IB/core: Enforce PKey security on QPs

[mirror_ubuntu-bionic-kernel.git] / include / linux / lsm_hooks.h

diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index 080f34e66017a8299d10bc4276b1acfe8a1f94cc..6d9f41fffda72f05635484b1f5ec84d23f3c4c5f 100644 (file)
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -8,6 +8,7 @@
  * Copyright (C) 2001 Silicon Graphics, Inc. (Trust Technology Group)
  * Copyright (C) 2015 Intel Corporation.
  * Copyright (C) 2015 Casey Schaufler <casey@schaufler-ca.com>
+ * Copyright (C) 2016 Mellanox Techonologies
  *
  *     This program is free software; you can redistribute it and/or modify
  *     it under the terms of the GNU General Public License as published by
@@ -911,6 +912,21 @@
  *     associated with the TUN device's security structure.
  *     @security pointer to the TUN devices's security structure.
  *
+ * Security hooks for Infiniband
+ *
+ * @ib_pkey_access:
+ *     Check permission to access a pkey when modifing a QP.
+ *     @subnet_prefix the subnet prefix of the port being used.
+ *     @pkey the pkey to be accessed.
+ *     @sec pointer to a security structure.
+ * @ib_alloc_security:
+ *     Allocate a security structure for Infiniband objects.
+ *     @sec pointer to a security structure pointer.
+ *     Returns 0 on success, non-zero on failure
+ * @ib_free_security:
+ *     Deallocate an Infiniband security structure.
+ *     @sec contains the security structure to be freed.
+ *
  * Security hooks for XFRM operations.
  *
  * @xfrm_policy_alloc_security:
@@ -1620,6 +1636,12 @@ union security_list_options {
        int (*tun_dev_open)(void *security);
 #endif /* CONFIG_SECURITY_NETWORK */
 
+#ifdef CONFIG_SECURITY_INFINIBAND
+       int (*ib_pkey_access)(void *sec, u64 subnet_prefix, u16 pkey);
+       int (*ib_alloc_security)(void **sec);
+       void (*ib_free_security)(void *sec);
+#endif /* CONFIG_SECURITY_INFINIBAND */
+
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
        int (*xfrm_policy_alloc_security)(struct xfrm_sec_ctx **ctxp,
                                          struct xfrm_user_sec_ctx *sec_ctx,
@@ -1851,6 +1873,11 @@ struct security_hook_heads {
        struct list_head tun_dev_attach;
        struct list_head tun_dev_open;
 #endif /* CONFIG_SECURITY_NETWORK */
+#ifdef CONFIG_SECURITY_INFINIBAND
+       struct list_head ib_pkey_access;
+       struct list_head ib_alloc_security;
+       struct list_head ib_free_security;
+#endif /* CONFIG_SECURITY_INFINIBAND */
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
        struct list_head xfrm_policy_alloc_security;
        struct list_head xfrm_policy_clone_security;