallback to another Legacy Major
267 * if the selected one was separately disabled: disable
268 * all non-matching Legacy Major LSMs.
270 for (major
= __start_lsm_info
; major
< __end_lsm_info
;
272 if ((major
->flags
& LSM_FLAG_LEGACY_MAJOR
) &&
273 strcmp(major
->name
, chosen_major_lsm
) != 0) {
274 set_enabled(major
, false);
275 init_debug("security=%s disabled: %s (only one legacy major LSM)\n",
276 chosen_major_lsm
, major
->name
);
281 sep
= kstrdup(order
, GFP_KERNEL
);
283 /* Walk the list, looking for matching LSMs. */
284 while ((name
= strsep(&next
, ",")) != NULL
) {
287 for (lsm
= __start_lsm_info
; lsm
< __end_lsm_info
; lsm
++) {
288 if (strcmp(lsm
->name
, name
) == 0) {
289 if (lsm
->order
== LSM_ORDER_MUTABLE
)
290 append_ordered_lsm(lsm
, origin
);
296 init_debug("%s ignored: %s (not built into kernel)\n",
300 /* Process "security=", if given. */
301 if (chosen_major_lsm
) {
302 for (lsm
= __start_lsm_info
; lsm
< __end_lsm_info
; lsm
++) {
303 if (exists_ordered_lsm(lsm
))
305 if (strcmp(lsm
->name
, chosen_major_lsm
) == 0)
306 append_ordered_lsm(lsm
, "security=");
310 /* LSM_ORDER_LAST is always last. */
311 for (lsm
= __start_lsm_info
; lsm
< __end_lsm_info
; lsm
++) {
312 if (lsm
->order
== LSM_ORDER_LAST
)
313 append_ordered_lsm(lsm
, " last");
316 /* Disable all LSMs not in the ordered list. */
317 for (lsm
= __start_lsm_info
; lsm
< __end_lsm_info
; lsm
++) {
318 if (exists_ordered_lsm(lsm
))
320 set_enabled(lsm
, false);
321 init_debug("%s skipped: %s (not in requested order)\n",
328 static void __init
lsm_early_cred(struct cred
*cred
);
329 static void __init
lsm_early_task(struct task_struct
*task
);
331 static int lsm_append(const char *new, char **result
);
333 static void __init
report_lsm_order(void)
335 struct lsm_info
**lsm
, *early
;
338 pr_info("initializing lsm=");
340 /* Report each enabled LSM name, comma separated. */
341 for (early
= __start_early_lsm_info
;
342 early
< __end_early_lsm_info
; early
++)
343 if (is_enabled(early
))
344 pr_cont("%s%s", first
++ == 0 ? "" : ",", early
->name
);
345 for (lsm
= ordered_lsms
; *lsm
; lsm
++)
346 if (is_enabled(*lsm
))
347 pr_cont("%s%s", first
++ == 0 ? "" : ",", (*lsm
)->name
);
352 static void __init
ordered_lsm_init(void)
354 struct lsm_info
**lsm
;
356 ordered_lsms
= kcalloc(LSM_COUNT
+ 1, sizeof(*ordered_lsms
),
359 if (chosen_lsm_order
) {
360 if (chosen_major_lsm
) {
361 pr_warn("security=%s is ignored because it is superseded by lsm=%s\n",
362 chosen_major_lsm
, chosen_lsm_order
);
363 chosen_major_lsm
= NULL
;
365 ordered_lsm_parse(chosen_lsm_order
, "cmdline");
367 ordered_lsm_parse(builtin_lsm_order
, "builtin");
369 for (lsm
= ordered_lsms
; *lsm
; lsm
++)
374 init_debug("cred blob size = %d\n", blob_sizes
.lbs_cred
);
375 init_debug("file blob size = %d\n", blob_sizes
.lbs_file
);
376 init_debug("inode blob size = %d\n", blob_sizes
.lbs_inode
);
377 init_debug("ipc blob size = %d\n", blob_sizes
.lbs_ipc
);
378 init_debug("msg_msg blob size = %d\n", blob_sizes
.lbs_msg_msg
);
379 init_debug("superblock blob size = %d\n", blob_sizes
.lbs_superblock
);
380 init_debug("task blob size = %d\n", blob_sizes
.lbs_task
);
383 * Create any kmem_caches needed for blobs
385 if (blob_sizes
.lbs_file
)
386 lsm_file_cache
= kmem_cache_create("lsm_file_cache",
387 blob_sizes
.lbs_file
, 0,
389 if (blob_sizes
.lbs_inode
)
390 lsm_inode_cache
= kmem_cache_create("lsm_inode_cache",
391 blob_sizes
.lbs_inode
, 0,
394 lsm_early_cred((struct cred
*) current
->cred
);
395 lsm_early_task(current
);
396 for (lsm
= ordered_lsms
; *lsm
; lsm
++)
397 initialize_lsm(*lsm
);
402 int __init
early_security_init(void)
404 struct lsm_info
*lsm
;
406 #define LSM_HOOK(RET, DEFAULT, NAME, ...) \
407 INIT_HLIST_HEAD(&security_hook_heads.NAME);
408 #include "linux/lsm_hook_defs.h"
411 for (lsm
= __start_early_lsm_info
; lsm
< __end_early_lsm_info
; lsm
++) {
413 lsm
->enabled
= &lsm_enabled_true
;
422 * security_init - initializes the security framework
424 * This should be called early in the kernel initialization sequence.
426 int __init
security_init(void)
428 struct lsm_info
*lsm
;
430 init_debug("legacy security=%s\n", chosen_major_lsm
? : " *unspecified*");
431 init_debug(" CONFIG_LSM=%s\n", builtin_lsm_order
);
432 init_debug("boot arg lsm=%s\n", chosen_lsm_order
? : " *unspecified*");
435 * Append the names of the early LSM modules now that kmalloc() is
438 for (lsm
= __start_early_lsm_info
; lsm
< __end_early_lsm_info
; lsm
++) {
439 init_debug(" early started: %s (%s)\n", lsm
->name
,
440 is_enabled(lsm
) ? "enabled" : "disabled");
442 lsm_append(lsm
->name
, &lsm_names
);
445 /* Load LSMs in specified order. */
451 /* Save user chosen LSM */
452 static int __init
choose_major_lsm(char *str
)
454 chosen_major_lsm
= str
;
457 __setup("security=", choose_major_lsm
);
459 /* Explicitly choose LSM initialization order. */
460 static int __init
choose_lsm_order(char *str
)
462 chosen_lsm_order
= str
;
465 __setup("lsm=", choose_lsm_order
);
467 /* Enable LSM order debugging. */
468 static int __init
enable_debug(char *str
)
473 __setup("lsm.debug", enable_debug
);
475 static bool match_last_lsm(const char *list
, const char *lsm
)
479 if (WARN_ON(!list
|| !lsm
))
481 last
= strrchr(list
, ',');
483 /* Pass the comma, strcmp() will check for '\0' */
487 return !strcmp(last
, lsm
);
490 static int lsm_append(const char *new, char **result
)
494 if (*result
== NULL
) {
495 *result
= kstrdup(new, GFP_KERNEL
);
499 /* Check if it is the last registered name */
500 if (match_last_lsm(*result
, new))
502 cp
= kasprintf(GFP_KERNEL
, "%s,%s", *result
, new);
512 * security_add_hooks - Add a modules hooks to the hook lists.
513 * @hooks: the hooks to add
514 * @count: the number of hooks to add
515 * @lsm: the name of the security module
517 * Each LSM has to register its hooks with the infrastructure.
519 void __init
security_add_hooks(struct security_hook_list
*hooks
, int count
,
524 for (i
= 0; i
< count
; i
++) {
526 hlist_add_tail_rcu(&hooks
[i
].list
, hooks
[i
].head
);
530 * Don't try to append during early_security_init(), we'll come back
531 * and fix this up afterwards.
533 if (slab_is_available()) {
534 if (lsm_append(lsm
, &lsm_names
) < 0)
535 panic("%s - Cannot get early memory.\n", __func__
);
539 int call_blocking_lsm_notifier(enum lsm_event event
, void *data
)
541 return blocking_notifier_call_chain(&blocking_lsm_notifier_chain
,
544 EXPORT_SYMBOL(call_blocking_lsm_notifier
);
546 int register_blocking_lsm_notifier(struct notifier_block
*nb
)
548 return blocking_notifier_chain_register(&blocking_lsm_notifier_chain
,
551 EXPORT_SYMBOL(register_blocking_lsm_notifier
);
553 int unregister_blocking_lsm_notifier(struct notifier_block
*nb
)
555 return blocking_notifier_chain_unregister(&blocking_lsm_notifier_chain
,
558 EXPORT_SYMBOL(unregister_blocking_lsm_notifier
);
561 * lsm_cred_alloc - allocate a composite cred blob
562 * @cred: the cred that needs a blob
563 * @gfp: allocation type
565 * Allocate the cred blob for all the modules
567 * Returns 0, or -ENOMEM if memory can't be allocated.
569 static int lsm_cred_alloc(struct cred
*cred
, gfp_t gfp
)
571 if (blob_sizes
.lbs_cred
== 0) {
572 cred
->security
= NULL
;
576 cred
->security
= kzalloc(blob_sizes
.lbs_cred
, gfp
);
577 if (cred
->security
== NULL
)
583 * lsm_early_cred - during initialization allocate a composite cred blob
584 * @cred: the cred that needs a blob
586 * Allocate the cred blob for all the modules
588 static void __init
lsm_early_cred(struct cred
*cred
)
590 int rc
= lsm_cred_alloc(cred
, GFP_KERNEL
);
593 panic("%s: Early cred alloc failed.\n", __func__
);
597 * lsm_file_alloc - allocate a composite file blob
598 * @file: the file that needs a blob
600 * Allocate the file blob for all the modules
602 * Returns 0, or -ENOMEM if memory can't be allocated.
604 static int lsm_file_alloc(struct file
*file
)
606 if (!lsm_file_cache
) {
607 file
->f_security
= NULL
;
611 file
->f_security
= kmem_cache_zalloc(lsm_file_cache
, GFP_KERNEL
);
612 if (file
->f_security
== NULL
)
618 * lsm_inode_alloc - allocate a composite inode blob
619 * @inode: the inode that needs a blob
621 * Allocate the inode blob for all the modules
623 * Returns 0, or -ENOMEM if memory can't be allocated.
625 int lsm_inode_alloc(struct inode
*inode
)
627 if (!lsm_inode_cache
) {
628 inode
->i_security
= NULL
;
632 inode
->i_security
= kmem_cache_zalloc(lsm_inode_cache
, GFP_NOFS
);
633 if (inode
->i_security
== NULL
)
639 * lsm_task_alloc - allocate a composite task blob
640 * @task: the task that needs a blob
642 * Allocate the task blob for all the modules
644 * Returns 0, or -ENOMEM if memory can't be allocated.
646 static int lsm_task_alloc(struct task_struct
*task
)
648 if (blob_sizes
.lbs_task
== 0) {
649 task
->security
= NULL
;
653 task
->security
= kzalloc(blob_sizes
.lbs_task
, GFP_KERNEL
);
654 if (task
->security
== NULL
)
660 * lsm_ipc_alloc - allocate a composite ipc blob
661 * @kip: the ipc that needs a blob
663 * Allocate the ipc blob for all the modules
665 * Returns 0, or -ENOMEM if memory can't be allocated.
667 static int lsm_ipc_alloc(struct kern_ipc_perm
*kip
)
669 if (blob_sizes
.lbs_ipc
== 0) {
670 kip
->security
= NULL
;
674 kip
->security
= kzalloc(blob_sizes
.lbs_ipc
, GFP_KERNEL
);
675 if (kip
->security
== NULL
)
681 * lsm_msg_msg_alloc - allocate a composite msg_msg blob
682 * @mp: the msg_msg that needs a blob
684 * Allocate the ipc blob for all the modules
686 * Returns 0, or -ENOMEM if memory can't be allocated.
688 static int lsm_msg_msg_alloc(struct msg_msg
*mp
)
690 if (blob_sizes
.lbs_msg_msg
== 0) {
695 mp
->security
= kzalloc(blob_sizes
.lbs_msg_msg
, GFP_KERNEL
);
696 if (mp
->security
== NULL
)
702 * lsm_early_task - during initialization allocate a composite task blob
703 * @task: the task that needs a blob
705 * Allocate the task blob for all the modules
707 static void __init
lsm_early_task(struct task_struct
*task
)
709 int rc
= lsm_task_alloc(task
);
712 panic("%s: Early task alloc failed.\n", __func__
);
716 * lsm_superblock_alloc - allocate a composite superblock blob
717 * @sb: the superblock that needs a blob
719 * Allocate the superblock blob for all the modules
721 * Returns 0, or -ENOMEM if memory can't be allocated.
723 static int lsm_superblock_alloc(struct super_block
*sb
)
725 if (blob_sizes
.lbs_superblock
== 0) {
726 sb
->s_security
= NULL
;
730 sb
->s_security
= kzalloc(blob_sizes
.lbs_superblock
, GFP_KERNEL
);
731 if (sb
->s_security
== NULL
)
737 * The default value of the LSM hook is defined in linux/lsm_hook_defs.h and
738 * can be accessed with:
740 * LSM_RET_DEFAULT(<hook_name>)
742 * The macros below define static constants for the default value of each
745 #define LSM_RET_DEFAULT(NAME) (NAME##_default)
746 #define DECLARE_LSM_RET_DEFAULT_void(DEFAULT, NAME)
747 #define DECLARE_LSM_RET_DEFAULT_int(DEFAULT, NAME) \
748 static const int __maybe_unused LSM_RET_DEFAULT(NAME) = (DEFAULT);
749 #define LSM_HOOK(RET, DEFAULT, NAME, ...) \
750 DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME)
752 #include <linux/lsm_hook_defs.h>
756 * Hook list operation macros.
759 * This is a hook that does not return a value.
762 * This is a hook that returns a value.
765 #define call_void_hook(FUNC, ...) \
767 struct security_hook_list *P; \
769 hlist_for_each_entry(P, &security_hook_heads.FUNC, list) \
770 P->hook.FUNC(__VA_ARGS__); \
773 #define call_int_hook(FUNC, IRC, ...) ({ \
776 struct security_hook_list *P; \
778 hlist_for_each_entry(P, &security_hook_heads.FUNC, list) { \
779 RC = P->hook.FUNC(__VA_ARGS__); \
787 /* Security operations */
790 * security_binder_set_context_mgr() - Check if becoming binder ctx mgr is ok
791 * @mgr: task credentials of current binder process
793 * Check whether @mgr is allowed to be the binder context manager.
795 * Return: Return 0 if permission is granted.
797 int security_binder_set_context_mgr(const struct cred
*mgr
)
799 return call_int_hook(binder_set_context_mgr
, 0, mgr
);
803 * security_binder_transaction() - Check if a binder transaction is allowed
804 * @from: sending process
805 * @to: receiving process
807 * Check whether @from is allowed to invoke a binder transaction call to @to.
809 * Return: Returns 0 if permission is granted.
811 int security_binder_transaction(const struct cred
*from
,
812 const struct cred
*to
)
814 return call_int_hook(binder_transaction
, 0, from
, to
);
818 * security_binder_transfer_binder() - Check if a binder transfer is allowed
819 * @from: sending process
820 * @to: receiving process
822 * Check whether @from is allowed to transfer a binder reference to @to.
824 * Return: Returns 0 if permission is granted.
826 int security_binder_transfer_binder(const struct cred
*from
,
827 const struct cred
*to
)
829 return call_int_hook(binder_transfer_binder
, 0, from
, to
);
833 * security_binder_transfer_file() - Check if a binder file xfer is allowed
834 * @from: sending process
835 * @to: receiving process
836 * @file: file being transferred
838 * Check whether @from is allowed to transfer @file to @to.
840 * Return: Returns 0 if permission is granted.
842 int security_binder_transfer_file(const struct cred
*from
,
843 const struct cred
*to
, struct file
*file
)
845 return call_int_hook(binder_transfer_file
, 0, from
, to
, file
);
849 * security_ptrace_access_check() - Check if tracing is allowed
850 * @child: target process
851 * @mode: PTRACE_MODE flags
853 * Check permission before allowing the current process to trace the @child
854 * process. Security modules may also want to perform a process tracing check
855 * during an execve in the set_security or apply_creds hooks of tracing check
856 * during an execve in the bprm_set_creds hook of binprm_security_ops if the
857 * process is being traced and its security attributes would be changed by the
860 * Return: Returns 0 if permission is granted.
862 int security_ptrace_access_check(struct task_struct
*child
, unsigned int mode
)
864 return call_int_hook(ptrace_access_check
, 0, child
, mode
);
868 * security_ptrace_traceme() - Check if tracing is allowed
869 * @parent: tracing process
871 * Check that the @parent process has sufficient permission to trace the
872 * current process before allowing the current process to present itself to the
873 * @parent process for tracing.
875 * Return: Returns 0 if permission is granted.
877 int security_ptrace_traceme(struct task_struct
*parent
)
879 return call_int_hook(ptrace_traceme
, 0, parent
);
883 * security_capget() - Get the capability sets for a process
884 * @target: target process
885 * @effective: effective capability set
886 * @inheritable: inheritable capability set
887 * @permitted: permitted capability set
889 * Get the @effective, @inheritable, and @permitted capability sets for the
890 * @target process. The hook may also perform permission checking to determine
891 * if the current process is allowed to see the capability sets of the @target
894 * Return: Returns 0 if the capability sets were successfully obtained.
896 int security_capget(struct task_struct
*target
,
897 kernel_cap_t
*effective
,
898 kernel_cap_t
*inheritable
,
899 kernel_cap_t
*permitted
)
901 return call_int_hook(capget
, 0, target
,
902 effective
, inheritable
, permitted
);
906 * security_capset() - Set the capability sets for a process
907 * @new: new credentials for the target process
908 * @old: current credentials of the target process
909 * @effective: effective capability set
910 * @inheritable: inheritable capability set
911 * @permitted: permitted capability set
913 * Set the @effective, @inheritable, and @permitted capability sets for the
916 * Return: Returns 0 and update @new if permission is granted.
918 int security_capset(struct cred
*new, const struct cred
*old
,
919 const kernel_cap_t
*effective
,
920 const kernel_cap_t
*inheritable
,
921 const kernel_cap_t
*permitted
)
923 return call_int_hook(capset
, 0, new, old
,
924 effective
, inheritable
, permitted
);
928 * security_capable() - Check if a process has the necessary capability
929 * @cred: credentials to examine
930 * @ns: user namespace
931 * @cap: capability requested
932 * @opts: capability check options
934 * Check whether the @tsk process has the @cap capability in the indicated
935 * credentials. @cap contains the capability <include/linux/capability.h>.
936 * @opts contains options for the capable check <include/linux/security.h>.
938 * Return: Returns 0 if the capability is granted.
940 int security_capable(const struct cred
*cred
,
941 struct user_namespace
*ns
,
945 return call_int_hook(capable
, 0, cred
, ns
, cap
, opts
);
949 * security_quotactl() - Check if a quotactl() syscall is allowed for this fs
955 * Check whether the quotactl syscall is allowed for this @sb.
957 * Return: Returns 0 if permission is granted.
959 int security_quotactl(int cmds
, int type
, int id
, struct super_block
*sb
)
961 return call_int_hook(quotactl
, 0, cmds
, type
, id
, sb
);
965 * security_quota_on() - Check if QUOTAON is allowed for a dentry
968 * Check whether QUOTAON is allowed for @dentry.
970 * Return: Returns 0 if permission is granted.
972 int security_quota_on(struct dentry
*dentry
)
974 return call_int_hook(quota_on
, 0, dentry
);
978 * security_syslog() - Check if accessing the kernel message ring is allowed
979 * @type: SYSLOG_ACTION_* type
981 * Check permission before accessing the kernel message ring or changing
982 * logging to the console. See the syslog(2) manual page for an explanation of
985 * Return: Return 0 if permission is granted.
987 int security_syslog(int type
)
989 return call_int_hook(syslog
, 0, type
);
993 * security_settime64() - Check if changing the system time is allowed
997 * Check permission to change the system time, struct timespec64 is defined in
998 * <include/linux/time64.h> and timezone is defined in <include/linux/time.h>.
1000 * Return: Returns 0 if permission is granted.
1002 int security_settime64(const struct timespec64
*ts
, const struct timezone
*tz
)
1004 return call_int_hook(settime
, 0, ts
, tz
);
1008 * security_vm_enough_memory_mm() - Check if allocating a new mem map is allowed
1010 * @pages: number of pages
1012 * Check permissions for allocating a new virtual mapping. If all LSMs return
1013 * a positive value, __vm_enough_memory() will be called with cap_sys_admin
1014 * set. If at least one LSM returns 0 or negative, __vm_enough_memory() will be
1015 * called with cap_sys_admin cleared.
1017 * Return: Returns 0 if permission is granted by the LSM infrastructure to the
1020 int security_vm_enough_memory_mm(struct mm_struct
*mm
, long pages
)
1022 struct security_hook_list
*hp
;
1023 int cap_sys_admin
= 1;
1027 * The module will respond with a positive value if
1028 * it thinks the __vm_enough_memory() call should be
1029 * made with the cap_sys_admin set. If all of the modules
1030 * agree that it should be set it will. If any module
1031 * thinks it should not be set it won't.
1033 hlist_for_each_entry(hp
, &security_hook_heads
.vm_enough_memory
, list
) {
1034 rc
= hp
->hook
.vm_enough_memory(mm
, pages
);
1040 return __vm_enough_memory(mm
, pages
, cap_sys_admin
);
1044 * security_bprm_creds_for_exec() - Prepare the credentials for exec()
1045 * @bprm: binary program information
1047 * If the setup in prepare_exec_creds did not setup @bprm->cred->security
1048 * properly for executing @bprm->file, update the LSM's portion of
1049 * @bprm->cred->security to be what commit_creds needs to install for the new
1050 * program. This hook may also optionally check permissions (e.g. for
1051 * transitions between security domains). The hook must set @bprm->secureexec
1052 * to 1 if AT_SECURE should be set to request libc enable secure mode. @bprm
1053 * contains the linux_binprm structure.
1055 * Return: Returns 0 if the hook is successful and permission is granted.
1057 int security_bprm_creds_for_exec(struct linux_binprm
*bprm
)
1059 return call_int_hook(bprm_creds_for_exec
, 0, bprm
);
1063 * security_bprm_creds_from_file() - Update linux_binprm creds based on file
1064 * @bprm: binary program information
1065 * @file: associated file
1067 * If @file is setpcap, suid, sgid or otherwise marked to change privilege upon
1068 * exec, update @bprm->cred to reflect that change. This is called after
1069 * finding the binary that will be executed without an interpreter. This
1070 * ensures that the credentials will not be derived from a script that the
1071 * binary will need to reopen, which when reopend may end up being a completely
1072 * different file. This hook may also optionally check permissions (e.g. for
1073 * transitions between security domains). The hook must set @bprm->secureexec
1074 * to 1 if AT_SECURE should be set to request libc enable secure mode. The
1075 * hook must add to @bprm->per_clear any personality flags that should be
1076 * cleared from current->personality. @bprm contains the linux_binprm
1079 * Return: Returns 0 if the hook is successful and permission is granted.
1081 int security_bprm_creds_from_file(struct linux_binprm
*bprm
, struct file
*file
)
1083 return call_int_hook(bprm_creds_from_file
, 0, bprm
, file
);
1087 * security_bprm_check() - Mediate binary handler search
1088 * @bprm: binary program information
1090 * This hook mediates the point when a search for a binary handler will begin.
1091 * It allows a check against the @bprm->cred->security value which was set in
1092 * the preceding creds_for_exec call. The argv list and envp list are reliably
1093 * available in @bprm. This hook may be called multiple times during a single
1094 * execve. @bprm contains the linux_binprm structure.
1096 * Return: Returns 0 if the hook is successful and permission is granted.
1098 int security_bprm_check(struct linux_binprm
*bprm
)
1102 ret
= call_int_hook(bprm_check_security
, 0, bprm
);
1105 return ima_bprm_check(bprm
);
1109 * security_bprm_committing_creds() - Install creds for a process during exec()
1110 * @bprm: binary program information
1112 * Prepare to install the new security attributes of a process being
1113 * transformed by an execve operation, based on the old credentials pointed to
1114 * by @current->cred and the information set in @bprm->cred by the
1115 * bprm_creds_for_exec hook. @bprm points to the linux_binprm structure. This
1116 * hook is a good place to perform state changes on the process such as closing
1117 * open file descriptors to which access will no longer be granted when the
1118 * attributes are changed. This is called immediately before commit_creds().
1120 void security_bprm_committing_creds(struct linux_binprm
*bprm
)
1122 call_void_hook(bprm_committing_creds
, bprm
);
1126 * security_bprm_committed_creds() - Tidy up after cred install during exec()
1127 * @bprm: binary program information
1129 * Tidy up after the installation of the new security attributes of a process
1130 * being transformed by an execve operation. The new credentials have, by this
1131 * point, been set to @current->cred. @bprm points to the linux_binprm
1132 * structure. This hook is a good place to perform state changes on the
1133 * process such as clearing out non-inheritable signal state. This is called
1134 * immediately after commit_creds().
1136 void security_bprm_committed_creds(struct linux_binprm
*bprm
)
1138 call_void_hook(bprm_committed_creds
, bprm
);
1142 * security_fs_context_dup() - Duplicate a fs_context LSM blob
1143 * @fc: destination filesystem context
1144 * @src_fc: source filesystem context
1146 * Allocate and attach a security structure to sc->security. This pointer is
1147 * initialised to NULL by the caller. @fc indicates the new filesystem context.
1148 * @src_fc indicates the original filesystem context.
1150 * Return: Returns 0 on success or a negative error code on failure.
1152 int security_fs_context_dup(struct fs_context
*fc
, struct fs_context
*src_fc
)
1154 return call_int_hook(fs_context_dup
, 0, fc
, src_fc
);
1158 * security_fs_context_parse_param() - Configure a filesystem context
1159 * @fc: filesystem context
1160 * @param: filesystem parameter
1162 * Userspace provided a parameter to configure a superblock. The LSM can
1163 * consume the parameter or return it to the caller for use elsewhere.
1165 * Return: If the parameter is used by the LSM it should return 0, if it is
1166 * returned to the caller -ENOPARAM is returned, otherwise a negative
1167 * error code is returned.
1169 int security_fs_context_parse_param(struct fs_context
*fc
,
1170 struct fs_parameter
*param
)
1172 struct security_hook_list
*hp
;
1176 hlist_for_each_entry(hp
, &security_hook_heads
.fs_context_parse_param
,
1178 trc
= hp
->hook
.fs_context_parse_param(fc
, param
);
1181 else if (trc
!= -ENOPARAM
)
1188 * security_sb_alloc() - Allocate a super_block LSM blob
1189 * @sb: filesystem superblock
1191 * Allocate and attach a security structure to the sb->s_security field. The
1192 * s_security field is initialized to NULL when the structure is allocated.
1193 * @sb contains the super_block structure to be modified.
1195 * Return: Returns 0 if operation was successful.
1197 int security_sb_alloc(struct super_block
*sb
)
1199 int rc
= lsm_superblock_alloc(sb
);
1203 rc
= call_int_hook(sb_alloc_security
, 0, sb
);
1205 security_sb_free(sb
);
1210 * security_sb_delete() - Release super_block LSM associated objects
1211 * @sb: filesystem superblock
1213 * Release objects tied to a superblock (e.g. inodes). @sb contains the
1214 * super_block structure being released.
1216 void security_sb_delete(struct super_block
*sb
)
1218 call_void_hook(sb_delete
, sb
);
1222 * security_sb_free() - Free a super_block LSM blob
1223 * @sb: filesystem superblock
1225 * Deallocate and clear the sb->s_security field. @sb contains the super_block
1226 * structure to be modified.
1228 void security_sb_free(struct super_block
*sb
)
1230 call_void_hook(sb_free_security
, sb
);
1231 kfree(sb
->s_security
);
1232 sb
->s_security
= NULL
;
1236 * security_free_mnt_opts() - Free memory associated with mount options
1237 * @mnt_opts: LSM processed mount options
1239 * Free memory associated with @mnt_ops.
1241 void security_free_mnt_opts(void **mnt_opts
)
1245 call_void_hook(sb_free_mnt_opts
, *mnt_opts
);
1248 EXPORT_SYMBOL(security_free_mnt_opts
);
1251 * security_sb_eat_lsm_opts() - Consume LSM mount options
1252 * @options: mount options
1253 * @mnt_opts: LSM processed mount options
1255 * Eat (scan @options) and save them in @mnt_opts.
1257 * Return: Returns 0 on success, negative values on failure.
1259 int security_sb_eat_lsm_opts(char *options
, void **mnt_opts
)
1261 return call_int_hook(sb_eat_lsm_opts
, 0, options
, mnt_opts
);
1263 EXPORT_SYMBOL(security_sb_eat_lsm_opts
);
1266 * security_sb_mnt_opts_compat() - Check if new mount options are allowed
1267 * @sb: filesystem superblock
1268 * @mnt_opts: new mount options
1270 * Determine if the new mount options in @mnt_opts are allowed given the
1271 * existing mounted filesystem at @sb. @sb superblock being compared.
1273 * Return: Returns 0 if options are compatible.
1275 int security_sb_mnt_opts_compat(struct super_block
*sb
,
1278 return call_int_hook(sb_mnt_opts_compat
, 0, sb
, mnt_opts
);
1280 EXPORT_SYMBOL(security_sb_mnt_opts_compat
);
1283 * security_sb_remount() - Verify no incompatible mount changes during remount
1284 * @sb: filesystem superblock
1285 * @mnt_opts: (re)mount options
1287 * Extracts security system specific mount options and verifies no changes are
1288 * being made to those options.
1290 * Return: Returns 0 if permission is granted.
1292 int security_sb_remount(struct super_block
*sb
,
1295 return call_int_hook(sb_remount
, 0, sb
, mnt_opts
);
1297 EXPORT_SYMBOL(security_sb_remount
);
1300 * security_sb_kern_mount() - Check if a kernel mount is allowed
1301 * @sb: filesystem superblock
1303 * Mount this @sb if allowed by permissions.
1305 * Return: Returns 0 if permission is granted.
1307 int security_sb_kern_mount(struct super_block
*sb
)
1309 return call_int_hook(sb_kern_mount
, 0, sb
);
1313 * security_sb_show_options() - Output the mount options for a superblock
1315 * @sb: filesystem superblock
1317 * Show (print on @m) mount options for this @sb.
1319 * Return: Returns 0 on success, negative values on failure.
1321 int security_sb_show_options(struct seq_file
*m
, struct super_block
*sb
)
1323 return call_int_hook(sb_show_options
, 0, m
, sb
);
1327 * security_sb_statfs() - Check if accessing fs stats is allowed
1328 * @dentry: superblock handle
1330 * Check permission before obtaining filesystem statistics for the @mnt
1331 * mountpoint. @dentry is a handle on the superblock for the filesystem.
1333 * Return: Returns 0 if permission is granted.
1335 int security_sb_statfs(struct dentry
*dentry
)
1337 return call_int_hook(sb_statfs
, 0, dentry
);
1341 * security_sb_mount() - Check permission for mounting a filesystem
1342 * @dev_name: filesystem backing device
1343 * @path: mount point
1344 * @type: filesystem type
1345 * @flags: mount flags
1346 * @data: filesystem specific data
1348 * Check permission before an object specified by @dev_name is mounted on the
1349 * mount point named by @nd. For an ordinary mount, @dev_name identifies a
1350 * device if the file system type requires a device. For a remount
1351 * (@flags & MS_REMOUNT), @dev_name is irrelevant. For a loopback/bind mount
1352 * (@flags & MS_BIND), @dev_name identifies the pathname of the object being
1355 * Return: Returns 0 if permission is granted.
1357 int security_sb_mount(const char *dev_name
, const struct path
*path
,
1358 const char *type
, unsigned long flags
, void *data
)
1360 return call_int_hook(sb_mount
, 0, dev_name
, path
, type
, flags
, data
);
1364 * security_sb_umount() - Check permission for unmounting a filesystem
1365 * @mnt: mounted filesystem
1366 * @flags: unmount flags
1368 * Check permission before the @mnt file system is unmounted.
1370 * Return: Returns 0 if permission is granted.
1372 int security_sb_umount(struct vfsmount
*mnt
, int flags
)
1374 return call_int_hook(sb_umount
, 0, mnt
, flags
);
1378 * security_sb_pivotroot() - Check permissions for pivoting the rootfs
1379 * @old_path: new location for current rootfs
1380 * @new_path: location of the new rootfs
1382 * Check permission before pivoting the root filesystem.
1384 * Return: Returns 0 if permission is granted.
1386 int security_sb_pivotroot(const struct path
*old_path
,
1387 const struct path
*new_path
)
1389 return call_int_hook(sb_pivotroot
, 0, old_path
, new_path
);
1393 * security_sb_set_mnt_opts() - Set the mount options for a filesystem
1394 * @sb: filesystem superblock
1395 * @mnt_opts: binary mount options
1396 * @kern_flags: kernel flags (in)
1397 * @set_kern_flags: kernel flags (out)
1399 * Set the security relevant mount options used for a superblock.
1401 * Return: Returns 0 on success, error on failure.
1403 int security_sb_set_mnt_opts(struct super_block
*sb
,
1405 unsigned long kern_flags
,
1406 unsigned long *set_kern_flags
)
1408 return call_int_hook(sb_set_mnt_opts
,
1409 mnt_opts
? -EOPNOTSUPP
: 0, sb
,
1410 mnt_opts
, kern_flags
, set_kern_flags
);
1412 EXPORT_SYMBOL(security_sb_set_mnt_opts
);
1415 * security_sb_clone_mnt_opts() - Duplicate superblock mount options
1416 * @oldsb: source superblock
1417 * @newsb: destination superblock
1418 * @kern_flags: kernel flags (in)
1419 * @set_kern_flags: kernel flags (out)
1421 * Copy all security options from a given superblock to another.
1423 * Return: Returns 0 on success, error on failure.
1425 int security_sb_clone_mnt_opts(const struct super_block
*oldsb
,
1426 struct super_block
*newsb
,
1427 unsigned long kern_flags
,
1428 unsigned long *set_kern_flags
)
1430 return call_int_hook(sb_clone_mnt_opts
, 0, oldsb
, newsb
,
1431 kern_flags
, set_kern_flags
);
1433 EXPORT_SYMBOL(security_sb_clone_mnt_opts
);
1436 * security_move_mount() - Check permissions for moving a mount
1437 * @from_path: source mount point
1438 * @to_path: destination mount point
1440 * Check permission before a mount is moved.
1442 * Return: Returns 0 if permission is granted.
1444 int security_move_mount(const struct path
*from_path
,
1445 const struct path
*to_path
)
1447 return call_int_hook(move_mount
, 0, from_path
, to_path
);
1451 * security_path_notify() - Check if setting a watch is allowed
1454 * @obj_type: file path type
1456 * Check permissions before setting a watch on events as defined by @mask, on
1457 * an object at @path, whose type is defined by @obj_type.
1459 * Return: Returns 0 if permission is granted.
1461 int security_path_notify(const struct path
*path
, u64 mask
,
1462 unsigned int obj_type
)
1464 return call_int_hook(path_notify
, 0, path
, mask
, obj_type
);
1468 * security_inode_alloc() - Allocate an inode LSM blob
1471 * Allocate and attach a security structure to @inode->i_security. The
1472 * i_security field is initialized to NULL when the inode structure is
1475 * Return: Return 0 if operation was successful.
1477 int security_inode_alloc(struct inode
*inode
)
1479 int rc
= lsm_inode_alloc(inode
);
1483 rc
= call_int_hook(inode_alloc_security
, 0, inode
);
1485 security_inode_free(inode
);
1489 static void inode_free_by_rcu(struct rcu_head
*head
)
1492 * The rcu head is at the start of the inode blob
1494 kmem_cache_free(lsm_inode_cache
, head
);
1498 * security_inode_free() - Free an inode's LSM blob
1501 * Deallocate the inode security structure and set @inode->i_security to NULL.
1503 void security_inode_free(struct inode
*inode
)
1505 integrity_inode_free(inode
);
1506 call_void_hook(inode_free_security
, inode
);
1508 * The inode may still be referenced in a path walk and
1509 * a call to security_inode_permission() can be made
1510 * after inode_free_security() is called. Ideally, the VFS
1511 * wouldn't do this, but fixing that is a much harder
1512 * job. For now, simply free the i_security via RCU, and
1513 * leave the current inode->i_security pointer intact.
1514 * The inode will be freed after the RCU grace period too.
1516 if (inode
->i_security
)
1517 call_rcu((struct rcu_head
*)inode
->i_security
,
1522 * security_dentry_init_security() - Perform dentry initialization
1523 * @dentry: the dentry to initialize
1524 * @mode: mode used to determine resource type
1525 * @name: name of the last path component
1526 * @xattr_name: name of the security/LSM xattr
1527 * @ctx: pointer to the resulting LSM context
1528 * @ctxlen: length of @ctx
1530 * Compute a context for a dentry as the inode is not yet available since NFSv4
1531 * has no label backed by an EA anyway. It is important to note that
1532 * @xattr_name does not need to be free'd by the caller, it is a static string.
1534 * Return: Returns 0 on success, negative values on failure.
1536 int security_dentry_init_security(struct dentry
*dentry
, int mode
,
1537 const struct qstr
*name
,
1538 const char **xattr_name
, void **ctx
,
1541 struct security_hook_list
*hp
;
1545 * Only one module will provide a security context.
1547 hlist_for_each_entry(hp
, &security_hook_heads
.dentry_init_security
,
1549 rc
= hp
->hook
.dentry_init_security(dentry
, mode
, name
,
1550 xattr_name
, ctx
, ctxlen
);
1551 if (rc
!= LSM_RET_DEFAULT(dentry_init_security
))
1554 return LSM_RET_DEFAULT(dentry_init_security
);
1556 EXPORT_SYMBOL(security_dentry_init_security
);
1559 * security_dentry_create_files_as() - Perform dentry initialization
1560 * @dentry: the dentry to initialize
1561 * @mode: mode used to determine resource type
1562 * @name: name of the last path component
1563 * @old: creds to use for LSM context calculations
1564 * @new: creds to modify
1566 * Compute a context for a dentry as the inode is not yet available and set
1567 * that context in passed in creds so that new files are created using that
1568 * context. Context is calculated using the passed in creds and not the creds
1571 * Return: Returns 0 on success, error on failure.
1573 int security_dentry_create_files_as(struct dentry
*dentry
, int mode
,
1575 const struct cred
*old
, struct cred
*new)
1577 return call_int_hook(dentry_create_files_as
, 0, dentry
, mode
,
1580 EXPORT_SYMBOL(security_dentry_create_files_as
);
1583 * security_inode_init_security() - Initialize an inode's LSM context
1585 * @dir: parent directory
1586 * @qstr: last component of the pathname
1587 * @initxattrs: callback function to write xattrs
1588 * @fs_data: filesystem specific data
1590 * Obtain the security attribute name suffix and value to set on a newly
1591 * created inode and set up the incore security field for the new inode. This
1592 * hook is called by the fs code as part of the inode creation transaction and
1593 * provides for atomic labeling of the inode, unlike the post_create/mkdir/...
1594 * hooks called by the VFS. The hook function is expected to allocate the name
1595 * and value via kmalloc, with the caller being responsible for calling kfree
1596 * after using them. If the security module does not use security attributes
1597 * or does not wish to put a security attribute on this particular inode, then
1598 * it should return -EOPNOTSUPP to skip this processing.
1600 * Return: Returns 0 on success, -EOPNOTSUPP if no security attribute is
1601 * needed, or -ENOMEM on memory allocation failure.
1603 int security_inode_init_security(struct inode
*inode
, struct inode
*dir
,
1604 const struct qstr
*qstr
,
1605 const initxattrs initxattrs
, void *fs_data
)
1607 struct xattr new_xattrs
[MAX_LSM_EVM_XATTR
+ 1];
1608 struct xattr
*lsm_xattr
, *evm_xattr
, *xattr
;
1611 if (unlikely(IS_PRIVATE(inode
)))
1615 return call_int_hook(inode_init_security
, -EOPNOTSUPP
, inode
,
1616 dir
, qstr
, NULL
, NULL
, NULL
);
1617 memset(new_xattrs
, 0, sizeof(new_xattrs
));
1618 lsm_xattr
= new_xattrs
;
1619 ret
= call_int_hook(inode_init_security
, -EOPNOTSUPP
, inode
, dir
, qstr
,
1622 &lsm_xattr
->value_len
);
1626 evm_xattr
= lsm_xattr
+ 1;
1627 ret
= evm_inode_init_security(inode
, lsm_xattr
, evm_xattr
);
1630 ret
= initxattrs(inode
, new_xattrs
, fs_data
);
1632 for (xattr
= new_xattrs
; xattr
->value
!= NULL
; xattr
++)
1633 kfree(xattr
->value
);
1634 return (ret
== -EOPNOTSUPP
) ? 0 : ret
;
1636 EXPORT_SYMBOL(security_inode_init_security
);
1639 * security_inode_init_security_anon() - Initialize an anonymous inode
1641 * @name: the anonymous inode class
1642 * @context_inode: an optional related inode
1644 * Set up the incore security field for the new anonymous inode and return
1645 * whether the inode creation is permitted by the security module or not.
1647 * Return: Returns 0 on success, -EACCES if the security module denies the
1648 * creation of this inode, or another -errno upon other errors.
1650 int security_inode_init_security_anon(struct inode
*inode
,
1651 const struct qstr
*name
,
1652 const struct inode
*context_inode
)
1654 return call_int_hook(inode_init_security_anon
, 0, inode
, name
,
1658 #ifdef CONFIG_SECURITY_PATH
1660 * security_path_mknod() - Check if creating a special file is allowed
1661 * @dir: parent directory
1663 * @mode: new file mode
1664 * @dev: device number
1666 * Check permissions when creating a file. Note that this hook is called even
1667 * if mknod operation is being done for a regular file.
1669 * Return: Returns 0 if permission is granted.
1671 int security_path_mknod(const struct path
*dir
, struct dentry
*dentry
,
1672 umode_t mode
, unsigned int dev
)
1674 if (unlikely(IS_PRIVATE(d_backing_inode(dir
->dentry
))))
1676 return call_int_hook(path_mknod
, 0, dir
, dentry
, mode
, dev
);
1678 EXPORT_SYMBOL(security_path_mknod
);
1681 * security_path_mkdir() - Check if creating a new directory is allowed
1682 * @dir: parent directory
1683 * @dentry: new directory
1684 * @mode: new directory mode
1686 * Check permissions to create a new directory in the existing directory.
1688 * Return: Returns 0 if permission is granted.
1690 int security_path_mkdir(const struct path
*dir
, struct dentry
*dentry
,
1693 if (unlikely(IS_PRIVATE(d_backing_inode(dir
->dentry
))))
1695 return call_int_hook(path_mkdir
, 0, dir
, dentry
, mode
);
1697 EXPORT_SYMBOL(security_path_mkdir
);
1700 * security_path_rmdir() - Check if removing a directory is allowed
1701 * @dir: parent directory
1702 * @dentry: directory to remove
1704 * Check the permission to remove a directory.
1706 * Return: Returns 0 if permission is granted.
1708 int security_path_rmdir(const struct path
*dir
, struct dentry
*dentry
)
1710 if (unlikely(IS_PRIVATE(d_backing_inode(dir
->dentry
))))
1712 return call_int_hook(path_rmdir
, 0, dir
, dentry
);
1716 * security_path_unlink() - Check if removing a hard link is allowed
1717 * @dir: parent directory
1720 * Check the permission to remove a hard link to a file.
1722 * Return: Returns 0 if permission is granted.
1724 int security_path_unlink(const struct path
*dir
, struct dentry
*dentry
)
1726 if (unlikely(IS_PRIVATE(d_backing_inode(dir
->dentry
))))
1728 return call_int_hook(path_unlink
, 0, dir
, dentry
);
1730 EXPORT_SYMBOL(security_path_unlink
);
1733 * security_path_symlink() - Check if creating a symbolic link is allowed
1734 * @dir: parent directory
1735 * @dentry: symbolic link
1736 * @old_name: file pathname
1738 * Check the permission to create a symbolic link to a file.
1740 * Return: Returns 0 if permission is granted.
1742 int security_path_symlink(const struct path
*dir
, struct dentry
*dentry
,
1743 const char *old_name
)
1745 if (unlikely(IS_PRIVATE(d_backing_inode(dir
->dentry
))))
1747 return call_int_hook(path_symlink
, 0, dir
, dentry
, old_name
);
1751 * security_path_link - Check if creating a hard link is allowed
1752 * @old_dentry: existing file
1753 * @new_dir: new parent directory
1754 * @new_dentry: new link
1756 * Check permission before creating a new hard link to a file.
1758 * Return: Returns 0 if permission is granted.
1760 int security_path_link(struct dentry
*old_dentry
, const struct path
*new_dir
,
1761 struct dentry
*new_dentry
)
1763 if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry
))))
1765 return call_int_hook(path_link
, 0, old_dentry
, new_dir
, new_dentry
);
1769 * security_path_rename() - Check if renaming a file is allowed
1770 * @old_dir: parent directory of the old file
1771 * @old_dentry: the old file
1772 * @new_dir: parent directory of the new file
1773 * @new_dentry: the new file
1776 * Check for permission to rename a file or directory.
1778 * Return: Returns 0 if permission is granted.
1780 int security_path_rename(const struct path
*old_dir
, struct dentry
*old_dentry
,
1781 const struct path
*new_dir
, struct dentry
*new_dentry
,
1784 if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry
)) ||
1785 (d_is_positive(new_dentry
) &&
1786 IS_PRIVATE(d_backing_inode(new_dentry
)))))
1789 return call_int_hook(path_rename
, 0, old_dir
, old_dentry
, new_dir
,
1792 EXPORT_SYMBOL(security_path_rename
);
1795 * security_path_truncate() - Check if truncating a file is allowed
1798 * Check permission before truncating the file indicated by path. Note that
1799 * truncation permissions may also be checked based on already opened files,
1800 * using the security_file_truncate() hook.
1802 * Return: Returns 0 if permission is granted.
1804 int security_path_truncate(const struct path
*path
)
1806 if (unlikely(IS_PRIVATE(d_backing_inode(path
->dentry
))))
1808 return call_int_hook(path_truncate
, 0, path
);
1812 * security_path_chmod() - Check if changing the file's mode is allowed
1816 * Check for permission to change a mode of the file @path. The new mode is
1817 * specified in @mode which is a bitmask of constants from
1818 * <include/uapi/linux/stat.h>.
1820 * Return: Returns 0 if permission is granted.
1822 int security_path_chmod(const struct path
*path
, umode_t mode
)
1824 if (unlikely(IS_PRIVATE(d_backing_inode(path
->dentry
))))
1826 return call_int_hook(path_chmod
, 0, path
, mode
);
1830 * security_path_chown() - Check if changing the file's owner/group is allowed
1835 * Check for permission to change owner/group of a file or directory.
1837 * Return: Returns 0 if permission is granted.
1839 int security_path_chown(const struct path
*path
, kuid_t uid
, kgid_t gid
)
1841 if (unlikely(IS_PRIVATE(d_backing_inode(path
->dentry
))))
1843 return call_int_hook(path_chown
, 0, path
, uid
, gid
);
1847 * security_path_chroot() - Check if changing the root directory is allowed
1850 * Check for permission to change root directory.
1852 * Return: Returns 0 if permission is granted.
1854 int security_path_chroot(const struct path
*path
)
1856 return call_int_hook(path_chroot
, 0, path
);
1858 #endif /* CONFIG_SECURITY_PATH */
1861 * security_inode_create() - Check if creating a file is allowed
1862 * @dir: the parent directory
1863 * @dentry: the file being created
1864 * @mode: requested file mode
1866 * Check permission to create a regular file.
1868 * Return: Returns 0 if permission is granted.
1870 int security_inode_create(struct inode
*dir
, struct dentry
*dentry
,
1873 if (unlikely(IS_PRIVATE(dir
)))
1875 return call_int_hook(inode_create
, 0, dir
, dentry
, mode
);
1877 EXPORT_SYMBOL_GPL(security_inode_create
);
1880 * security_inode_link() - Check if creating a hard link is allowed
1881 * @old_dentry: existing file
1882 * @dir: new parent directory
1883 * @new_dentry: new link
1885 * Check permission before creating a new hard link to a file.
1887 * Return: Returns 0 if permission is granted.
1889 int security_inode_link(struct dentry
*old_dentry
, struct inode
*dir
,
1890 struct dentry
*new_dentry
)
1892 if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry
))))
1894 return call_int_hook(inode_link
, 0, old_dentry
, dir
, new_dentry
);
1898 * security_inode_unlink() - Check if removing a hard link is allowed
1899 * @dir: parent directory
1902 * Check the permission to remove a hard link to a file.
1904 * Return: Returns 0 if permission is granted.
1906 int security_inode_unlink(struct inode
*dir
, struct dentry
*dentry
)
1908 if (unlikely(IS_PRIVATE(d_backing_inode(dentry
))))
1910 return call_int_hook(inode_unlink
, 0, dir
, dentry
);
1914 * security_inode_symlink() - Check if creating a symbolic link is allowed
1915 * @dir: parent directory
1916 * @dentry: symbolic link
1917 * @old_name: existing filename
1919 * Check the permission to create a symbolic link to a file.
1921 * Return: Returns 0 if permission is granted.
1923 int security_inode_symlink(struct inode
*dir
, struct dentry
*dentry
,
1924 const char *old_name
)
1926 if (unlikely(IS_PRIVATE(dir
)))
1928 return call_int_hook(inode_symlink
, 0, dir
, dentry
, old_name
);
1932 * security_inode_mkdir() - Check if creation a new director is allowed
1933 * @dir: parent directory
1934 * @dentry: new directory
1935 * @mode: new directory mode
1937 * Check permissions to create a new directory in the existing directory
1938 * associated with inode structure @dir.
1940 * Return: Returns 0 if permission is granted.
1942 int security_inode_mkdir(struct inode
*dir
, struct dentry
*dentry
, umode_t mode
)
1944 if (unlikely(IS_PRIVATE(dir
)))
1946 return call_int_hook(inode_mkdir
, 0, dir
, dentry
, mode
);
1948 EXPORT_SYMBOL_GPL(security_inode_mkdir
);
1951 * security_inode_rmdir() - Check if removing a directory is allowed
1952 * @dir: parent directory
1953 * @dentry: directory to be removed
1955 * Check the permission to remove a directory.
1957 * Return: Returns 0 if permission is granted.
1959 int security_inode_rmdir(struct inode
*dir
, struct dentry
*dentry
)
1961 if (unlikely(IS_PRIVATE(d_backing_inode(dentry
))))
1963 return call_int_hook(inode_rmdir
, 0, dir
, dentry
);
1967 * security_inode_mknod() - Check if creating a special file is allowed
1968 * @dir: parent directory
1970 * @mode: new file mode
1971 * @dev: device number
1973 * Check permissions when creating a special file (or a socket or a fifo file
1974 * created via the mknod system call). Note that if mknod operation is being
1975 * done for a regular file, then the create hook will be called and not this
1978 * Return: Returns 0 if permission is granted.
1980 int security_inode_mknod(struct inode
*dir
, struct dentry
*dentry
,
1981 umode_t mode
, dev_t dev
)
1983 if (unlikely(IS_PRIVATE(dir
)))
1985 return call_int_hook(inode_mknod
, 0, dir
, dentry
, mode
, dev
);
1989 * security_inode_rename() - Check if renaming a file is allowed
1990 * @old_dir: parent directory of the old file
1991 * @old_dentry: the old file
1992 * @new_dir: parent directory of the new file
1993 * @new_dentry: the new file
1996 * Check for permission to rename a file or directory.
1998 * Return: Returns 0 if permission is granted.
2000 int security_inode_rename(struct inode
*old_dir
, struct dentry
*old_dentry
,
2001 struct inode
*new_dir
, struct dentry
*new_dentry
,
2004 if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry
)) ||
2005 (d_is_positive(new_dentry
) &&
2006 IS_PRIVATE(d_backing_inode(new_dentry
)))))
2009 if (flags
& RENAME_EXCHANGE
) {
2010 int err
= call_int_hook(inode_rename
, 0, new_dir
, new_dentry
,
2011 old_dir
, old_dentry
);
2016 return call_int_hook(inode_rename
, 0, old_dir
, old_dentry
,
2017 new_dir
, new_dentry
);
2021 * security_inode_readlink() - Check if reading a symbolic link is allowed
2024 * Check the permission to read the symbolic link.
2026 * Return: Returns 0 if permission is granted.
2028 int security_inode_readlink(struct dentry
*dentry
)
2030 if (unlikely(IS_PRIVATE(d_backing_inode(dentry
))))
2032 return call_int_hook(inode_readlink
, 0, dentry
);
2036 * security_inode_follow_link() - Check if following a symbolic link is allowed
2037 * @dentry: link dentry
2038 * @inode: link inode
2039 * @rcu: true if in RCU-walk mode
2041 * Check permission to follow a symbolic link when looking up a pathname. If
2042 * @rcu is true, @inode is not stable.
2044 * Return: Returns 0 if permission is granted.
2046 int security_inode_follow_link(struct dentry
*dentry
, struct inode
*inode
,
2049 if (unlikely(IS_PRIVATE(inode
)))
2051 return call_int_hook(inode_follow_link
, 0, dentry
, inode
, rcu
);
2055 * security_inode_permission() - Check if accessing an inode is allowed
2057 * @mask: access mask
2059 * Check permission before accessing an inode. This hook is called by the
2060 * existing Linux permission function, so a security module can use it to
2061 * provide additional checking for existing Linux permission checks. Notice
2062 * that this hook is called when a file is opened (as well as many other
2063 * operations), whereas the file_security_ops permission hook is called when
2064 * the actual read/write operations are performed.
2066 * Return: Returns 0 if permission is granted.
2068 int security_inode_permission(struct inode
*inode
, int mask
)
2070 if (unlikely(IS_PRIVATE(inode
)))
2072 return call_int_hook(inode_permission
, 0, inode
, mask
);
2076 * security_inode_setattr() - Check if setting file attributes is allowed
2077 * @idmap: idmap of the mount
2079 * @attr: new attributes
2081 * Check permission before setting file attributes. Note that the kernel call
2082 * to notify_change is performed from several locations, whenever file
2083 * attributes change (such as when a file is truncated, chown/chmod operations,
2084 * transferring disk quotas, etc).
2086 * Return: Returns 0 if permission is granted.
2088 int security_inode_setattr(struct mnt_idmap
*idmap
,
2089 struct dentry
*dentry
, struct iattr
*attr
)
2093 if (unlikely(IS_PRIVATE(d_backing_inode(dentry
))))
2095 ret
= call_int_hook(inode_setattr
, 0, dentry
, attr
);
2098 return evm_inode_setattr(idmap
, dentry
, attr
);
2100 EXPORT_SYMBOL_GPL(security_inode_setattr
);
2103 * security_inode_getattr() - Check if getting file attributes is allowed
2106 * Check permission before obtaining file attributes.
2108 * Return: Returns 0 if permission is granted.
2110 int security_inode_getattr(const struct path
*path
)
2112 if (unlikely(IS_PRIVATE(d_backing_inode(path
->dentry
))))
2114 return call_int_hook(inode_getattr
, 0, path
);
2118 * security_inode_setxattr() - Check if setting file xattrs is allowed
2119 * @idmap: idmap of the mount
2122 * @value: xattr value
2123 * @size: size of xattr value
2126 * Check permission before setting the extended attributes.
2128 * Return: Returns 0 if permission is granted.
2130 int security_inode_setxattr(struct mnt_idmap
*idmap
,
2131 struct dentry
*dentry
, const char *name
,
2132 const void *value
, size_t size
, int flags
)
2136 if (unlikely(IS_PRIVATE(d_backing_inode(dentry
))))
2139 * SELinux and Smack integrate the cap call,
2140 * so assume that all LSMs supplying this call do so.
2142 ret
= call_int_hook(inode_setxattr
, 1, idmap
, dentry
, name
, value
,
2146 ret
= cap_inode_setxattr(dentry
, name
, value
, size
, flags
);
2149 ret
= ima_inode_setxattr(dentry
, name
, value
, size
);
2152 return evm_inode_setxattr(idmap
, dentry
, name
, value
, size
);
2156 * security_inode_set_acl() - Check if setting posix acls is allowed
2157 * @idmap: idmap of the mount
2159 * @acl_name: acl name
2162 * Check permission before setting posix acls, the posix acls in @kacl are
2163 * identified by @acl_name.
2165 * Return: Returns 0 if permission is granted.
2167 int security_inode_set_acl(struct mnt_idmap
*idmap
,
2168 struct dentry
*dentry
, const char *acl_name
,
2169 struct posix_acl
*kacl
)
2173 if (unlikely(IS_PRIVATE(d_backing_inode(dentry
))))
2175 ret
= call_int_hook(inode_set_acl
, 0, idmap
, dentry
, acl_name
,
2179 ret
= ima_inode_set_acl(idmap
, dentry
, acl_name
, kacl
);
2182 return evm_inode_set_acl(idmap
, dentry
, acl_name
, kacl
);
2186 * security_inode_get_acl() - Check if reading posix acls is allowed
2187 * @idmap: idmap of the mount
2189 * @acl_name: acl name
2191 * Check permission before getting osix acls, the posix acls are identified by
2194 * Return: Returns 0 if permission is granted.
2196 int security_inode_get_acl(struct mnt_idmap
*idmap
,
2197 struct dentry
*dentry
, const char *acl_name
)
2199 if (unlikely(IS_PRIVATE(d_backing_inode(dentry
))))
2201 return call_int_hook(inode_get_acl
, 0, idmap
, dentry
, acl_name
);
2205 * security_inode_remove_acl() - Check if removing a posix acl is allowed
2206 * @idmap: idmap of the mount
2208 * @acl_name: acl name
2210 * Check permission before removing posix acls, the posix acls are identified
2213 * Return: Returns 0 if permission is granted.
2215 int security_inode_remove_acl(struct mnt_idmap
*idmap
,
2216 struct dentry
*dentry
, const char *acl_name
)
2220 if (unlikely(IS_PRIVATE(d_backing_inode(dentry
))))
2222 ret
= call_int_hook(inode_remove_acl
, 0, idmap
, dentry
, acl_name
);
2225 ret
= ima_inode_remove_acl(idmap
, dentry
, acl_name
);
2228 return evm_inode_remove_acl(idmap
, dentry
, acl_name
);
2232 * security_inode_post_setxattr() - Update the inode after a setxattr operation
2235 * @value: xattr value
2236 * @size: xattr value size
2239 * Update inode security field after successful setxattr operation.
2241 void security_inode_post_setxattr(struct dentry
*dentry
, const char *name
,
2242 const void *value
, size_t size
, int flags
)
2244 if (unlikely(IS_PRIVATE(d_backing_inode(dentry
))))
2246 call_void_hook(inode_post_setxattr
, dentry
, name
, value
, size
, flags
);
2247 evm_inode_post_setxattr(dentry
, name
, value
, size
);
2251 * security_inode_getxattr() - Check if xattr access is allowed
2255 * Check permission before obtaining the extended attributes identified by
2256 * @name for @dentry.
2258 * Return: Returns 0 if permission is granted.
2260 int security_inode_getxattr(struct dentry
*dentry
, const char *name
)
2262 if (unlikely(IS_PRIVATE(d_backing_inode(dentry
))))
2264 return call_int_hook(inode_getxattr
, 0, dentry
, name
);
2268 * security_inode_listxattr() - Check if listing xattrs is allowed
2271 * Check permission before obtaining the list of extended attribute names for
2274 * Return: Returns 0 if permission is granted.
2276 int security_inode_listxattr(struct dentry
*dentry
)
2278 if (unlikely(IS_PRIVATE(d_backing_inode(dentry
))))
2280 return call_int_hook(inode_listxattr
, 0, dentry
);
2284 * security_inode_removexattr() - Check if removing an xattr is allowed
2285 * @idmap: idmap of the mount
2289 * Check permission before removing the extended attribute identified by @name
2292 * Return: Returns 0 if permission is granted.
2294 int security_inode_removexattr(struct mnt_idmap
*idmap
,
2295 struct dentry
*dentry
, const char *name
)
2299 if (unlikely(IS_PRIVATE(d_backing_inode(dentry
))))
2302 * SELinux and Smack integrate the cap call,
2303 * so assume that all LSMs supplying this call do so.
2305 ret
= call_int_hook(inode_removexattr
, 1, idmap
, dentry
, name
);
2307 ret
= cap_inode_removexattr(idmap
, dentry
, name
);
2310 ret
= ima_inode_removexattr(dentry
, name
);
2313 return evm_inode_removexattr(idmap
, dentry
, name
);
2317 * security_inode_need_killpriv() - Check if security_inode_killpriv() required
2318 * @dentry: associated dentry
2320 * Called when an inode has been changed to determine if
2321 * security_inode_killpriv() should be called.
2323 * Return: Return <0 on error to abort the inode change operation, return 0 if
2324 * security_inode_killpriv() does not need to be called, return >0 if
2325 * security_inode_killpriv() does need to be called.
2327 int security_inode_need_killpriv(struct dentry
*dentry
)
2329 return call_int_hook(inode_need_killpriv
, 0, dentry
);
2333 * security_inode_killpriv() - The setuid bit is removed, update LSM state
2334 * @idmap: idmap of the mount
2335 * @dentry: associated dentry
2337 * The @dentry's setuid bit is being removed. Remove similar security labels.
2338 * Called with the dentry->d_inode->i_mutex held.
2340 * Return: Return 0 on success. If error is returned, then the operation
2341 * causing setuid bit removal is failed.
2343 int security_inode_killpriv(struct mnt_idmap
*idmap
,
2344 struct dentry
*dentry
)
2346 return call_int_hook(inode_killpriv
, 0, idmap
, dentry
);
2350 * security_inode_getsecurity() - Get the xattr security label of an inode
2351 * @idmap: idmap of the mount
2354 * @buffer: security label buffer
2355 * @alloc: allocation flag
2357 * Retrieve a copy of the extended attribute representation of the security
2358 * label associated with @name for @inode via @buffer. Note that @name is the
2359 * remainder of the attribute name after the security prefix has been removed.
2360 * @alloc is used to specify if the call should return a value via the buffer
2361 * or just the value length.
2363 * Return: Returns size of buffer on success.
2365 int security_inode_getsecurity(struct mnt_idmap
*idmap
,
2366 struct inode
*inode
, const char *name
,
2367 void **buffer
, bool alloc
)
2369 struct security_hook_list
*hp
;
2372 if (unlikely(IS_PRIVATE(inode
)))
2373 return LSM_RET_DEFAULT(inode_getsecurity
);
2375 * Only one module will provide an attribute with a given name.
2377 hlist_for_each_entry(hp
, &security_hook_heads
.inode_getsecurity
, list
) {
2378 rc
= hp
->hook
.inode_getsecurity(idmap
, inode
, name
, buffer
,
2380 if (rc
!= LSM_RET_DEFAULT(inode_getsecurity
))
2383 return LSM_RET_DEFAULT(inode_getsecurity
);
2387 * security_inode_setsecurity() - Set the xattr security label of an inode
2390 * @value: security label
2391 * @size: length of security label
2394 * Set the security label associated with @name for @inode from the extended
2395 * attribute value @value. @size indicates the size of the @value in bytes.
2396 * @flags may be XATTR_CREATE, XATTR_REPLACE, or 0. Note that @name is the
2397 * remainder of the attribute name after the security. prefix has been removed.
2399 * Return: Returns 0 on success.
2401 int security_inode_setsecurity(struct inode
*inode
, const char *name
,
2402 const void *value
, size_t size
, int flags
)
2404 struct security_hook_list
*hp
;
2407 if (unlikely(IS_PRIVATE(inode
)))
2408 return LSM_RET_DEFAULT(inode_setsecurity
);
2410 * Only one module will provide an attribute with a given name.
2412 hlist_for_each_entry(hp
, &security_hook_heads
.inode_setsecurity
, list
) {
2413 rc
= hp
->hook
.inode_setsecurity(inode
, name
, value
, size
,
2415 if (rc
!= LSM_RET_DEFAULT(inode_setsecurity
))
2418 return LSM_RET_DEFAULT(inode_setsecurity
);
2422 * security_inode_listsecurity() - List the xattr security label names
2425 * @buffer_size: size of buffer
2427 * Copy the extended attribute names for the security labels associated with
2428 * @inode into @buffer. The maximum size of @buffer is specified by
2429 * @buffer_size. @buffer may be NULL to request the size of the buffer
2432 * Return: Returns number of bytes used/required on success.
2434 int security_inode_listsecurity(struct inode
*inode
,
2435 char *buffer
, size_t buffer_size
)
2437 if (unlikely(IS_PRIVATE(inode
)))
2439 return call_int_hook(inode_listsecurity
, 0, inode
, buffer
, buffer_size
);
2441 EXPORT_SYMBOL(security_inode_listsecurity
);
2444 * security_inode_getsecid() - Get an inode's secid
2446 * @secid: secid to return
2448 * Get the secid associated with the node. In case of failure, @secid will be
2451 void security_inode_getsecid(struct inode
*inode
, u32
*secid
)
2453 call_void_hook(inode_getsecid
, inode
, secid
);
2457 * security_inode_copy_up() - Create new creds for an overlayfs copy-up op
2458 * @src: union dentry of copy-up file
2459 * @new: newly created creds
2461 * A file is about to be copied up from lower layer to upper layer of overlay
2462 * filesystem. Security module can prepare a set of new creds and modify as
2463 * need be and return new creds. Caller will switch to new creds temporarily to
2464 * create new file and release newly allocated creds.
2466 * Return: Returns 0 on success or a negative error code on error.
2468 int security_inode_copy_up(struct dentry
*src
, struct cred
**new)
2470 return call_int_hook(inode_copy_up
, 0, src
, new);
2472 EXPORT_SYMBOL(security_inode_copy_up
);
2475 * security_inode_copy_up_xattr() - Filter xattrs in an overlayfs copy-up op
2478 * Filter the xattrs being copied up when a unioned file is copied up from a
2479 * lower layer to the union/overlay layer. The caller is responsible for
2480 * reading and writing the xattrs, this hook is merely a filter.
2482 * Return: Returns 0 to accept the xattr, 1 to discard the xattr, -EOPNOTSUPP
2483 * if the security module does not know about attribute, or a negative
2484 * error code to abort the copy up.
2486 int security_inode_copy_up_xattr(const char *name
)
2488 struct security_hook_list
*hp
;
2492 * The implementation can return 0 (accept the xattr), 1 (discard the
2493 * xattr), -EOPNOTSUPP if it does not know anything about the xattr or
2494 * any other error code in case of an error.
2496 hlist_for_each_entry(hp
,
2497 &security_hook_heads
.inode_copy_up_xattr
, list
) {
2498 rc
= hp
->hook
.inode_copy_up_xattr(name
);
2499 if (rc
!= LSM_RET_DEFAULT(inode_copy_up_xattr
))
2503 return LSM_RET_DEFAULT(inode_copy_up_xattr
);
2505 EXPORT_SYMBOL(security_inode_copy_up_xattr
);
2508 * security_kernfs_init_security() - Init LSM context for a kernfs node
2509 * @kn_dir: parent kernfs node
2510 * @kn: the kernfs node to initialize
2512 * Initialize the security context of a newly created kernfs node based on its
2513 * own and its parent's attributes.
2515 * Return: Returns 0 if permission is granted.
2517 int security_kernfs_init_security(struct kernfs_node
*kn_dir
,
2518 struct kernfs_node
*kn
)
2520 return call_int_hook(kernfs_init_security
, 0, kn_dir
, kn
);
2524 * security_file_permission() - Check file permissions
2526 * @mask: requested permissions
2528 * Check file permissions before accessing an open file. This hook is called
2529 * by various operations that read or write files. A security module can use
2530 * this hook to perform additional checking on these operations, e.g. to
2531 * revalidate permissions on use to support privilege bracketing or policy
2532 * changes. Notice that this hook is used when the actual read/write
2533 * operations are performed, whereas the inode_security_ops hook is called when
2534 * a file is opened (as well as many other operations). Although this hook can
2535 * be used to revalidate permissions for various system call operations that
2536 * read or write files, it does not address the revalidation of permissions for
2537 * memory-mapped files. Security modules must handle this separately if they
2538 * need such revalidation.
2540 * Return: Returns 0 if permission is granted.
2542 int security_file_permission(struct file
*file
, int mask
)
2546 ret
= call_int_hook(file_permission
, 0, file
, mask
);
2550 return fsnotify_perm(file
, mask
);
2554 * security_file_alloc() - Allocate and init a file's LSM blob
2557 * Allocate and attach a security structure to the file->f_security field. The
2558 * security field is initialized to NULL when the structure is first created.
2560 * Return: Return 0 if the hook is successful and permission is granted.
2562 int security_file_alloc(struct file
*file
)
2564 int rc
= lsm_file_alloc(file
);
2568 rc
= call_int_hook(file_alloc_security
, 0, file
);
2570 security_file_free(file
);
2575 * security_file_free() - Free a file's LSM blob
2578 * Deallocate and free any security structures stored in file->f_security.
2580 void security_file_free(struct file
*file
)
2584 call_void_hook(file_free_security
, file
);
2586 blob
= file
->f_security
;
2588 file
->f_security
= NULL
;
2589 kmem_cache_free(lsm_file_cache
, blob
);
2594 * security_file_ioctl() - Check if an ioctl is allowed
2595 * @file: associated file
2597 * @arg: ioctl arguments
2599 * Check permission for an ioctl operation on @file. Note that @arg sometimes
2600 * represents a user space pointer; in other cases, it may be a simple integer
2601 * value. When @arg represents a user space pointer, it should never be used
2602 * by the security module.
2604 * Return: Returns 0 if permission is granted.
2606 int security_file_ioctl(struct file
*file
, unsigned int cmd
, unsigned long arg
)
2608 return call_int_hook(file_ioctl
, 0, file
, cmd
, arg
);
2610 EXPORT_SYMBOL_GPL(security_file_ioctl
);
2612 static inline unsigned long mmap_prot(struct file
*file
, unsigned long prot
)
2615 * Does we have PROT_READ and does the application expect
2616 * it to imply PROT_EXEC? If not, nothing to talk about...
2618 if ((prot
& (PROT_READ
| PROT_EXEC
)) != PROT_READ
)
2620 if (!(current
->personality
& READ_IMPLIES_EXEC
))
2623 * if that's an anonymous mapping, let it.
2626 return prot
| PROT_EXEC
;
2628 * ditto if it's not on noexec mount, except that on !MMU we need
2629 * NOMMU_MAP_EXEC (== VM_MAYEXEC) in this case
2631 if (!path_noexec(&file
->f_path
)) {
2633 if (file
->f_op
->mmap_capabilities
) {
2634 unsigned caps
= file
->f_op
->mmap_capabilities(file
);
2635 if (!(caps
& NOMMU_MAP_EXEC
))
2639 return prot
| PROT_EXEC
;
2641 /* anything on noexec mount won't get PROT_EXEC */
2646 * security_mmap_file() - Check if mmap'ing a file is allowed
2648 * @prot: protection applied by the kernel
2651 * Check permissions for a mmap operation. The @file may be NULL, e.g. if
2652 * mapping anonymous memory.
2654 * Return: Returns 0 if permission is granted.
2656 int security_mmap_file(struct file
*file
, unsigned long prot
,
2657 unsigned long flags
)
2659 unsigned long prot_adj
= mmap_prot(file
, prot
);
2662 ret
= call_int_hook(mmap_file
, 0, file
, prot
, prot_adj
, flags
);
2665 return ima_file_mmap(file
, prot
, prot_adj
, flags
);
2669 * security_mmap_addr() - Check if mmap'ing an address is allowed
2672 * Check permissions for a mmap operation at @addr.
2674 * Return: Returns 0 if permission is granted.
2676 int security_mmap_addr(unsigned long addr
)
2678 return call_int_hook(mmap_addr
, 0, addr
);
2682 * security_file_mprotect() - Check if changing memory protections is allowed
2683 * @vma: memory region
2684 * @reqprot: application requested protection
2685 * @prot: protection applied by the kernel
2687 * Check permissions before changing memory access permissions.
2689 * Return: Returns 0 if permission is granted.
2691 int security_file_mprotect(struct vm_area_struct
*vma
, unsigned long reqprot
,
2696 ret
= call_int_hook(file_mprotect
, 0, vma
, reqprot
, prot
);
2699 return ima_file_mprotect(vma
, prot
);
2703 * security_file_lock() - Check if a file lock is allowed
2705 * @cmd: lock operation (e.g. F_RDLCK, F_WRLCK)
2707 * Check permission before performing file locking operations. Note the hook
2708 * mediates both flock and fcntl style locks.
2710 * Return: Returns 0 if permission is granted.
2712 int security_file_lock(struct file
*file
, unsigned int cmd
)
2714 return call_int_hook(file_lock
, 0, file
, cmd
);
2718 * security_file_fcntl() - Check if fcntl() op is allowed
2720 * @cmd: fnctl command
2721 * @arg: command argument
2723 * Check permission before allowing the file operation specified by @cmd from
2724 * being performed on the file @file. Note that @arg sometimes represents a
2725 * user space pointer; in other cases, it may be a simple integer value. When
2726 * @arg represents a user space pointer, it should never be used by the
2729 * Return: Returns 0 if permission is granted.
2731 int security_file_fcntl(struct file
*file
, unsigned int cmd
, unsigned long arg
)
2733 return call_int_hook(file_fcntl
, 0, file
, cmd
, arg
);
2737 * security_file_set_fowner() - Set the file owner info in the LSM blob
2740 * Save owner security information (typically from current->security) in
2741 * file->f_security for later use by the send_sigiotask hook.
2743 * Return: Returns 0 on success.
2745 void security_file_set_fowner(struct file
*file
)
2747 call_void_hook(file_set_fowner
, file
);
2751 * security_file_send_sigiotask() - Check if sending SIGIO/SIGURG is allowed
2753 * @fown: signal sender
2754 * @sig: signal to be sent, SIGIO is sent if 0
2756 * Check permission for the file owner @fown to send SIGIO or SIGURG to the
2757 * process @tsk. Note that this hook is sometimes called from interrupt. Note
2758 * that the fown_struct, @fown, is never outside the context of a struct file,
2759 * so the file structure (and associated security information) can always be
2760 * obtained: container_of(fown, struct file, f_owner).
2762 * Return: Returns 0 if permission is granted.
2764 int security_file_send_sigiotask(struct task_struct
*tsk
,
2765 struct fown_struct
*fown
, int sig
)
2767 return call_int_hook(file_send_sigiotask
, 0, tsk
, fown
, sig
);
2771 * security_file_receive() - Check is receiving a file via IPC is allowed
2772 * @file: file being received
2774 * This hook allows security modules to control the ability of a process to
2775 * receive an open file descriptor via socket IPC.
2777 * Return: Returns 0 if permission is granted.
2779 int security_file_receive(struct file
*file
)
2781 return call_int_hook(file_receive
, 0, file
);
2785 * security_file_open() - Save open() time state for late use by the LSM
2788 * Save open-time permission checking state for later use upon file_permission,
2789 * and recheck access if anything has changed since inode_permission.
2791 * Return: Returns 0 if permission is granted.
2793 int security_file_open(struct file
*file
)
2797 ret
= call_int_hook(file_open
, 0, file
);
2801 return fsnotify_perm(file
, MAY_OPEN
);
2805 * security_file_truncate() - Check if truncating a file is allowed
2808 * Check permission before truncating a file, i.e. using ftruncate. Note that
2809 * truncation permission may also be checked based on the path, using the
2810 * @path_truncate hook.
2812 * Return: Returns 0 if permission is granted.
2814 int security_file_truncate(struct file
*file
)
2816 return call_int_hook(file_truncate
, 0, file
);
2820 * security_task_alloc() - Allocate a task's LSM blob
2822 * @clone_flags: flags indicating what is being shared
2824 * Handle allocation of task-related resources.
2826 * Return: Returns a zero on success, negative values on failure.
2828 int security_task_alloc(struct task_struct
*task
, unsigned long clone_flags
)
2830 int rc
= lsm_task_alloc(task
);
2834 rc
= call_int_hook(task_alloc
, 0, task
, clone_flags
);
2836 security_task_free(task
);
2841 * security_task_free() - Free a task's LSM blob and related resources
2844 * Handle release of task-related resources. Note that this can be called from
2845 * interrupt context.
2847 void security_task_free(struct task_struct
*task
)
2849 call_void_hook(task_free
, task
);
2851 kfree(task
->security
);
2852 task
->security
= NULL
;
2856 * security_cred_alloc_blank() - Allocate the min memory to allow cred_transfer
2857 * @cred: credentials
2860 * Only allocate sufficient memory and attach to @cred such that
2861 * cred_transfer() will not get ENOMEM.
2863 * Return: Returns 0 on success, negative values on failure.
2865 int security_cred_alloc_blank(struct cred
*cred
, gfp_t gfp
)
2867 int rc
= lsm_cred_alloc(cred
, gfp
);
2872 rc
= call_int_hook(cred_alloc_blank
, 0, cred
, gfp
);
2874 security_cred_free(cred
);
2879 * security_cred_free() - Free the cred's LSM blob and associated resources
2880 * @cred: credentials
2882 * Deallocate and clear the cred->security field in a set of credentials.
2884 void security_cred_free(struct cred
*cred
)
2887 * There is a failure case in prepare_creds() that
2888 * may result in a call here with ->security being NULL.
2890 if (unlikely(cred
->security
== NULL
))
2893 call_void_hook(cred_free
, cred
);
2895 kfree(cred
->security
);
2896 cred
->security
= NULL
;
2900 * security_prepare_creds() - Prepare a new set of credentials
2901 * @new: new credentials
2902 * @old: original credentials
2905 * Prepare a new set of credentials by copying the data from the old set.
2907 * Return: Returns 0 on success, negative values on failure.
2909 int security_prepare_creds(struct cred
*new, const struct cred
*old
, gfp_t gfp
)
2911 int rc
= lsm_cred_alloc(new, gfp
);
2916 rc
= call_int_hook(cred_prepare
, 0, new, old
, gfp
);
2918 security_cred_free(new);
2923 * security_transfer_creds() - Transfer creds
2924 * @new: target credentials
2925 * @old: original credentials
2927 * Transfer data from original creds to new creds.
2929 void security_transfer_creds(struct cred
*new, const struct cred
*old
)
2931 call_void_hook(cred_transfer
, new, old
);
2935 * security_cred_getsecid() - Get the secid from a set of credentials
2937 * @secid: secid value
2939 * Retrieve the security identifier of the cred structure @c. In case of
2940 * failure, @secid will be set to zero.
2942 void security_cred_getsecid(const struct cred
*c
, u32
*secid
)
2945 call_void_hook(cred_getsecid
, c
, secid
);
2947 EXPORT_SYMBOL(security_cred_getsecid
);
2950 * security_kernel_act_as() - Set the kernel credentials to act as secid
2954 * Set the credentials for a kernel service to act as (subjective context).
2955 * The current task must be the one that nominated @secid.
2957 * Return: Returns 0 if successful.
2959 int security_kernel_act_as(struct cred
*new, u32 secid
)
2961 return call_int_hook(kernel_act_as
, 0, new, secid
);
2965 * security_kernel_create_files_as() - Set file creation context using an inode
2966 * @new: target credentials
2967 * @inode: reference inode
2969 * Set the file creation context in a set of credentials to be the same as the
2970 * objective context of the specified inode. The current task must be the one
2971 * that nominated @inode.
2973 * Return: Returns 0 if successful.
2975 int security_kernel_create_files_as(struct cred
*new, struct inode
*inode
)
2977 return call_int_hook(kernel_create_files_as
, 0, new, inode
);
2981 * security_kernel_module_request() - Check is loading a module is allowed
2982 * @kmod_name: module name
2984 * Ability to trigger the kernel to automatically upcall to userspace for
2985 * userspace to load a kernel module with the given name.
2987 * Return: Returns 0 if successful.
2989 int security_kernel_module_request(char *kmod_name
)
2993 ret
= call_int_hook(kernel_module_request
, 0, kmod_name
);
2996 return integrity_kernel_module_request(kmod_name
);
3000 * security_kernel_read_file() - Read a file specified by userspace
3002 * @id: file identifier
3003 * @contents: trust if security_kernel_post_read_file() will be called
3005 * Read a file specified by userspace.
3007 * Return: Returns 0 if permission is granted.
3009 int security_kernel_read_file(struct file
*file
, enum kernel_read_file_id id
,
3014 ret
= call_int_hook(kernel_read_file
, 0, file
, id
, contents
);
3017 return ima_read_file(file
, id
, contents
);
3019 EXPORT_SYMBOL_GPL(security_kernel_read_file
);
3022 * security_kernel_post_read_file() - Read a file specified by userspace
3024 * @buf: file contents
3025 * @size: size of file contents
3026 * @id: file identifier
3028 * Read a file specified by userspace. This must be paired with a prior call
3029 * to security_kernel_read_file() call that indicated this hook would also be
3030 * called, see security_kernel_read_file() for more information.
3032 * Return: Returns 0 if permission is granted.
3034 int security_kernel_post_read_file(struct file
*file
, char *buf
, loff_t size
,
3035 enum kernel_read_file_id id
)
3039 ret
= call_int_hook(kernel_post_read_file
, 0, file
, buf
, size
, id
);
3042 return ima_post_read_file(file
, buf
, size
, id
);
3044 EXPORT_SYMBOL_GPL(security_kernel_post_read_file
);
3047 * security_kernel_load_data() - Load data provided by userspace
3048 * @id: data identifier
3049 * @contents: true if security_kernel_post_load_data() will be called
3051 * Load data provided by userspace.
3053 * Return: Returns 0 if permission is granted.
3055 int security_kernel_load_data(enum kernel_load_data_id id
, bool contents
)
3059 ret
= call_int_hook(kernel_load_data
, 0, id
, contents
);
3062 return ima_load_data(id
, contents
);
3064 EXPORT_SYMBOL_GPL(security_kernel_load_data
);
3067 * security_kernel_post_load_data() - Load userspace data from a non-file source
3069 * @size: size of data
3070 * @id: data identifier
3071 * @description: text description of data, specific to the id value
3073 * Load data provided by a non-file source (usually userspace buffer). This
3074 * must be paired with a prior security_kernel_load_data() call that indicated
3075 * this hook would also be called, see security_kernel_load_data() for more
3078 * Return: Returns 0 if permission is granted.
3080 int security_kernel_post_load_data(char *buf
, loff_t size
,
3081 enum kernel_load_data_id id
,
3086 ret
= call_int_hook(kernel_post_load_data
, 0, buf
, size
, id
,
3090 return ima_post_load_data(buf
, size
, id
, description
);
3092 EXPORT_SYMBOL_GPL(security_kernel_post_load_data
);
3095 * security_task_fix_setuid() - Update LSM with new user id attributes
3096 * @new: updated credentials
3097 * @old: credentials being replaced
3098 * @flags: LSM_SETID_* flag values
3100 * Update the module's state after setting one or more of the user identity
3101 * attributes of the current process. The @flags parameter indicates which of
3102 * the set*uid system calls invoked this hook. If @new is the set of
3103 * credentials that will be installed. Modifications should be made to this
3104 * rather than to @current->cred.
3106 * Return: Returns 0 on success.
3108 int security_task_fix_setuid(struct cred
*new, const struct cred
*old
,
3111 return call_int_hook(task_fix_setuid
, 0, new, old
, flags
);
3115 * security_task_fix_setgid() - Update LSM with new group id attributes
3116 * @new: updated credentials
3117 * @old: credentials being replaced
3118 * @flags: LSM_SETID_* flag value
3120 * Update the module's state after setting one or more of the group identity
3121 * attributes of the current process. The @flags parameter indicates which of
3122 * the set*gid system calls invoked this hook. @new is the set of credentials
3123 * that will be installed. Modifications should be made to this rather than to
3126 * Return: Returns 0 on success.
3128 int security_task_fix_setgid(struct cred
*new, const struct cred
*old
,
3131 return call_int_hook(task_fix_setgid
, 0, new, old
, flags
);
3135 * security_task_fix_setgroups() - Update LSM with new supplementary groups
3136 * @new: updated credentials
3137 * @old: credentials being replaced
3139 * Update the module's state after setting the supplementary group identity
3140 * attributes of the current process. @new is the set of credentials that will
3141 * be installed. Modifications should be made to this rather than to
3144 * Return: Returns 0 on success.
3146 int security_task_fix_setgroups(struct cred
*new, const struct cred
*old
)
3148 return call_int_hook(task_fix_setgroups
, 0, new, old
);
3152 * security_task_setpgid() - Check if setting the pgid is allowed
3153 * @p: task being modified
3156 * Check permission before setting the process group identifier of the process
3159 * Return: Returns 0 if permission is granted.
3161 int security_task_setpgid(struct task_struct
*p
, pid_t pgid
)
3163 return call_int_hook(task_setpgid
, 0, p
, pgid
);
3167 * security_task_getpgid() - Check if getting the pgid is allowed
3170 * Check permission before getting the process group identifier of the process
3173 * Return: Returns 0 if permission is granted.
3175 int security_task_getpgid(struct task_struct
*p
)
3177 return call_int_hook(task_getpgid
, 0, p
);
3181 * security_task_getsid() - Check if getting the session id is allowed
3184 * Check permission before getting the session identifier of the process @p.
3186 * Return: Returns 0 if permission is granted.
3188 int security_task_getsid(struct task_struct
*p
)
3190 return call_int_hook(task_getsid
, 0, p
);
3194 * security_current_getsecid_subj() - Get the current task's subjective secid
3195 * @secid: secid value
3197 * Retrieve the subjective security identifier of the current task and return
3198 * it in @secid. In case of failure, @secid will be set to zero.
3200 void security_current_getsecid_subj(u32
*secid
)
3203 call_void_hook(current_getsecid_subj
, secid
);
3205 EXPORT_SYMBOL(security_current_getsecid_subj
);
3208 * security_task_getsecid_obj() - Get a task's objective secid
3210 * @secid: secid value
3212 * Retrieve the objective security identifier of the task_struct in @p and
3213 * return it in @secid. In case of failure, @secid will be set to zero.
3215 void security_task_getsecid_obj(struct task_struct
*p
, u32
*secid
)
3218 call_void_hook(task_getsecid_obj
, p
, secid
);
3220 EXPORT_SYMBOL(security_task_getsecid_obj
);
3223 * security_task_setnice() - Check if setting a task's nice value is allowed
3227 * Check permission before setting the nice value of @p to @nice.
3229 * Return: Returns 0 if permission is granted.
3231 int security_task_setnice(struct task_struct
*p
, int nice
)
3233 return call_int_hook(task_setnice
, 0, p
, nice
);
3237 * security_task_setioprio() - Check if setting a task's ioprio is allowed
3239 * @ioprio: ioprio value
3241 * Check permission before setting the ioprio value of @p to @ioprio.
3243 * Return: Returns 0 if permission is granted.
3245 int security_task_setioprio(struct task_struct
*p
, int ioprio
)
3247 return call_int_hook(task_setioprio
, 0, p
, ioprio
);
3251 * security_task_getioprio() - Check if getting a task's ioprio is allowed
3254 * Check permission before getting the ioprio value of @p.
3256 * Return: Returns 0 if permission is granted.
3258 int security_task_getioprio(struct task_struct
*p
)
3260 return call_int_hook(task_getioprio
, 0, p
);
3264 * security_task_prlimit() - Check if get/setting resources limits is allowed
3265 * @cred: current task credentials
3266 * @tcred: target task credentials
3267 * @flags: LSM_PRLIMIT_* flag bits indicating a get/set/both
3269 * Check permission before getting and/or setting the resource limits of
3272 * Return: Returns 0 if permission is granted.
3274 int security_task_prlimit(const struct cred
*cred
, const struct cred
*tcred
,
3277 return call_int_hook(task_prlimit
, 0, cred
, tcred
, flags
);
3281 * security_task_setrlimit() - Check if setting a new rlimit value is allowed
3282 * @p: target task's group leader
3283 * @resource: resource whose limit is being set
3284 * @new_rlim: new resource limit
3286 * Check permission before setting the resource limits of process @p for
3287 * @resource to @new_rlim. The old resource limit values can be examined by
3288 * dereferencing (p->signal->rlim + resource).
3290 * Return: Returns 0 if permission is granted.
3292 int security_task_setrlimit(struct task_struct
*p
, unsigned int resource
,
3293 struct rlimit
*new_rlim
)
3295 return call_int_hook(task_setrlimit
, 0, p
, resource
, new_rlim
);
3299 * security_task_setscheduler() - Check if setting sched policy/param is allowed
3302 * Check permission before setting scheduling policy and/or parameters of
3305 * Return: Returns 0 if permission is granted.
3307 int security_task_setscheduler(struct task_struct
*p
)
3309 return call_int_hook(task_setscheduler
, 0, p
);
3313 * security_task_getscheduler() - Check if getting scheduling info is allowed
3316 * Check permission before obtaining scheduling information for process @p.
3318 * Return: Returns 0 if permission is granted.
3320 int security_task_getscheduler(struct task_struct
*p
)
3322 return call_int_hook(task_getscheduler
, 0, p
);
3326 * security_task_movememory() - Check if moving memory is allowed
3329 * Check permission before moving memory owned by process @p.
3331 * Return: Returns 0 if permission is granted.
3333 int security_task_movememory(struct task_struct
*p
)
3335 return call_int_hook(task_movememory
, 0, p
);
3339 * security_task_kill() - Check if sending a signal is allowed
3340 * @p: target process
3341 * @info: signal information
3342 * @sig: signal value
3343 * @cred: credentials of the signal sender, NULL if @current
3345 * Check permission before sending signal @sig to @p. @info can be NULL, the
3346 * constant 1, or a pointer to a kernel_siginfo structure. If @info is 1 or
3347 * SI_FROMKERNEL(info) is true, then the signal should be viewed as coming from
3348 * the kernel and should typically be permitted. SIGIO signals are handled
3349 * separately by the send_sigiotask hook in file_security_ops.
3351 * Return: Returns 0 if permission is granted.
3353 int security_task_kill(struct task_struct
*p
, struct kernel_siginfo
*info
,
3354 int sig
, const struct cred
*cred
)
3356 return call_int_hook(task_kill
, 0, p
, info
, sig
, cred
);
3360 * security_task_prctl() - Check if a prctl op is allowed
3361 * @option: operation
3367 * Check permission before performing a process control operation on the
3370 * Return: Return -ENOSYS if no-one wanted to handle this op, any other value
3371 * to cause prctl() to return immediately with that value.
3373 int security_task_prctl(int option
, unsigned long arg2
, unsigned long arg3
,
3374 unsigned long arg4
, unsigned long arg5
)
3377 int rc
= LSM_RET_DEFAULT(task_prctl
);
3378 struct security_hook_list
*hp
;
3380 hlist_for_each_entry(hp
, &security_hook_heads
.task_prctl
, list
) {
3381 thisrc
= hp
->hook
.task_prctl(option
, arg2
, arg3
, arg4
, arg5
);
3382 if (thisrc
!= LSM_RET_DEFAULT(task_prctl
)) {
3392 * security_task_to_inode() - Set the security attributes of a task's inode
3396 * Set the security attributes for an inode based on an associated task's
3397 * security attributes, e.g. for /proc/pid inodes.
3399 void security_task_to_inode(struct task_struct
*p
, struct inode
*inode
)
3401 call_void_hook(task_to_inode
, p
, inode
);
3405 * security_create_user_ns() - Check if creating a new userns is allowed
3406 * @cred: prepared creds
3408 * Check permission prior to creating a new user namespace.
3410 * Return: Returns 0 if successful, otherwise < 0 error code.
3412 int security_create_user_ns(const struct cred
*cred
)
3414 return call_int_hook(userns_create
, 0, cred
);
3418 * security_ipc_permission() - Check if sysv ipc access is allowed
3419 * @ipcp: ipc permission structure
3420 * @flag: requested permissions
3422 * Check permissions for access to IPC.
3424 * Return: Returns 0 if permission is granted.
3426 int security_ipc_permission(struct kern_ipc_perm
*ipcp
, short flag
)
3428 return call_int_hook(ipc_permission
, 0, ipcp
, flag
);
3432 * security_ipc_getsecid() - Get the sysv ipc object's secid
3433 * @ipcp: ipc permission structure
3434 * @secid: secid pointer
3436 * Get the secid associated with the ipc object. In case of failure, @secid
3437 * will be set to zero.
3439 void security_ipc_getsecid(struct kern_ipc_perm
*ipcp
, u32
*secid
)
3442 call_void_hook(ipc_getsecid
, ipcp
, secid
);
3446 * security_msg_msg_alloc() - Allocate a sysv ipc message LSM blob
3447 * @msg: message structure
3449 * Allocate and attach a security structure to the msg->security field. The
3450 * security field is initialized to NULL when the structure is first created.
3452 * Return: Return 0 if operation was successful and permission is granted.
3454 int security_msg_msg_alloc(struct msg_msg
*msg
)
3456 int rc
= lsm_msg_msg_alloc(msg
);
3460 rc
= call_int_hook(msg_msg_alloc_security
, 0, msg
);
3462 security_msg_msg_free(msg
);
3467 * security_msg_msg_free() - Free a sysv ipc message LSM blob
3468 * @msg: message structure
3470 * Deallocate the security structure for this message.
3472 void security_msg_msg_free(struct msg_msg
*msg
)
3474 call_void_hook(msg_msg_free_security
, msg
);
3475 kfree(msg
->security
);
3476 msg
->security
= NULL
;
3480 * security_msg_queue_alloc() - Allocate a sysv ipc msg queue LSM blob
3481 * @msq: sysv ipc permission structure
3483 * Allocate and attach a security structure to @msg. The security field is
3484 * initialized to NULL when the structure is first created.
3486 * Return: Returns 0 if operation was successful and permission is granted.
3488 int security_msg_queue_alloc(struct kern_ipc_perm
*msq
)
3490 int rc
= lsm_ipc_alloc(msq
);
3494 rc
= call_int_hook(msg_queue_alloc_security
, 0, msq
);
3496 security_msg_queue_free(msq
);
3501 * security_msg_queue_free() - Free a sysv ipc msg queue LSM blob
3502 * @msq: sysv ipc permission structure
3504 * Deallocate security field @perm->security for the message queue.
3506 void security_msg_queue_free(struct kern_ipc_perm
*msq
)
3508 call_void_hook(msg_queue_free_security
, msq
);
3509 kfree(msq
->security
);
3510 msq
->security
= NULL
;
3514 * security_msg_queue_associate() - Check if a msg queue operation is allowed
3515 * @msq: sysv ipc permission structure
3516 * @msqflg: operation flags
3518 * Check permission when a message queue is requested through the msgget system
3519 * call. This hook is only called when returning the message queue identifier
3520 * for an existing message queue, not when a new message queue is created.
3522 * Return: Return 0 if permission is granted.
3524 int security_msg_queue_associate(struct kern_ipc_perm
*msq
, int msqflg
)
3526 return call_int_hook(msg_queue_associate
, 0, msq
, msqflg
);
3530 * security_msg_queue_msgctl() - Check if a msg queue operation is allowed
3531 * @msq: sysv ipc permission structure
3534 * Check permission when a message control operation specified by @cmd is to be
3535 * performed on the message queue with permissions.
3537 * Return: Returns 0 if permission is granted.
3539 int security_msg_queue_msgctl(struct kern_ipc_perm
*msq
, int cmd
)
3541 return call_int_hook(msg_queue_msgctl
, 0, msq
, cmd
);
3545 * security_msg_queue_msgsnd() - Check if sending a sysv ipc message is allowed
3546 * @msq: sysv ipc permission structure
3548 * @msqflg: operation flags
3550 * Check permission before a message, @msg, is enqueued on the message queue
3551 * with permissions specified in @msq.
3553 * Return: Returns 0 if permission is granted.
3555 int security_msg_queue_msgsnd(struct kern_ipc_perm
*msq
,
3556 struct msg_msg
*msg
, int msqflg
)
3558 return call_int_hook(msg_queue_msgsnd
, 0, msq
, msg
, msqflg
);
3562 * security_msg_queue_msgrcv() - Check if receiving a sysv ipc msg is allowed
3563 * @msq: sysv ipc permission structure
3565 * @target: target task
3566 * @type: type of message requested
3567 * @mode: operation flags
3569 * Check permission before a message, @msg, is removed from the message queue.
3570 * The @target task structure contains a pointer to the process that will be
3571 * receiving the message (not equal to the current process when inline receives
3572 * are being performed).
3574 * Return: Returns 0 if permission is granted.
3576 int security_msg_queue_msgrcv(struct kern_ipc_perm
*msq
, struct msg_msg
*msg
,
3577 struct task_struct
*target
, long type
, int mode
)
3579 return call_int_hook(msg_queue_msgrcv
, 0, msq
, msg
, target
, type
, mode
);
3583 * security_shm_alloc() - Allocate a sysv shm LSM blob
3584 * @shp: sysv ipc permission structure
3586 * Allocate and attach a security structure to the @shp security field. The
3587 * security field is initialized to NULL when the structure is first created.
3589 * Return: Returns 0 if operation was successful and permission is granted.
3591 int security_shm_alloc(struct kern_ipc_perm
*shp
)
3593 int rc
= lsm_ipc_alloc(shp
);
3597 rc
= call_int_hook(shm_alloc_security
, 0, shp
);
3599 security_shm_free(shp
);
3604 * security_shm_free() - Free a sysv shm LSM blob
3605 * @shp: sysv ipc permission structure
3607 * Deallocate the security structure @perm->security for the memory segment.
3609 void security_shm_free(struct kern_ipc_perm
*shp
)
3611 call_void_hook(shm_free_security
, shp
);
3612 kfree(shp
->security
);
3613 shp
->security
= NULL
;
3617 * security_shm_associate() - Check if a sysv shm operation is allowed
3618 * @shp: sysv ipc permission structure
3619 * @shmflg: operation flags
3621 * Check permission when a shared memory region is requested through the shmget
3622 * system call. This hook is only called when returning the shared memory
3623 * region identifier for an existing region, not when a new shared memory
3624 * region is created.
3626 * Return: Returns 0 if permission is granted.
3628 int security_shm_associate(struct kern_ipc_perm
*shp
, int shmflg
)
3630 return call_int_hook(shm_associate
, 0, shp
, shmflg
);
3634 * security_shm_shmctl() - Check if a sysv shm operation is allowed
3635 * @shp: sysv ipc permission structure
3638 * Check permission when a shared memory control operation specified by @cmd is
3639 * to be performed on the shared memory region with permissions in @shp.
3641 * Return: Return 0 if permission is granted.
3643 int security_shm_shmctl(struct kern_ipc_perm
*shp
, int cmd
)
3645 return call_int_hook(shm_shmctl
, 0, shp
, cmd
);
3649 * security_shm_shmat() - Check if a sysv shm attach operation is allowed
3650 * @shp: sysv ipc permission structure
3651 * @shmaddr: address of memory region to attach
3652 * @shmflg: operation flags
3654 * Check permissions prior to allowing the shmat system call to attach the
3655 * shared memory segment with permissions @shp to the data segment of the
3656 * calling process. The attaching address is specified by @shmaddr.
3658 * Return: Returns 0 if permission is granted.
3660 int security_shm_shmat(struct kern_ipc_perm
*shp
,
3661 char __user
*shmaddr
, int shmflg
)
3663 return call_int_hook(shm_shmat
, 0, shp
, shmaddr
, shmflg
);
3667 * security_sem_alloc() - Allocate a sysv semaphore LSM blob
3668 * @sma: sysv ipc permission structure
3670 * Allocate and attach a security structure to the @sma security field. The
3671 * security field is initialized to NULL when the structure is first created.
3673 * Return: Returns 0 if operation was successful and permission is granted.
3675 int security_sem_alloc(struct kern_ipc_perm
*sma
)
3677 int rc
= lsm_ipc_alloc(sma
);
3681 rc
= call_int_hook(sem_alloc_security
, 0, sma
);
3683 security_sem_free(sma
);
3688 * security_sem_free() - Free a sysv semaphore LSM blob
3689 * @sma: sysv ipc permission structure
3691 * Deallocate security structure @sma->security for the semaphore.
3693 void security_sem_free(struct kern_ipc_perm
*sma
)
3695 call_void_hook(sem_free_security
, sma
);
3696 kfree(sma
->security
);
3697 sma
->security
= NULL
;
3701 * security_sem_associate() - Check if a sysv semaphore operation is allowed
3702 * @sma: sysv ipc permission structure
3703 * @semflg: operation flags
3705 * Check permission when a semaphore is requested through the semget system
3706 * call. This hook is only called when returning the semaphore identifier for
3707 * an existing semaphore, not when a new one must be created.
3709 * Return: Returns 0 if permission is granted.
3711 int security_sem_associate(struct kern_ipc_perm
*sma
, int semflg
)
3713 return call_int_hook(sem_associate
, 0, sma
, semflg
);
3717 * security_sem_semctl() - Check if a sysv semaphore operation is allowed
3718 * @sma: sysv ipc permission structure
3721 * Check permission when a semaphore operation specified by @cmd is to be
3722 * performed on the semaphore.
3724 * Return: Returns 0 if permission is granted.
3726 int security_sem_semctl(struct kern_ipc_perm
*sma
, int cmd
)
3728 return call_int_hook(sem_semctl
, 0, sma
, cmd
);
3732 * security_sem_semop() - Check if a sysv semaphore operation is allowed
3733 * @sma: sysv ipc permission structure
3734 * @sops: operations to perform
3735 * @nsops: number of operations
3736 * @alter: flag indicating changes will be made
3738 * Check permissions before performing operations on members of the semaphore
3739 * set. If the @alter flag is nonzero, the semaphore set may be modified.
3741 * Return: Returns 0 if permission is granted.
3743 int security_sem_semop(struct kern_ipc_perm
*sma
, struct sembuf
*sops
,
3744 unsigned nsops
, int alter
)
3746 return call_int_hook(sem_semop
, 0, sma
, sops
, nsops
, alter
);
3750 * security_d_instantiate() - Populate an inode's LSM state based on a dentry
3754 * Fill in @inode security information for a @dentry if allowed.
3756 void security_d_instantiate(struct dentry
*dentry
, struct inode
*inode
)
3758 if (unlikely(inode
&& IS_PRIVATE(inode
)))
3760 call_void_hook(d_instantiate
, dentry
, inode
);
3762 EXPORT_SYMBOL(security_d_instantiate
);
3765 * security_getprocattr() - Read an attribute for a task
3768 * @name: attribute name
3769 * @value: attribute value
3771 * Read attribute @name for task @p and store it into @value if allowed.
3773 * Return: Returns the length of @value on success, a negative value otherwise.
3775 int security_getprocattr(struct task_struct
*p
, const char *lsm
,
3776 const char *name
, char **value
)
3778 struct security_hook_list
*hp
;
3780 hlist_for_each_entry(hp
, &security_hook_heads
.getprocattr
, list
) {
3781 if (lsm
!= NULL
&& strcmp(lsm
, hp
->lsm
))
3783 return hp
->hook
.getprocattr(p
, name
, value
);
3785 return LSM_RET_DEFAULT(getprocattr
);
3789 * security_setprocattr() - Set an attribute for a task
3791 * @name: attribute name
3792 * @value: attribute value
3793 * @size: attribute value size
3795 * Write (set) the current task's attribute @name to @value, size @size if
3798 * Return: Returns bytes written on success, a negative value otherwise.
3800 int security_setprocattr(const char *lsm
, const char *name
, void *value
,
3803 struct security_hook_list
*hp
;
3805 hlist_for_each_entry(hp
, &security_hook_heads
.setprocattr
, list
) {
3806 if (lsm
!= NULL
&& strcmp(lsm
, hp
->lsm
))
3808 return hp
->hook
.setprocattr(name
, value
, size
);
3810 return LSM_RET_DEFAULT(setprocattr
);
3814 * security_netlink_send() - Save info and check if netlink sending is allowed
3815 * @sk: sending socket
3816 * @skb: netlink message
3818 * Save security information for a netlink message so that permission checking
3819 * can be performed when the message is processed. The security information
3820 * can be saved using the eff_cap field of the netlink_skb_parms structure.
3821 * Also may be used to provide fine grained control over message transmission.
3823 * Return: Returns 0 if the information was successfully saved and message is
3824 * allowed to be transmitted.
3826 int security_netlink_send(struct sock
*sk
, struct sk_buff
*skb
)
3828 return call_int_hook(netlink_send
, 0, sk
, skb
);
3832 * security_ismaclabel() - Check is the named attribute is a MAC label
3833 * @name: full extended attribute name
3835 * Check if the extended attribute specified by @name represents a MAC label.
3837 * Return: Returns 1 if name is a MAC attribute otherwise returns 0.
3839 int security_ismaclabel(const char *name
)
3841 return call_int_hook(ismaclabel
, 0, name
);
3843 EXPORT_SYMBOL(security_ismaclabel
);
3846 * security_secid_to_secctx() - Convert a secid to a secctx
3849 * @seclen: secctx length
3851 * Convert secid to security context. If @secdata is NULL the length of the
3852 * result will be returned in @seclen, but no @secdata will be returned. This
3853 * does mean that the length could change between calls to check the length and
3854 * the next call which actually allocates and returns the @secdata.
3856 * Return: Return 0 on success, error on failure.
3858 int security_secid_to_secctx(u32 secid
, char **secdata
, u32
*seclen
)
3860 struct security_hook_list
*hp
;
3864 * Currently, only one LSM can implement secid_to_secctx (i.e this
3865 * LSM hook is not "stackable").
3867 hlist_for_each_entry(hp
, &security_hook_heads
.secid_to_secctx
, list
) {
3868 rc
= hp
->hook
.secid_to_secctx(secid
, secdata
, seclen
);
3869 if (rc
!= LSM_RET_DEFAULT(secid_to_secctx
))
3873 return LSM_RET_DEFAULT(secid_to_secctx
);
3875 EXPORT_SYMBOL(security_secid_to_secctx
);
3878 * security_secctx_to_secid() - Convert a secctx to a secid
3880 * @seclen: length of secctx
3883 * Convert security context to secid.
3885 * Return: Returns 0 on success, error on failure.
3887 int security_secctx_to_secid(const char *secdata
, u32 seclen
, u32
*secid
)
3890 return call_int_hook(secctx_to_secid
, 0, secdata
, seclen
, secid
);
3892 EXPORT_SYMBOL(security_secctx_to_secid
);
3895 * security_release_secctx() - Free a secctx buffer
3897 * @seclen: length of secctx
3899 * Release the security context.
3901 void security_release_secctx(char *secdata
, u32 seclen
)
3903 call_void_hook(release_secctx
, secdata
, seclen
);
3905 EXPORT_SYMBOL(security_release_secctx
);
3908 * security_inode_invalidate_secctx() - Invalidate an inode's security label
3911 * Notify the security module that it must revalidate the security context of
3914 void security_inode_invalidate_secctx(struct inode
*inode
)
3916 call_void_hook(inode_invalidate_secctx
, inode
);
3918 EXPORT_SYMBOL(security_inode_invalidate_secctx
);
3921 * security_inode_notifysecctx() - Nofify the LSM of an inode's security label
3924 * @ctxlen: length of secctx
3926 * Notify the security module of what the security context of an inode should
3927 * be. Initializes the incore security context managed by the security module
3928 * for this inode. Example usage: NFS client invokes this hook to initialize
3929 * the security context in its incore inode to the value provided by the server
3930 * for the file when the server returned the file's attributes to the client.
3931 * Must be called with inode->i_mutex locked.
3933 * Return: Returns 0 on success, error on failure.
3935 int security_inode_notifysecctx(struct inode
*inode
, void *ctx
, u32 ctxlen
)
3937 return call_int_hook(inode_notifysecctx
, 0, inode
, ctx
, ctxlen
);
3939 EXPORT_SYMBOL(security_inode_notifysecctx
);
3942 * security_inode_setsecctx() - Change the security label of an inode
3945 * @ctxlen: length of secctx
3947 * Change the security context of an inode. Updates the incore security
3948 * context managed by the security module and invokes the fs code as needed
3949 * (via __vfs_setxattr_noperm) to update any backing xattrs that represent the
3950 * context. Example usage: NFS server invokes this hook to change the security
3951 * context in its incore inode and on the backing filesystem to a value
3952 * provided by the client on a SETATTR operation. Must be called with
3953 * inode->i_mutex locked.
3955 * Return: Returns 0 on success, error on failure.
3957 int security_inode_setsecctx(struct dentry
*dentry
, void *ctx
, u32 ctxlen
)
3959 return call_int_hook(inode_setsecctx
, 0, dentry
, ctx
, ctxlen
);
3961 EXPORT_SYMBOL(security_inode_setsecctx
);
3964 * security_inode_getsecctx() - Get the security label of an inode
3967 * @ctxlen: length of secctx
3969 * On success, returns 0 and fills out @ctx and @ctxlen with the security
3970 * context for the given @inode.
3972 * Return: Returns 0 on success, error on failure.
3974 int security_inode_getsecctx(struct inode
*inode
, void **ctx
, u32
*ctxlen
)
3976 return call_int_hook(inode_getsecctx
, -EOPNOTSUPP
, inode
, ctx
, ctxlen
);
3978 EXPORT_SYMBOL(security_inode_getsecctx
);
3980 #ifdef CONFIG_WATCH_QUEUE
3982 * security_post_notification() - Check if a watch notification can be posted
3983 * @w_cred: credentials of the task that set the watch
3984 * @cred: credentials of the task which triggered the watch
3985 * @n: the notification
3987 * Check to see if a watch notification can be posted to a particular queue.
3989 * Return: Returns 0 if permission is granted.
3991 int security_post_notification(const struct cred
*w_cred
,
3992 const struct cred
*cred
,
3993 struct watch_notification
*n
)
3995 return call_int_hook(post_notification
, 0, w_cred
, cred
, n
);
3997 #endif /* CONFIG_WATCH_QUEUE */
3999 #ifdef CONFIG_KEY_NOTIFICATIONS
4001 * security_watch_key() - Check if a task is allowed to watch for key events
4002 * @key: the key to watch
4004 * Check to see if a process is allowed to watch for event notifications from
4007 * Return: Returns 0 if permission is granted.
4009 int security_watch_key(struct key
*key
)
4011 return call_int_hook(watch_key
, 0, key
);
4013 #endif /* CONFIG_KEY_NOTIFICATIONS */
4015 #ifdef CONFIG_SECURITY_NETWORK
4017 * security_unix_stream_connect() - Check if a AF_UNIX stream is allowed
4018 * @sock: originating sock
4022 * Check permissions before establishing a Unix domain stream connection
4023 * between @sock and @other.
4025 * The @unix_stream_connect and @unix_may_send hooks were necessary because
4026 * Linux provides an alternative to the conventional file name space for Unix
4027 * domain sockets. Whereas binding and connecting to sockets in the file name
4028 * space is mediated by the typical file permissions (and caught by the mknod
4029 * and permission hooks in inode_security_ops), binding and connecting to
4030 * sockets in the abstract name space is completely unmediated. Sufficient
4031 * control of Unix domain sockets in the abstract name space isn't possible
4032 * using only the socket layer hooks, since we need to know the actual target
4033 * socket, which is not looked up until we are inside the af_unix code.
4035 * Return: Returns 0 if permission is granted.
4037 int security_unix_stream_connect(struct sock
*sock
, struct sock
*other
,
4040 return call_int_hook(unix_stream_connect
, 0, sock
, other
, newsk
);
4042 EXPORT_SYMBOL(security_unix_stream_connect
);
4045 * security_unix_may_send() - Check if AF_UNIX socket can send datagrams
4046 * @sock: originating sock
4049 * Check permissions before connecting or sending datagrams from @sock to
4052 * The @unix_stream_connect and @unix_may_send hooks were necessary because
4053 * Linux provides an alternative to the conventional file name space for Unix
4054 * domain sockets. Whereas binding and connecting to sockets in the file name
4055 * space is mediated by the typical file permissions (and caught by the mknod
4056 * and permission hooks in inode_security_ops), binding and connecting to
4057 * sockets in the abstract name space is completely unmediated. Sufficient
4058 * control of Unix domain sockets in the abstract name space isn't possible
4059 * using only the socket layer hooks, since we need to know the actual target
4060 * socket, which is not looked up until we are inside the af_unix code.
4062 * Return: Returns 0 if permission is granted.
4064 int security_unix_may_send(struct socket
*sock
, struct socket
*other
)
4066 return call_int_hook(unix_may_send
, 0, sock
, other
);
4068 EXPORT_SYMBOL(security_unix_may_send
);
4071 * security_socket_create() - Check if creating a new socket is allowed
4072 * @family: protocol family
4073 * @type: communications type
4074 * @protocol: requested protocol
4075 * @kern: set to 1 if a kernel socket is requested
4077 * Check permissions prior to creating a new socket.
4079 * Return: Returns 0 if permission is granted.
4081 int security_socket_create(int family
, int type
, int protocol
, int kern
)
4083 return call_int_hook(socket_create
, 0, family
, type
, protocol
, kern
);
4087 * security_socket_post_create() - Initialize a newly created socket
4089 * @family: protocol family
4090 * @type: communications type
4091 * @protocol: requested protocol
4092 * @kern: set to 1 if a kernel socket is requested
4094 * This hook allows a module to update or allocate a per-socket security
4095 * structure. Note that the security field was not added directly to the socket
4096 * structure, but rather, the socket security information is stored in the
4097 * associated inode. Typically, the inode alloc_security hook will allocate
4098 * and attach security information to SOCK_INODE(sock)->i_security. This hook
4099 * may be used to update the SOCK_INODE(sock)->i_security field with additional
4100 * information that wasn't available when the inode was allocated.
4102 * Return: Returns 0 if permission is granted.
4104 int security_socket_post_create(struct socket
*sock
, int family
,
4105 int type
, int protocol
, int kern
)
4107 return call_int_hook(socket_post_create
, 0, sock
, family
, type
,
4112 * security_socket_socketpair() - Check if creating a socketpair is allowed
4113 * @socka: first socket
4114 * @sockb: second socket
4116 * Check permissions before creating a fresh pair of sockets.
4118 * Return: Returns 0 if permission is granted and the connection was
4121 int security_socket_socketpair(struct socket
*socka
, struct socket
*sockb
)
4123 return call_int_hook(socket_socketpair
, 0, socka
, sockb
);
4125 EXPORT_SYMBOL(security_socket_socketpair
);
4128 * security_socket_bind() - Check if a socket bind operation is allowed
4130 * @address: requested bind address
4131 * @addrlen: length of address
4133 * Check permission before socket protocol layer bind operation is performed
4134 * and the socket @sock is bound to the address specified in the @address
4137 * Return: Returns 0 if permission is granted.
4139 int security_socket_bind(struct socket
*sock
,
4140 struct sockaddr
*address
, int addrlen
)
4142 return call_int_hook(socket_bind
, 0, sock
, address
, addrlen
);
4146 * security_socket_connect() - Check if a socket connect operation is allowed
4148 * @address: address of remote connection point
4149 * @addrlen: length of address
4151 * Check permission before socket protocol layer connect operation attempts to
4152 * connect socket @sock to a remote address, @address.
4154 * Return: Returns 0 if permission is granted.
4156 int security_socket_connect(struct socket
*sock
,
4157 struct sockaddr
*address
, int addrlen
)
4159 return call_int_hook(socket_connect
, 0, sock
, address
, addrlen
);
4163 * security_socket_listen() - Check if a socket is allowed to listen
4165 * @backlog: connection queue size
4167 * Check permission before socket protocol layer listen operation.
4169 * Return: Returns 0 if permission is granted.
4171 int security_socket_listen(struct socket
*sock
, int backlog
)
4173 return call_int_hook(socket_listen
, 0, sock
, backlog
);
4177 * security_socket_accept() - Check if a socket is allowed to accept connections
4178 * @sock: listening socket
4179 * @newsock: newly creation connection socket
4181 * Check permission before accepting a new connection. Note that the new
4182 * socket, @newsock, has been created and some information copied to it, but
4183 * the accept operation has not actually been performed.
4185 * Return: Returns 0 if permission is granted.
4187 int security_socket_accept(struct socket
*sock
, struct socket
*newsock
)
4189 return call_int_hook(socket_accept
, 0, sock
, newsock
);
4193 * security_socket_sendmsg() - Check is sending a message is allowed
4194 * @sock: sending socket
4195 * @msg: message to send
4196 * @size: size of message
4198 * Check permission before transmitting a message to another socket.
4200 * Return: Returns 0 if permission is granted.
4202 int security_socket_sendmsg(struct socket
*sock
, struct msghdr
*msg
, int size
)
4204 return call_int_hook(socket_sendmsg
, 0, sock
, msg
, size
);
4208 * security_socket_recvmsg() - Check if receiving a message is allowed
4209 * @sock: receiving socket
4210 * @msg: message to receive
4211 * @size: size of message
4212 * @flags: operational flags
4214 * Check permission before receiving a message from a socket.
4216 * Return: Returns 0 if permission is granted.
4218 int security_socket_recvmsg(struct socket
*sock
, struct msghdr
*msg
,
4219 int size
, int flags
)
4221 return call_int_hook(socket_recvmsg
, 0, sock
, msg
, size
, flags
);
4225 * security_socket_getsockname() - Check if reading the socket addr is allowed
4228 * Check permission before reading the local address (name) of the socket
4231 * Return: Returns 0 if permission is granted.
4233 int security_socket_getsockname(struct socket
*sock
)
4235 return call_int_hook(socket_getsockname
, 0, sock
);
4239 * security_socket_getpeername() - Check if reading the peer's addr is allowed
4242 * Check permission before the remote address (name) of a socket object.
4244 * Return: Returns 0 if permission is granted.
4246 int security_socket_getpeername(struct socket
*sock
)
4248 return call_int_hook(socket_getpeername
, 0, sock
);
4252 * security_socket_getsockopt() - Check if reading a socket option is allowed
4254 * @level: option's protocol level
4255 * @optname: option name
4257 * Check permissions before retrieving the options associated with socket
4260 * Return: Returns 0 if permission is granted.
4262 int security_socket_getsockopt(struct socket
*sock
, int level
, int optname
)
4264 return call_int_hook(socket_getsockopt
, 0, sock
, level
, optname
);
4268 * security_socket_setsockopt() - Check if setting a socket option is allowed
4270 * @level: option's protocol level
4271 * @optname: option name
4273 * Check permissions before setting the options associated with socket @sock.
4275 * Return: Returns 0 if permission is granted.
4277 int security_socket_setsockopt(struct socket
*sock
, int level
, int optname
)
4279 return call_int_hook(socket_setsockopt
, 0, sock
, level
, optname
);
4283 * security_socket_shutdown() - Checks if shutting down the socket is allowed
4285 * @how: flag indicating how sends and receives are handled
4287 * Checks permission before all or part of a connection on the socket @sock is
4290 * Return: Returns 0 if permission is granted.
4292 int security_socket_shutdown(struct socket
*sock
, int how
)
4294 return call_int_hook(socket_shutdown
, 0, sock
, how
);
4298 * security_sock_rcv_skb() - Check if an incoming network packet is allowed
4299 * @sk: destination sock
4300 * @skb: incoming packet
4302 * Check permissions on incoming network packets. This hook is distinct from
4303 * Netfilter's IP input hooks since it is the first time that the incoming
4304 * sk_buff @skb has been associated with a particular socket, @sk. Must not
4305 * sleep inside this hook because some callers hold spinlocks.
4307 * Return: Returns 0 if permission is granted.
4309 int security_sock_rcv_skb(struct sock
*sk
, struct sk_buff
*skb
)
4311 return call_int_hook(socket_sock_rcv_skb
, 0, sk
, skb
);
4313 EXPORT_SYMBOL(security_sock_rcv_skb
);
4316 * security_socket_getpeersec_stream() - Get the remote peer label
4318 * @optval: destination buffer
4319 * @optlen: size of peer label copied into the buffer
4320 * @len: maximum size of the destination buffer
4322 * This hook allows the security module to provide peer socket security state
4323 * for unix or connected tcp sockets to userspace via getsockopt SO_GETPEERSEC.
4324 * For tcp sockets this can be meaningful if the socket is associated with an
4327 * Return: Returns 0 if all is well, otherwise, typical getsockopt return
4330 int security_socket_getpeersec_stream(struct socket
*sock
, sockptr_t optval
,
4331 sockptr_t optlen
, unsigned int len
)
4333 return call_int_hook(socket_getpeersec_stream
, -ENOPROTOOPT
, sock
,
4334 optval
, optlen
, len
);
4338 * security_socket_getpeersec_dgram() - Get the remote peer label
4340 * @skb: datagram packet
4341 * @secid: remote peer label secid
4343 * This hook allows the security module to provide peer socket security state
4344 * for udp sockets on a per-packet basis to userspace via getsockopt
4345 * SO_GETPEERSEC. The application must first have indicated the IP_PASSSEC
4346 * option via getsockopt. It can then retrieve the security state returned by
4347 * this hook for a packet via the SCM_SECURITY ancillary message type.
4349 * Return: Returns 0 on success, error on failure.
4351 int security_socket_getpeersec_dgram(struct socket
*sock
,
4352 struct sk_buff
*skb
, u32
*secid
)
4354 return call_int_hook(socket_getpeersec_dgram
, -ENOPROTOOPT
, sock
,
4357 EXPORT_SYMBOL(security_socket_getpeersec_dgram
);
4360 * security_sk_alloc() - Allocate and initialize a sock's LSM blob
4362 * @family: protocol family
4363 * @priority: gfp flags
4365 * Allocate and attach a security structure to the sk->sk_security field, which
4366 * is used to copy security attributes between local stream sockets.
4368 * Return: Returns 0 on success, error on failure.
4370 int security_sk_alloc(struct sock
*sk
, int family
, gfp_t priority
)
4372 return call_int_hook(sk_alloc_security
, 0, sk
, family
, priority
);
4376 * security_sk_free() - Free the sock's LSM blob
4379 * Deallocate security structure.
4381 void security_sk_free(struct sock
*sk
)
4383 call_void_hook(sk_free_security
, sk
);
4387 * security_sk_clone() - Clone a sock's LSM state
4388 * @sk: original sock
4389 * @newsk: target sock
4391 * Clone/copy security structure.
4393 void security_sk_clone(const struct sock
*sk
, struct sock
*newsk
)
4395 call_void_hook(sk_clone_security
, sk
, newsk
);
4397 EXPORT_SYMBOL(security_sk_clone
);
4399 void security_sk_classify_flow(struct sock
*sk
, struct flowi_common
*flic
)
4401 call_void_hook(sk_getsecid
, sk
, &flic
->flowic_secid
);
4403 EXPORT_SYMBOL(security_sk_classify_flow
);
4406 * security_req_classify_flow() - Set a flow's secid based on request_sock
4407 * @req: request_sock
4408 * @flic: target flow
4410 * Sets @flic's secid to @req's secid.
4412 void security_req_classify_flow(const struct request_sock
*req
,
4413 struct flowi_common
*flic
)
4415 call_void_hook(req_classify_flow
, req
, flic
);
4417 EXPORT_SYMBOL(security_req_classify_flow
);
4420 * security_sock_graft() - Reconcile LSM state when grafting a sock on a socket
4421 * @sk: sock being grafted
4422 * @parent: target parent socket
4424 * Sets @parent's inode secid to @sk's secid and update @sk with any necessary
4425 * LSM state from @parent.
4427 void security_sock_graft(struct sock
*sk
, struct socket
*parent
)
4429 call_void_hook(sock_graft
, sk
, parent
);
4431 EXPORT_SYMBOL(security_sock_graft
);
4434 * security_inet_conn_request() - Set request_sock state using incoming connect
4435 * @sk: parent listening sock
4436 * @skb: incoming connection
4437 * @req: new request_sock
4439 * Initialize the @req LSM state based on @sk and the incoming connect in @skb.
4441 * Return: Returns 0 if permission is granted.
4443 int security_inet_conn_request(const struct sock
*sk
,
4444 struct sk_buff
*skb
, struct request_sock
*req
)
4446 return call_int_hook(inet_conn_request
, 0, sk
, skb
, req
);
4448 EXPORT_SYMBOL(security_inet_conn_request
);
4451 * security_inet_csk_clone() - Set new sock LSM state based on request_sock
4453 * @req: connection request_sock
4455 * Set that LSM state of @sock using the LSM state from @req.
4457 void security_inet_csk_clone(struct sock
*newsk
,
4458 const struct request_sock
*req
)
4460 call_void_hook(inet_csk_clone
, newsk
, req
);
4464 * security_inet_conn_established() - Update sock's LSM state with connection
4466 * @skb: connection packet
4468 * Update @sock's LSM state to represent a new connection from @skb.
4470 void security_inet_conn_established(struct sock
*sk
,
4471 struct sk_buff
*skb
)
4473 call_void_hook(inet_conn_established
, sk
, skb
);
4475 EXPORT_SYMBOL(security_inet_conn_established
);
4478 * security_secmark_relabel_packet() - Check if setting a secmark is allowed
4479 * @secid: new secmark value
4481 * Check if the process should be allowed to relabel packets to @secid.
4483 * Return: Returns 0 if permission is granted.
4485 int security_secmark_relabel_packet(u32 secid
)
4487 return call_int_hook(secmark_relabel_packet
, 0, secid
);
4489 EXPORT_SYMBOL(security_secmark_relabel_packet
);
4492 * security_secmark_refcount_inc() - Increment the secmark labeling rule count
4494 * Tells the LSM to increment the number of secmark labeling rules loaded.
4496 void security_secmark_refcount_inc(void)
4498 call_void_hook(secmark_refcount_inc
);
4500 EXPORT_SYMBOL(security_secmark_refcount_inc
);
4503 * security_secmark_refcount_dec() - Decrement the secmark labeling rule count
4505 * Tells the LSM to decrement the number of secmark labeling rules loaded.
4507 void security_secmark_refcount_dec(void)
4509 call_void_hook(secmark_refcount_dec
);
4511 EXPORT_SYMBOL(security_secmark_refcount_dec
);
4514 * security_tun_dev_alloc_security() - Allocate a LSM blob for a TUN device
4515 * @security: pointer to the LSM blob
4517 * This hook allows a module to allocate a security structure for a TUN device,
4518 * returning the pointer in @security.
4520 * Return: Returns a zero on success, negative values on failure.
4522 int security_tun_dev_alloc_security(void **security
)
4524 return call_int_hook(tun_dev_alloc_security
, 0, security
);
4526 EXPORT_SYMBOL(security_tun_dev_alloc_security
);
4529 * security_tun_dev_free_security() - Free a TUN device LSM blob
4530 * @security: LSM blob
4532 * This hook allows a module to free the security structure for a TUN device.
4534 void security_tun_dev_free_security(void *security
)
4536 call_void_hook(tun_dev_free_security
, security
);
4538 EXPORT_SYMBOL(security_tun_dev_free_security
);
4541 * security_tun_dev_create() - Check if creating a TUN device is allowed
4543 * Check permissions prior to creating a new TUN device.
4545 * Return: Returns 0 if permission is granted.
4547 int security_tun_dev_create(void)
4549 return call_int_hook(tun_dev_create
, 0);
4551 EXPORT_SYMBOL(security_tun_dev_create
);
4554 * security_tun_dev_attach_queue() - Check if attaching a TUN queue is allowed
4555 * @security: TUN device LSM blob
4557 * Check permissions prior to attaching to a TUN device queue.
4559 * Return: Returns 0 if permission is granted.
4561 int security_tun_dev_attach_queue(void *security
)
4563 return call_int_hook(tun_dev_attach_queue
, 0, security
);
4565 EXPORT_SYMBOL(security_tun_dev_attach_queue
);
4568 * security_tun_dev_attach() - Update TUN device LSM state on attach
4569 * @sk: associated sock
4570 * @security: TUN device LSM blob
4572 * This hook can be used by the module to update any security state associated
4573 * with the TUN device's sock structure.
4575 * Return: Returns 0 if permission is granted.
4577 int security_tun_dev_attach(struct sock
*sk
, void *security
)
4579 return call_int_hook(tun_dev_attach
, 0, sk
, security
);
4581 EXPORT_SYMBOL(security_tun_dev_attach
);
4584 * security_tun_dev_open() - Update TUN device LSM state on open
4585 * @security: TUN device LSM blob
4587 * This hook can be used by the module to update any security state associated
4588 * with the TUN device's security structure.
4590 * Return: Returns 0 if permission is granted.
4592 int security_tun_dev_open(void *security
)
4594 return call_int_hook(tun_dev_open
, 0, security
);
4596 EXPORT_SYMBOL(security_tun_dev_open
);
4599 * security_sctp_assoc_request() - Update the LSM on a SCTP association req
4600 * @asoc: SCTP association
4601 * @skb: packet requesting the association
4603 * Passes the @asoc and @chunk->skb of the association INIT packet to the LSM.
4605 * Return: Returns 0 on success, error on failure.
4607 int security_sctp_assoc_request(struct sctp_association
*asoc
,
4608 struct sk_buff
*skb
)
4610 return call_int_hook(sctp_assoc_request
, 0, asoc
, skb
);
4612 EXPORT_SYMBOL(security_sctp_assoc_request
);
4615 * security_sctp_bind_connect() - Validate a list of addrs for a SCTP option
4617 * @optname: SCTP option to validate
4618 * @address: list of IP addresses to validate
4619 * @addrlen: length of the address list
4621 * Validiate permissions required for each address associated with sock @sk.
4622 * Depending on @optname, the addresses will be treated as either a connect or
4623 * bind service. The @addrlen is calculated on each IPv4 and IPv6 address using
4624 * sizeof(struct sockaddr_in) or sizeof(struct sockaddr_in6).
4626 * Return: Returns 0 on success, error on failure.
4628 int security_sctp_bind_connect(struct sock
*sk
, int optname
,
4629 struct sockaddr
*address
, int addrlen
)
4631 return call_int_hook(sctp_bind_connect
, 0, sk
, optname
,
4634 EXPORT_SYMBOL(security_sctp_bind_connect
);
4637 * security_sctp_sk_clone() - Clone a SCTP sock's LSM state
4638 * @asoc: SCTP association
4639 * @sk: original sock
4640 * @newsk: target sock
4642 * Called whenever a new socket is created by accept(2) (i.e. a TCP style
4643 * socket) or when a socket is 'peeled off' e.g userspace calls
4646 void security_sctp_sk_clone(struct sctp_association
*asoc
, struct sock
*sk
,
4649 call_void_hook(sctp_sk_clone
, asoc
, sk
, newsk
);
4651 EXPORT_SYMBOL(security_sctp_sk_clone
);
4654 * security_sctp_assoc_established() - Update LSM state when assoc established
4655 * @asoc: SCTP association
4656 * @skb: packet establishing the association
4658 * Passes the @asoc and @chunk->skb of the association COOKIE_ACK packet to the
4661 * Return: Returns 0 if permission is granted.
4663 int security_sctp_assoc_established(struct sctp_association
*asoc
,
4664 struct sk_buff
*skb
)
4666 return call_int_hook(sctp_assoc_established
, 0, asoc
, skb
);
4668 EXPORT_SYMBOL(security_sctp_assoc_established
);
4671 * security_mptcp_add_subflow() - Inherit the LSM label from the MPTCP socket
4672 * @sk: the owning MPTCP socket
4673 * @ssk: the new subflow
4675 * Update the labeling for the given MPTCP subflow, to match the one of the
4676 * owning MPTCP socket. This hook has to be called after the socket creation and
4677 * initialization via the security_socket_create() and
4678 * security_socket_post_create() LSM hooks.
4680 * Return: Returns 0 on success or a negative error code on failure.
4682 int security_mptcp_add_subflow(struct sock
*sk
, struct sock
*ssk
)
4684 return call_int_hook(mptcp_add_subflow
, 0, sk
, ssk
);
4687 #endif /* CONFIG_SECURITY_NETWORK */
4689 #ifdef CONFIG_SECURITY_INFINIBAND
4691 * security_ib_pkey_access() - Check if access to an IB pkey is allowed
4693 * @subnet_prefix: subnet prefix of the port
4696 * Check permission to access a pkey when modifying a QP.
4698 * Return: Returns 0 if permission is granted.
4700 int security_ib_pkey_access(void *sec
, u64 subnet_prefix
, u16 pkey
)
4702 return call_int_hook(ib_pkey_access
, 0, sec
, subnet_prefix
, pkey
);
4704 EXPORT_SYMBOL(security_ib_pkey_access
);
4707 * security_ib_endport_manage_subnet() - Check if SMPs traffic is allowed
4709 * @dev_name: IB device name
4710 * @port_num: port number
4712 * Check permissions to send and receive SMPs on a end port.
4714 * Return: Returns 0 if permission is granted.
4716 int security_ib_endport_manage_subnet(void *sec
,
4717 const char *dev_name
, u8 port_num
)
4719 return call_int_hook(ib_endport_manage_subnet
, 0, sec
,
4720 dev_name
, port_num
);
4722 EXPORT_SYMBOL(security_ib_endport_manage_subnet
);
4725 * security_ib_alloc_security() - Allocate an Infiniband LSM blob
4728 * Allocate a security structure for Infiniband objects.
4730 * Return: Returns 0 on success, non-zero on failure.
4732 int security_ib_alloc_security(void **sec
)
4734 return call_int_hook(ib_alloc_security
, 0, sec
);
4736 EXPORT_SYMBOL(security_ib_alloc_security
);
4739 * security_ib_free_security() - Free an Infiniband LSM blob
4742 * Deallocate an Infiniband security structure.
4744 void security_ib_free_security(void *sec
)
4746 call_void_hook(ib_free_security
, sec
);
4748 EXPORT_SYMBOL(security_ib_free_security
);
4749 #endif /* CONFIG_SECURITY_INFINIBAND */
4751 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4753 * security_xfrm_policy_alloc() - Allocate a xfrm policy LSM blob
4754 * @ctxp: xfrm security context being added to the SPD
4755 * @sec_ctx: security label provided by userspace
4758 * Allocate a security structure to the xp->security field; the security field
4759 * is initialized to NULL when the xfrm_policy is allocated.
4761 * Return: Return 0 if operation was successful.
4763 int security_xfrm_policy_alloc(struct xfrm_sec_ctx
**ctxp
,
4764 struct xfrm_user_sec_ctx
*sec_ctx
,
4767 return call_int_hook(xfrm_policy_alloc_security
, 0, ctxp
, sec_ctx
, gfp
);
4769 EXPORT_SYMBOL(security_xfrm_policy_alloc
);
4772 * security_xfrm_policy_clone() - Clone xfrm policy LSM state
4773 * @old_ctx: xfrm security context
4774 * @new_ctxp: target xfrm security context
4776 * Allocate a security structure in new_ctxp that contains the information from
4777 * the old_ctx structure.
4779 * Return: Return 0 if operation was successful.
4781 int security_xfrm_policy_clone(struct xfrm_sec_ctx
*old_ctx
,
4782 struct xfrm_sec_ctx
**new_ctxp
)
4784 return call_int_hook(xfrm_policy_clone_security
, 0, old_ctx
, new_ctxp
);
4788 * security_xfrm_policy_free() - Free a xfrm security context
4789 * @ctx: xfrm security context
4791 * Free LSM resources associated with @ctx.
4793 void security_xfrm_policy_free(struct xfrm_sec_ctx
*ctx
)
4795 call_void_hook(xfrm_policy_free_security
, ctx
);
4797 EXPORT_SYMBOL(security_xfrm_policy_free
);
4800 * security_xfrm_policy_delete() - Check if deleting a xfrm policy is allowed
4801 * @ctx: xfrm security context
4803 * Authorize deletion of a SPD entry.
4805 * Return: Returns 0 if permission is granted.
4807 int security_xfrm_policy_delete(struct xfrm_sec_ctx
*ctx
)
4809 return call_int_hook(xfrm_policy_delete_security
, 0, ctx
);
4813 * security_xfrm_state_alloc() - Allocate a xfrm state LSM blob
4814 * @x: xfrm state being added to the SAD
4815 * @sec_ctx: security label provided by userspace
4817 * Allocate a security structure to the @x->security field; the security field
4818 * is initialized to NULL when the xfrm_state is allocated. Set the context to
4819 * correspond to @sec_ctx.
4821 * Return: Return 0 if operation was successful.
4823 int security_xfrm_state_alloc(struct xfrm_state
*x
,
4824 struct xfrm_user_sec_ctx
*sec_ctx
)
4826 return call_int_hook(xfrm_state_alloc
, 0, x
, sec_ctx
);
4828 EXPORT_SYMBOL(security_xfrm_state_alloc
);
4831 * security_xfrm_state_alloc_acquire() - Allocate a xfrm state LSM blob
4832 * @x: xfrm state being added to the SAD
4833 * @polsec: associated policy's security context
4834 * @secid: secid from the flow
4836 * Allocate a security structure to the x->security field; the security field
4837 * is initialized to NULL when the xfrm_state is allocated. Set the context to
4838 * correspond to secid.
4840 * Return: Returns 0 if operation was successful.
4842 int security_xfrm_state_alloc_acquire(struct xfrm_state
*x
,
4843 struct xfrm_sec_ctx
*polsec
, u32 secid
)
4845 return call_int_hook(xfrm_state_alloc_acquire
, 0, x
, polsec
, secid
);
4849 * security_xfrm_state_delete() - Check if deleting a xfrm state is allowed
4852 * Authorize deletion of x->security.
4854 * Return: Returns 0 if permission is granted.
4856 int security_xfrm_state_delete(struct xfrm_state
*x
)
4858 return call_int_hook(xfrm_state_delete_security
, 0, x
);
4860 EXPORT_SYMBOL(security_xfrm_state_delete
);
4863 * security_xfrm_state_free() - Free a xfrm state
4866 * Deallocate x->security.
4868 void security_xfrm_state_free(struct xfrm_state
*x
)
4870 call_void_hook(xfrm_state_free_security
, x
);
4874 * security_xfrm_policy_lookup() - Check if using a xfrm policy is allowed
4875 * @ctx: target xfrm security context
4876 * @fl_secid: flow secid used to authorize access
4878 * Check permission when a flow selects a xfrm_policy for processing XFRMs on a
4879 * packet. The hook is called when selecting either a per-socket policy or a
4880 * generic xfrm policy.
4882 * Return: Return 0 if permission is granted, -ESRCH otherwise, or -errno on
4885 int security_xfrm_policy_lookup(struct xfrm_sec_ctx
*ctx
, u32 fl_secid
)
4887 return call_int_hook(xfrm_policy_lookup
, 0, ctx
, fl_secid
);
4891 * security_xfrm_state_pol_flow_match() - Check for a xfrm match
4892 * @x: xfrm state to match
4893 * @xp: xfrm policy to check for a match
4894 * @flic: flow to check for a match.
4896 * Check @xp and @flic for a match with @x.
4898 * Return: Returns 1 if there is a match.
4900 int security_xfrm_state_pol_flow_match(struct xfrm_state
*x
,
4901 struct xfrm_policy
*xp
,
4902 const struct flowi_common
*flic
)
4904 struct security_hook_list
*hp
;
4905 int rc
= LSM_RET_DEFAULT(xfrm_state_pol_flow_match
);
4908 * Since this function is expected to return 0 or 1, the judgment
4909 * becomes difficult if multiple LSMs supply this call. Fortunately,
4910 * we can use the first LSM's judgment because currently only SELinux
4911 * supplies this call.
4913 * For speed optimization, we explicitly break the loop rather than
4916 hlist_for_each_entry(hp
, &security_hook_heads
.xfrm_state_pol_flow_match
,
4918 rc
= hp
->hook
.xfrm_state_pol_flow_match(x
, xp
, flic
);
4925 * security_xfrm_decode_session() - Determine the xfrm secid for a packet
4929 * Decode the packet in @skb and return the security label in @secid.
4931 * Return: Return 0 if all xfrms used have the same secid.
4933 int security_xfrm_decode_session(struct sk_buff
*skb
, u32
*secid
)
4935 return call_int_hook(xfrm_decode_session
, 0, skb
, secid
, 1);
4938 void security_skb_classify_flow(struct sk_buff
*skb
, struct flowi_common
*flic
)
4940 int rc
= call_int_hook(xfrm_decode_session
, 0, skb
, &flic
->flowic_secid
,
4945 EXPORT_SYMBOL(security_skb_classify_flow
);
4946 #endif /* CONFIG_SECURITY_NETWORK_XFRM */
4950 * security_key_alloc() - Allocate and initialize a kernel key LSM blob
4952 * @cred: credentials
4953 * @flags: allocation flags
4955 * Permit allocation of a key and assign security data. Note that key does not
4956 * have a serial number assigned at this point.
4958 * Return: Return 0 if permission is granted, -ve error otherwise.
4960 int security_key_alloc(struct key
*key
, const struct cred
*cred
,
4961 unsigned long flags
)
4963 return call_int_hook(key_alloc
, 0, key
, cred
, flags
);
4967 * security_key_free() - Free a kernel key LSM blob
4970 * Notification of destruction; free security data.
4972 void security_key_free(struct key
*key
)
4974 call_void_hook(key_free
, key
);
4978 * security_key_permission() - Check if a kernel key operation is allowed
4979 * @key_ref: key reference
4980 * @cred: credentials of actor requesting access
4981 * @need_perm: requested permissions
4983 * See whether a specific operational right is granted to a process on a key.
4985 * Return: Return 0 if permission is granted, -ve error otherwise.
4987 int security_key_permission(key_ref_t key_ref
, const struct cred
*cred
,
4988 enum key_need_perm need_perm
)
4990 return call_int_hook(key_permission
, 0, key_ref
, cred
, need_perm
);
4994 * security_key_getsecurity() - Get the key's security label
4996 * @buffer: security label buffer
4998 * Get a textual representation of the security context attached to a key for
4999 * the purposes of honouring KEYCTL_GETSECURITY. This function allocates the
5000 * storage for the NUL-terminated string and the caller should free it.
5002 * Return: Returns the length of @buffer (including terminating NUL) or -ve if
5003 * an error occurs. May also return 0 (and a NULL buffer pointer) if
5004 * there is no security label assigned to the key.
5006 int security_key_getsecurity(struct key
*key
, char **buffer
)
5009 return call_int_hook(key_getsecurity
, 0, key
, buffer
);
5011 #endif /* CONFIG_KEYS */
5015 * security_audit_rule_init() - Allocate and init an LSM audit rule struct
5016 * @field: audit action
5017 * @op: rule operator
5018 * @rulestr: rule context
5019 * @lsmrule: receive buffer for audit rule struct
5021 * Allocate and initialize an LSM audit rule structure.
5023 * Return: Return 0 if @lsmrule has been successfully set, -EINVAL in case of
5026 int security_audit_rule_init(u32 field
, u32 op
, char *rulestr
, void **lsmrule
)
5028 return call_int_hook(audit_rule_init
, 0, field
, op
, rulestr
, lsmrule
);
5032 * security_audit_rule_known() - Check if an audit rule contains LSM fields
5033 * @krule: audit rule
5035 * Specifies whether given @krule contains any fields related to the current
5038 * Return: Returns 1 in case of relation found, 0 otherwise.
5040 int security_audit_rule_known(struct audit_krule
*krule
)
5042 return call_int_hook(audit_rule_known
, 0, krule
);
5046 * security_audit_rule_free() - Free an LSM audit rule struct
5047 * @lsmrule: audit rule struct
5049 * Deallocate the LSM audit rule structure previously allocated by
5050 * audit_rule_init().
5052 void security_audit_rule_free(void *lsmrule
)
5054 call_void_hook(audit_rule_free
, lsmrule
);
5058 * security_audit_rule_match() - Check if a label matches an audit rule
5059 * @secid: security label
5060 * @field: LSM audit field
5061 * @op: matching operator
5062 * @lsmrule: audit rule
5064 * Determine if given @secid matches a rule previously approved by
5065 * security_audit_rule_known().
5067 * Return: Returns 1 if secid matches the rule, 0 if it does not, -ERRNO on
5070 int security_audit_rule_match(u32 secid
, u32 field
, u32 op
, void *lsmrule
)
5072 return call_int_hook(audit_rule_match
, 0, secid
, field
, op
, lsmrule
);
5074 #endif /* CONFIG_AUDIT */
5076 #ifdef CONFIG_BPF_SYSCALL
5078 * security_bpf() - Check if the bpf syscall operation is allowed
5080 * @attr: bpf attribute
5083 * Do a initial check for all bpf syscalls after the attribute is copied into
5084 * the kernel. The actual security module can implement their own rules to
5085 * check the specific cmd they need.
5087 * Return: Returns 0 if permission is granted.
5089 int security_bpf(int cmd
, union bpf_attr
*attr
, unsigned int size
)
5091 return call_int_hook(bpf
, 0, cmd
, attr
, size
);
5095 * security_bpf_map() - Check if access to a bpf map is allowed
5099 * Do a check when the kernel generates and returns a file descriptor for eBPF
5102 * Return: Returns 0 if permission is granted.
5104 int security_bpf_map(struct bpf_map
*map
, fmode_t fmode
)
5106 return call_int_hook(bpf_map
, 0, map
, fmode
);
5110 * security_bpf_prog() - Check if access to a bpf program is allowed
5111 * @prog: bpf program
5113 * Do a check when the kernel generates and returns a file descriptor for eBPF
5116 * Return: Returns 0 if permission is granted.
5118 int security_bpf_prog(struct bpf_prog
*prog
)
5120 return call_int_hook(bpf_prog
, 0, prog
);
5124 * security_bpf_map_alloc() - Allocate a bpf map LSM blob
5127 * Initialize the security field inside bpf map.
5129 * Return: Returns 0 on success, error on failure.
5131 int security_bpf_map_alloc(struct bpf_map
*map
)
5133 return call_int_hook(bpf_map_alloc_security
, 0, map
);
5137 * security_bpf_prog_alloc() - Allocate a bpf program LSM blob
5138 * @aux: bpf program aux info struct
5140 * Initialize the security field inside bpf program.
5142 * Return: Returns 0 on success, error on failure.
5144 int security_bpf_prog_alloc(struct bpf_prog_aux
*aux
)
5146 return call_int_hook(bpf_prog_alloc_security
, 0, aux
);
5150 * security_bpf_map_free() - Free a bpf map's LSM blob
5153 * Clean up the security information stored inside bpf map.
5155 void security_bpf_map_free(struct bpf_map
*map
)
5157 call_void_hook(bpf_map_free_security
, map
);
5161 * security_bpf_prog_free() - Free a bpf program's LSM blob
5162 * @aux: bpf program aux info struct
5164 * Clean up the security information stored inside bpf prog.
5166 void security_bpf_prog_free(struct bpf_prog_aux
*aux
)
5168 call_void_hook(bpf_prog_free_security
, aux
);
5170 #endif /* CONFIG_BPF_SYSCALL */
5173 * security_locked_down() - Check if a kernel feature is allowed
5174 * @what: requested kernel feature
5176 * Determine whether a kernel feature that potentially enables arbitrary code
5177 * execution in kernel space should be permitted.
5179 * Return: Returns 0 if permission is granted.
5181 int security_locked_down(enum lockdown_reason what
)
5183 return call_int_hook(locked_down
, 0, what
);
5185 EXPORT_SYMBOL(security_locked_down
);
5187 #ifdef CONFIG_PERF_EVENTS
5189 * security_perf_event_open() - Check if a perf event open is allowed
5190 * @attr: perf event attribute
5191 * @type: type of event
5193 * Check whether the @type of perf_event_open syscall is allowed.
5195 * Return: Returns 0 if permission is granted.
5197 int security_perf_event_open(struct perf_event_attr
*attr
, int type
)
5199 return call_int_hook(perf_event_open
, 0, attr
, type
);
5203 * security_perf_event_alloc() - Allocate a perf event LSM blob
5204 * @event: perf event
5206 * Allocate and save perf_event security info.
5208 * Return: Returns 0 on success, error on failure.
5210 int security_perf_event_alloc(struct perf_event
*event
)
5212 return call_int_hook(perf_event_alloc
, 0, event
);
5216 * security_perf_event_free() - Free a perf event LSM blob
5217 * @event: perf event
5219 * Release (free) perf_event security info.
5221 void security_perf_event_free(struct perf_event
*event
)
5223 call_void_hook(perf_event_free
, event
);
5227 * security_perf_event_read() - Check if reading a perf event label is allowed
5228 * @event: perf event
5230 * Read perf_event security info if allowed.
5232 * Return: Returns 0 if permission is granted.
5234 int security_perf_event_read(struct perf_event
*event
)
5236 return call_int_hook(perf_event_read
, 0, event
);
5240 * security_perf_event_write() - Check if writing a perf event label is allowed
5241 * @event: perf event
5243 * Write perf_event security info if allowed.
5245 * Return: Returns 0 if permission is granted.
5247 int security_perf_event_write(struct perf_event
*event
)
5249 return call_int_hook(perf_event_write
, 0, event
);
5251 #endif /* CONFIG_PERF_EVENTS */
5253 #ifdef CONFIG_IO_URING
5255 * security_uring_override_creds() - Check if overriding creds is allowed
5256 * @new: new credentials
5258 * Check if the current task, executing an io_uring operation, is allowed to
5259 * override it's credentials with @new.
5261 * Return: Returns 0 if permission is granted.
5263 int security_uring_override_creds(const struct cred
*new)
5265 return call_int_hook(uring_override_creds
, 0, new);
5269 * security_uring_sqpoll() - Check if IORING_SETUP_SQPOLL is allowed
5271 * Check whether the current task is allowed to spawn a io_uring polling thread
5272 * (IORING_SETUP_SQPOLL).
5274 * Return: Returns 0 if permission is granted.
5276 int security_uring_sqpoll(void)
5278 return call_int_hook(uring_sqpoll
, 0);
5282 * security_uring_cmd() - Check if a io_uring passthrough command is allowed
5285 * Check whether the file_operations uring_cmd is allowed to run.
5287 * Return: Returns 0 if permission is granted.
5289 int security_uring_cmd(struct io_uring_cmd
*ioucmd
)
5291 return call_int_hook(uring_cmd
, 0, ioucmd
);
5293 #endif /* CONFIG_IO_URING */