]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - security/security.c
LSM: generalize flag passing to security_capable
[mirror_ubuntu-bionic-kernel.git] / security / security.c
CommitLineData
1da177e4
LT
1/*
2 * Security plug functions
3 *
4 * Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com>
5 * Copyright (C) 2001-2002 Greg Kroah-Hartman <greg@kroah.com>
6 * Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com>
d291f1a6 7 * Copyright (C) 2016 Mellanox Technologies
1da177e4
LT
8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
13 */
14
afdb09c7 15#include <linux/bpf.h>
c59ede7b 16#include <linux/capability.h>
d47be3df 17#include <linux/dcache.h>
1da177e4
LT
18#include <linux/module.h>
19#include <linux/init.h>
20#include <linux/kernel.h>
3c4ed7bd 21#include <linux/lsm_hooks.h>
f381c272 22#include <linux/integrity.h>
6c21a7fb 23#include <linux/ima.h>
3e1be52d 24#include <linux/evm.h>
40401530 25#include <linux/fsnotify.h>
8b3ec681
AV
26#include <linux/mman.h>
27#include <linux/mount.h>
28#include <linux/personality.h>
75331a59 29#include <linux/backing-dev.h>
3bb857e4 30#include <linux/string.h>
7a90fc39 31#include <linux/msg.h>
a69a0684 32#include <linux/prctl.h>
40401530 33#include <net/flow.h>
7a90fc39 34#include <net/sock.h>
1da177e4 35
823eb1cc 36#define MAX_LSM_EVM_XATTR 2
1da177e4 37
b1d9e6b0
CS
38/* Maximum number of letters for an LSM name string */
39#define SECURITY_NAME_MAX 10
f9047a0c 40#define SECURITY_CHOSEN_NAMES_MAX (SECURITY_NAME_MAX * LSM_MAX_MAJOR)
54f4b36b 41#define MODULE_STACK "(stacking)"
b1d9e6b0 42
3dfc9b02 43struct security_hook_heads security_hook_heads __lsm_ro_after_init;
8f408ab6
DJ
44static ATOMIC_NOTIFIER_HEAD(lsm_notifier_chain);
45
ab9b110b 46static struct kmem_cache *lsm_file_cache;
7a90fc39 47static struct kmem_cache *lsm_inode_cache;
ab9b110b 48
d69dece5 49char *lsm_names;
a69a0684
JJ
50
51/*
52 * If stacking is enabled the task blob will always
53 * include an indicator of what security module data
54 * should be displayed. This is set with PR_SET_DISPLAY_LSM.
55 */
56static struct lsm_blob_sizes blob_sizes = {
57#ifdef CONFIG_SECURITY_STACKING
469fbb39 58 .lbs_task = SECURITY_NAME_MAX + 6,
a69a0684
JJ
59#endif
60};
f1efc8c4 61
076c54c5 62/* Boot-time LSM user choice */
f9047a0c 63static __initdata char chosen_lsms[SECURITY_CHOSEN_NAMES_MAX + 1] =
54f4b36b
CS
64#ifdef CONFIG_SECURITY_STACKING
65 MODULE_STACK;
66#else
6e65f92f 67 CONFIG_DEFAULT_SECURITY;
54f4b36b 68#endif
adf8a6ee
JJ
69static __initdata char chosen_display_lsm[SECURITY_NAME_MAX + 1]
70#ifdef CONFIG_SECURITY_STACKING
71 = CONFIG_SECURITY_DEFAULT_DISPLAY_NAME
72#endif
73;
6a3b4b47 74static char default_display_lsm[SECURITY_NAME_MAX + 1];
1da177e4 75
1da177e4
LT
76static void __init do_security_initcalls(void)
77{
78 initcall_t *call;
79 call = __security_initcall_start;
80 while (call < __security_initcall_end) {
81 (*call) ();
82 call++;
83 }
84}
85
86/**
87 * security_init - initializes the security framework
88 *
89 * This should be called early in the kernel initialization sequence.
90 */
91int __init security_init(void)
92{
3dfc9b02
TH
93 int i;
94 struct list_head *list = (struct list_head *) &security_hook_heads;
95
96 for (i = 0; i < sizeof(security_hook_heads) / sizeof(struct list_head);
97 i++)
98 INIT_LIST_HEAD(&list[i]);
b1d9e6b0 99 pr_info("Security Framework initialized\n");
1da177e4 100
b1d9e6b0 101 /*
730daa16 102 * Load minor LSMs, with the capability module always first.
b1d9e6b0
CS
103 */
104 capability_add_hooks();
b1d9e6b0 105 yama_add_hooks();
9b091556 106 loadpin_add_hooks();
730daa16 107
b1d9e6b0 108 /*
f1efc8c4
CS
109 * The first call to a module specific init function
110 * updates the blob size requirements.
111 */
112 do_security_initcalls();
113
ab9b110b
CS
114 /*
115 * Create any kmem_caches needed for blobs
116 */
117 if (blob_sizes.lbs_file)
118 lsm_file_cache = kmem_cache_create("lsm_file_cache",
119 blob_sizes.lbs_file, 0,
120 SLAB_PANIC, NULL);
7a90fc39
CS
121 if (blob_sizes.lbs_inode)
122 lsm_inode_cache = kmem_cache_create("lsm_inode_cache",
123 blob_sizes.lbs_inode, 0,
124 SLAB_PANIC, NULL);
f1efc8c4
CS
125 /*
126 * The second call to a module specific init function
127 * adds hooks to the hook lists and does any other early
128 * initializations required.
b1d9e6b0 129 */
1da177e4
LT
130 do_security_initcalls();
131
f1efc8c4
CS
132#ifdef CONFIG_SECURITY_LSM_DEBUG
133 pr_info("LSM: cred blob size = %d\n", blob_sizes.lbs_cred);
ab9b110b 134 pr_info("LSM: file blob size = %d\n", blob_sizes.lbs_file);
7a90fc39
CS
135 pr_info("LSM: inode blob size = %d\n", blob_sizes.lbs_inode);
136 pr_info("LSM: ipc blob size = %d\n", blob_sizes.lbs_ipc);
137#ifdef CONFIG_KEYS
138 pr_info("LSM: key blob size = %d\n", blob_sizes.lbs_key);
139#endif /* CONFIG_KEYS */
140 pr_info("LSM: msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg);
141 pr_info("LSM: sock blob size = %d\n", blob_sizes.lbs_sock);
142 pr_info("LSM: superblock blob size = %d\n", blob_sizes.lbs_superblock);
7f79f508 143 pr_info("LSM: task blob size = %d\n", blob_sizes.lbs_task);
7a90fc39 144#endif /* CONFIG_SECURITY_LSM_DEBUG */
f1efc8c4 145
1da177e4
LT
146 return 0;
147}
148
076c54c5
AD
149/* Save user chosen LSM */
150static int __init choose_lsm(char *str)
151{
f9047a0c
JJ
152 strncpy(chosen_lsms, str, SECURITY_CHOSEN_NAMES_MAX);
153 pr_info("LSM: command line set '%s' security module(s).\n",
154 chosen_lsms);
076c54c5
AD
155 return 1;
156}
157__setup("security=", choose_lsm);
158
6a3b4b47
JJ
159static int __init choose_display_lsm(char *str)
160{
161 strncpy(chosen_display_lsm, str, SECURITY_NAME_MAX);
162 pr_info("LSM: command line set default display lsm %s'\n",
163 chosen_display_lsm);
164 return 1;
165}
166__setup("security.display=", choose_display_lsm);
167
3bb857e4
MS
168static bool match_last_lsm(const char *list, const char *lsm)
169{
170 const char *last;
171
172 if (WARN_ON(!list || !lsm))
173 return false;
174 last = strrchr(list, ',');
175 if (last)
176 /* Pass the comma, strcmp() will check for '\0' */
177 last++;
178 else
179 last = list;
180 return !strcmp(last, lsm);
181}
182
d69dece5
CS
183static int lsm_append(char *new, char **result)
184{
185 char *cp;
186
187 if (*result == NULL) {
188 *result = kstrdup(new, GFP_KERNEL);
cf5fe980
EB
189 if (*result == NULL)
190 return -ENOMEM;
d69dece5 191 } else {
3bb857e4
MS
192 /* Check if it is the last registered name */
193 if (match_last_lsm(*result, new))
194 return 0;
d69dece5
CS
195 cp = kasprintf(GFP_KERNEL, "%s,%s", *result, new);
196 if (cp == NULL)
197 return -ENOMEM;
198 kfree(*result);
199 *result = cp;
200 }
201 return 0;
202}
203
076c54c5
AD
204/**
205 * security_module_enable - Load given security module on boot ?
b1d9e6b0 206 * @module: the name of the module
54f4b36b 207 * @stacked: indicates that the module wants to be stacked
076c54c5
AD
208 *
209 * Each LSM must pass this method before registering its own operations
210 * to avoid security registration races. This method may also be used
7cea51be 211 * to check if your LSM is currently loaded during kernel initialization.
076c54c5 212 *
0e056eb5
MCC
213 * Returns:
214 *
215 * true if:
216 *
217 * - The passed LSM is the one chosen by user at boot time,
218 * - or the passed LSM is configured as the default and the user did not
219 * choose an alternate LSM at boot time.
220 *
076c54c5
AD
221 * Otherwise, return false.
222 */
f9047a0c
JJ
223#ifdef CONFIG_SECURITY_STACKING
224static bool __init cmp_lsms(const char *lsm)
225{
226 const char *str = chosen_lsms;
227 const char *split;
228 int len = strlen(lsm);
229
230 if (len > SECURITY_NAME_MAX) {
231 pr_info("LSM: security module name '%s' exceeds limit\n", lsm);
232 return false;
233 }
234 for (split = strchr(str, ','); split; split = strchr(str, ',')) {
235 if ((len == split - str) && !strncmp(lsm, str, split - str))
236 return true;
237 str = split + 1;
238 }
239 if ((len == strlen(str)) && !strncmp(lsm, str, strlen(str)))
240 return true;
241 return false;
242}
243#endif
244
54f4b36b 245bool __init security_module_enable(const char *lsm, const bool stacked)
076c54c5 246{
54f4b36b
CS
247#ifdef CONFIG_SECURITY_STACKING
248 /*
249 * Module defined on the command line security=XXXX
250 */
6a3b4b47
JJ
251 if (strcmp(chosen_lsms, MODULE_STACK)) {
252 if (cmp_lsms(lsm)) {
253 /* set to first LSM registered and then override */
254 if (!*default_display_lsm)
255 strcpy(default_display_lsm, lsm);
256 else if (*chosen_display_lsm && !strcmp(chosen_display_lsm, lsm)) {
257 strcpy(default_display_lsm, lsm);
258 pr_info("LSM: default display lsm '%s'\n", default_display_lsm);
259 }
260 return true;
261 }
262 return false;
263 }
54f4b36b
CS
264 /*
265 * Module configured as stacked.
266 */
6a3b4b47
JJ
267 if (stacked && !*default_display_lsm)
268 strcpy(default_display_lsm, lsm);
269 else if (stacked && *chosen_display_lsm && !strcmp(chosen_display_lsm, lsm)) {
270 strcpy(default_display_lsm, lsm);
271 pr_info("LSM: default display lsm '%s'\n", default_display_lsm);
272 }
273
54f4b36b
CS
274 return stacked;
275#else
6a3b4b47
JJ
276 if (strcmp(lsm, chosen_lsms) == 0) {
277 strcpy(default_display_lsm, lsm);
54f4b36b 278 return true;
6a3b4b47 279 }
54f4b36b
CS
280 return false;
281#endif
076c54c5
AD
282}
283
d0c8f0ad
JJ
284/*
285 * Keep the order of major modules for mapping secids.
286 */
287static int lsm_next_major;
288
d69dece5
CS
289/**
290 * security_add_hooks - Add a modules hooks to the hook lists.
291 * @hooks: the hooks to add
292 * @count: the number of hooks to add
293 * @lsm: the name of the security module
294 *
295 * Each LSM has to register its hooks with the infrastructure.
296 */
297void __init security_add_hooks(struct security_hook_list *hooks, int count,
298 char *lsm)
299{
300 int i;
d0c8f0ad
JJ
301 int lsm_index = lsm_next_major++;
302
303#ifdef CONFIG_SECURITY_LSM_DEBUG
304 pr_info("LSM: Security module %s gets index %d\n", lsm, lsm_index);
305#endif
d69dece5
CS
306 for (i = 0; i < count; i++) {
307 hooks[i].lsm = lsm;
d0c8f0ad 308 hooks[i].lsm_index = lsm_index;
d69dece5
CS
309 list_add_tail_rcu(&hooks[i].list, hooks[i].head);
310 }
311 if (lsm_append(lsm, &lsm_names) < 0)
312 panic("%s - Cannot get early memory.\n", __func__);
313}
314
8f408ab6
DJ
315int call_lsm_notifier(enum lsm_event event, void *data)
316{
317 return atomic_notifier_call_chain(&lsm_notifier_chain, event, data);
318}
319EXPORT_SYMBOL(call_lsm_notifier);
320
321int register_lsm_notifier(struct notifier_block *nb)
322{
323 return atomic_notifier_chain_register(&lsm_notifier_chain, nb);
324}
325EXPORT_SYMBOL(register_lsm_notifier);
326
327int unregister_lsm_notifier(struct notifier_block *nb)
328{
329 return atomic_notifier_chain_unregister(&lsm_notifier_chain, nb);
330}
331EXPORT_SYMBOL(unregister_lsm_notifier);
332
f1efc8c4
CS
333/**
334 * lsm_cred_alloc - allocate a composite cred blob
335 * @cred: the cred that needs a blob
336 * @gfp: allocation type
337 *
338 * Allocate the cred blob for all the modules
339 *
340 * Returns 0, or -ENOMEM if memory can't be allocated.
341 */
342int lsm_cred_alloc(struct cred *cred, gfp_t gfp)
343{
344 if (blob_sizes.lbs_cred == 0) {
345 cred->security = NULL;
346 return 0;
347 }
348
349 cred->security = kzalloc(blob_sizes.lbs_cred, gfp);
350 if (cred->security == NULL)
351 return -ENOMEM;
352 return 0;
353}
354
355/**
356 * lsm_early_cred - during initialization allocate a composite cred blob
357 * @cred: the cred that needs a blob
358 *
359 * Allocate the cred blob for all the modules if it's not already there
360 */
361void lsm_early_cred(struct cred *cred)
362{
363 int rc;
364
365 if (cred == NULL)
366 panic("%s: NULL cred.\n", __func__);
367 if (cred->security != NULL)
368 return;
369 rc = lsm_cred_alloc(cred, GFP_KERNEL);
370 if (rc)
371 panic("%s: Early cred alloc failed.\n", __func__);
372}
373
374static void __init lsm_set_size(int *need, int *lbs)
375{
376 int offset;
377
378 if (*need > 0) {
379 offset = *lbs;
380 *lbs += *need;
381 *need = offset;
382 }
383}
384
385/**
386 * security_add_blobs - Report blob sizes
387 * @needed: the size of blobs needed by the module
388 *
389 * Each LSM has to register its blobs with the infrastructure.
390 * The "needed" data tells the infrastructure how much memory
391 * the module requires for each of its blobs. On return the
392 * structure is filled with the offset that module should use
393 * from the blob pointer.
394 */
395void __init security_add_blobs(struct lsm_blob_sizes *needed)
396{
397 lsm_set_size(&needed->lbs_cred, &blob_sizes.lbs_cred);
ab9b110b 398 lsm_set_size(&needed->lbs_file, &blob_sizes.lbs_file);
7a90fc39
CS
399 lsm_set_size(&needed->lbs_ipc, &blob_sizes.lbs_ipc);
400 lsm_set_size(&needed->lbs_key, &blob_sizes.lbs_key);
401 lsm_set_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg);
402 lsm_set_size(&needed->lbs_sock, &blob_sizes.lbs_sock);
403 lsm_set_size(&needed->lbs_superblock, &blob_sizes.lbs_superblock);
7f79f508 404 lsm_set_size(&needed->lbs_task, &blob_sizes.lbs_task);
7a90fc39
CS
405 /*
406 * The inode blob gets an rcu_head in addition to
407 * what the modules might need.
408 */
409 if (needed->lbs_inode && blob_sizes.lbs_inode == 0)
410 blob_sizes.lbs_inode = sizeof(struct rcu_head);
411 lsm_set_size(&needed->lbs_inode, &blob_sizes.lbs_inode);
ab9b110b
CS
412}
413
414/**
415 * lsm_file_alloc - allocate a composite file blob
416 * @file: the file that needs a blob
417 *
418 * Allocate the file blob for all the modules
419 *
420 * Returns 0, or -ENOMEM if memory can't be allocated.
421 */
422int lsm_file_alloc(struct file *file)
423{
424 if (!lsm_file_cache) {
425 file->f_security = NULL;
426 return 0;
427 }
428
429 file->f_security = kmem_cache_zalloc(lsm_file_cache, GFP_KERNEL);
430 if (file->f_security == NULL)
431 return -ENOMEM;
432 return 0;
f1efc8c4
CS
433}
434
a69a0684
JJ
435#ifdef CONFIG_SECURITY_STACKING
436static inline char *lsm_of_task(struct task_struct *task)
437{
438#ifdef CONFIG_SECURITY_LSM_DEBUG
439 if (task->security == NULL)
440 pr_info("%s: task has no lsm name.\n", __func__);
441#endif
442 return task->security;
443}
444#endif
445
7f79f508
CS
446/**
447 * lsm_task_alloc - allocate a composite task blob
448 * @task: the task that needs a blob
449 *
450 * Allocate the task blob for all the modules
451 *
452 * Returns 0, or -ENOMEM if memory can't be allocated.
453 */
454int lsm_task_alloc(struct task_struct *task)
455{
456 if (blob_sizes.lbs_task == 0) {
457 task->security = NULL;
458 return 0;
459 }
460
461 task->security = kzalloc(blob_sizes.lbs_task, GFP_KERNEL);
462 if (task->security == NULL)
463 return -ENOMEM;
76afa12e
JJ
464
465 /* inherit current display lsm */
466#ifdef CONFIG_SECURITY_STACKING
467 if (current->security)
468 strcpy(task->security, lsm_of_task(current));
6a3b4b47
JJ
469 else
470 strcpy(task->security, default_display_lsm);
76afa12e 471#endif
7f79f508
CS
472 return 0;
473}
474
7a90fc39
CS
475/**
476 * lsm_inode_alloc - allocate a composite inode blob
477 * @inode: the inode that needs a blob
478 *
479 * Allocate the inode blob for all the modules
480 *
481 * Returns 0, or -ENOMEM if memory can't be allocated.
482 */
483int lsm_inode_alloc(struct inode *inode)
484{
485 if (!lsm_inode_cache) {
486 inode->i_security = NULL;
487 return 0;
488 }
489
490 inode->i_security = kmem_cache_zalloc(lsm_inode_cache, GFP_KERNEL);
491 if (inode->i_security == NULL)
492 return -ENOMEM;
493 return 0;
494}
495
496/**
497 * lsm_early_inode - during initialization allocate a composite inode blob
498 * @inode: the inode that needs a blob
499 *
500 * Allocate the inode blob for all the modules if it's not already there
501 */
502void lsm_early_inode(struct inode *inode)
503{
504 int rc;
505
506 if (inode == NULL)
507 panic("%s: NULL inode.\n", __func__);
508 if (inode->i_security != NULL)
509 return;
510 rc = lsm_inode_alloc(inode);
511 if (rc)
512 panic("%s: Early inode alloc failed.\n", __func__);
513}
514
515/**
516 * lsm_ipc_alloc - allocate a composite ipc blob
517 * @kip: the ipc that needs a blob
518 *
519 * Allocate the ipc blob for all the modules
520 *
521 * Returns 0, or -ENOMEM if memory can't be allocated.
522 */
523int lsm_ipc_alloc(struct kern_ipc_perm *kip)
524{
525 if (blob_sizes.lbs_ipc == 0) {
526 kip->security = NULL;
527 return 0;
528 }
529
530 kip->security = kzalloc(blob_sizes.lbs_ipc, GFP_KERNEL);
531 if (kip->security == NULL)
532 return -ENOMEM;
533 return 0;
534}
535
536#ifdef CONFIG_KEYS
537/**
538 * lsm_key_alloc - allocate a composite key blob
539 * @key: the key that needs a blob
540 *
541 * Allocate the key blob for all the modules
542 *
543 * Returns 0, or -ENOMEM if memory can't be allocated.
544 */
545int lsm_key_alloc(struct key *key)
546{
547 if (blob_sizes.lbs_key == 0) {
548 key->security = NULL;
549 return 0;
550 }
551
552 key->security = kzalloc(blob_sizes.lbs_key, GFP_KERNEL);
553 if (key->security == NULL)
554 return -ENOMEM;
555 return 0;
556}
557#endif /* CONFIG_KEYS */
558
559/**
560 * lsm_msg_msg_alloc - allocate a composite msg_msg blob
561 * @mp: the msg_msg that needs a blob
562 *
563 * Allocate the ipc blob for all the modules
564 *
565 * Returns 0, or -ENOMEM if memory can't be allocated.
566 */
567int lsm_msg_msg_alloc(struct msg_msg *mp)
568{
569 if (blob_sizes.lbs_msg_msg == 0) {
570 mp->security = NULL;
571 return 0;
572 }
573
574 mp->security = kzalloc(blob_sizes.lbs_msg_msg, GFP_KERNEL);
575 if (mp->security == NULL)
576 return -ENOMEM;
577 return 0;
578}
579
580/**
581 * lsm_sock_alloc - allocate a composite sock blob
582 * @sock: the sock that needs a blob
583 * @priority: allocation mode
584 *
585 * Allocate the sock blob for all the modules
586 *
587 * Returns 0, or -ENOMEM if memory can't be allocated.
588 */
589int lsm_sock_alloc(struct sock *sock, gfp_t priority)
590{
591 if (blob_sizes.lbs_sock == 0) {
592 sock->sk_security = NULL;
593 return 0;
594 }
595
596 sock->sk_security = kzalloc(blob_sizes.lbs_sock, priority);
597 if (sock->sk_security == NULL)
598 return -ENOMEM;
599 return 0;
600}
601
602/**
603 * lsm_superblock_alloc - allocate a composite superblock blob
604 * @sb: the superblock that needs a blob
605 *
606 * Allocate the superblock blob for all the modules
607 *
608 * Returns 0, or -ENOMEM if memory can't be allocated.
609 */
610int lsm_superblock_alloc(struct super_block *sb)
611{
612 if (blob_sizes.lbs_superblock == 0) {
613 sb->s_security = NULL;
614 return 0;
615 }
616
617 sb->s_security = kzalloc(blob_sizes.lbs_superblock, GFP_KERNEL);
618 if (sb->s_security == NULL)
619 return -ENOMEM;
620 return 0;
621}
622
f25fce3e 623/*
b1d9e6b0 624 * Hook list operation macros.
1da177e4 625 *
f25fce3e
CS
626 * call_void_hook:
627 * This is a hook that does not return a value.
1da177e4 628 *
f25fce3e
CS
629 * call_int_hook:
630 * This is a hook that returns a value.
1da177e4 631 */
1da177e4 632
b1d9e6b0
CS
633#define call_void_hook(FUNC, ...) \
634 do { \
635 struct security_hook_list *P; \
636 \
637 list_for_each_entry(P, &security_hook_heads.FUNC, list) \
638 P->hook.FUNC(__VA_ARGS__); \
639 } while (0)
640
641#define call_int_hook(FUNC, IRC, ...) ({ \
642 int RC = IRC; \
643 do { \
644 struct security_hook_list *P; \
645 \
646 list_for_each_entry(P, &security_hook_heads.FUNC, list) { \
647 RC = P->hook.FUNC(__VA_ARGS__); \
648 if (RC != 0) \
649 break; \
650 } \
651 } while (0); \
652 RC; \
653})
1da177e4 654
20510f2f
JM
655/* Security operations */
656
79af7307
SS
657int security_binder_set_context_mgr(struct task_struct *mgr)
658{
f25fce3e 659 return call_int_hook(binder_set_context_mgr, 0, mgr);
79af7307
SS
660}
661
662int security_binder_transaction(struct task_struct *from,
663 struct task_struct *to)
664{
f25fce3e 665 return call_int_hook(binder_transaction, 0, from, to);
79af7307
SS
666}
667
668int security_binder_transfer_binder(struct task_struct *from,
669 struct task_struct *to)
670{
f25fce3e 671 return call_int_hook(binder_transfer_binder, 0, from, to);
79af7307
SS
672}
673
674int security_binder_transfer_file(struct task_struct *from,
675 struct task_struct *to, struct file *file)
676{
f25fce3e 677 return call_int_hook(binder_transfer_file, 0, from, to, file);
79af7307
SS
678}
679
9e48858f 680int security_ptrace_access_check(struct task_struct *child, unsigned int mode)
20510f2f 681{
f25fce3e 682 return call_int_hook(ptrace_access_check, 0, child, mode);
5cd9c58f
DH
683}
684
685int security_ptrace_traceme(struct task_struct *parent)
686{
f25fce3e 687 return call_int_hook(ptrace_traceme, 0, parent);
20510f2f
JM
688}
689
690int security_capget(struct task_struct *target,
691 kernel_cap_t *effective,
692 kernel_cap_t *inheritable,
693 kernel_cap_t *permitted)
694{
f25fce3e
CS
695 return call_int_hook(capget, 0, target,
696 effective, inheritable, permitted);
20510f2f
JM
697}
698
d84f4f99
DH
699int security_capset(struct cred *new, const struct cred *old,
700 const kernel_cap_t *effective,
701 const kernel_cap_t *inheritable,
702 const kernel_cap_t *permitted)
20510f2f 703{
f25fce3e
CS
704 return call_int_hook(capset, 0, new, old,
705 effective, inheritable, permitted);
20510f2f
JM
706}
707
428bc0be
MM
708int security_capable(const struct cred *cred,
709 struct user_namespace *ns,
710 int cap,
711 unsigned int opts)
20510f2f 712{
428bc0be 713 return call_int_hook(capable, 0, cred, ns, cap, opts);
20510f2f
JM
714}
715
20510f2f
JM
716int security_quotactl(int cmds, int type, int id, struct super_block *sb)
717{
f25fce3e 718 return call_int_hook(quotactl, 0, cmds, type, id, sb);
20510f2f
JM
719}
720
721int security_quota_on(struct dentry *dentry)
722{
f25fce3e 723 return call_int_hook(quota_on, 0, dentry);
20510f2f
JM
724}
725
12b3052c 726int security_syslog(int type)
20510f2f 727{
f25fce3e 728 return call_int_hook(syslog, 0, type);
20510f2f
JM
729}
730
457db29b 731int security_settime64(const struct timespec64 *ts, const struct timezone *tz)
20510f2f 732{
f25fce3e 733 return call_int_hook(settime, 0, ts, tz);
20510f2f
JM
734}
735
20510f2f
JM
736int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
737{
b1d9e6b0
CS
738 struct security_hook_list *hp;
739 int cap_sys_admin = 1;
740 int rc;
741
742 /*
743 * The module will respond with a positive value if
744 * it thinks the __vm_enough_memory() call should be
745 * made with the cap_sys_admin set. If all of the modules
746 * agree that it should be set it will. If any module
747 * thinks it should not be set it won't.
748 */
749 list_for_each_entry(hp, &security_hook_heads.vm_enough_memory, list) {
750 rc = hp->hook.vm_enough_memory(mm, pages);
751 if (rc <= 0) {
752 cap_sys_admin = 0;
753 break;
754 }
755 }
756 return __vm_enough_memory(mm, pages, cap_sys_admin);
20510f2f
JM
757}
758
a6f76f23 759int security_bprm_set_creds(struct linux_binprm *bprm)
20510f2f 760{
f25fce3e 761 return call_int_hook(bprm_set_creds, 0, bprm);
20510f2f
JM
762}
763
a6f76f23 764int security_bprm_check(struct linux_binprm *bprm)
20510f2f 765{
6c21a7fb
MZ
766 int ret;
767
f25fce3e 768 ret = call_int_hook(bprm_check_security, 0, bprm);
6c21a7fb
MZ
769 if (ret)
770 return ret;
771 return ima_bprm_check(bprm);
20510f2f
JM
772}
773
a6f76f23 774void security_bprm_committing_creds(struct linux_binprm *bprm)
20510f2f 775{
f25fce3e 776 call_void_hook(bprm_committing_creds, bprm);
20510f2f
JM
777}
778
a6f76f23 779void security_bprm_committed_creds(struct linux_binprm *bprm)
20510f2f 780{
f25fce3e 781 call_void_hook(bprm_committed_creds, bprm);
20510f2f
JM
782}
783
20510f2f
JM
784int security_sb_alloc(struct super_block *sb)
785{
7a90fc39
CS
786 int rc = lsm_superblock_alloc(sb);
787
788 if (unlikely(rc))
789 return rc;
790 rc = call_int_hook(sb_alloc_security, 0, sb);
791 if (unlikely(rc))
792 security_sb_free(sb);
793 return rc;
20510f2f
JM
794}
795
796void security_sb_free(struct super_block *sb)
797{
f25fce3e 798 call_void_hook(sb_free_security, sb);
7a90fc39
CS
799 kfree(sb->s_security);
800 sb->s_security = NULL;
20510f2f
JM
801}
802
e0007529 803int security_sb_copy_data(char *orig, char *copy)
20510f2f 804{
f25fce3e 805 return call_int_hook(sb_copy_data, 0, orig, copy);
20510f2f 806}
e0007529 807EXPORT_SYMBOL(security_sb_copy_data);
20510f2f 808
ff36fe2c
EP
809int security_sb_remount(struct super_block *sb, void *data)
810{
f25fce3e 811 return call_int_hook(sb_remount, 0, sb, data);
ff36fe2c
EP
812}
813
12204e24 814int security_sb_kern_mount(struct super_block *sb, int flags, void *data)
20510f2f 815{
f25fce3e 816 return call_int_hook(sb_kern_mount, 0, sb, flags, data);
20510f2f
JM
817}
818
2069f457
EP
819int security_sb_show_options(struct seq_file *m, struct super_block *sb)
820{
f25fce3e 821 return call_int_hook(sb_show_options, 0, m, sb);
2069f457
EP
822}
823
20510f2f
JM
824int security_sb_statfs(struct dentry *dentry)
825{
f25fce3e 826 return call_int_hook(sb_statfs, 0, dentry);
20510f2f
JM
827}
828
8a04c43b 829int security_sb_mount(const char *dev_name, const struct path *path,
808d4e3c 830 const char *type, unsigned long flags, void *data)
20510f2f 831{
f25fce3e 832 return call_int_hook(sb_mount, 0, dev_name, path, type, flags, data);
20510f2f
JM
833}
834
20510f2f
JM
835int security_sb_umount(struct vfsmount *mnt, int flags)
836{
f25fce3e 837 return call_int_hook(sb_umount, 0, mnt, flags);
20510f2f
JM
838}
839
3b73b68c 840int security_sb_pivotroot(const struct path *old_path, const struct path *new_path)
20510f2f 841{
f25fce3e 842 return call_int_hook(sb_pivotroot, 0, old_path, new_path);
20510f2f
JM
843}
844
c9180a57 845int security_sb_set_mnt_opts(struct super_block *sb,
649f6e77
DQ
846 struct security_mnt_opts *opts,
847 unsigned long kern_flags,
848 unsigned long *set_kern_flags)
c9180a57 849{
b1d9e6b0
CS
850 return call_int_hook(sb_set_mnt_opts,
851 opts->num_mnt_opts ? -EOPNOTSUPP : 0, sb,
852 opts, kern_flags, set_kern_flags);
c9180a57 853}
e0007529 854EXPORT_SYMBOL(security_sb_set_mnt_opts);
c9180a57 855
094f7b69 856int security_sb_clone_mnt_opts(const struct super_block *oldsb,
0b4d3452
SM
857 struct super_block *newsb,
858 unsigned long kern_flags,
859 unsigned long *set_kern_flags)
c9180a57 860{
0b4d3452
SM
861 return call_int_hook(sb_clone_mnt_opts, 0, oldsb, newsb,
862 kern_flags, set_kern_flags);
c9180a57 863}
e0007529
EP
864EXPORT_SYMBOL(security_sb_clone_mnt_opts);
865
866int security_sb_parse_opts_str(char *options, struct security_mnt_opts *opts)
867{
f25fce3e 868 return call_int_hook(sb_parse_opts_str, 0, options, opts);
e0007529
EP
869}
870EXPORT_SYMBOL(security_sb_parse_opts_str);
c9180a57 871
20510f2f
JM
872int security_inode_alloc(struct inode *inode)
873{
7a90fc39
CS
874 int rc = lsm_inode_alloc(inode);
875
876 if (unlikely(rc))
877 return rc;
878 rc = call_int_hook(inode_alloc_security, 0, inode);
879 if (unlikely(rc))
880 security_inode_free(inode);
881 return rc;
882}
883
884static void inode_free_by_rcu(struct rcu_head *head)
885{
886 /*
887 * The rcu head is at the start of the inode blob
888 */
889 kmem_cache_free(lsm_inode_cache, head);
20510f2f
JM
890}
891
892void security_inode_free(struct inode *inode)
893{
f381c272 894 integrity_inode_free(inode);
f25fce3e 895 call_void_hook(inode_free_security, inode);
7a90fc39
CS
896 /*
897 * The inode may still be referenced in a path walk and
898 * a call to security_inode_permission() can be made
899 * after inode_free_security() is called. Ideally, the VFS
900 * wouldn't do this, but fixing that is a much harder
901 * job. For now, simply free the i_security via RCU, and
902 * leave the current inode->i_security pointer intact.
903 * The inode will be freed after the RCU grace period too.
904 */
905 if (inode->i_security)
906 call_rcu((struct rcu_head *)inode->i_security,
907 inode_free_by_rcu);
20510f2f
JM
908}
909
d47be3df 910int security_dentry_init_security(struct dentry *dentry, int mode,
4f3ccd76 911 const struct qstr *name, void **ctx,
d47be3df
DQ
912 u32 *ctxlen)
913{
b1d9e6b0
CS
914 return call_int_hook(dentry_init_security, -EOPNOTSUPP, dentry, mode,
915 name, ctx, ctxlen);
d47be3df
DQ
916}
917EXPORT_SYMBOL(security_dentry_init_security);
918
2602625b
VG
919int security_dentry_create_files_as(struct dentry *dentry, int mode,
920 struct qstr *name,
921 const struct cred *old, struct cred *new)
922{
923 return call_int_hook(dentry_create_files_as, 0, dentry, mode,
924 name, old, new);
925}
926EXPORT_SYMBOL(security_dentry_create_files_as);
927
20510f2f 928int security_inode_init_security(struct inode *inode, struct inode *dir,
9d8f13ba
MZ
929 const struct qstr *qstr,
930 const initxattrs initxattrs, void *fs_data)
20510f2f 931{
823eb1cc
MZ
932 struct xattr new_xattrs[MAX_LSM_EVM_XATTR + 1];
933 struct xattr *lsm_xattr, *evm_xattr, *xattr;
9d8f13ba
MZ
934 int ret;
935
20510f2f 936 if (unlikely(IS_PRIVATE(inode)))
fb88c2b6 937 return 0;
9d8f13ba 938
9d8f13ba 939 if (!initxattrs)
e308fd3b
JB
940 return call_int_hook(inode_init_security, -EOPNOTSUPP, inode,
941 dir, qstr, NULL, NULL, NULL);
9548906b 942 memset(new_xattrs, 0, sizeof(new_xattrs));
9d8f13ba 943 lsm_xattr = new_xattrs;
b1d9e6b0 944 ret = call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir, qstr,
9d8f13ba
MZ
945 &lsm_xattr->name,
946 &lsm_xattr->value,
947 &lsm_xattr->value_len);
948 if (ret)
949 goto out;
823eb1cc
MZ
950
951 evm_xattr = lsm_xattr + 1;
952 ret = evm_inode_init_security(inode, lsm_xattr, evm_xattr);
953 if (ret)
954 goto out;
9d8f13ba
MZ
955 ret = initxattrs(inode, new_xattrs, fs_data);
956out:
9548906b 957 for (xattr = new_xattrs; xattr->value != NULL; xattr++)
823eb1cc 958 kfree(xattr->value);
9d8f13ba
MZ
959 return (ret == -EOPNOTSUPP) ? 0 : ret;
960}
961EXPORT_SYMBOL(security_inode_init_security);
962
963int security_old_inode_init_security(struct inode *inode, struct inode *dir,
9548906b 964 const struct qstr *qstr, const char **name,
9d8f13ba 965 void **value, size_t *len)
20510f2f
JM
966{
967 if (unlikely(IS_PRIVATE(inode)))
30e05324 968 return -EOPNOTSUPP;
e308fd3b
JB
969 return call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir,
970 qstr, name, value, len);
20510f2f 971}
9d8f13ba 972EXPORT_SYMBOL(security_old_inode_init_security);
20510f2f 973
be6d3e56 974#ifdef CONFIG_SECURITY_PATH
d3607752 975int security_path_mknod(const struct path *dir, struct dentry *dentry, umode_t mode,
be6d3e56
KT
976 unsigned int dev)
977{
c6f493d6 978 if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
be6d3e56 979 return 0;
f25fce3e 980 return call_int_hook(path_mknod, 0, dir, dentry, mode, dev);
be6d3e56
KT
981}
982EXPORT_SYMBOL(security_path_mknod);
983
d3607752 984int security_path_mkdir(const struct path *dir, struct dentry *dentry, umode_t mode)
be6d3e56 985{
c6f493d6 986 if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
be6d3e56 987 return 0;
f25fce3e 988 return call_int_hook(path_mkdir, 0, dir, dentry, mode);
be6d3e56 989}
82140443 990EXPORT_SYMBOL(security_path_mkdir);
be6d3e56 991
989f74e0 992int security_path_rmdir(const struct path *dir, struct dentry *dentry)
be6d3e56 993{
c6f493d6 994 if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
be6d3e56 995 return 0;
f25fce3e 996 return call_int_hook(path_rmdir, 0, dir, dentry);
be6d3e56 997}
c088e31d 998EXPORT_SYMBOL_GPL(security_path_rmdir);
be6d3e56 999
989f74e0 1000int security_path_unlink(const struct path *dir, struct dentry *dentry)
be6d3e56 1001{
c6f493d6 1002 if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
be6d3e56 1003 return 0;
f25fce3e 1004 return call_int_hook(path_unlink, 0, dir, dentry);
be6d3e56 1005}
82140443 1006EXPORT_SYMBOL(security_path_unlink);
be6d3e56 1007
d3607752 1008int security_path_symlink(const struct path *dir, struct dentry *dentry,
be6d3e56
KT
1009 const char *old_name)
1010{
c6f493d6 1011 if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
be6d3e56 1012 return 0;
f25fce3e 1013 return call_int_hook(path_symlink, 0, dir, dentry, old_name);
be6d3e56 1014}
c088e31d 1015EXPORT_SYMBOL_GPL(security_path_symlink);
be6d3e56 1016
3ccee46a 1017int security_path_link(struct dentry *old_dentry, const struct path *new_dir,
be6d3e56
KT
1018 struct dentry *new_dentry)
1019{
c6f493d6 1020 if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))
be6d3e56 1021 return 0;
f25fce3e 1022 return call_int_hook(path_link, 0, old_dentry, new_dir, new_dentry);
be6d3e56 1023}
c088e31d 1024EXPORT_SYMBOL_GPL(security_path_link);
be6d3e56 1025
3ccee46a
AV
1026int security_path_rename(const struct path *old_dir, struct dentry *old_dentry,
1027 const struct path *new_dir, struct dentry *new_dentry,
0b3974eb 1028 unsigned int flags)
be6d3e56 1029{
c6f493d6
DH
1030 if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry)) ||
1031 (d_is_positive(new_dentry) && IS_PRIVATE(d_backing_inode(new_dentry)))))
be6d3e56 1032 return 0;
da1ce067
MS
1033
1034 if (flags & RENAME_EXCHANGE) {
f25fce3e
CS
1035 int err = call_int_hook(path_rename, 0, new_dir, new_dentry,
1036 old_dir, old_dentry);
da1ce067
MS
1037 if (err)
1038 return err;
1039 }
1040
f25fce3e
CS
1041 return call_int_hook(path_rename, 0, old_dir, old_dentry, new_dir,
1042 new_dentry);
be6d3e56 1043}
82140443 1044EXPORT_SYMBOL(security_path_rename);
be6d3e56 1045
81f4c506 1046int security_path_truncate(const struct path *path)
be6d3e56 1047{
c6f493d6 1048 if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
be6d3e56 1049 return 0;
f25fce3e 1050 return call_int_hook(path_truncate, 0, path);
be6d3e56 1051}
c088e31d 1052EXPORT_SYMBOL_GPL(security_path_truncate);
89eda068 1053
be01f9f2 1054int security_path_chmod(const struct path *path, umode_t mode)
89eda068 1055{
c6f493d6 1056 if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
89eda068 1057 return 0;
f25fce3e 1058 return call_int_hook(path_chmod, 0, path, mode);
89eda068 1059}
c088e31d 1060EXPORT_SYMBOL_GPL(security_path_chmod);
89eda068 1061
7fd25dac 1062int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
89eda068 1063{
c6f493d6 1064 if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
89eda068 1065 return 0;
f25fce3e 1066 return call_int_hook(path_chown, 0, path, uid, gid);
89eda068 1067}
c088e31d 1068EXPORT_SYMBOL_GPL(security_path_chown);
8b8efb44 1069
77b286c0 1070int security_path_chroot(const struct path *path)
8b8efb44 1071{
f25fce3e 1072 return call_int_hook(path_chroot, 0, path);
8b8efb44 1073}
be6d3e56
KT
1074#endif
1075
4acdaf27 1076int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
20510f2f
JM
1077{
1078 if (unlikely(IS_PRIVATE(dir)))
1079 return 0;
f25fce3e 1080 return call_int_hook(inode_create, 0, dir, dentry, mode);
20510f2f 1081}
800a9647 1082EXPORT_SYMBOL_GPL(security_inode_create);
20510f2f
JM
1083
1084int security_inode_link(struct dentry *old_dentry, struct inode *dir,
1085 struct dentry *new_dentry)
1086{
c6f493d6 1087 if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))
20510f2f 1088 return 0;
f25fce3e 1089 return call_int_hook(inode_link, 0, old_dentry, dir, new_dentry);
20510f2f
JM
1090}
1091
1092int security_inode_unlink(struct inode *dir, struct dentry *dentry)
1093{
c6f493d6 1094 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
20510f2f 1095 return 0;
f25fce3e 1096 return call_int_hook(inode_unlink, 0, dir, dentry);
20510f2f
JM
1097}
1098
1099int security_inode_symlink(struct inode *dir, struct dentry *dentry,
1100 const char *old_name)
1101{
1102 if (unlikely(IS_PRIVATE(dir)))
1103 return 0;
f25fce3e 1104 return call_int_hook(inode_symlink, 0, dir, dentry, old_name);
20510f2f
JM
1105}
1106
18bb1db3 1107int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
20510f2f
JM
1108{
1109 if (unlikely(IS_PRIVATE(dir)))
1110 return 0;
f25fce3e 1111 return call_int_hook(inode_mkdir, 0, dir, dentry, mode);
20510f2f 1112}
800a9647 1113EXPORT_SYMBOL_GPL(security_inode_mkdir);
20510f2f
JM
1114
1115int security_inode_rmdir(struct inode *dir, struct dentry *dentry)
1116{
c6f493d6 1117 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
20510f2f 1118 return 0;
f25fce3e 1119 return call_int_hook(inode_rmdir, 0, dir, dentry);
20510f2f
JM
1120}
1121
1a67aafb 1122int security_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
20510f2f
JM
1123{
1124 if (unlikely(IS_PRIVATE(dir)))
1125 return 0;
f25fce3e 1126 return call_int_hook(inode_mknod, 0, dir, dentry, mode, dev);
20510f2f
JM
1127}
1128
1129int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
0b3974eb
MS
1130 struct inode *new_dir, struct dentry *new_dentry,
1131 unsigned int flags)
20510f2f 1132{
c6f493d6
DH
1133 if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry)) ||
1134 (d_is_positive(new_dentry) && IS_PRIVATE(d_backing_inode(new_dentry)))))
20510f2f 1135 return 0;
da1ce067
MS
1136
1137 if (flags & RENAME_EXCHANGE) {
f25fce3e 1138 int err = call_int_hook(inode_rename, 0, new_dir, new_dentry,
da1ce067
MS
1139 old_dir, old_dentry);
1140 if (err)
1141 return err;
1142 }
1143
f25fce3e 1144 return call_int_hook(inode_rename, 0, old_dir, old_dentry,
20510f2f
JM
1145 new_dir, new_dentry);
1146}
1147
1148int security_inode_readlink(struct dentry *dentry)
1149{
c6f493d6 1150 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
20510f2f 1151 return 0;
f25fce3e 1152 return call_int_hook(inode_readlink, 0, dentry);
20510f2f 1153}
c088e31d 1154EXPORT_SYMBOL_GPL(security_inode_readlink);
20510f2f 1155
bda0be7a
N
1156int security_inode_follow_link(struct dentry *dentry, struct inode *inode,
1157 bool rcu)
20510f2f 1158{
bda0be7a 1159 if (unlikely(IS_PRIVATE(inode)))
20510f2f 1160 return 0;
e22619a2 1161 return call_int_hook(inode_follow_link, 0, dentry, inode, rcu);
20510f2f
JM
1162}
1163
b77b0646 1164int security_inode_permission(struct inode *inode, int mask)
20510f2f
JM
1165{
1166 if (unlikely(IS_PRIVATE(inode)))
1167 return 0;
f25fce3e 1168 return call_int_hook(inode_permission, 0, inode, mask);
20510f2f 1169}
c088e31d 1170EXPORT_SYMBOL_GPL(security_inode_permission);
20510f2f
JM
1171
1172int security_inode_setattr(struct dentry *dentry, struct iattr *attr)
1173{
817b54aa
MZ
1174 int ret;
1175
c6f493d6 1176 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
20510f2f 1177 return 0;
f25fce3e 1178 ret = call_int_hook(inode_setattr, 0, dentry, attr);
817b54aa
MZ
1179 if (ret)
1180 return ret;
1181 return evm_inode_setattr(dentry, attr);
20510f2f 1182}
b1da47e2 1183EXPORT_SYMBOL_GPL(security_inode_setattr);
20510f2f 1184
3f7036a0 1185int security_inode_getattr(const struct path *path)
20510f2f 1186{
c6f493d6 1187 if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
20510f2f 1188 return 0;
f25fce3e 1189 return call_int_hook(inode_getattr, 0, path);
20510f2f
JM
1190}
1191
8f0cfa52
DH
1192int security_inode_setxattr(struct dentry *dentry, const char *name,
1193 const void *value, size_t size, int flags)
20510f2f 1194{
3e1be52d
MZ
1195 int ret;
1196
c6f493d6 1197 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
20510f2f 1198 return 0;
b1d9e6b0
CS
1199 /*
1200 * SELinux and Smack integrate the cap call,
1201 * so assume that all LSMs supplying this call do so.
1202 */
1203 ret = call_int_hook(inode_setxattr, 1, dentry, name, value, size,
f25fce3e 1204 flags);
b1d9e6b0
CS
1205
1206 if (ret == 1)
1207 ret = cap_inode_setxattr(dentry, name, value, size, flags);
42c63330
MZ
1208 if (ret)
1209 return ret;
1210 ret = ima_inode_setxattr(dentry, name, value, size);
3e1be52d
MZ
1211 if (ret)
1212 return ret;
1213 return evm_inode_setxattr(dentry, name, value, size);
20510f2f
JM
1214}
1215
8f0cfa52
DH
1216void security_inode_post_setxattr(struct dentry *dentry, const char *name,
1217 const void *value, size_t size, int flags)
20510f2f 1218{
c6f493d6 1219 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
20510f2f 1220 return;
f25fce3e 1221 call_void_hook(inode_post_setxattr, dentry, name, value, size, flags);
3e1be52d 1222 evm_inode_post_setxattr(dentry, name, value, size);
20510f2f
JM
1223}
1224
8f0cfa52 1225int security_inode_getxattr(struct dentry *dentry, const char *name)
20510f2f 1226{
c6f493d6 1227 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
20510f2f 1228 return 0;
f25fce3e 1229 return call_int_hook(inode_getxattr, 0, dentry, name);
20510f2f
JM
1230}
1231
1232int security_inode_listxattr(struct dentry *dentry)
1233{
c6f493d6 1234 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
20510f2f 1235 return 0;
f25fce3e 1236 return call_int_hook(inode_listxattr, 0, dentry);
20510f2f
JM
1237}
1238
8f0cfa52 1239int security_inode_removexattr(struct dentry *dentry, const char *name)
20510f2f 1240{
3e1be52d
MZ
1241 int ret;
1242
c6f493d6 1243 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
20510f2f 1244 return 0;
b1d9e6b0
CS
1245 /*
1246 * SELinux and Smack integrate the cap call,
1247 * so assume that all LSMs supplying this call do so.
1248 */
1249 ret = call_int_hook(inode_removexattr, 1, dentry, name);
1250 if (ret == 1)
1251 ret = cap_inode_removexattr(dentry, name);
42c63330
MZ
1252 if (ret)
1253 return ret;
1254 ret = ima_inode_removexattr(dentry, name);
3e1be52d
MZ
1255 if (ret)
1256 return ret;
1257 return evm_inode_removexattr(dentry, name);
20510f2f
JM
1258}
1259
b5376771
SH
1260int security_inode_need_killpriv(struct dentry *dentry)
1261{
f25fce3e 1262 return call_int_hook(inode_need_killpriv, 0, dentry);
b5376771
SH
1263}
1264
1265int security_inode_killpriv(struct dentry *dentry)
1266{
f25fce3e 1267 return call_int_hook(inode_killpriv, 0, dentry);
b5376771
SH
1268}
1269
ea861dfd 1270int security_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
20510f2f 1271{
2885c1e3
CS
1272 struct security_hook_list *hp;
1273 int rc;
1274
20510f2f 1275 if (unlikely(IS_PRIVATE(inode)))
8d952504 1276 return -EOPNOTSUPP;
2885c1e3
CS
1277 /*
1278 * Only one module will provide an attribute with a given name.
1279 */
1280 list_for_each_entry(hp, &security_hook_heads.inode_getsecurity, list) {
1281 rc = hp->hook.inode_getsecurity(inode, name, buffer, alloc);
1282 if (rc != -EOPNOTSUPP)
1283 return rc;
1284 }
1285 return -EOPNOTSUPP;
20510f2f
JM
1286}
1287
1288int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
1289{
2885c1e3
CS
1290 struct security_hook_list *hp;
1291 int rc;
1292
20510f2f 1293 if (unlikely(IS_PRIVATE(inode)))
8d952504 1294 return -EOPNOTSUPP;
2885c1e3
CS
1295 /*
1296 * Only one module will provide an attribute with a given name.
1297 */
1298 list_for_each_entry(hp, &security_hook_heads.inode_setsecurity, list) {
1299 rc = hp->hook.inode_setsecurity(inode, name, value, size,
1300 flags);
1301 if (rc != -EOPNOTSUPP)
1302 return rc;
1303 }
1304 return -EOPNOTSUPP;
20510f2f
JM
1305}
1306
1307int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
1308{
1309 if (unlikely(IS_PRIVATE(inode)))
1310 return 0;
f25fce3e 1311 return call_int_hook(inode_listsecurity, 0, inode, buffer, buffer_size);
20510f2f 1312}
c9bccef6 1313EXPORT_SYMBOL(security_inode_listsecurity);
20510f2f 1314
d6335d77 1315void security_inode_getsecid(struct inode *inode, u32 *secid)
8a076191 1316{
f25fce3e 1317 call_void_hook(inode_getsecid, inode, secid);
8a076191
AD
1318}
1319
d8ad8b49
VG
1320int security_inode_copy_up(struct dentry *src, struct cred **new)
1321{
1322 return call_int_hook(inode_copy_up, 0, src, new);
1323}
1324EXPORT_SYMBOL(security_inode_copy_up);
1325
121ab822
VG
1326int security_inode_copy_up_xattr(const char *name)
1327{
1328 return call_int_hook(inode_copy_up_xattr, -EOPNOTSUPP, name);
1329}
1330EXPORT_SYMBOL(security_inode_copy_up_xattr);
1331
20510f2f
JM
1332int security_file_permission(struct file *file, int mask)
1333{
c4ec54b4
EP
1334 int ret;
1335
f25fce3e 1336 ret = call_int_hook(file_permission, 0, file, mask);
c4ec54b4
EP
1337 if (ret)
1338 return ret;
1339
1340 return fsnotify_perm(file, mask);
20510f2f 1341}
c088e31d 1342EXPORT_SYMBOL_GPL(security_file_permission);
20510f2f
JM
1343
1344int security_file_alloc(struct file *file)
1345{
ab9b110b
CS
1346 int rc = lsm_file_alloc(file);
1347
7a90fc39 1348 if (unlikely(rc))
ab9b110b
CS
1349 return rc;
1350 rc = call_int_hook(file_alloc_security, 0, file);
1351 if (unlikely(rc))
1352 security_file_free(file);
1353 return rc;
20510f2f
JM
1354}
1355
1356void security_file_free(struct file *file)
1357{
ab9b110b
CS
1358 void *blob;
1359
1360 if (!lsm_file_cache)
1361 return;
1362
f25fce3e 1363 call_void_hook(file_free_security, file);
ab9b110b
CS
1364
1365 blob = file->f_security;
1366 file->f_security = NULL;
1367 kmem_cache_free(lsm_file_cache, blob);
20510f2f
JM
1368}
1369
1370int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
1371{
f25fce3e 1372 return call_int_hook(file_ioctl, 0, file, cmd, arg);
20510f2f
JM
1373}
1374
98de59bf 1375static inline unsigned long mmap_prot(struct file *file, unsigned long prot)
20510f2f 1376{
8b3ec681 1377 /*
98de59bf
AV
1378 * Does we have PROT_READ and does the application expect
1379 * it to imply PROT_EXEC? If not, nothing to talk about...
8b3ec681 1380 */
98de59bf
AV
1381 if ((prot & (PROT_READ | PROT_EXEC)) != PROT_READ)
1382 return prot;
8b3ec681 1383 if (!(current->personality & READ_IMPLIES_EXEC))
98de59bf
AV
1384 return prot;
1385 /*
1386 * if that's an anonymous mapping, let it.
1387 */
1388 if (!file)
1389 return prot | PROT_EXEC;
1390 /*
1391 * ditto if it's not on noexec mount, except that on !MMU we need
b4caecd4 1392 * NOMMU_MAP_EXEC (== VM_MAYEXEC) in this case
98de59bf 1393 */
90f8572b 1394 if (!path_noexec(&file->f_path)) {
8b3ec681 1395#ifndef CONFIG_MMU
b4caecd4
CH
1396 if (file->f_op->mmap_capabilities) {
1397 unsigned caps = file->f_op->mmap_capabilities(file);
1398 if (!(caps & NOMMU_MAP_EXEC))
1399 return prot;
1400 }
8b3ec681 1401#endif
98de59bf 1402 return prot | PROT_EXEC;
8b3ec681 1403 }
98de59bf
AV
1404 /* anything on noexec mount won't get PROT_EXEC */
1405 return prot;
1406}
1407
1408int security_mmap_file(struct file *file, unsigned long prot,
1409 unsigned long flags)
1410{
1411 int ret;
f25fce3e 1412 ret = call_int_hook(mmap_file, 0, file, prot,
98de59bf 1413 mmap_prot(file, prot), flags);
6c21a7fb
MZ
1414 if (ret)
1415 return ret;
1416 return ima_file_mmap(file, prot);
20510f2f 1417}
c088e31d 1418EXPORT_SYMBOL_GPL(security_mmap_file);
20510f2f 1419
e5467859
AV
1420int security_mmap_addr(unsigned long addr)
1421{
f25fce3e 1422 return call_int_hook(mmap_addr, 0, addr);
e5467859
AV
1423}
1424
20510f2f
JM
1425int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
1426 unsigned long prot)
1427{
f25fce3e 1428 return call_int_hook(file_mprotect, 0, vma, reqprot, prot);
20510f2f
JM
1429}
1430
1431int security_file_lock(struct file *file, unsigned int cmd)
1432{
f25fce3e 1433 return call_int_hook(file_lock, 0, file, cmd);
20510f2f
JM
1434}
1435
1436int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
1437{
f25fce3e 1438 return call_int_hook(file_fcntl, 0, file, cmd, arg);
20510f2f
JM
1439}
1440
e0b93edd 1441void security_file_set_fowner(struct file *file)
20510f2f 1442{
f25fce3e 1443 call_void_hook(file_set_fowner, file);
20510f2f
JM
1444}
1445
1446int security_file_send_sigiotask(struct task_struct *tsk,
1447 struct fown_struct *fown, int sig)
1448{
f25fce3e 1449 return call_int_hook(file_send_sigiotask, 0, tsk, fown, sig);
20510f2f
JM
1450}
1451
1452int security_file_receive(struct file *file)
1453{
f25fce3e 1454 return call_int_hook(file_receive, 0, file);
20510f2f
JM
1455}
1456
83d49856 1457int security_file_open(struct file *file, const struct cred *cred)
20510f2f 1458{
c4ec54b4
EP
1459 int ret;
1460
f25fce3e 1461 ret = call_int_hook(file_open, 0, file, cred);
c4ec54b4
EP
1462 if (ret)
1463 return ret;
1464
1465 return fsnotify_perm(file, MAY_OPEN);
20510f2f
JM
1466}
1467
e4e55b47
TH
1468int security_task_alloc(struct task_struct *task, unsigned long clone_flags)
1469{
7f79f508
CS
1470 int rc = lsm_task_alloc(task);
1471
7a90fc39 1472 if (unlikely(rc))
7f79f508
CS
1473 return rc;
1474 rc = call_int_hook(task_alloc, 0, task, clone_flags);
1475 if (unlikely(rc))
1476 security_task_free(task);
1477 return rc;
e4e55b47
TH
1478}
1479
1a2a4d06
KC
1480void security_task_free(struct task_struct *task)
1481{
f25fce3e 1482 call_void_hook(task_free, task);
7f79f508
CS
1483
1484 kfree(task->security);
1485 task->security = NULL;
1a2a4d06
KC
1486}
1487
ee18d64c
DH
1488int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)
1489{
f1efc8c4
CS
1490 int rc = lsm_cred_alloc(cred, gfp);
1491
7a90fc39 1492 if (unlikely(rc))
f1efc8c4
CS
1493 return rc;
1494
1495 rc = call_int_hook(cred_alloc_blank, 0, cred, gfp);
ab9b110b 1496 if (unlikely(rc))
f1efc8c4
CS
1497 security_cred_free(cred);
1498 return rc;
ee18d64c
DH
1499}
1500
d84f4f99 1501void security_cred_free(struct cred *cred)
20510f2f 1502{
9405bd1d
JM
1503 /*
1504 * There is a failure case in prepare_creds() that
1505 * may result in a call here with ->security being NULL.
1506 */
1507 if (unlikely(cred->security == NULL))
1508 return;
1509
f25fce3e 1510 call_void_hook(cred_free, cred);
f1efc8c4
CS
1511
1512 kfree(cred->security);
1513 cred->security = NULL;
20510f2f
JM
1514}
1515
d84f4f99 1516int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp)
20510f2f 1517{
f1efc8c4
CS
1518 int rc = lsm_cred_alloc(new, gfp);
1519
7a90fc39 1520 if (unlikely(rc))
f1efc8c4
CS
1521 return rc;
1522
1523 rc = call_int_hook(cred_prepare, 0, new, old, gfp);
ab9b110b 1524 if (unlikely(rc))
f1efc8c4
CS
1525 security_cred_free(new);
1526 return rc;
d84f4f99
DH
1527}
1528
ee18d64c
DH
1529void security_transfer_creds(struct cred *new, const struct cred *old)
1530{
f25fce3e 1531 call_void_hook(cred_transfer, new, old);
ee18d64c
DH
1532}
1533
3a3b7ce9
DH
1534int security_kernel_act_as(struct cred *new, u32 secid)
1535{
f25fce3e 1536 return call_int_hook(kernel_act_as, 0, new, secid);
3a3b7ce9
DH
1537}
1538
1539int security_kernel_create_files_as(struct cred *new, struct inode *inode)
1540{
f25fce3e 1541 return call_int_hook(kernel_create_files_as, 0, new, inode);
3a3b7ce9
DH
1542}
1543
dd8dbf2e 1544int security_kernel_module_request(char *kmod_name)
9188499c 1545{
f25fce3e 1546 return call_int_hook(kernel_module_request, 0, kmod_name);
9188499c
EP
1547}
1548
39eeb4fb
MZ
1549int security_kernel_read_file(struct file *file, enum kernel_read_file_id id)
1550{
1551 int ret;
1552
1553 ret = call_int_hook(kernel_read_file, 0, file, id);
1554 if (ret)
1555 return ret;
1556 return ima_read_file(file, id);
1557}
1558EXPORT_SYMBOL_GPL(security_kernel_read_file);
1559
bc8ca5b9
MZ
1560int security_kernel_post_read_file(struct file *file, char *buf, loff_t size,
1561 enum kernel_read_file_id id)
b44a7dfc 1562{
cf222217
MZ
1563 int ret;
1564
1565 ret = call_int_hook(kernel_post_read_file, 0, file, buf, size, id);
1566 if (ret)
1567 return ret;
1568 return ima_post_read_file(file, buf, size, id);
b44a7dfc
MZ
1569}
1570EXPORT_SYMBOL_GPL(security_kernel_post_read_file);
1571
d84f4f99
DH
1572int security_task_fix_setuid(struct cred *new, const struct cred *old,
1573 int flags)
20510f2f 1574{
f25fce3e 1575 return call_int_hook(task_fix_setuid, 0, new, old, flags);
20510f2f
JM
1576}
1577
20510f2f
JM
1578int security_task_setpgid(struct task_struct *p, pid_t pgid)
1579{
f25fce3e 1580 return call_int_hook(task_setpgid, 0, p, pgid);
20510f2f
JM
1581}
1582
1583int security_task_getpgid(struct task_struct *p)
1584{
f25fce3e 1585 return call_int_hook(task_getpgid, 0, p);
20510f2f
JM
1586}
1587
1588int security_task_getsid(struct task_struct *p)
1589{
f25fce3e 1590 return call_int_hook(task_getsid, 0, p);
20510f2f
JM
1591}
1592
1593void security_task_getsecid(struct task_struct *p, u32 *secid)
1594{
b1d9e6b0 1595 *secid = 0;
f25fce3e 1596 call_void_hook(task_getsecid, p, secid);
20510f2f
JM
1597}
1598EXPORT_SYMBOL(security_task_getsecid);
1599
20510f2f
JM
1600int security_task_setnice(struct task_struct *p, int nice)
1601{
f25fce3e 1602 return call_int_hook(task_setnice, 0, p, nice);
20510f2f
JM
1603}
1604
1605int security_task_setioprio(struct task_struct *p, int ioprio)
1606{
f25fce3e 1607 return call_int_hook(task_setioprio, 0, p, ioprio);
20510f2f
JM
1608}
1609
1610int security_task_getioprio(struct task_struct *p)
1611{
f25fce3e 1612 return call_int_hook(task_getioprio, 0, p);
20510f2f
JM
1613}
1614
791ec491
SS
1615int security_task_prlimit(const struct cred *cred, const struct cred *tcred,
1616 unsigned int flags)
1617{
1618 return call_int_hook(task_prlimit, 0, cred, tcred, flags);
1619}
1620
8fd00b4d
JS
1621int security_task_setrlimit(struct task_struct *p, unsigned int resource,
1622 struct rlimit *new_rlim)
20510f2f 1623{
f25fce3e 1624 return call_int_hook(task_setrlimit, 0, p, resource, new_rlim);
20510f2f
JM
1625}
1626
b0ae1981 1627int security_task_setscheduler(struct task_struct *p)
20510f2f 1628{
f25fce3e 1629 return call_int_hook(task_setscheduler, 0, p);
20510f2f
JM
1630}
1631
1632int security_task_getscheduler(struct task_struct *p)
1633{
f25fce3e 1634 return call_int_hook(task_getscheduler, 0, p);
20510f2f
JM
1635}
1636
1637int security_task_movememory(struct task_struct *p)
1638{
f25fce3e 1639 return call_int_hook(task_movememory, 0, p);
20510f2f
JM
1640}
1641
1642int security_task_kill(struct task_struct *p, struct siginfo *info,
1643 int sig, u32 secid)
1644{
f25fce3e 1645 return call_int_hook(task_kill, 0, p, info, sig, secid);
20510f2f
JM
1646}
1647
a69a0684
JJ
1648#ifdef CONFIG_SECURITY_STACKING
1649static char *nolsm = "-default";
1650#define NOLSMLEN 9
1651
c9353421
JJ
1652static bool is_registered_lsm(const char *str, size_t size)
1653{
1654 struct security_hook_list *hp;
1655
1656 list_for_each_entry(hp, &security_hook_heads.getprocattr, list) {
1657 if (size == strlen(hp->lsm) && !strncmp(str, hp->lsm, size))
1658 return true;
1659 }
1660
1661 return false;
1662}
1663
1664static bool set_lsm_of_current(const char *str, size_t size)
1665{
1666 char *lsm = lsm_of_task(current);
1667
1668 if (is_registered_lsm(str, size)) {
1669 strncpy(lsm, str, size);
1670 lsm[size] = '\0';
1671 } else if (size == NOLSMLEN && !strncmp(str, nolsm, size)) {
1672 lsm[0] = '\0';
1673 } else {
1674 return false;
1675 }
1676 return true;
1677}
1678
a69a0684
JJ
1679static int lsm_task_prctl(int option, unsigned long arg2, unsigned long arg3,
1680 unsigned long arg4, unsigned long arg5)
1681{
1682 char *lsm = lsm_of_task(current);
1683 char buffer[SECURITY_NAME_MAX + 1];
1684 __user char *optval = (__user char *)arg2;
1685 __user int *optlen = (__user int *)arg3;
1686 int dlen;
1687 int len;
1688
1689 switch (option) {
1690 case PR_GET_DISPLAY_LSM:
1691 len = arg4;
1692 if (lsm[0] == '\0') {
1693 lsm = nolsm;
1694 dlen = NOLSMLEN;
1695 } else
1696 dlen = strlen(lsm) + 1;
1697 if (dlen > len)
1698 return -ERANGE;
1699 if (copy_to_user(optval, lsm, dlen))
1700 return -EFAULT;
1701 if (put_user(dlen, optlen))
1702 return -EFAULT;
1703 break;
1704 case PR_SET_DISPLAY_LSM:
1705 len = arg3;
1706 if (len > SECURITY_NAME_MAX)
1707 return -EINVAL;
1708 if (copy_from_user(buffer, optval, len))
1709 return -EFAULT;
1710 buffer[len] = '\0';
b3da8757 1711 /* verify the requested LSM is registered */
c9353421 1712 if (!set_lsm_of_current(buffer, len))
b3da8757 1713 return -ENOENT;
a69a0684
JJ
1714 break;
1715 default:
1716 return -ENOSYS;
1717 }
1718 return 0;
1719}
1720#endif
1721
20510f2f 1722int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
d84f4f99 1723 unsigned long arg4, unsigned long arg5)
20510f2f 1724{
b1d9e6b0
CS
1725 int thisrc;
1726 int rc = -ENOSYS;
1727 struct security_hook_list *hp;
1728
a69a0684
JJ
1729#ifdef CONFIG_SECURITY_STACKING
1730 rc = lsm_task_prctl(option, arg2, arg3, arg4, arg5);
1731 if (rc != -ENOSYS)
1732 return rc;
1733#endif
1734
b1d9e6b0
CS
1735 list_for_each_entry(hp, &security_hook_heads.task_prctl, list) {
1736 thisrc = hp->hook.task_prctl(option, arg2, arg3, arg4, arg5);
1737 if (thisrc != -ENOSYS) {
1738 rc = thisrc;
1739 if (thisrc != 0)
1740 break;
1741 }
1742 }
1743 return rc;
20510f2f
JM
1744}
1745
1746void security_task_to_inode(struct task_struct *p, struct inode *inode)
1747{
f25fce3e 1748 call_void_hook(task_to_inode, p, inode);
20510f2f
JM
1749}
1750
1751int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
1752{
f25fce3e 1753 return call_int_hook(ipc_permission, 0, ipcp, flag);
20510f2f
JM
1754}
1755
8a076191
AD
1756void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
1757{
b1d9e6b0 1758 *secid = 0;
f25fce3e 1759 call_void_hook(ipc_getsecid, ipcp, secid);
8a076191
AD
1760}
1761
20510f2f
JM
1762int security_msg_msg_alloc(struct msg_msg *msg)
1763{
7a90fc39
CS
1764 int rc = lsm_msg_msg_alloc(msg);
1765
1766 if (unlikely(rc))
1767 return rc;
1768 rc = call_int_hook(msg_msg_alloc_security, 0, msg);
1769 if (unlikely(rc))
1770 security_msg_msg_free(msg);
1771 return rc;
20510f2f
JM
1772}
1773
1774void security_msg_msg_free(struct msg_msg *msg)
1775{
f25fce3e 1776 call_void_hook(msg_msg_free_security, msg);
7a90fc39
CS
1777 kfree(msg->security);
1778 msg->security = NULL;
20510f2f
JM
1779}
1780
1781int security_msg_queue_alloc(struct msg_queue *msq)
1782{
7a90fc39
CS
1783 int rc = lsm_ipc_alloc(&msq->q_perm);
1784
1785 if (unlikely(rc))
1786 return rc;
1787 rc = call_int_hook(msg_queue_alloc_security, 0, msq);
1788 if (unlikely(rc))
1789 security_msg_queue_free(msq);
1790 return rc;
20510f2f
JM
1791}
1792
1793void security_msg_queue_free(struct msg_queue *msq)
1794{
7a90fc39
CS
1795 struct kern_ipc_perm *kip = &msq->q_perm;
1796
f25fce3e 1797 call_void_hook(msg_queue_free_security, msq);
7a90fc39
CS
1798 kfree(kip->security);
1799 kip->security = NULL;
20510f2f
JM
1800}
1801
1802int security_msg_queue_associate(struct msg_queue *msq, int msqflg)
1803{
f25fce3e 1804 return call_int_hook(msg_queue_associate, 0, msq, msqflg);
20510f2f
JM
1805}
1806
1807int security_msg_queue_msgctl(struct msg_queue *msq, int cmd)
1808{
f25fce3e 1809 return call_int_hook(msg_queue_msgctl, 0, msq, cmd);
20510f2f
JM
1810}
1811
1812int security_msg_queue_msgsnd(struct msg_queue *msq,
1813 struct msg_msg *msg, int msqflg)
1814{
f25fce3e 1815 return call_int_hook(msg_queue_msgsnd, 0, msq, msg, msqflg);
20510f2f
JM
1816}
1817
1818int security_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
1819 struct task_struct *target, long type, int mode)
1820{
f25fce3e 1821 return call_int_hook(msg_queue_msgrcv, 0, msq, msg, target, type, mode);
20510f2f
JM
1822}
1823
1824int security_shm_alloc(struct shmid_kernel *shp)
1825{
7a90fc39
CS
1826 int rc = lsm_ipc_alloc(&shp->shm_perm);
1827
1828 if (unlikely(rc))
1829 return rc;
1830 rc = call_int_hook(shm_alloc_security, 0, shp);
1831 if (unlikely(rc))
1832 security_shm_free(shp);
1833 return rc;
20510f2f
JM
1834}
1835
1836void security_shm_free(struct shmid_kernel *shp)
1837{
7a90fc39
CS
1838 struct kern_ipc_perm *kip = &shp->shm_perm;
1839
f25fce3e 1840 call_void_hook(shm_free_security, shp);
7a90fc39
CS
1841 kfree(kip->security);
1842 kip->security = NULL;
20510f2f
JM
1843}
1844
1845int security_shm_associate(struct shmid_kernel *shp, int shmflg)
1846{
f25fce3e 1847 return call_int_hook(shm_associate, 0, shp, shmflg);
20510f2f
JM
1848}
1849
1850int security_shm_shmctl(struct shmid_kernel *shp, int cmd)
1851{
f25fce3e 1852 return call_int_hook(shm_shmctl, 0, shp, cmd);
20510f2f
JM
1853}
1854
1855int security_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr, int shmflg)
1856{
f25fce3e 1857 return call_int_hook(shm_shmat, 0, shp, shmaddr, shmflg);
20510f2f
JM
1858}
1859
1860int security_sem_alloc(struct sem_array *sma)
1861{
7a90fc39
CS
1862 int rc = lsm_ipc_alloc(&sma->sem_perm);
1863
1864 if (unlikely(rc))
1865 return rc;
1866 rc = call_int_hook(sem_alloc_security, 0, sma);
1867 if (unlikely(rc))
1868 security_sem_free(sma);
1869 return rc;
20510f2f
JM
1870}
1871
1872void security_sem_free(struct sem_array *sma)
1873{
7a90fc39
CS
1874 struct kern_ipc_perm *kip = &sma->sem_perm;
1875
f25fce3e 1876 call_void_hook(sem_free_security, sma);
7a90fc39
CS
1877 kfree(kip->security);
1878 kip->security = NULL;
20510f2f
JM
1879}
1880
1881int security_sem_associate(struct sem_array *sma, int semflg)
1882{
f25fce3e 1883 return call_int_hook(sem_associate, 0, sma, semflg);
20510f2f
JM
1884}
1885
1886int security_sem_semctl(struct sem_array *sma, int cmd)
1887{
f25fce3e 1888 return call_int_hook(sem_semctl, 0, sma, cmd);
20510f2f
JM
1889}
1890
1891int security_sem_semop(struct sem_array *sma, struct sembuf *sops,
1892 unsigned nsops, int alter)
1893{
f25fce3e 1894 return call_int_hook(sem_semop, 0, sma, sops, nsops, alter);
20510f2f
JM
1895}
1896
1897void security_d_instantiate(struct dentry *dentry, struct inode *inode)
1898{
1899 if (unlikely(inode && IS_PRIVATE(inode)))
1900 return;
f25fce3e 1901 call_void_hook(d_instantiate, dentry, inode);
20510f2f
JM
1902}
1903EXPORT_SYMBOL(security_d_instantiate);
1904
dcd148a1
CS
1905int security_getprocattr(struct task_struct *p, const char *lsm, char *name,
1906 char **value)
20510f2f 1907{
a69a0684
JJ
1908#ifdef CONFIG_SECURITY_STACKING
1909 char *speclsm = lsm_of_task(p);
1910#endif
dcd148a1 1911 struct security_hook_list *hp;
c9353421
JJ
1912 int rc;
1913
5a1d919f 1914 if (strcmp(name, "display_lsm") == 0) {
c9353421
JJ
1915 *value = kstrdup(current->security, GFP_KERNEL);
1916 if (*value == NULL)
1917 return -ENOMEM;
1918 return strlen(*value);
1919 }
dcd148a1
CS
1920
1921 list_for_each_entry(hp, &security_hook_heads.getprocattr, list) {
1922 if (lsm != NULL && strcmp(lsm, hp->lsm))
1923 continue;
a69a0684
JJ
1924#ifdef CONFIG_SECURITY_STACKING
1925 if (!lsm && speclsm && speclsm[0] && strcmp(speclsm, hp->lsm))
1926 continue;
1927#endif
1928 rc = hp->hook.getprocattr(p, name, value);
1929 if (rc != -ENOSYS)
1930 return rc;
dcd148a1
CS
1931 }
1932 return -EINVAL;
20510f2f
JM
1933}
1934
dcd148a1
CS
1935int security_setprocattr(const char *lsm, const char *name, void *value,
1936 size_t size)
20510f2f 1937{
a69a0684
JJ
1938#ifdef CONFIG_SECURITY_STACKING
1939 char *speclsm = lsm_of_task(current);
a69a0684
JJ
1940#else
1941 char *tvalue;
1942#endif
dcd148a1 1943 struct security_hook_list *hp;
a69a0684 1944 int rc;
a69a0684 1945
36788bfe
CIK
1946 if (!size)
1947 return -EINVAL;
1948
5a1d919f 1949 if (strcmp(name, "display_lsm") == 0) {
c9353421
JJ
1950#ifdef CONFIG_SECURITY_STACKING
1951 if (set_lsm_of_current(value, size))
1952 return size;
1953#endif
1954 return -EINVAL;
a69a0684 1955 }
dcd148a1
CS
1956
1957 list_for_each_entry(hp, &security_hook_heads.setprocattr, list) {
a69a0684
JJ
1958#ifdef CONFIG_SECURITY_STACKING
1959 if (!lsm && speclsm && speclsm[0] && strcmp(speclsm, hp->lsm))
dcd148a1 1960 continue;
a69a0684
JJ
1961#endif
1962 rc = hp->hook.setprocattr(name, value, size);
1963 if (rc)
1964 return rc;
dcd148a1
CS
1965 }
1966 return -EINVAL;
20510f2f
JM
1967}
1968
1969int security_netlink_send(struct sock *sk, struct sk_buff *skb)
1970{
f25fce3e 1971 return call_int_hook(netlink_send, 0, sk, skb);
20510f2f 1972}
20510f2f 1973
746df9b5
DQ
1974int security_ismaclabel(const char *name)
1975{
f25fce3e 1976 return call_int_hook(ismaclabel, 0, name);
746df9b5
DQ
1977}
1978EXPORT_SYMBOL(security_ismaclabel);
1979
20510f2f
JM
1980int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
1981{
b1d9e6b0
CS
1982 return call_int_hook(secid_to_secctx, -EOPNOTSUPP, secid, secdata,
1983 seclen);
20510f2f
JM
1984}
1985EXPORT_SYMBOL(security_secid_to_secctx);
1986
7bf570dc 1987int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
63cb3449 1988{
b1d9e6b0 1989 *secid = 0;
f25fce3e 1990 return call_int_hook(secctx_to_secid, 0, secdata, seclen, secid);
63cb3449
DH
1991}
1992EXPORT_SYMBOL(security_secctx_to_secid);
1993
20510f2f
JM
1994void security_release_secctx(char *secdata, u32 seclen)
1995{
a69a0684
JJ
1996#ifdef CONFIG_SECURITY_STACKING
1997 char *speclsm = lsm_of_task(current);
1998#endif
1999 struct security_hook_list *hp;
2000
2001 list_for_each_entry(hp, &security_hook_heads.release_secctx, list) {
2002#ifdef CONFIG_SECURITY_STACKING
2003 if (speclsm[0] && strcmp(hp->lsm, speclsm))
2004 continue;
2005#endif
2006 hp->hook.release_secctx(secdata, seclen);
2007 break;
2008 }
20510f2f
JM
2009}
2010EXPORT_SYMBOL(security_release_secctx);
2011
6f3be9f5
AG
2012void security_inode_invalidate_secctx(struct inode *inode)
2013{
2014 call_void_hook(inode_invalidate_secctx, inode);
2015}
2016EXPORT_SYMBOL(security_inode_invalidate_secctx);
2017
1ee65e37
DQ
2018int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
2019{
f25fce3e 2020 return call_int_hook(inode_notifysecctx, 0, inode, ctx, ctxlen);
1ee65e37
DQ
2021}
2022EXPORT_SYMBOL(security_inode_notifysecctx);
2023
2024int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
2025{
f25fce3e 2026 return call_int_hook(inode_setsecctx, 0, dentry, ctx, ctxlen);
1ee65e37
DQ
2027}
2028EXPORT_SYMBOL(security_inode_setsecctx);
2029
2030int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
2031{
b1d9e6b0 2032 return call_int_hook(inode_getsecctx, -EOPNOTSUPP, inode, ctx, ctxlen);
1ee65e37
DQ
2033}
2034EXPORT_SYMBOL(security_inode_getsecctx);
2035
20510f2f
JM
2036#ifdef CONFIG_SECURITY_NETWORK
2037
3610cda5 2038int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk)
20510f2f 2039{
f25fce3e 2040 return call_int_hook(unix_stream_connect, 0, sock, other, newsk);
20510f2f
JM
2041}
2042EXPORT_SYMBOL(security_unix_stream_connect);
2043
2044int security_unix_may_send(struct socket *sock, struct socket *other)
2045{
f25fce3e 2046 return call_int_hook(unix_may_send, 0, sock, other);
20510f2f
JM
2047}
2048EXPORT_SYMBOL(security_unix_may_send);
2049
2050int security_socket_create(int family, int type, int protocol, int kern)
2051{
f25fce3e 2052 return call_int_hook(socket_create, 0, family, type, protocol, kern);
20510f2f
JM
2053}
2054
2055int security_socket_post_create(struct socket *sock, int family,
2056 int type, int protocol, int kern)
2057{
f25fce3e 2058 return call_int_hook(socket_post_create, 0, sock, family, type,
20510f2f
JM
2059 protocol, kern);
2060}
2061
2062int security_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
2063{
f25fce3e 2064 return call_int_hook(socket_bind, 0, sock, address, addrlen);
20510f2f
JM
2065}
2066
2067int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
2068{
f25fce3e 2069 return call_int_hook(socket_connect, 0, sock, address, addrlen);
20510f2f
JM
2070}
2071
2072int security_socket_listen(struct socket *sock, int backlog)
2073{
f25fce3e 2074 return call_int_hook(socket_listen, 0, sock, backlog);
20510f2f
JM
2075}
2076
2077int security_socket_accept(struct socket *sock, struct socket *newsock)
2078{
f25fce3e 2079 return call_int_hook(socket_accept, 0, sock, newsock);
20510f2f
JM
2080}
2081
20510f2f
JM
2082int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size)
2083{
f25fce3e 2084 return call_int_hook(socket_sendmsg, 0, sock, msg, size);
20510f2f
JM
2085}
2086
2087int security_socket_recvmsg(struct socket *sock, struct msghdr *msg,
2088 int size, int flags)
2089{
f25fce3e 2090 return call_int_hook(socket_recvmsg, 0, sock, msg, size, flags);
20510f2f
JM
2091}
2092
2093int security_socket_getsockname(struct socket *sock)
2094{
f25fce3e 2095 return call_int_hook(socket_getsockname, 0, sock);
20510f2f
JM
2096}
2097
2098int security_socket_getpeername(struct socket *sock)
2099{
f25fce3e 2100 return call_int_hook(socket_getpeername, 0, sock);
20510f2f
JM
2101}
2102
2103int security_socket_getsockopt(struct socket *sock, int level, int optname)
2104{
f25fce3e 2105 return call_int_hook(socket_getsockopt, 0, sock, level, optname);
20510f2f
JM
2106}
2107
2108int security_socket_setsockopt(struct socket *sock, int level, int optname)
2109{
f25fce3e 2110 return call_int_hook(socket_setsockopt, 0, sock, level, optname);
20510f2f
JM
2111}
2112
2113int security_socket_shutdown(struct socket *sock, int how)
2114{
f25fce3e 2115 return call_int_hook(socket_shutdown, 0, sock, how);
20510f2f
JM
2116}
2117
2118int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
2119{
f25fce3e 2120 return call_int_hook(socket_sock_rcv_skb, 0, sk, skb);
20510f2f
JM
2121}
2122EXPORT_SYMBOL(security_sock_rcv_skb);
2123
2124int security_socket_getpeersec_stream(struct socket *sock, char __user *optval,
2125 int __user *optlen, unsigned len)
2126{
8e42f92b
JJ
2127#ifdef CONFIG_SECURITY_STACKING
2128 struct security_hook_list *hp;
2129 char *lsm = lsm_of_task(current);
2130
2131 list_for_each_entry(hp, &security_hook_heads.socket_getpeersec_stream,
2132 list) {
2133 if (!lsm || !lsm[0] || !strcmp(lsm, hp->lsm))
2134 return hp->hook.socket_getpeersec_stream(sock, optval,
2135 optlen, len);
2136 }
2137 return -ENOPROTOOPT;
2138#else
b1d9e6b0
CS
2139 return call_int_hook(socket_getpeersec_stream, -ENOPROTOOPT, sock,
2140 optval, optlen, len);
8e42f92b 2141#endif
20510f2f
JM
2142}
2143
2144int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
2145{
e308fd3b
JB
2146 return call_int_hook(socket_getpeersec_dgram, -ENOPROTOOPT, sock,
2147 skb, secid);
20510f2f
JM
2148}
2149EXPORT_SYMBOL(security_socket_getpeersec_dgram);
2150
2151int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
2152{
7a90fc39
CS
2153 int rc = lsm_sock_alloc(sk, priority);
2154
2155 if (unlikely(rc))
2156 return rc;
2157 rc = call_int_hook(sk_alloc_security, 0, sk, family, priority);
2158 if (unlikely(rc))
2159 security_sk_free(sk);
2160 return rc;
20510f2f
JM
2161}
2162
2163void security_sk_free(struct sock *sk)
2164{
f25fce3e 2165 call_void_hook(sk_free_security, sk);
7a90fc39
CS
2166 kfree(sk->sk_security);
2167 sk->sk_security = NULL;
20510f2f
JM
2168}
2169
2170void security_sk_clone(const struct sock *sk, struct sock *newsk)
2171{
f25fce3e 2172 call_void_hook(sk_clone_security, sk, newsk);
20510f2f 2173}
6230c9b4 2174EXPORT_SYMBOL(security_sk_clone);
20510f2f
JM
2175
2176void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
2177{
f25fce3e 2178 call_void_hook(sk_getsecid, sk, &fl->flowi_secid);
20510f2f
JM
2179}
2180EXPORT_SYMBOL(security_sk_classify_flow);
2181
2182void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
2183{
f25fce3e 2184 call_void_hook(req_classify_flow, req, fl);
20510f2f
JM
2185}
2186EXPORT_SYMBOL(security_req_classify_flow);
2187
2188void security_sock_graft(struct sock *sk, struct socket *parent)
2189{
f25fce3e 2190 call_void_hook(sock_graft, sk, parent);
20510f2f
JM
2191}
2192EXPORT_SYMBOL(security_sock_graft);
2193
2194int security_inet_conn_request(struct sock *sk,
2195 struct sk_buff *skb, struct request_sock *req)
2196{
f25fce3e 2197 return call_int_hook(inet_conn_request, 0, sk, skb, req);
20510f2f
JM
2198}
2199EXPORT_SYMBOL(security_inet_conn_request);
2200
2201void security_inet_csk_clone(struct sock *newsk,
2202 const struct request_sock *req)
2203{
f25fce3e 2204 call_void_hook(inet_csk_clone, newsk, req);
20510f2f
JM
2205}
2206
2207void security_inet_conn_established(struct sock *sk,
2208 struct sk_buff *skb)
2209{
f25fce3e 2210 call_void_hook(inet_conn_established, sk, skb);
20510f2f
JM
2211}
2212
2606fd1f
EP
2213int security_secmark_relabel_packet(u32 secid)
2214{
f25fce3e 2215 return call_int_hook(secmark_relabel_packet, 0, secid);
2606fd1f
EP
2216}
2217EXPORT_SYMBOL(security_secmark_relabel_packet);
2218
2219void security_secmark_refcount_inc(void)
2220{
f25fce3e 2221 call_void_hook(secmark_refcount_inc);
2606fd1f
EP
2222}
2223EXPORT_SYMBOL(security_secmark_refcount_inc);
2224
2225void security_secmark_refcount_dec(void)
2226{
f25fce3e 2227 call_void_hook(secmark_refcount_dec);
2606fd1f
EP
2228}
2229EXPORT_SYMBOL(security_secmark_refcount_dec);
2230
5dbbaf2d
PM
2231int security_tun_dev_alloc_security(void **security)
2232{
f25fce3e 2233 return call_int_hook(tun_dev_alloc_security, 0, security);
5dbbaf2d
PM
2234}
2235EXPORT_SYMBOL(security_tun_dev_alloc_security);
2236
2237void security_tun_dev_free_security(void *security)
2238{
f25fce3e 2239 call_void_hook(tun_dev_free_security, security);
5dbbaf2d
PM
2240}
2241EXPORT_SYMBOL(security_tun_dev_free_security);
2242
2b980dbd
PM
2243int security_tun_dev_create(void)
2244{
f25fce3e 2245 return call_int_hook(tun_dev_create, 0);
2b980dbd
PM
2246}
2247EXPORT_SYMBOL(security_tun_dev_create);
2248
5dbbaf2d 2249int security_tun_dev_attach_queue(void *security)
2b980dbd 2250{
f25fce3e 2251 return call_int_hook(tun_dev_attach_queue, 0, security);
2b980dbd 2252}
5dbbaf2d 2253EXPORT_SYMBOL(security_tun_dev_attach_queue);
2b980dbd 2254
5dbbaf2d 2255int security_tun_dev_attach(struct sock *sk, void *security)
2b980dbd 2256{
f25fce3e 2257 return call_int_hook(tun_dev_attach, 0, sk, security);
2b980dbd
PM
2258}
2259EXPORT_SYMBOL(security_tun_dev_attach);
2260
5dbbaf2d
PM
2261int security_tun_dev_open(void *security)
2262{
f25fce3e 2263 return call_int_hook(tun_dev_open, 0, security);
5dbbaf2d
PM
2264}
2265EXPORT_SYMBOL(security_tun_dev_open);
2266
20510f2f
JM
2267#endif /* CONFIG_SECURITY_NETWORK */
2268
d291f1a6
DJ
2269#ifdef CONFIG_SECURITY_INFINIBAND
2270
2271int security_ib_pkey_access(void *sec, u64 subnet_prefix, u16 pkey)
2272{
2273 return call_int_hook(ib_pkey_access, 0, sec, subnet_prefix, pkey);
2274}
2275EXPORT_SYMBOL(security_ib_pkey_access);
2276
47a2b338
DJ
2277int security_ib_endport_manage_subnet(void *sec, const char *dev_name, u8 port_num)
2278{
2279 return call_int_hook(ib_endport_manage_subnet, 0, sec, dev_name, port_num);
2280}
2281EXPORT_SYMBOL(security_ib_endport_manage_subnet);
2282
d291f1a6
DJ
2283int security_ib_alloc_security(void **sec)
2284{
2285 return call_int_hook(ib_alloc_security, 0, sec);
2286}
2287EXPORT_SYMBOL(security_ib_alloc_security);
2288
2289void security_ib_free_security(void *sec)
2290{
2291 call_void_hook(ib_free_security, sec);
2292}
2293EXPORT_SYMBOL(security_ib_free_security);
2294#endif /* CONFIG_SECURITY_INFINIBAND */
2295
20510f2f
JM
2296#ifdef CONFIG_SECURITY_NETWORK_XFRM
2297
52a4c640
NA
2298int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
2299 struct xfrm_user_sec_ctx *sec_ctx,
2300 gfp_t gfp)
20510f2f 2301{
f25fce3e 2302 return call_int_hook(xfrm_policy_alloc_security, 0, ctxp, sec_ctx, gfp);
20510f2f
JM
2303}
2304EXPORT_SYMBOL(security_xfrm_policy_alloc);
2305
03e1ad7b
PM
2306int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
2307 struct xfrm_sec_ctx **new_ctxp)
20510f2f 2308{
f25fce3e 2309 return call_int_hook(xfrm_policy_clone_security, 0, old_ctx, new_ctxp);
20510f2f
JM
2310}
2311
03e1ad7b 2312void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
20510f2f 2313{
f25fce3e 2314 call_void_hook(xfrm_policy_free_security, ctx);
20510f2f
JM
2315}
2316EXPORT_SYMBOL(security_xfrm_policy_free);
2317
03e1ad7b 2318int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
20510f2f 2319{
f25fce3e 2320 return call_int_hook(xfrm_policy_delete_security, 0, ctx);
20510f2f
JM
2321}
2322
2e5aa866
PM
2323int security_xfrm_state_alloc(struct xfrm_state *x,
2324 struct xfrm_user_sec_ctx *sec_ctx)
20510f2f 2325{
f25fce3e 2326 return call_int_hook(xfrm_state_alloc, 0, x, sec_ctx);
20510f2f
JM
2327}
2328EXPORT_SYMBOL(security_xfrm_state_alloc);
2329
2330int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
2331 struct xfrm_sec_ctx *polsec, u32 secid)
2332{
f25fce3e 2333 return call_int_hook(xfrm_state_alloc_acquire, 0, x, polsec, secid);
20510f2f
JM
2334}
2335
2336int security_xfrm_state_delete(struct xfrm_state *x)
2337{
f25fce3e 2338 return call_int_hook(xfrm_state_delete_security, 0, x);
20510f2f
JM
2339}
2340EXPORT_SYMBOL(security_xfrm_state_delete);
2341
2342void security_xfrm_state_free(struct xfrm_state *x)
2343{
f25fce3e 2344 call_void_hook(xfrm_state_free_security, x);
20510f2f
JM
2345}
2346
03e1ad7b 2347int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
20510f2f 2348{
f25fce3e 2349 return call_int_hook(xfrm_policy_lookup, 0, ctx, fl_secid, dir);
20510f2f
JM
2350}
2351
2352int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
e33f7704
DM
2353 struct xfrm_policy *xp,
2354 const struct flowi *fl)
20510f2f 2355{
b1d9e6b0
CS
2356 struct security_hook_list *hp;
2357 int rc = 1;
2358
2359 /*
2360 * Since this function is expected to return 0 or 1, the judgment
2361 * becomes difficult if multiple LSMs supply this call. Fortunately,
2362 * we can use the first LSM's judgment because currently only SELinux
2363 * supplies this call.
2364 *
2365 * For speed optimization, we explicitly break the loop rather than
2366 * using the macro
2367 */
2368 list_for_each_entry(hp, &security_hook_heads.xfrm_state_pol_flow_match,
2369 list) {
2370 rc = hp->hook.xfrm_state_pol_flow_match(x, xp, fl);
2371 break;
2372 }
2373 return rc;
20510f2f
JM
2374}
2375
2376int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
2377{
f25fce3e 2378 return call_int_hook(xfrm_decode_session, 0, skb, secid, 1);
20510f2f
JM
2379}
2380
2381void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl)
2382{
f25fce3e
CS
2383 int rc = call_int_hook(xfrm_decode_session, 0, skb, &fl->flowi_secid,
2384 0);
20510f2f
JM
2385
2386 BUG_ON(rc);
2387}
2388EXPORT_SYMBOL(security_skb_classify_flow);
2389
2390#endif /* CONFIG_SECURITY_NETWORK_XFRM */
2391
2392#ifdef CONFIG_KEYS
2393
d84f4f99
DH
2394int security_key_alloc(struct key *key, const struct cred *cred,
2395 unsigned long flags)
20510f2f 2396{
7a90fc39
CS
2397 int rc = lsm_key_alloc(key);
2398
2399 if (unlikely(rc))
2400 return rc;
2401 rc = call_int_hook(key_alloc, 0, key, cred, flags);
2402 if (unlikely(rc))
2403 security_key_free(key);
2404 return rc;
20510f2f
JM
2405}
2406
2407void security_key_free(struct key *key)
2408{
f25fce3e 2409 call_void_hook(key_free, key);
7a90fc39
CS
2410 kfree(key->security);
2411 key->security = NULL;
20510f2f
JM
2412}
2413
2414int security_key_permission(key_ref_t key_ref,
f5895943 2415 const struct cred *cred, unsigned perm)
20510f2f 2416{
f25fce3e 2417 return call_int_hook(key_permission, 0, key_ref, cred, perm);
20510f2f
JM
2418}
2419
70a5bb72
DH
2420int security_key_getsecurity(struct key *key, char **_buffer)
2421{
b1d9e6b0 2422 *_buffer = NULL;
f25fce3e 2423 return call_int_hook(key_getsecurity, 0, key, _buffer);
70a5bb72
DH
2424}
2425
20510f2f 2426#endif /* CONFIG_KEYS */
03d37d25
AD
2427
2428#ifdef CONFIG_AUDIT
2429
2430int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule)
2431{
f25fce3e 2432 return call_int_hook(audit_rule_init, 0, field, op, rulestr, lsmrule);
03d37d25
AD
2433}
2434
2435int security_audit_rule_known(struct audit_krule *krule)
2436{
f25fce3e 2437 return call_int_hook(audit_rule_known, 0, krule);
03d37d25
AD
2438}
2439
2440void security_audit_rule_free(void *lsmrule)
2441{
f25fce3e 2442 call_void_hook(audit_rule_free, lsmrule);
03d37d25
AD
2443}
2444
2445int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule,
2446 struct audit_context *actx)
2447{
f25fce3e
CS
2448 return call_int_hook(audit_rule_match, 0, secid, field, op, lsmrule,
2449 actx);
03d37d25 2450}
b1d9e6b0 2451#endif /* CONFIG_AUDIT */
afdb09c7
CF
2452
2453#ifdef CONFIG_BPF_SYSCALL
2454int security_bpf(int cmd, union bpf_attr *attr, unsigned int size)
2455{
2456 return call_int_hook(bpf, 0, cmd, attr, size);
2457}
2458int security_bpf_map(struct bpf_map *map, fmode_t fmode)
2459{
2460 return call_int_hook(bpf_map, 0, map, fmode);
2461}
2462int security_bpf_prog(struct bpf_prog *prog)
2463{
2464 return call_int_hook(bpf_prog, 0, prog);
2465}
2466int security_bpf_map_alloc(struct bpf_map *map)
2467{
2468 return call_int_hook(bpf_map_alloc_security, 0, map);
2469}
2470int security_bpf_prog_alloc(struct bpf_prog_aux *aux)
2471{
2472 return call_int_hook(bpf_prog_alloc_security, 0, aux);
2473}
2474void security_bpf_map_free(struct bpf_map *map)
2475{
2476 call_void_hook(bpf_map_free_security, map);
2477}
2478void security_bpf_prog_free(struct bpf_prog_aux *aux)
2479{
2480 call_void_hook(bpf_prog_free_security, aux);
2481}
2482#endif /* CONFIG_BPF_SYSCALL */