security.c 43.5 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6
/*
 * Security plug functions
 *
 * Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com>
 * Copyright (C) 2001-2002 Greg Kroah-Hartman <greg@kroah.com>
 * Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com>
7
 * Copyright (C) 2016 Mellanox Technologies
L
Linus Torvalds 已提交
8 9 10 11 12 13 14
 *
 *	This program is free software; you can redistribute it and/or modify
 *	it under the terms of the GNU General Public License as published by
 *	the Free Software Foundation; either version 2 of the License, or
 *	(at your option) any later version.
 */

15
#include <linux/bpf.h>
16
#include <linux/capability.h>
17
#include <linux/dcache.h>
L
Linus Torvalds 已提交
18 19 20
#include <linux/module.h>
#include <linux/init.h>
#include <linux/kernel.h>
C
Casey Schaufler 已提交
21
#include <linux/lsm_hooks.h>
22
#include <linux/integrity.h>
23
#include <linux/ima.h>
24
#include <linux/evm.h>
A
Al Viro 已提交
25
#include <linux/fsnotify.h>
26 27 28
#include <linux/mman.h>
#include <linux/mount.h>
#include <linux/personality.h>
P
Paul Mundt 已提交
29
#include <linux/backing-dev.h>
30
#include <linux/string.h>
A
Al Viro 已提交
31
#include <net/flow.h>
L
Linus Torvalds 已提交
32

33
#define MAX_LSM_EVM_XATTR	2
L
Linus Torvalds 已提交
34

C
Casey Schaufler 已提交
35 36 37
/* Maximum number of letters for an LSM name string */
#define SECURITY_NAME_MAX	10

38
struct security_hook_heads security_hook_heads __lsm_ro_after_init;
39 40
static ATOMIC_NOTIFIER_HEAD(lsm_notifier_chain);

41
char *lsm_names;
42
/* Boot-time LSM user choice */
J
John Johansen 已提交
43 44
static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] =
	CONFIG_DEFAULT_SECURITY;
L
Linus Torvalds 已提交
45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62

static void __init do_security_initcalls(void)
{
	initcall_t *call;
	call = __security_initcall_start;
	while (call < __security_initcall_end) {
		(*call) ();
		call++;
	}
}

/**
 * security_init - initializes the security framework
 *
 * This should be called early in the kernel initialization sequence.
 */
int __init security_init(void)
{
63 64 65 66 67 68
	int i;
	struct list_head *list = (struct list_head *) &security_hook_heads;

	for (i = 0; i < sizeof(security_hook_heads) / sizeof(struct list_head);
	     i++)
		INIT_LIST_HEAD(&list[i]);
C
Casey Schaufler 已提交
69
	pr_info("Security Framework initialized\n");
L
Linus Torvalds 已提交
70

C
Casey Schaufler 已提交
71
	/*
72
	 * Load minor LSMs, with the capability module always first.
C
Casey Schaufler 已提交
73 74 75
	 */
	capability_add_hooks();
	yama_add_hooks();
76
	loadpin_add_hooks();
77

C
Casey Schaufler 已提交
78
	/*
79
	 * Load all the remaining security modules.
C
Casey Schaufler 已提交
80
	 */
L
Linus Torvalds 已提交
81 82 83 84 85
	do_security_initcalls();

	return 0;
}

86 87 88 89 90 91 92 93
/* Save user chosen LSM */
static int __init choose_lsm(char *str)
{
	strncpy(chosen_lsm, str, SECURITY_NAME_MAX);
	return 1;
}
__setup("security=", choose_lsm);

94 95 96 97 98 99 100 101 102 103 104 105 106 107 108
static bool match_last_lsm(const char *list, const char *lsm)
{
	const char *last;

	if (WARN_ON(!list || !lsm))
		return false;
	last = strrchr(list, ',');
	if (last)
		/* Pass the comma, strcmp() will check for '\0' */
		last++;
	else
		last = list;
	return !strcmp(last, lsm);
}

109 110 111 112 113 114 115
static int lsm_append(char *new, char **result)
{
	char *cp;

	if (*result == NULL) {
		*result = kstrdup(new, GFP_KERNEL);
	} else {
116 117 118
		/* Check if it is the last registered name */
		if (match_last_lsm(*result, new))
			return 0;
119 120 121 122 123 124 125 126 127
		cp = kasprintf(GFP_KERNEL, "%s,%s", *result, new);
		if (cp == NULL)
			return -ENOMEM;
		kfree(*result);
		*result = cp;
	}
	return 0;
}

128 129
/**
 * security_module_enable - Load given security module on boot ?
C
Casey Schaufler 已提交
130
 * @module: the name of the module
131 132 133
 *
 * Each LSM must pass this method before registering its own operations
 * to avoid security registration races. This method may also be used
134
 * to check if your LSM is currently loaded during kernel initialization.
135
 *
136 137 138 139 140 141 142 143
 * Returns:
 *
 * true if:
 *
 * - The passed LSM is the one chosen by user at boot time,
 * - or the passed LSM is configured as the default and the user did not
 *   choose an alternate LSM at boot time.
 *
144 145
 * Otherwise, return false.
 */
C
Casey Schaufler 已提交
146
int __init security_module_enable(const char *module)
147
{
C
Casey Schaufler 已提交
148
	return !strcmp(module, chosen_lsm);
149 150
}

151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171
/**
 * security_add_hooks - Add a modules hooks to the hook lists.
 * @hooks: the hooks to add
 * @count: the number of hooks to add
 * @lsm: the name of the security module
 *
 * Each LSM has to register its hooks with the infrastructure.
 */
void __init security_add_hooks(struct security_hook_list *hooks, int count,
				char *lsm)
{
	int i;

	for (i = 0; i < count; i++) {
		hooks[i].lsm = lsm;
		list_add_tail_rcu(&hooks[i].list, hooks[i].head);
	}
	if (lsm_append(lsm, &lsm_names) < 0)
		panic("%s - Cannot get early memory.\n", __func__);
}

172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189
int call_lsm_notifier(enum lsm_event event, void *data)
{
	return atomic_notifier_call_chain(&lsm_notifier_chain, event, data);
}
EXPORT_SYMBOL(call_lsm_notifier);

int register_lsm_notifier(struct notifier_block *nb)
{
	return atomic_notifier_chain_register(&lsm_notifier_chain, nb);
}
EXPORT_SYMBOL(register_lsm_notifier);

int unregister_lsm_notifier(struct notifier_block *nb)
{
	return atomic_notifier_chain_unregister(&lsm_notifier_chain, nb);
}
EXPORT_SYMBOL(unregister_lsm_notifier);

190
/*
C
Casey Schaufler 已提交
191
 * Hook list operation macros.
L
Linus Torvalds 已提交
192
 *
193 194
 * call_void_hook:
 *	This is a hook that does not return a value.
L
Linus Torvalds 已提交
195
 *
196 197
 * call_int_hook:
 *	This is a hook that returns a value.
L
Linus Torvalds 已提交
198 199
 */

C
Casey Schaufler 已提交
200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220
#define call_void_hook(FUNC, ...)				\
	do {							\
		struct security_hook_list *P;			\
								\
		list_for_each_entry(P, &security_hook_heads.FUNC, list)	\
			P->hook.FUNC(__VA_ARGS__);		\
	} while (0)

#define call_int_hook(FUNC, IRC, ...) ({			\
	int RC = IRC;						\
	do {							\
		struct security_hook_list *P;			\
								\
		list_for_each_entry(P, &security_hook_heads.FUNC, list) { \
			RC = P->hook.FUNC(__VA_ARGS__);		\
			if (RC != 0)				\
				break;				\
		}						\
	} while (0);						\
	RC;							\
})
L
Linus Torvalds 已提交
221

222 223
/* Security operations */

224 225
int security_binder_set_context_mgr(struct task_struct *mgr)
{
226
	return call_int_hook(binder_set_context_mgr, 0, mgr);
227 228 229 230 231
}

int security_binder_transaction(struct task_struct *from,
				struct task_struct *to)
{
232
	return call_int_hook(binder_transaction, 0, from, to);
233 234 235 236 237
}

int security_binder_transfer_binder(struct task_struct *from,
				    struct task_struct *to)
{
238
	return call_int_hook(binder_transfer_binder, 0, from, to);
239 240 241 242 243
}

int security_binder_transfer_file(struct task_struct *from,
				  struct task_struct *to, struct file *file)
{
244
	return call_int_hook(binder_transfer_file, 0, from, to, file);
245 246
}

247
int security_ptrace_access_check(struct task_struct *child, unsigned int mode)
248
{
249
	return call_int_hook(ptrace_access_check, 0, child, mode);
250 251 252 253
}

int security_ptrace_traceme(struct task_struct *parent)
{
254
	return call_int_hook(ptrace_traceme, 0, parent);
255 256 257 258 259 260 261
}

int security_capget(struct task_struct *target,
		     kernel_cap_t *effective,
		     kernel_cap_t *inheritable,
		     kernel_cap_t *permitted)
{
262 263
	return call_int_hook(capget, 0, target,
				effective, inheritable, permitted);
264 265
}

D
David Howells 已提交
266 267 268 269
int security_capset(struct cred *new, const struct cred *old,
		    const kernel_cap_t *effective,
		    const kernel_cap_t *inheritable,
		    const kernel_cap_t *permitted)
270
{
271 272
	return call_int_hook(capset, 0, new, old,
				effective, inheritable, permitted);
273 274
}

275
int security_capable(const struct cred *cred, struct user_namespace *ns,
276
		     int cap)
277
{
278
	return call_int_hook(capable, 0, cred, ns, cap, SECURITY_CAP_AUDIT);
279 280
}

281 282
int security_capable_noaudit(const struct cred *cred, struct user_namespace *ns,
			     int cap)
283
{
284
	return call_int_hook(capable, 0, cred, ns, cap, SECURITY_CAP_NOAUDIT);
285 286 287 288
}

int security_quotactl(int cmds, int type, int id, struct super_block *sb)
{
289
	return call_int_hook(quotactl, 0, cmds, type, id, sb);
290 291 292 293
}

int security_quota_on(struct dentry *dentry)
{
294
	return call_int_hook(quota_on, 0, dentry);
295 296
}

297
int security_syslog(int type)
298
{
299
	return call_int_hook(syslog, 0, type);
300 301
}

302
int security_settime64(const struct timespec64 *ts, const struct timezone *tz)
303
{
304
	return call_int_hook(settime, 0, ts, tz);
305 306 307 308
}

int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
{
C
Casey Schaufler 已提交
309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327
	struct security_hook_list *hp;
	int cap_sys_admin = 1;
	int rc;

	/*
	 * The module will respond with a positive value if
	 * it thinks the __vm_enough_memory() call should be
	 * made with the cap_sys_admin set. If all of the modules
	 * agree that it should be set it will. If any module
	 * thinks it should not be set it won't.
	 */
	list_for_each_entry(hp, &security_hook_heads.vm_enough_memory, list) {
		rc = hp->hook.vm_enough_memory(mm, pages);
		if (rc <= 0) {
			cap_sys_admin = 0;
			break;
		}
	}
	return __vm_enough_memory(mm, pages, cap_sys_admin);
328 329
}

330
int security_bprm_set_creds(struct linux_binprm *bprm)
331
{
332
	return call_int_hook(bprm_set_creds, 0, bprm);
333 334
}

335
int security_bprm_check(struct linux_binprm *bprm)
336
{
337 338
	int ret;

339
	ret = call_int_hook(bprm_check_security, 0, bprm);
340 341 342
	if (ret)
		return ret;
	return ima_bprm_check(bprm);
343 344
}

345
void security_bprm_committing_creds(struct linux_binprm *bprm)
346
{
347
	call_void_hook(bprm_committing_creds, bprm);
348 349
}

350
void security_bprm_committed_creds(struct linux_binprm *bprm)
351
{
352
	call_void_hook(bprm_committed_creds, bprm);
353 354 355 356
}

int security_sb_alloc(struct super_block *sb)
{
357
	return call_int_hook(sb_alloc_security, 0, sb);
358 359 360 361
}

void security_sb_free(struct super_block *sb)
{
362
	call_void_hook(sb_free_security, sb);
363 364
}

365
int security_sb_copy_data(char *orig, char *copy)
366
{
367
	return call_int_hook(sb_copy_data, 0, orig, copy);
368
}
369
EXPORT_SYMBOL(security_sb_copy_data);
370

371 372
int security_sb_remount(struct super_block *sb, void *data)
{
373
	return call_int_hook(sb_remount, 0, sb, data);
374 375
}

376
int security_sb_kern_mount(struct super_block *sb, int flags, void *data)
377
{
378
	return call_int_hook(sb_kern_mount, 0, sb, flags, data);
379 380
}

381 382
int security_sb_show_options(struct seq_file *m, struct super_block *sb)
{
383
	return call_int_hook(sb_show_options, 0, m, sb);
384 385
}

386 387
int security_sb_statfs(struct dentry *dentry)
{
388
	return call_int_hook(sb_statfs, 0, dentry);
389 390
}

A
Al Viro 已提交
391
int security_sb_mount(const char *dev_name, const struct path *path,
A
Al Viro 已提交
392
                       const char *type, unsigned long flags, void *data)
393
{
394
	return call_int_hook(sb_mount, 0, dev_name, path, type, flags, data);
395 396 397 398
}

int security_sb_umount(struct vfsmount *mnt, int flags)
{
399
	return call_int_hook(sb_umount, 0, mnt, flags);
400 401
}

A
Al Viro 已提交
402
int security_sb_pivotroot(const struct path *old_path, const struct path *new_path)
403
{
404
	return call_int_hook(sb_pivotroot, 0, old_path, new_path);
405 406
}

407
int security_sb_set_mnt_opts(struct super_block *sb,
408 409 410
				struct security_mnt_opts *opts,
				unsigned long kern_flags,
				unsigned long *set_kern_flags)
411
{
C
Casey Schaufler 已提交
412 413 414
	return call_int_hook(sb_set_mnt_opts,
				opts->num_mnt_opts ? -EOPNOTSUPP : 0, sb,
				opts, kern_flags, set_kern_flags);
415
}
416
EXPORT_SYMBOL(security_sb_set_mnt_opts);
417

418
int security_sb_clone_mnt_opts(const struct super_block *oldsb,
419 420 421
				struct super_block *newsb,
				unsigned long kern_flags,
				unsigned long *set_kern_flags)
422
{
423 424
	return call_int_hook(sb_clone_mnt_opts, 0, oldsb, newsb,
				kern_flags, set_kern_flags);
425
}
426 427 428 429
EXPORT_SYMBOL(security_sb_clone_mnt_opts);

int security_sb_parse_opts_str(char *options, struct security_mnt_opts *opts)
{
430
	return call_int_hook(sb_parse_opts_str, 0, options, opts);
431 432
}
EXPORT_SYMBOL(security_sb_parse_opts_str);
433

434 435 436
int security_inode_alloc(struct inode *inode)
{
	inode->i_security = NULL;
437
	return call_int_hook(inode_alloc_security, 0, inode);
438 439 440 441
}

void security_inode_free(struct inode *inode)
{
442
	integrity_inode_free(inode);
443
	call_void_hook(inode_free_security, inode);
444 445
}

446
int security_dentry_init_security(struct dentry *dentry, int mode,
A
Al Viro 已提交
447
					const struct qstr *name, void **ctx,
448 449
					u32 *ctxlen)
{
C
Casey Schaufler 已提交
450 451
	return call_int_hook(dentry_init_security, -EOPNOTSUPP, dentry, mode,
				name, ctx, ctxlen);
452 453 454
}
EXPORT_SYMBOL(security_dentry_init_security);

455 456 457 458 459 460 461 462 463
int security_dentry_create_files_as(struct dentry *dentry, int mode,
				    struct qstr *name,
				    const struct cred *old, struct cred *new)
{
	return call_int_hook(dentry_create_files_as, 0, dentry, mode,
				name, old, new);
}
EXPORT_SYMBOL(security_dentry_create_files_as);

464
int security_inode_init_security(struct inode *inode, struct inode *dir,
465 466
				 const struct qstr *qstr,
				 const initxattrs initxattrs, void *fs_data)
467
{
468 469
	struct xattr new_xattrs[MAX_LSM_EVM_XATTR + 1];
	struct xattr *lsm_xattr, *evm_xattr, *xattr;
470 471
	int ret;

472
	if (unlikely(IS_PRIVATE(inode)))
473
		return 0;
474 475

	if (!initxattrs)
476 477
		return call_int_hook(inode_init_security, -EOPNOTSUPP, inode,
				     dir, qstr, NULL, NULL, NULL);
478
	memset(new_xattrs, 0, sizeof(new_xattrs));
479
	lsm_xattr = new_xattrs;
C
Casey Schaufler 已提交
480
	ret = call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir, qstr,
481 482 483 484 485
						&lsm_xattr->name,
						&lsm_xattr->value,
						&lsm_xattr->value_len);
	if (ret)
		goto out;
486 487 488 489 490

	evm_xattr = lsm_xattr + 1;
	ret = evm_inode_init_security(inode, lsm_xattr, evm_xattr);
	if (ret)
		goto out;
491 492
	ret = initxattrs(inode, new_xattrs, fs_data);
out:
493
	for (xattr = new_xattrs; xattr->value != NULL; xattr++)
494
		kfree(xattr->value);
495 496 497 498 499
	return (ret == -EOPNOTSUPP) ? 0 : ret;
}
EXPORT_SYMBOL(security_inode_init_security);

int security_old_inode_init_security(struct inode *inode, struct inode *dir,
500
				     const struct qstr *qstr, const char **name,
501
				     void **value, size_t *len)
502 503
{
	if (unlikely(IS_PRIVATE(inode)))
504
		return -EOPNOTSUPP;
505 506
	return call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir,
			     qstr, name, value, len);
507
}
508
EXPORT_SYMBOL(security_old_inode_init_security);
509

510
#ifdef CONFIG_SECURITY_PATH
511
int security_path_mknod(const struct path *dir, struct dentry *dentry, umode_t mode,
512 513
			unsigned int dev)
{
514
	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
515
		return 0;
516
	return call_int_hook(path_mknod, 0, dir, dentry, mode, dev);
517 518 519
}
EXPORT_SYMBOL(security_path_mknod);

520
int security_path_mkdir(const struct path *dir, struct dentry *dentry, umode_t mode)
521
{
522
	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
523
		return 0;
524
	return call_int_hook(path_mkdir, 0, dir, dentry, mode);
525
}
526
EXPORT_SYMBOL(security_path_mkdir);
527

A
Al Viro 已提交
528
int security_path_rmdir(const struct path *dir, struct dentry *dentry)
529
{
530
	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
531
		return 0;
532
	return call_int_hook(path_rmdir, 0, dir, dentry);
533 534
}

A
Al Viro 已提交
535
int security_path_unlink(const struct path *dir, struct dentry *dentry)
536
{
537
	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
538
		return 0;
539
	return call_int_hook(path_unlink, 0, dir, dentry);
540
}
541
EXPORT_SYMBOL(security_path_unlink);
542

543
int security_path_symlink(const struct path *dir, struct dentry *dentry,
544 545
			  const char *old_name)
{
546
	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
547
		return 0;
548
	return call_int_hook(path_symlink, 0, dir, dentry, old_name);
549 550
}

A
Al Viro 已提交
551
int security_path_link(struct dentry *old_dentry, const struct path *new_dir,
552 553
		       struct dentry *new_dentry)
{
554
	if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))
555
		return 0;
556
	return call_int_hook(path_link, 0, old_dentry, new_dir, new_dentry);
557 558
}

A
Al Viro 已提交
559 560
int security_path_rename(const struct path *old_dir, struct dentry *old_dentry,
			 const struct path *new_dir, struct dentry *new_dentry,
561
			 unsigned int flags)
562
{
563 564
	if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry)) ||
		     (d_is_positive(new_dentry) && IS_PRIVATE(d_backing_inode(new_dentry)))))
565
		return 0;
M
Miklos Szeredi 已提交
566 567

	if (flags & RENAME_EXCHANGE) {
568 569
		int err = call_int_hook(path_rename, 0, new_dir, new_dentry,
					old_dir, old_dentry);
M
Miklos Szeredi 已提交
570 571 572 573
		if (err)
			return err;
	}

574 575
	return call_int_hook(path_rename, 0, old_dir, old_dentry, new_dir,
				new_dentry);
576
}
577
EXPORT_SYMBOL(security_path_rename);
578

A
Al Viro 已提交
579
int security_path_truncate(const struct path *path)
580
{
581
	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
582
		return 0;
583
	return call_int_hook(path_truncate, 0, path);
584
}
585

586
int security_path_chmod(const struct path *path, umode_t mode)
587
{
588
	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
589
		return 0;
590
	return call_int_hook(path_chmod, 0, path, mode);
591 592
}

593
int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
594
{
595
	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
596
		return 0;
597
	return call_int_hook(path_chown, 0, path, uid, gid);
598
}
T
Tetsuo Handa 已提交
599

A
Al Viro 已提交
600
int security_path_chroot(const struct path *path)
T
Tetsuo Handa 已提交
601
{
602
	return call_int_hook(path_chroot, 0, path);
T
Tetsuo Handa 已提交
603
}
604 605
#endif

A
Al Viro 已提交
606
int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
607 608 609
{
	if (unlikely(IS_PRIVATE(dir)))
		return 0;
610
	return call_int_hook(inode_create, 0, dir, dentry, mode);
611
}
612
EXPORT_SYMBOL_GPL(security_inode_create);
613 614 615 616

int security_inode_link(struct dentry *old_dentry, struct inode *dir,
			 struct dentry *new_dentry)
{
617
	if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))
618
		return 0;
619
	return call_int_hook(inode_link, 0, old_dentry, dir, new_dentry);
620 621 622 623
}

int security_inode_unlink(struct inode *dir, struct dentry *dentry)
{
624
	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
625
		return 0;
626
	return call_int_hook(inode_unlink, 0, dir, dentry);
627 628 629 630 631 632 633
}

int security_inode_symlink(struct inode *dir, struct dentry *dentry,
			    const char *old_name)
{
	if (unlikely(IS_PRIVATE(dir)))
		return 0;
634
	return call_int_hook(inode_symlink, 0, dir, dentry, old_name);
635 636
}

637
int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
638 639 640
{
	if (unlikely(IS_PRIVATE(dir)))
		return 0;
641
	return call_int_hook(inode_mkdir, 0, dir, dentry, mode);
642
}
643
EXPORT_SYMBOL_GPL(security_inode_mkdir);
644 645 646

int security_inode_rmdir(struct inode *dir, struct dentry *dentry)
{
647
	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
648
		return 0;
649
	return call_int_hook(inode_rmdir, 0, dir, dentry);
650 651
}

A
Al Viro 已提交
652
int security_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
653 654 655
{
	if (unlikely(IS_PRIVATE(dir)))
		return 0;
656
	return call_int_hook(inode_mknod, 0, dir, dentry, mode, dev);
657 658 659
}

int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
660 661
			   struct inode *new_dir, struct dentry *new_dentry,
			   unsigned int flags)
662
{
663 664
        if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry)) ||
            (d_is_positive(new_dentry) && IS_PRIVATE(d_backing_inode(new_dentry)))))
665
		return 0;
M
Miklos Szeredi 已提交
666 667

	if (flags & RENAME_EXCHANGE) {
668
		int err = call_int_hook(inode_rename, 0, new_dir, new_dentry,
M
Miklos Szeredi 已提交
669 670 671 672 673
						     old_dir, old_dentry);
		if (err)
			return err;
	}

674
	return call_int_hook(inode_rename, 0, old_dir, old_dentry,
675 676 677 678 679
					   new_dir, new_dentry);
}

int security_inode_readlink(struct dentry *dentry)
{
680
	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
681
		return 0;
682
	return call_int_hook(inode_readlink, 0, dentry);
683 684
}

685 686
int security_inode_follow_link(struct dentry *dentry, struct inode *inode,
			       bool rcu)
687
{
688
	if (unlikely(IS_PRIVATE(inode)))
689
		return 0;
690
	return call_int_hook(inode_follow_link, 0, dentry, inode, rcu);
691 692
}

693
int security_inode_permission(struct inode *inode, int mask)
694 695 696
{
	if (unlikely(IS_PRIVATE(inode)))
		return 0;
697
	return call_int_hook(inode_permission, 0, inode, mask);
698 699 700 701
}

int security_inode_setattr(struct dentry *dentry, struct iattr *attr)
{
702 703
	int ret;

704
	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
705
		return 0;
706
	ret = call_int_hook(inode_setattr, 0, dentry, attr);
707 708 709
	if (ret)
		return ret;
	return evm_inode_setattr(dentry, attr);
710
}
711
EXPORT_SYMBOL_GPL(security_inode_setattr);
712

713
int security_inode_getattr(const struct path *path)
714
{
715
	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
716
		return 0;
717
	return call_int_hook(inode_getattr, 0, path);
718 719
}

720 721
int security_inode_setxattr(struct dentry *dentry, const char *name,
			    const void *value, size_t size, int flags)
722
{
723 724
	int ret;

725
	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
726
		return 0;
C
Casey Schaufler 已提交
727 728 729 730 731
	/*
	 * SELinux and Smack integrate the cap call,
	 * so assume that all LSMs supplying this call do so.
	 */
	ret = call_int_hook(inode_setxattr, 1, dentry, name, value, size,
732
				flags);
C
Casey Schaufler 已提交
733 734 735

	if (ret == 1)
		ret = cap_inode_setxattr(dentry, name, value, size, flags);
736 737 738
	if (ret)
		return ret;
	ret = ima_inode_setxattr(dentry, name, value, size);
739 740 741
	if (ret)
		return ret;
	return evm_inode_setxattr(dentry, name, value, size);
742 743
}

744 745
void security_inode_post_setxattr(struct dentry *dentry, const char *name,
				  const void *value, size_t size, int flags)
746
{
747
	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
748
		return;
749
	call_void_hook(inode_post_setxattr, dentry, name, value, size, flags);
750
	evm_inode_post_setxattr(dentry, name, value, size);
751 752
}

753
int security_inode_getxattr(struct dentry *dentry, const char *name)
754
{
755
	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
756
		return 0;
757
	return call_int_hook(inode_getxattr, 0, dentry, name);
758 759 760 761
}

int security_inode_listxattr(struct dentry *dentry)
{
762
	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
763
		return 0;
764
	return call_int_hook(inode_listxattr, 0, dentry);
765 766
}

767
int security_inode_removexattr(struct dentry *dentry, const char *name)
768
{
769 770
	int ret;

771
	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
772
		return 0;
C
Casey Schaufler 已提交
773 774 775 776 777 778 779
	/*
	 * SELinux and Smack integrate the cap call,
	 * so assume that all LSMs supplying this call do so.
	 */
	ret = call_int_hook(inode_removexattr, 1, dentry, name);
	if (ret == 1)
		ret = cap_inode_removexattr(dentry, name);
780 781 782
	if (ret)
		return ret;
	ret = ima_inode_removexattr(dentry, name);
783 784 785
	if (ret)
		return ret;
	return evm_inode_removexattr(dentry, name);
786 787
}

788 789
int security_inode_need_killpriv(struct dentry *dentry)
{
790
	return call_int_hook(inode_need_killpriv, 0, dentry);
791 792 793 794
}

int security_inode_killpriv(struct dentry *dentry)
{
795
	return call_int_hook(inode_killpriv, 0, dentry);
796 797
}

798
int security_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
799
{
800 801 802
	struct security_hook_list *hp;
	int rc;

803
	if (unlikely(IS_PRIVATE(inode)))
804
		return -EOPNOTSUPP;
805 806 807 808 809 810 811 812 813
	/*
	 * Only one module will provide an attribute with a given name.
	 */
	list_for_each_entry(hp, &security_hook_heads.inode_getsecurity, list) {
		rc = hp->hook.inode_getsecurity(inode, name, buffer, alloc);
		if (rc != -EOPNOTSUPP)
			return rc;
	}
	return -EOPNOTSUPP;
814 815 816 817
}

int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
{
818 819 820
	struct security_hook_list *hp;
	int rc;

821
	if (unlikely(IS_PRIVATE(inode)))
822
		return -EOPNOTSUPP;
823 824 825 826 827 828 829 830 831 832
	/*
	 * Only one module will provide an attribute with a given name.
	 */
	list_for_each_entry(hp, &security_hook_heads.inode_setsecurity, list) {
		rc = hp->hook.inode_setsecurity(inode, name, value, size,
								flags);
		if (rc != -EOPNOTSUPP)
			return rc;
	}
	return -EOPNOTSUPP;
833 834 835 836 837 838
}

int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
{
	if (unlikely(IS_PRIVATE(inode)))
		return 0;
839
	return call_int_hook(inode_listsecurity, 0, inode, buffer, buffer_size);
840
}
841
EXPORT_SYMBOL(security_inode_listsecurity);
842

843
void security_inode_getsecid(struct inode *inode, u32 *secid)
844
{
845
	call_void_hook(inode_getsecid, inode, secid);
846 847
}

848 849 850 851 852 853
int security_inode_copy_up(struct dentry *src, struct cred **new)
{
	return call_int_hook(inode_copy_up, 0, src, new);
}
EXPORT_SYMBOL(security_inode_copy_up);

854 855 856 857 858 859
int security_inode_copy_up_xattr(const char *name)
{
	return call_int_hook(inode_copy_up_xattr, -EOPNOTSUPP, name);
}
EXPORT_SYMBOL(security_inode_copy_up_xattr);

860 861
int security_file_permission(struct file *file, int mask)
{
862 863
	int ret;

864
	ret = call_int_hook(file_permission, 0, file, mask);
865 866 867 868
	if (ret)
		return ret;

	return fsnotify_perm(file, mask);
869 870 871 872
}

int security_file_alloc(struct file *file)
{
873
	return call_int_hook(file_alloc_security, 0, file);
874 875 876 877
}

void security_file_free(struct file *file)
{
878
	call_void_hook(file_free_security, file);
879 880 881 882
}

int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
{
883
	return call_int_hook(file_ioctl, 0, file, cmd, arg);
884 885
}

886
static inline unsigned long mmap_prot(struct file *file, unsigned long prot)
887
{
888
	/*
889 890
	 * Does we have PROT_READ and does the application expect
	 * it to imply PROT_EXEC?  If not, nothing to talk about...
891
	 */
892 893
	if ((prot & (PROT_READ | PROT_EXEC)) != PROT_READ)
		return prot;
894
	if (!(current->personality & READ_IMPLIES_EXEC))
895 896 897 898 899 900 901 902
		return prot;
	/*
	 * if that's an anonymous mapping, let it.
	 */
	if (!file)
		return prot | PROT_EXEC;
	/*
	 * ditto if it's not on noexec mount, except that on !MMU we need
903
	 * NOMMU_MAP_EXEC (== VM_MAYEXEC) in this case
904
	 */
905
	if (!path_noexec(&file->f_path)) {
906
#ifndef CONFIG_MMU
907 908 909 910 911
		if (file->f_op->mmap_capabilities) {
			unsigned caps = file->f_op->mmap_capabilities(file);
			if (!(caps & NOMMU_MAP_EXEC))
				return prot;
		}
912
#endif
913
		return prot | PROT_EXEC;
914
	}
915 916 917 918 919 920 921 922
	/* anything on noexec mount won't get PROT_EXEC */
	return prot;
}

int security_mmap_file(struct file *file, unsigned long prot,
			unsigned long flags)
{
	int ret;
923
	ret = call_int_hook(mmap_file, 0, file, prot,
924
					mmap_prot(file, prot), flags);
925 926 927
	if (ret)
		return ret;
	return ima_file_mmap(file, prot);
928 929
}

930 931
int security_mmap_addr(unsigned long addr)
{
932
	return call_int_hook(mmap_addr, 0, addr);
933 934
}

935 936 937
int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
			    unsigned long prot)
{
938
	return call_int_hook(file_mprotect, 0, vma, reqprot, prot);
939 940 941 942
}

int security_file_lock(struct file *file, unsigned int cmd)
{
943
	return call_int_hook(file_lock, 0, file, cmd);
944 945 946 947
}

int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
{
948
	return call_int_hook(file_fcntl, 0, file, cmd, arg);
949 950
}

951
void security_file_set_fowner(struct file *file)
952
{
953
	call_void_hook(file_set_fowner, file);
954 955 956 957 958
}

int security_file_send_sigiotask(struct task_struct *tsk,
				  struct fown_struct *fown, int sig)
{
959
	return call_int_hook(file_send_sigiotask, 0, tsk, fown, sig);
960 961 962 963
}

int security_file_receive(struct file *file)
{
964
	return call_int_hook(file_receive, 0, file);
965 966
}

967
int security_file_open(struct file *file, const struct cred *cred)
968
{
969 970
	int ret;

971
	ret = call_int_hook(file_open, 0, file, cred);
972 973 974 975
	if (ret)
		return ret;

	return fsnotify_perm(file, MAY_OPEN);
976 977
}

978 979 980 981 982
int security_task_alloc(struct task_struct *task, unsigned long clone_flags)
{
	return call_int_hook(task_alloc, 0, task, clone_flags);
}

983 984
void security_task_free(struct task_struct *task)
{
985
	call_void_hook(task_free, task);
986 987
}

988 989
int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)
{
990
	return call_int_hook(cred_alloc_blank, 0, cred, gfp);
991 992
}

D
David Howells 已提交
993
void security_cred_free(struct cred *cred)
994
{
995
	call_void_hook(cred_free, cred);
996 997
}

D
David Howells 已提交
998
int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp)
999
{
1000
	return call_int_hook(cred_prepare, 0, new, old, gfp);
D
David Howells 已提交
1001 1002
}

1003 1004
void security_transfer_creds(struct cred *new, const struct cred *old)
{
1005
	call_void_hook(cred_transfer, new, old);
1006 1007
}

1008 1009
int security_kernel_act_as(struct cred *new, u32 secid)
{
1010
	return call_int_hook(kernel_act_as, 0, new, secid);
1011 1012 1013 1014
}

int security_kernel_create_files_as(struct cred *new, struct inode *inode)
{
1015
	return call_int_hook(kernel_create_files_as, 0, new, inode);
1016 1017
}

1018
int security_kernel_module_request(char *kmod_name)
1019
{
1020
	return call_int_hook(kernel_module_request, 0, kmod_name);
1021 1022
}

1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033
int security_kernel_read_file(struct file *file, enum kernel_read_file_id id)
{
	int ret;

	ret = call_int_hook(kernel_read_file, 0, file, id);
	if (ret)
		return ret;
	return ima_read_file(file, id);
}
EXPORT_SYMBOL_GPL(security_kernel_read_file);

1034 1035
int security_kernel_post_read_file(struct file *file, char *buf, loff_t size,
				   enum kernel_read_file_id id)
1036
{
1037 1038 1039 1040 1041 1042
	int ret;

	ret = call_int_hook(kernel_post_read_file, 0, file, buf, size, id);
	if (ret)
		return ret;
	return ima_post_read_file(file, buf, size, id);
1043 1044 1045
}
EXPORT_SYMBOL_GPL(security_kernel_post_read_file);

D
David Howells 已提交
1046 1047
int security_task_fix_setuid(struct cred *new, const struct cred *old,
			     int flags)
1048
{
1049
	return call_int_hook(task_fix_setuid, 0, new, old, flags);
1050 1051 1052 1053
}

int security_task_setpgid(struct task_struct *p, pid_t pgid)
{
1054
	return call_int_hook(task_setpgid, 0, p, pgid);
1055 1056 1057 1058
}

int security_task_getpgid(struct task_struct *p)
{
1059
	return call_int_hook(task_getpgid, 0, p);
1060 1061 1062 1063
}

int security_task_getsid(struct task_struct *p)
{
1064
	return call_int_hook(task_getsid, 0, p);
1065 1066 1067 1068
}

void security_task_getsecid(struct task_struct *p, u32 *secid)
{
C
Casey Schaufler 已提交
1069
	*secid = 0;
1070
	call_void_hook(task_getsecid, p, secid);
1071 1072 1073 1074 1075
}
EXPORT_SYMBOL(security_task_getsecid);

int security_task_setnice(struct task_struct *p, int nice)
{
1076
	return call_int_hook(task_setnice, 0, p, nice);
1077 1078 1079 1080
}

int security_task_setioprio(struct task_struct *p, int ioprio)
{
1081
	return call_int_hook(task_setioprio, 0, p, ioprio);
1082 1083 1084 1085
}

int security_task_getioprio(struct task_struct *p)
{
1086
	return call_int_hook(task_getioprio, 0, p);
1087 1088
}

1089 1090 1091 1092 1093 1094
int security_task_prlimit(const struct cred *cred, const struct cred *tcred,
			  unsigned int flags)
{
	return call_int_hook(task_prlimit, 0, cred, tcred, flags);
}

1095 1096
int security_task_setrlimit(struct task_struct *p, unsigned int resource,
		struct rlimit *new_rlim)
1097
{
1098
	return call_int_hook(task_setrlimit, 0, p, resource, new_rlim);
1099 1100
}

1101
int security_task_setscheduler(struct task_struct *p)
1102
{
1103
	return call_int_hook(task_setscheduler, 0, p);
1104 1105 1106 1107
}

int security_task_getscheduler(struct task_struct *p)
{
1108
	return call_int_hook(task_getscheduler, 0, p);
1109 1110 1111 1112
}

int security_task_movememory(struct task_struct *p)
{
1113
	return call_int_hook(task_movememory, 0, p);
1114 1115 1116 1117 1118
}

int security_task_kill(struct task_struct *p, struct siginfo *info,
			int sig, u32 secid)
{
1119
	return call_int_hook(task_kill, 0, p, info, sig, secid);
1120 1121 1122
}

int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
D
David Howells 已提交
1123
			 unsigned long arg4, unsigned long arg5)
1124
{
C
Casey Schaufler 已提交
1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137
	int thisrc;
	int rc = -ENOSYS;
	struct security_hook_list *hp;

	list_for_each_entry(hp, &security_hook_heads.task_prctl, list) {
		thisrc = hp->hook.task_prctl(option, arg2, arg3, arg4, arg5);
		if (thisrc != -ENOSYS) {
			rc = thisrc;
			if (thisrc != 0)
				break;
		}
	}
	return rc;
1138 1139 1140 1141
}

void security_task_to_inode(struct task_struct *p, struct inode *inode)
{
1142
	call_void_hook(task_to_inode, p, inode);
1143 1144 1145 1146
}

int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
{
1147
	return call_int_hook(ipc_permission, 0, ipcp, flag);
1148 1149
}

1150 1151
void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
{
C
Casey Schaufler 已提交
1152
	*secid = 0;
1153
	call_void_hook(ipc_getsecid, ipcp, secid);
1154 1155
}

1156 1157
int security_msg_msg_alloc(struct msg_msg *msg)
{
1158
	return call_int_hook(msg_msg_alloc_security, 0, msg);
1159 1160 1161 1162
}

void security_msg_msg_free(struct msg_msg *msg)
{
1163
	call_void_hook(msg_msg_free_security, msg);
1164 1165 1166 1167
}

int security_msg_queue_alloc(struct msg_queue *msq)
{
1168
	return call_int_hook(msg_queue_alloc_security, 0, msq);
1169 1170 1171 1172
}

void security_msg_queue_free(struct msg_queue *msq)
{
1173
	call_void_hook(msg_queue_free_security, msq);
1174 1175 1176 1177
}

int security_msg_queue_associate(struct msg_queue *msq, int msqflg)
{
1178
	return call_int_hook(msg_queue_associate, 0, msq, msqflg);
1179 1180 1181 1182
}

int security_msg_queue_msgctl(struct msg_queue *msq, int cmd)
{
1183
	return call_int_hook(msg_queue_msgctl, 0, msq, cmd);
1184 1185 1186 1187 1188
}

int security_msg_queue_msgsnd(struct msg_queue *msq,
			       struct msg_msg *msg, int msqflg)
{
1189
	return call_int_hook(msg_queue_msgsnd, 0, msq, msg, msqflg);
1190 1191 1192 1193 1194
}

int security_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
			       struct task_struct *target, long type, int mode)
{
1195
	return call_int_hook(msg_queue_msgrcv, 0, msq, msg, target, type, mode);
1196 1197 1198 1199
}

int security_shm_alloc(struct shmid_kernel *shp)
{
1200
	return call_int_hook(shm_alloc_security, 0, shp);
1201 1202 1203 1204
}

void security_shm_free(struct shmid_kernel *shp)
{
1205
	call_void_hook(shm_free_security, shp);
1206 1207 1208 1209
}

int security_shm_associate(struct shmid_kernel *shp, int shmflg)
{
1210
	return call_int_hook(shm_associate, 0, shp, shmflg);
1211 1212 1213 1214
}

int security_shm_shmctl(struct shmid_kernel *shp, int cmd)
{
1215
	return call_int_hook(shm_shmctl, 0, shp, cmd);
1216 1217 1218 1219
}

int security_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr, int shmflg)
{
1220
	return call_int_hook(shm_shmat, 0, shp, shmaddr, shmflg);
1221 1222 1223 1224
}

int security_sem_alloc(struct sem_array *sma)
{
1225
	return call_int_hook(sem_alloc_security, 0, sma);
1226 1227 1228 1229
}

void security_sem_free(struct sem_array *sma)
{
1230
	call_void_hook(sem_free_security, sma);
1231 1232 1233 1234
}

int security_sem_associate(struct sem_array *sma, int semflg)
{
1235
	return call_int_hook(sem_associate, 0, sma, semflg);
1236 1237 1238 1239
}

int security_sem_semctl(struct sem_array *sma, int cmd)
{
1240
	return call_int_hook(sem_semctl, 0, sma, cmd);
1241 1242 1243 1244 1245
}

int security_sem_semop(struct sem_array *sma, struct sembuf *sops,
			unsigned nsops, int alter)
{
1246
	return call_int_hook(sem_semop, 0, sma, sops, nsops, alter);
1247 1248 1249 1250 1251 1252
}

void security_d_instantiate(struct dentry *dentry, struct inode *inode)
{
	if (unlikely(inode && IS_PRIVATE(inode)))
		return;
1253
	call_void_hook(d_instantiate, dentry, inode);
1254 1255 1256 1257 1258
}
EXPORT_SYMBOL(security_d_instantiate);

int security_getprocattr(struct task_struct *p, char *name, char **value)
{
C
Casey Schaufler 已提交
1259
	return call_int_hook(getprocattr, -EINVAL, p, name, value);
1260 1261
}

1262
int security_setprocattr(const char *name, void *value, size_t size)
1263
{
1264
	return call_int_hook(setprocattr, -EINVAL, name, value, size);
1265 1266 1267 1268
}

int security_netlink_send(struct sock *sk, struct sk_buff *skb)
{
1269
	return call_int_hook(netlink_send, 0, sk, skb);
1270 1271
}

1272 1273
int security_ismaclabel(const char *name)
{
1274
	return call_int_hook(ismaclabel, 0, name);
1275 1276 1277
}
EXPORT_SYMBOL(security_ismaclabel);

1278 1279
int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
{
C
Casey Schaufler 已提交
1280 1281
	return call_int_hook(secid_to_secctx, -EOPNOTSUPP, secid, secdata,
				seclen);
1282 1283 1284
}
EXPORT_SYMBOL(security_secid_to_secctx);

1285
int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
1286
{
C
Casey Schaufler 已提交
1287
	*secid = 0;
1288
	return call_int_hook(secctx_to_secid, 0, secdata, seclen, secid);
1289 1290 1291
}
EXPORT_SYMBOL(security_secctx_to_secid);

1292 1293
void security_release_secctx(char *secdata, u32 seclen)
{
1294
	call_void_hook(release_secctx, secdata, seclen);
1295 1296 1297
}
EXPORT_SYMBOL(security_release_secctx);

1298 1299 1300 1301 1302 1303
void security_inode_invalidate_secctx(struct inode *inode)
{
	call_void_hook(inode_invalidate_secctx, inode);
}
EXPORT_SYMBOL(security_inode_invalidate_secctx);

1304 1305
int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
{
1306
	return call_int_hook(inode_notifysecctx, 0, inode, ctx, ctxlen);
1307 1308 1309 1310 1311
}
EXPORT_SYMBOL(security_inode_notifysecctx);

int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
{
1312
	return call_int_hook(inode_setsecctx, 0, dentry, ctx, ctxlen);
1313 1314 1315 1316 1317
}
EXPORT_SYMBOL(security_inode_setsecctx);

int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
{
C
Casey Schaufler 已提交
1318
	return call_int_hook(inode_getsecctx, -EOPNOTSUPP, inode, ctx, ctxlen);
1319 1320 1321
}
EXPORT_SYMBOL(security_inode_getsecctx);

1322 1323
#ifdef CONFIG_SECURITY_NETWORK

1324
int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk)
1325
{
1326
	return call_int_hook(unix_stream_connect, 0, sock, other, newsk);
1327 1328 1329 1330 1331
}
EXPORT_SYMBOL(security_unix_stream_connect);

int security_unix_may_send(struct socket *sock,  struct socket *other)
{
1332
	return call_int_hook(unix_may_send, 0, sock, other);
1333 1334 1335 1336 1337
}
EXPORT_SYMBOL(security_unix_may_send);

int security_socket_create(int family, int type, int protocol, int kern)
{
1338
	return call_int_hook(socket_create, 0, family, type, protocol, kern);
1339 1340 1341 1342 1343
}

int security_socket_post_create(struct socket *sock, int family,
				int type, int protocol, int kern)
{
1344
	return call_int_hook(socket_post_create, 0, sock, family, type,
1345 1346 1347 1348 1349
						protocol, kern);
}

int security_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
{
1350
	return call_int_hook(socket_bind, 0, sock, address, addrlen);
1351 1352 1353 1354
}

int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
{
1355
	return call_int_hook(socket_connect, 0, sock, address, addrlen);
1356 1357 1358 1359
}

int security_socket_listen(struct socket *sock, int backlog)
{
1360
	return call_int_hook(socket_listen, 0, sock, backlog);
1361 1362 1363 1364
}

int security_socket_accept(struct socket *sock, struct socket *newsock)
{
1365
	return call_int_hook(socket_accept, 0, sock, newsock);
1366 1367 1368 1369
}

int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size)
{
1370
	return call_int_hook(socket_sendmsg, 0, sock, msg, size);
1371 1372 1373 1374 1375
}

int security_socket_recvmsg(struct socket *sock, struct msghdr *msg,
			    int size, int flags)
{
1376
	return call_int_hook(socket_recvmsg, 0, sock, msg, size, flags);
1377 1378 1379 1380
}

int security_socket_getsockname(struct socket *sock)
{
1381
	return call_int_hook(socket_getsockname, 0, sock);
1382 1383 1384 1385
}

int security_socket_getpeername(struct socket *sock)
{
1386
	return call_int_hook(socket_getpeername, 0, sock);
1387 1388 1389 1390
}

int security_socket_getsockopt(struct socket *sock, int level, int optname)
{
1391
	return call_int_hook(socket_getsockopt, 0, sock, level, optname);
1392 1393 1394 1395
}

int security_socket_setsockopt(struct socket *sock, int level, int optname)
{
1396
	return call_int_hook(socket_setsockopt, 0, sock, level, optname);
1397 1398 1399 1400
}

int security_socket_shutdown(struct socket *sock, int how)
{
1401
	return call_int_hook(socket_shutdown, 0, sock, how);
1402 1403 1404 1405
}

int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
{
1406
	return call_int_hook(socket_sock_rcv_skb, 0, sk, skb);
1407 1408 1409 1410 1411 1412
}
EXPORT_SYMBOL(security_sock_rcv_skb);

int security_socket_getpeersec_stream(struct socket *sock, char __user *optval,
				      int __user *optlen, unsigned len)
{
C
Casey Schaufler 已提交
1413 1414
	return call_int_hook(socket_getpeersec_stream, -ENOPROTOOPT, sock,
				optval, optlen, len);
1415 1416 1417 1418
}

int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
{
1419 1420
	return call_int_hook(socket_getpeersec_dgram, -ENOPROTOOPT, sock,
			     skb, secid);
1421 1422 1423 1424 1425
}
EXPORT_SYMBOL(security_socket_getpeersec_dgram);

int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
{
1426
	return call_int_hook(sk_alloc_security, 0, sk, family, priority);
1427 1428 1429 1430
}

void security_sk_free(struct sock *sk)
{
1431
	call_void_hook(sk_free_security, sk);
1432 1433 1434 1435
}

void security_sk_clone(const struct sock *sk, struct sock *newsk)
{
1436
	call_void_hook(sk_clone_security, sk, newsk);
1437
}
1438
EXPORT_SYMBOL(security_sk_clone);
1439 1440 1441

void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
{
1442
	call_void_hook(sk_getsecid, sk, &fl->flowi_secid);
1443 1444 1445 1446 1447
}
EXPORT_SYMBOL(security_sk_classify_flow);

void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
{
1448
	call_void_hook(req_classify_flow, req, fl);
1449 1450 1451 1452 1453
}
EXPORT_SYMBOL(security_req_classify_flow);

void security_sock_graft(struct sock *sk, struct socket *parent)
{
1454
	call_void_hook(sock_graft, sk, parent);
1455 1456 1457 1458 1459 1460
}
EXPORT_SYMBOL(security_sock_graft);

int security_inet_conn_request(struct sock *sk,
			struct sk_buff *skb, struct request_sock *req)
{
1461
	return call_int_hook(inet_conn_request, 0, sk, skb, req);
1462 1463 1464 1465 1466 1467
}
EXPORT_SYMBOL(security_inet_conn_request);

void security_inet_csk_clone(struct sock *newsk,
			const struct request_sock *req)
{
1468
	call_void_hook(inet_csk_clone, newsk, req);
1469 1470 1471 1472 1473
}

void security_inet_conn_established(struct sock *sk,
			struct sk_buff *skb)
{
1474
	call_void_hook(inet_conn_established, sk, skb);
1475 1476
}

1477 1478
int security_secmark_relabel_packet(u32 secid)
{
1479
	return call_int_hook(secmark_relabel_packet, 0, secid);
1480 1481 1482 1483 1484
}
EXPORT_SYMBOL(security_secmark_relabel_packet);

void security_secmark_refcount_inc(void)
{
1485
	call_void_hook(secmark_refcount_inc);
1486 1487 1488 1489 1490
}
EXPORT_SYMBOL(security_secmark_refcount_inc);

void security_secmark_refcount_dec(void)
{
1491
	call_void_hook(secmark_refcount_dec);
1492 1493 1494
}
EXPORT_SYMBOL(security_secmark_refcount_dec);

1495 1496
int security_tun_dev_alloc_security(void **security)
{
1497
	return call_int_hook(tun_dev_alloc_security, 0, security);
1498 1499 1500 1501 1502
}
EXPORT_SYMBOL(security_tun_dev_alloc_security);

void security_tun_dev_free_security(void *security)
{
1503
	call_void_hook(tun_dev_free_security, security);
1504 1505 1506
}
EXPORT_SYMBOL(security_tun_dev_free_security);

P
Paul Moore 已提交
1507 1508
int security_tun_dev_create(void)
{
1509
	return call_int_hook(tun_dev_create, 0);
P
Paul Moore 已提交
1510 1511 1512
}
EXPORT_SYMBOL(security_tun_dev_create);

1513
int security_tun_dev_attach_queue(void *security)
P
Paul Moore 已提交
1514
{
1515
	return call_int_hook(tun_dev_attach_queue, 0, security);
P
Paul Moore 已提交
1516
}
1517
EXPORT_SYMBOL(security_tun_dev_attach_queue);
P
Paul Moore 已提交
1518

1519
int security_tun_dev_attach(struct sock *sk, void *security)
P
Paul Moore 已提交
1520
{
1521
	return call_int_hook(tun_dev_attach, 0, sk, security);
P
Paul Moore 已提交
1522 1523 1524
}
EXPORT_SYMBOL(security_tun_dev_attach);

1525 1526
int security_tun_dev_open(void *security)
{
1527
	return call_int_hook(tun_dev_open, 0, security);
1528 1529 1530
}
EXPORT_SYMBOL(security_tun_dev_open);

1531 1532
#endif	/* CONFIG_SECURITY_NETWORK */

1533 1534 1535 1536 1537 1538 1539 1540
#ifdef CONFIG_SECURITY_INFINIBAND

int security_ib_pkey_access(void *sec, u64 subnet_prefix, u16 pkey)
{
	return call_int_hook(ib_pkey_access, 0, sec, subnet_prefix, pkey);
}
EXPORT_SYMBOL(security_ib_pkey_access);

1541 1542 1543 1544 1545 1546
int security_ib_endport_manage_subnet(void *sec, const char *dev_name, u8 port_num)
{
	return call_int_hook(ib_endport_manage_subnet, 0, sec, dev_name, port_num);
}
EXPORT_SYMBOL(security_ib_endport_manage_subnet);

1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559
int security_ib_alloc_security(void **sec)
{
	return call_int_hook(ib_alloc_security, 0, sec);
}
EXPORT_SYMBOL(security_ib_alloc_security);

void security_ib_free_security(void *sec)
{
	call_void_hook(ib_free_security, sec);
}
EXPORT_SYMBOL(security_ib_free_security);
#endif	/* CONFIG_SECURITY_INFINIBAND */

1560 1561
#ifdef CONFIG_SECURITY_NETWORK_XFRM

1562 1563 1564
int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
			       struct xfrm_user_sec_ctx *sec_ctx,
			       gfp_t gfp)
1565
{
1566
	return call_int_hook(xfrm_policy_alloc_security, 0, ctxp, sec_ctx, gfp);
1567 1568 1569
}
EXPORT_SYMBOL(security_xfrm_policy_alloc);

1570 1571
int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
			      struct xfrm_sec_ctx **new_ctxp)
1572
{
1573
	return call_int_hook(xfrm_policy_clone_security, 0, old_ctx, new_ctxp);
1574 1575
}

1576
void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
1577
{
1578
	call_void_hook(xfrm_policy_free_security, ctx);
1579 1580 1581
}
EXPORT_SYMBOL(security_xfrm_policy_free);

1582
int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
1583
{
1584
	return call_int_hook(xfrm_policy_delete_security, 0, ctx);
1585 1586
}

1587 1588
int security_xfrm_state_alloc(struct xfrm_state *x,
			      struct xfrm_user_sec_ctx *sec_ctx)
1589
{
1590
	return call_int_hook(xfrm_state_alloc, 0, x, sec_ctx);
1591 1592 1593 1594 1595 1596
}
EXPORT_SYMBOL(security_xfrm_state_alloc);

int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
				      struct xfrm_sec_ctx *polsec, u32 secid)
{
1597
	return call_int_hook(xfrm_state_alloc_acquire, 0, x, polsec, secid);
1598 1599 1600 1601
}

int security_xfrm_state_delete(struct xfrm_state *x)
{
1602
	return call_int_hook(xfrm_state_delete_security, 0, x);
1603 1604 1605 1606 1607
}
EXPORT_SYMBOL(security_xfrm_state_delete);

void security_xfrm_state_free(struct xfrm_state *x)
{
1608
	call_void_hook(xfrm_state_free_security, x);
1609 1610
}

1611
int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
1612
{
1613
	return call_int_hook(xfrm_policy_lookup, 0, ctx, fl_secid, dir);
1614 1615 1616
}

int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
1617 1618
				       struct xfrm_policy *xp,
				       const struct flowi *fl)
1619
{
C
Casey Schaufler 已提交
1620 1621 1622 1623 1624 1625 1626 1627 1628 1629 1630 1631 1632 1633 1634 1635 1636 1637
	struct security_hook_list *hp;
	int rc = 1;

	/*
	 * Since this function is expected to return 0 or 1, the judgment
	 * becomes difficult if multiple LSMs supply this call. Fortunately,
	 * we can use the first LSM's judgment because currently only SELinux
	 * supplies this call.
	 *
	 * For speed optimization, we explicitly break the loop rather than
	 * using the macro
	 */
	list_for_each_entry(hp, &security_hook_heads.xfrm_state_pol_flow_match,
				list) {
		rc = hp->hook.xfrm_state_pol_flow_match(x, xp, fl);
		break;
	}
	return rc;
1638 1639 1640 1641
}

int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
{
1642
	return call_int_hook(xfrm_decode_session, 0, skb, secid, 1);
1643 1644 1645 1646
}

void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl)
{
1647 1648
	int rc = call_int_hook(xfrm_decode_session, 0, skb, &fl->flowi_secid,
				0);
1649 1650 1651 1652 1653 1654 1655 1656 1657

	BUG_ON(rc);
}
EXPORT_SYMBOL(security_skb_classify_flow);

#endif	/* CONFIG_SECURITY_NETWORK_XFRM */

#ifdef CONFIG_KEYS

D
David Howells 已提交
1658 1659
int security_key_alloc(struct key *key, const struct cred *cred,
		       unsigned long flags)
1660
{
1661
	return call_int_hook(key_alloc, 0, key, cred, flags);
1662 1663 1664 1665
}

void security_key_free(struct key *key)
{
1666
	call_void_hook(key_free, key);
1667 1668 1669
}

int security_key_permission(key_ref_t key_ref,
1670
			    const struct cred *cred, unsigned perm)
1671
{
1672
	return call_int_hook(key_permission, 0, key_ref, cred, perm);
1673 1674
}

1675 1676
int security_key_getsecurity(struct key *key, char **_buffer)
{
C
Casey Schaufler 已提交
1677
	*_buffer = NULL;
1678
	return call_int_hook(key_getsecurity, 0, key, _buffer);
1679 1680
}

1681
#endif	/* CONFIG_KEYS */
1682 1683 1684 1685 1686

#ifdef CONFIG_AUDIT

int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule)
{
1687
	return call_int_hook(audit_rule_init, 0, field, op, rulestr, lsmrule);
1688 1689 1690 1691
}

int security_audit_rule_known(struct audit_krule *krule)
{
1692
	return call_int_hook(audit_rule_known, 0, krule);
1693 1694 1695 1696
}

void security_audit_rule_free(void *lsmrule)
{
1697
	call_void_hook(audit_rule_free, lsmrule);
1698 1699 1700 1701 1702
}

int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule,
			      struct audit_context *actx)
{
1703 1704
	return call_int_hook(audit_rule_match, 0, secid, field, op, lsmrule,
				actx);
1705
}
C
Casey Schaufler 已提交
1706
#endif /* CONFIG_AUDIT */
1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737

#ifdef CONFIG_BPF_SYSCALL
int security_bpf(int cmd, union bpf_attr *attr, unsigned int size)
{
	return call_int_hook(bpf, 0, cmd, attr, size);
}
int security_bpf_map(struct bpf_map *map, fmode_t fmode)
{
	return call_int_hook(bpf_map, 0, map, fmode);
}
int security_bpf_prog(struct bpf_prog *prog)
{
	return call_int_hook(bpf_prog, 0, prog);
}
int security_bpf_map_alloc(struct bpf_map *map)
{
	return call_int_hook(bpf_map_alloc_security, 0, map);
}
int security_bpf_prog_alloc(struct bpf_prog_aux *aux)
{
	return call_int_hook(bpf_prog_alloc_security, 0, aux);
}
void security_bpf_map_free(struct bpf_map *map)
{
	call_void_hook(bpf_map_free_security, map);
}
void security_bpf_prog_free(struct bpf_prog_aux *aux)
{
	call_void_hook(bpf_prog_free_security, aux);
}
#endif /* CONFIG_BPF_SYSCALL */