Line data Source code
1 : /*
2 : * Linux Security plug
3 : *
4 : * Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com>
5 : * Copyright (C) 2001 Greg Kroah-Hartman <greg@kroah.com>
6 : * Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com>
7 : * Copyright (C) 2001 James Morris <jmorris@intercode.com.au>
8 : * Copyright (C) 2001 Silicon Graphics, Inc. (Trust Technology Group)
9 : * Copyright (C) 2016 Mellanox Techonologies
10 : *
11 : * This program is free software; you can redistribute it and/or modify
12 : * it under the terms of the GNU General Public License as published by
13 : * the Free Software Foundation; either version 2 of the License, or
14 : * (at your option) any later version.
15 : *
16 : * Due to this file being licensed under the GPL there is controversy over
17 : * whether this permits you to write a module that #includes this file
18 : * without placing your module under the GPL. Please consult a lawyer for
19 : * advice before doing this.
20 : *
21 : */
22 :
23 : #ifndef __LINUX_SECURITY_H
24 : #define __LINUX_SECURITY_H
25 :
26 : #include <linux/kernel_read_file.h>
27 : #include <linux/key.h>
28 : #include <linux/capability.h>
29 : #include <linux/fs.h>
30 : #include <linux/slab.h>
31 : #include <linux/err.h>
32 : #include <linux/string.h>
33 : #include <linux/mm.h>
34 : #include <linux/sockptr.h>
35 :
36 : struct linux_binprm;
37 : struct cred;
38 : struct rlimit;
39 : struct kernel_siginfo;
40 : struct sembuf;
41 : struct kern_ipc_perm;
42 : struct audit_context;
43 : struct super_block;
44 : struct inode;
45 : struct dentry;
46 : struct file;
47 : struct vfsmount;
48 : struct path;
49 : struct qstr;
50 : struct iattr;
51 : struct fown_struct;
52 : struct file_operations;
53 : struct msg_msg;
54 : struct xattr;
55 : struct kernfs_node;
56 : struct xfrm_sec_ctx;
57 : struct mm_struct;
58 : struct fs_context;
59 : struct fs_parameter;
60 : enum fs_value_type;
61 : struct watch;
62 : struct watch_notification;
63 :
64 : /* Default (no) options for the capable function */
65 : #define CAP_OPT_NONE 0x0
66 : /* If capable should audit the security request */
67 : #define CAP_OPT_NOAUDIT BIT(1)
68 : /* If capable is being called by a setid function */
69 : #define CAP_OPT_INSETID BIT(2)
70 :
71 : /* LSM Agnostic defines for security_sb_set_mnt_opts() flags */
72 : #define SECURITY_LSM_NATIVE_LABELS 1
73 :
74 : struct ctl_table;
75 : struct audit_krule;
76 : struct user_namespace;
77 : struct timezone;
78 :
79 : enum lsm_event {
80 : LSM_POLICY_CHANGE,
81 : };
82 :
83 : /*
84 : * These are reasons that can be passed to the security_locked_down()
85 : * LSM hook. Lockdown reasons that protect kernel integrity (ie, the
86 : * ability for userland to modify kernel code) are placed before
87 : * LOCKDOWN_INTEGRITY_MAX. Lockdown reasons that protect kernel
88 : * confidentiality (ie, the ability for userland to extract
89 : * information from the running kernel that would otherwise be
90 : * restricted) are placed before LOCKDOWN_CONFIDENTIALITY_MAX.
91 : *
92 : * LSM authors should note that the semantics of any given lockdown
93 : * reason are not guaranteed to be stable - the same reason may block
94 : * one set of features in one kernel release, and a slightly different
95 : * set of features in a later kernel release. LSMs that seek to expose
96 : * lockdown policy at any level of granularity other than "none",
97 : * "integrity" or "confidentiality" are responsible for either
98 : * ensuring that they expose a consistent level of functionality to
99 : * userland, or ensuring that userland is aware that this is
100 : * potentially a moving target. It is easy to misuse this information
101 : * in a way that could break userspace. Please be careful not to do
102 : * so.
103 : *
104 : * If you add to this, remember to extend lockdown_reasons in
105 : * security/lockdown/lockdown.c.
106 : */
107 : enum lockdown_reason {
108 : LOCKDOWN_NONE,
109 : LOCKDOWN_MODULE_SIGNATURE,
110 : LOCKDOWN_DEV_MEM,
111 : LOCKDOWN_EFI_TEST,
112 : LOCKDOWN_KEXEC,
113 : LOCKDOWN_HIBERNATION,
114 : LOCKDOWN_PCI_ACCESS,
115 : LOCKDOWN_IOPORT,
116 : LOCKDOWN_MSR,
117 : LOCKDOWN_ACPI_TABLES,
118 : LOCKDOWN_DEVICE_TREE,
119 : LOCKDOWN_PCMCIA_CIS,
120 : LOCKDOWN_TIOCSSERIAL,
121 : LOCKDOWN_MODULE_PARAMETERS,
122 : LOCKDOWN_MMIOTRACE,
123 : LOCKDOWN_DEBUGFS,
124 : LOCKDOWN_XMON_WR,
125 : LOCKDOWN_BPF_WRITE_USER,
126 : LOCKDOWN_DBG_WRITE_KERNEL,
127 : LOCKDOWN_RTAS_ERROR_INJECTION,
128 : LOCKDOWN_INTEGRITY_MAX,
129 : LOCKDOWN_KCORE,
130 : LOCKDOWN_KPROBES,
131 : LOCKDOWN_BPF_READ_KERNEL,
132 : LOCKDOWN_DBG_READ_KERNEL,
133 : LOCKDOWN_PERF,
134 : LOCKDOWN_TRACEFS,
135 : LOCKDOWN_XMON_RW,
136 : LOCKDOWN_XFRM_SECRET,
137 : LOCKDOWN_CONFIDENTIALITY_MAX,
138 : };
139 :
140 : extern const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1];
141 :
142 : /* These functions are in security/commoncap.c */
143 : extern int cap_capable(const struct cred *cred, struct user_namespace *ns,
144 : int cap, unsigned int opts);
145 : extern int cap_settime(const struct timespec64 *ts, const struct timezone *tz);
146 : extern int cap_ptrace_access_check(struct task_struct *child, unsigned int mode);
147 : extern int cap_ptrace_traceme(struct task_struct *parent);
148 : extern int cap_capget(struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);
149 : extern int cap_capset(struct cred *new, const struct cred *old,
150 : const kernel_cap_t *effective,
151 : const kernel_cap_t *inheritable,
152 : const kernel_cap_t *permitted);
153 : extern int cap_bprm_creds_from_file(struct linux_binprm *bprm, struct file *file);
154 : int cap_inode_setxattr(struct dentry *dentry, const char *name,
155 : const void *value, size_t size, int flags);
156 : int cap_inode_removexattr(struct mnt_idmap *idmap,
157 : struct dentry *dentry, const char *name);
158 : int cap_inode_need_killpriv(struct dentry *dentry);
159 : int cap_inode_killpriv(struct mnt_idmap *idmap, struct dentry *dentry);
160 : int cap_inode_getsecurity(struct mnt_idmap *idmap,
161 : struct inode *inode, const char *name, void **buffer,
162 : bool alloc);
163 : extern int cap_mmap_addr(unsigned long addr);
164 : extern int cap_mmap_file(struct file *file, unsigned long reqprot,
165 : unsigned long prot, unsigned long flags);
166 : extern int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags);
167 : extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
168 : unsigned long arg4, unsigned long arg5);
169 : extern int cap_task_setscheduler(struct task_struct *p);
170 : extern int cap_task_setioprio(struct task_struct *p, int ioprio);
171 : extern int cap_task_setnice(struct task_struct *p, int nice);
172 : extern int cap_vm_enough_memory(struct mm_struct *mm, long pages);
173 :
174 : struct msghdr;
175 : struct sk_buff;
176 : struct sock;
177 : struct sockaddr;
178 : struct socket;
179 : struct flowi_common;
180 : struct dst_entry;
181 : struct xfrm_selector;
182 : struct xfrm_policy;
183 : struct xfrm_state;
184 : struct xfrm_user_sec_ctx;
185 : struct seq_file;
186 : struct sctp_association;
187 :
188 : #ifdef CONFIG_MMU
189 : extern unsigned long mmap_min_addr;
190 : extern unsigned long dac_mmap_min_addr;
191 : #else
192 : #define mmap_min_addr 0UL
193 : #define dac_mmap_min_addr 0UL
194 : #endif
195 :
196 : /*
197 : * Values used in the task_security_ops calls
198 : */
199 : /* setuid or setgid, id0 == uid or gid */
200 : #define LSM_SETID_ID 1
201 :
202 : /* setreuid or setregid, id0 == real, id1 == eff */
203 : #define LSM_SETID_RE 2
204 :
205 : /* setresuid or setresgid, id0 == real, id1 == eff, uid2 == saved */
206 : #define LSM_SETID_RES 4
207 :
208 : /* setfsuid or setfsgid, id0 == fsuid or fsgid */
209 : #define LSM_SETID_FS 8
210 :
211 : /* Flags for security_task_prlimit(). */
212 : #define LSM_PRLIMIT_READ 1
213 : #define LSM_PRLIMIT_WRITE 2
214 :
215 : /* forward declares to avoid warnings */
216 : struct sched_param;
217 : struct request_sock;
218 :
219 : /* bprm->unsafe reasons */
220 : #define LSM_UNSAFE_SHARE 1
221 : #define LSM_UNSAFE_PTRACE 2
222 : #define LSM_UNSAFE_NO_NEW_PRIVS 4
223 :
224 : #ifdef CONFIG_MMU
225 : extern int mmap_min_addr_handler(struct ctl_table *table, int write,
226 : void *buffer, size_t *lenp, loff_t *ppos);
227 : #endif
228 :
229 : /* security_inode_init_security callback function to write xattrs */
230 : typedef int (*initxattrs) (struct inode *inode,
231 : const struct xattr *xattr_array, void *fs_data);
232 :
233 :
234 : /* Keep the kernel_load_data_id enum in sync with kernel_read_file_id */
235 : #define __data_id_enumify(ENUM, dummy) LOADING_ ## ENUM,
236 : #define __data_id_stringify(dummy, str) #str,
237 :
238 : enum kernel_load_data_id {
239 : __kernel_read_file_id(__data_id_enumify)
240 : };
241 :
242 : static const char * const kernel_load_data_str[] = {
243 : __kernel_read_file_id(__data_id_stringify)
244 : };
245 :
246 : static inline const char *kernel_load_data_id_str(enum kernel_load_data_id id)
247 : {
248 : if ((unsigned)id >= LOADING_MAX_ID)
249 : return kernel_load_data_str[LOADING_UNKNOWN];
250 :
251 : return kernel_load_data_str[id];
252 : }
253 :
254 : #ifdef CONFIG_SECURITY
255 :
256 : int call_blocking_lsm_notifier(enum lsm_event event, void *data);
257 : int register_blocking_lsm_notifier(struct notifier_block *nb);
258 : int unregister_blocking_lsm_notifier(struct notifier_block *nb);
259 :
260 : /* prototypes */
261 : extern int security_init(void);
262 : extern int early_security_init(void);
263 :
264 : /* Security operations */
265 : int security_binder_set_context_mgr(const struct cred *mgr);
266 : int security_binder_transaction(const struct cred *from,
267 : const struct cred *to);
268 : int security_binder_transfer_binder(const struct cred *from,
269 : const struct cred *to);
270 : int security_binder_transfer_file(const struct cred *from,
271 : const struct cred *to, struct file *file);
272 : int security_ptrace_access_check(struct task_struct *child, unsigned int mode);
273 : int security_ptrace_traceme(struct task_struct *parent);
274 : int security_capget(struct task_struct *target,
275 : kernel_cap_t *effective,
276 : kernel_cap_t *inheritable,
277 : kernel_cap_t *permitted);
278 : int security_capset(struct cred *new, const struct cred *old,
279 : const kernel_cap_t *effective,
280 : const kernel_cap_t *inheritable,
281 : const kernel_cap_t *permitted);
282 : int security_capable(const struct cred *cred,
283 : struct user_namespace *ns,
284 : int cap,
285 : unsigned int opts);
286 : int security_quotactl(int cmds, int type, int id, struct super_block *sb);
287 : int security_quota_on(struct dentry *dentry);
288 : int security_syslog(int type);
289 : int security_settime64(const struct timespec64 *ts, const struct timezone *tz);
290 : int security_vm_enough_memory_mm(struct mm_struct *mm, long pages);
291 : int security_bprm_creds_for_exec(struct linux_binprm *bprm);
292 : int security_bprm_creds_from_file(struct linux_binprm *bprm, struct file *file);
293 : int security_bprm_check(struct linux_binprm *bprm);
294 : void security_bprm_committing_creds(struct linux_binprm *bprm);
295 : void security_bprm_committed_creds(struct linux_binprm *bprm);
296 : int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc);
297 : int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param);
298 : int security_sb_alloc(struct super_block *sb);
299 : void security_sb_delete(struct super_block *sb);
300 : void security_sb_free(struct super_block *sb);
301 : void security_free_mnt_opts(void **mnt_opts);
302 : int security_sb_eat_lsm_opts(char *options, void **mnt_opts);
303 : int security_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts);
304 : int security_sb_remount(struct super_block *sb, void *mnt_opts);
305 : int security_sb_kern_mount(struct super_block *sb);
306 : int security_sb_show_options(struct seq_file *m, struct super_block *sb);
307 : int security_sb_statfs(struct dentry *dentry);
308 : int security_sb_mount(const char *dev_name, const struct path *path,
309 : const char *type, unsigned long flags, void *data);
310 : int security_sb_umount(struct vfsmount *mnt, int flags);
311 : int security_sb_pivotroot(const struct path *old_path, const struct path *new_path);
312 : int security_sb_set_mnt_opts(struct super_block *sb,
313 : void *mnt_opts,
314 : unsigned long kern_flags,
315 : unsigned long *set_kern_flags);
316 : int security_sb_clone_mnt_opts(const struct super_block *oldsb,
317 : struct super_block *newsb,
318 : unsigned long kern_flags,
319 : unsigned long *set_kern_flags);
320 : int security_move_mount(const struct path *from_path, const struct path *to_path);
321 : int security_dentry_init_security(struct dentry *dentry, int mode,
322 : const struct qstr *name,
323 : const char **xattr_name, void **ctx,
324 : u32 *ctxlen);
325 : int security_dentry_create_files_as(struct dentry *dentry, int mode,
326 : struct qstr *name,
327 : const struct cred *old,
328 : struct cred *new);
329 : int security_path_notify(const struct path *path, u64 mask,
330 : unsigned int obj_type);
331 : int security_inode_alloc(struct inode *inode);
332 : void security_inode_free(struct inode *inode);
333 : int security_inode_init_security(struct inode *inode, struct inode *dir,
334 : const struct qstr *qstr,
335 : initxattrs initxattrs, void *fs_data);
336 : int security_inode_init_security_anon(struct inode *inode,
337 : const struct qstr *name,
338 : const struct inode *context_inode);
339 : int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode);
340 : int security_inode_link(struct dentry *old_dentry, struct inode *dir,
341 : struct dentry *new_dentry);
342 : int security_inode_unlink(struct inode *dir, struct dentry *dentry);
343 : int security_inode_symlink(struct inode *dir, struct dentry *dentry,
344 : const char *old_name);
345 : int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode);
346 : int security_inode_rmdir(struct inode *dir, struct dentry *dentry);
347 : int security_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev);
348 : int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
349 : struct inode *new_dir, struct dentry *new_dentry,
350 : unsigned int flags);
351 : int security_inode_readlink(struct dentry *dentry);
352 : int security_inode_follow_link(struct dentry *dentry, struct inode *inode,
353 : bool rcu);
354 : int security_inode_permission(struct inode *inode, int mask);
355 : int security_inode_setattr(struct mnt_idmap *idmap,
356 : struct dentry *dentry, struct iattr *attr);
357 : int security_inode_getattr(const struct path *path);
358 : int security_inode_setxattr(struct mnt_idmap *idmap,
359 : struct dentry *dentry, const char *name,
360 : const void *value, size_t size, int flags);
361 : int security_inode_set_acl(struct mnt_idmap *idmap,
362 : struct dentry *dentry, const char *acl_name,
363 : struct posix_acl *kacl);
364 : int security_inode_get_acl(struct mnt_idmap *idmap,
365 : struct dentry *dentry, const char *acl_name);
366 : int security_inode_remove_acl(struct mnt_idmap *idmap,
367 : struct dentry *dentry, const char *acl_name);
368 : void security_inode_post_setxattr(struct dentry *dentry, const char *name,
369 : const void *value, size_t size, int flags);
370 : int security_inode_getxattr(struct dentry *dentry, const char *name);
371 : int security_inode_listxattr(struct dentry *dentry);
372 : int security_inode_removexattr(struct mnt_idmap *idmap,
373 : struct dentry *dentry, const char *name);
374 : int security_inode_need_killpriv(struct dentry *dentry);
375 : int security_inode_killpriv(struct mnt_idmap *idmap, struct dentry *dentry);
376 : int security_inode_getsecurity(struct mnt_idmap *idmap,
377 : struct inode *inode, const char *name,
378 : void **buffer, bool alloc);
379 : int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags);
380 : int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size);
381 : void security_inode_getsecid(struct inode *inode, u32 *secid);
382 : int security_inode_copy_up(struct dentry *src, struct cred **new);
383 : int security_inode_copy_up_xattr(const char *name);
384 : int security_kernfs_init_security(struct kernfs_node *kn_dir,
385 : struct kernfs_node *kn);
386 : int security_file_permission(struct file *file, int mask);
387 : int security_file_alloc(struct file *file);
388 : void security_file_free(struct file *file);
389 : int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
390 : int security_mmap_file(struct file *file, unsigned long prot,
391 : unsigned long flags);
392 : int security_mmap_addr(unsigned long addr);
393 : int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
394 : unsigned long prot);
395 : int security_file_lock(struct file *file, unsigned int cmd);
396 : int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg);
397 : void security_file_set_fowner(struct file *file);
398 : int security_file_send_sigiotask(struct task_struct *tsk,
399 : struct fown_struct *fown, int sig);
400 : int security_file_receive(struct file *file);
401 : int security_file_open(struct file *file);
402 : int security_file_truncate(struct file *file);
403 : int security_task_alloc(struct task_struct *task, unsigned long clone_flags);
404 : void security_task_free(struct task_struct *task);
405 : int security_cred_alloc_blank(struct cred *cred, gfp_t gfp);
406 : void security_cred_free(struct cred *cred);
407 : int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp);
408 : void security_transfer_creds(struct cred *new, const struct cred *old);
409 : void security_cred_getsecid(const struct cred *c, u32 *secid);
410 : int security_kernel_act_as(struct cred *new, u32 secid);
411 : int security_kernel_create_files_as(struct cred *new, struct inode *inode);
412 : int security_kernel_module_request(char *kmod_name);
413 : int security_kernel_load_data(enum kernel_load_data_id id, bool contents);
414 : int security_kernel_post_load_data(char *buf, loff_t size,
415 : enum kernel_load_data_id id,
416 : char *description);
417 : int security_kernel_read_file(struct file *file, enum kernel_read_file_id id,
418 : bool contents);
419 : int security_kernel_post_read_file(struct file *file, char *buf, loff_t size,
420 : enum kernel_read_file_id id);
421 : int security_task_fix_setuid(struct cred *new, const struct cred *old,
422 : int flags);
423 : int security_task_fix_setgid(struct cred *new, const struct cred *old,
424 : int flags);
425 : int security_task_fix_setgroups(struct cred *new, const struct cred *old);
426 : int security_task_setpgid(struct task_struct *p, pid_t pgid);
427 : int security_task_getpgid(struct task_struct *p);
428 : int security_task_getsid(struct task_struct *p);
429 : void security_current_getsecid_subj(u32 *secid);
430 : void security_task_getsecid_obj(struct task_struct *p, u32 *secid);
431 : int security_task_setnice(struct task_struct *p, int nice);
432 : int security_task_setioprio(struct task_struct *p, int ioprio);
433 : int security_task_getioprio(struct task_struct *p);
434 : int security_task_prlimit(const struct cred *cred, const struct cred *tcred,
435 : unsigned int flags);
436 : int security_task_setrlimit(struct task_struct *p, unsigned int resource,
437 : struct rlimit *new_rlim);
438 : int security_task_setscheduler(struct task_struct *p);
439 : int security_task_getscheduler(struct task_struct *p);
440 : int security_task_movememory(struct task_struct *p);
441 : int security_task_kill(struct task_struct *p, struct kernel_siginfo *info,
442 : int sig, const struct cred *cred);
443 : int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
444 : unsigned long arg4, unsigned long arg5);
445 : void security_task_to_inode(struct task_struct *p, struct inode *inode);
446 : int security_create_user_ns(const struct cred *cred);
447 : int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag);
448 : void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid);
449 : int security_msg_msg_alloc(struct msg_msg *msg);
450 : void security_msg_msg_free(struct msg_msg *msg);
451 : int security_msg_queue_alloc(struct kern_ipc_perm *msq);
452 : void security_msg_queue_free(struct kern_ipc_perm *msq);
453 : int security_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg);
454 : int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd);
455 : int security_msg_queue_msgsnd(struct kern_ipc_perm *msq,
456 : struct msg_msg *msg, int msqflg);
457 : int security_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
458 : struct task_struct *target, long type, int mode);
459 : int security_shm_alloc(struct kern_ipc_perm *shp);
460 : void security_shm_free(struct kern_ipc_perm *shp);
461 : int security_shm_associate(struct kern_ipc_perm *shp, int shmflg);
462 : int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd);
463 : int security_shm_shmat(struct kern_ipc_perm *shp, char __user *shmaddr, int shmflg);
464 : int security_sem_alloc(struct kern_ipc_perm *sma);
465 : void security_sem_free(struct kern_ipc_perm *sma);
466 : int security_sem_associate(struct kern_ipc_perm *sma, int semflg);
467 : int security_sem_semctl(struct kern_ipc_perm *sma, int cmd);
468 : int security_sem_semop(struct kern_ipc_perm *sma, struct sembuf *sops,
469 : unsigned nsops, int alter);
470 : void security_d_instantiate(struct dentry *dentry, struct inode *inode);
471 : int security_getprocattr(struct task_struct *p, const char *lsm, const char *name,
472 : char **value);
473 : int security_setprocattr(const char *lsm, const char *name, void *value,
474 : size_t size);
475 : int security_netlink_send(struct sock *sk, struct sk_buff *skb);
476 : int security_ismaclabel(const char *name);
477 : int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);
478 : int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
479 : void security_release_secctx(char *secdata, u32 seclen);
480 : void security_inode_invalidate_secctx(struct inode *inode);
481 : int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen);
482 : int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
483 : int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen);
484 : int security_locked_down(enum lockdown_reason what);
485 : #else /* CONFIG_SECURITY */
486 :
487 : static inline int call_blocking_lsm_notifier(enum lsm_event event, void *data)
488 : {
489 : return 0;
490 : }
491 :
492 : static inline int register_blocking_lsm_notifier(struct notifier_block *nb)
493 : {
494 : return 0;
495 : }
496 :
497 : static inline int unregister_blocking_lsm_notifier(struct notifier_block *nb)
498 : {
499 : return 0;
500 : }
501 :
502 : static inline void security_free_mnt_opts(void **mnt_opts)
503 : {
504 : }
505 :
506 : /*
507 : * This is the default capabilities functionality. Most of these functions
508 : * are just stubbed out, but a few must call the proper capable code.
509 : */
510 :
511 : static inline int security_init(void)
512 : {
513 : return 0;
514 : }
515 :
516 : static inline int early_security_init(void)
517 : {
518 : return 0;
519 : }
520 :
521 : static inline int security_binder_set_context_mgr(const struct cred *mgr)
522 : {
523 : return 0;
524 : }
525 :
526 : static inline int security_binder_transaction(const struct cred *from,
527 : const struct cred *to)
528 : {
529 : return 0;
530 : }
531 :
532 : static inline int security_binder_transfer_binder(const struct cred *from,
533 : const struct cred *to)
534 : {
535 : return 0;
536 : }
537 :
538 : static inline int security_binder_transfer_file(const struct cred *from,
539 : const struct cred *to,
540 : struct file *file)
541 : {
542 : return 0;
543 : }
544 :
545 : static inline int security_ptrace_access_check(struct task_struct *child,
546 : unsigned int mode)
547 : {
548 0 : return cap_ptrace_access_check(child, mode);
549 : }
550 :
551 : static inline int security_ptrace_traceme(struct task_struct *parent)
552 : {
553 0 : return cap_ptrace_traceme(parent);
554 : }
555 :
556 : static inline int security_capget(struct task_struct *target,
557 : kernel_cap_t *effective,
558 : kernel_cap_t *inheritable,
559 : kernel_cap_t *permitted)
560 : {
561 0 : return cap_capget(target, effective, inheritable, permitted);
562 : }
563 :
564 : static inline int security_capset(struct cred *new,
565 : const struct cred *old,
566 : const kernel_cap_t *effective,
567 : const kernel_cap_t *inheritable,
568 : const kernel_cap_t *permitted)
569 : {
570 0 : return cap_capset(new, old, effective, inheritable, permitted);
571 : }
572 :
573 : static inline int security_capable(const struct cred *cred,
574 : struct user_namespace *ns,
575 : int cap,
576 : unsigned int opts)
577 : {
578 1 : return cap_capable(cred, ns, cap, opts);
579 : }
580 :
581 : static inline int security_quotactl(int cmds, int type, int id,
582 : struct super_block *sb)
583 : {
584 : return 0;
585 : }
586 :
587 : static inline int security_quota_on(struct dentry *dentry)
588 : {
589 : return 0;
590 : }
591 :
592 : static inline int security_syslog(int type)
593 : {
594 : return 0;
595 : }
596 :
597 : static inline int security_settime64(const struct timespec64 *ts,
598 : const struct timezone *tz)
599 : {
600 0 : return cap_settime(ts, tz);
601 : }
602 :
603 0 : static inline int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
604 : {
605 0 : return __vm_enough_memory(mm, pages, cap_vm_enough_memory(mm, pages));
606 : }
607 :
608 : static inline int security_bprm_creds_for_exec(struct linux_binprm *bprm)
609 : {
610 : return 0;
611 : }
612 :
613 : static inline int security_bprm_creds_from_file(struct linux_binprm *bprm,
614 : struct file *file)
615 : {
616 0 : return cap_bprm_creds_from_file(bprm, file);
617 : }
618 :
619 : static inline int security_bprm_check(struct linux_binprm *bprm)
620 : {
621 : return 0;
622 : }
623 :
624 : static inline void security_bprm_committing_creds(struct linux_binprm *bprm)
625 : {
626 : }
627 :
628 : static inline void security_bprm_committed_creds(struct linux_binprm *bprm)
629 : {
630 : }
631 :
632 : static inline int security_fs_context_dup(struct fs_context *fc,
633 : struct fs_context *src_fc)
634 : {
635 : return 0;
636 : }
637 : static inline int security_fs_context_parse_param(struct fs_context *fc,
638 : struct fs_parameter *param)
639 : {
640 : return -ENOPARAM;
641 : }
642 :
643 : static inline int security_sb_alloc(struct super_block *sb)
644 : {
645 : return 0;
646 : }
647 :
648 : static inline void security_sb_delete(struct super_block *sb)
649 : { }
650 :
651 : static inline void security_sb_free(struct super_block *sb)
652 : { }
653 :
654 : static inline int security_sb_eat_lsm_opts(char *options,
655 : void **mnt_opts)
656 : {
657 : return 0;
658 : }
659 :
660 : static inline int security_sb_remount(struct super_block *sb,
661 : void *mnt_opts)
662 : {
663 : return 0;
664 : }
665 :
666 : static inline int security_sb_mnt_opts_compat(struct super_block *sb,
667 : void *mnt_opts)
668 : {
669 : return 0;
670 : }
671 :
672 :
673 : static inline int security_sb_kern_mount(struct super_block *sb)
674 : {
675 : return 0;
676 : }
677 :
678 : static inline int security_sb_show_options(struct seq_file *m,
679 : struct super_block *sb)
680 : {
681 : return 0;
682 : }
683 :
684 : static inline int security_sb_statfs(struct dentry *dentry)
685 : {
686 : return 0;
687 : }
688 :
689 : static inline int security_sb_mount(const char *dev_name, const struct path *path,
690 : const char *type, unsigned long flags,
691 : void *data)
692 : {
693 : return 0;
694 : }
695 :
696 : static inline int security_sb_umount(struct vfsmount *mnt, int flags)
697 : {
698 : return 0;
699 : }
700 :
701 : static inline int security_sb_pivotroot(const struct path *old_path,
702 : const struct path *new_path)
703 : {
704 : return 0;
705 : }
706 :
707 : static inline int security_sb_set_mnt_opts(struct super_block *sb,
708 : void *mnt_opts,
709 : unsigned long kern_flags,
710 : unsigned long *set_kern_flags)
711 : {
712 : return 0;
713 : }
714 :
715 : static inline int security_sb_clone_mnt_opts(const struct super_block *oldsb,
716 : struct super_block *newsb,
717 : unsigned long kern_flags,
718 : unsigned long *set_kern_flags)
719 : {
720 : return 0;
721 : }
722 :
723 : static inline int security_move_mount(const struct path *from_path,
724 : const struct path *to_path)
725 : {
726 : return 0;
727 : }
728 :
729 : static inline int security_path_notify(const struct path *path, u64 mask,
730 : unsigned int obj_type)
731 : {
732 : return 0;
733 : }
734 :
735 : static inline int security_inode_alloc(struct inode *inode)
736 : {
737 : return 0;
738 : }
739 :
740 : static inline void security_inode_free(struct inode *inode)
741 : { }
742 :
743 : static inline int security_dentry_init_security(struct dentry *dentry,
744 : int mode,
745 : const struct qstr *name,
746 : const char **xattr_name,
747 : void **ctx,
748 : u32 *ctxlen)
749 : {
750 : return -EOPNOTSUPP;
751 : }
752 :
753 : static inline int security_dentry_create_files_as(struct dentry *dentry,
754 : int mode, struct qstr *name,
755 : const struct cred *old,
756 : struct cred *new)
757 : {
758 : return 0;
759 : }
760 :
761 :
762 : static inline int security_inode_init_security(struct inode *inode,
763 : struct inode *dir,
764 : const struct qstr *qstr,
765 : const initxattrs xattrs,
766 : void *fs_data)
767 : {
768 : return 0;
769 : }
770 :
771 : static inline int security_inode_init_security_anon(struct inode *inode,
772 : const struct qstr *name,
773 : const struct inode *context_inode)
774 : {
775 : return 0;
776 : }
777 :
778 : static inline int security_inode_create(struct inode *dir,
779 : struct dentry *dentry,
780 : umode_t mode)
781 : {
782 : return 0;
783 : }
784 :
785 : static inline int security_inode_link(struct dentry *old_dentry,
786 : struct inode *dir,
787 : struct dentry *new_dentry)
788 : {
789 : return 0;
790 : }
791 :
792 : static inline int security_inode_unlink(struct inode *dir,
793 : struct dentry *dentry)
794 : {
795 : return 0;
796 : }
797 :
798 : static inline int security_inode_symlink(struct inode *dir,
799 : struct dentry *dentry,
800 : const char *old_name)
801 : {
802 : return 0;
803 : }
804 :
805 : static inline int security_inode_mkdir(struct inode *dir,
806 : struct dentry *dentry,
807 : int mode)
808 : {
809 : return 0;
810 : }
811 :
812 : static inline int security_inode_rmdir(struct inode *dir,
813 : struct dentry *dentry)
814 : {
815 : return 0;
816 : }
817 :
818 : static inline int security_inode_mknod(struct inode *dir,
819 : struct dentry *dentry,
820 : int mode, dev_t dev)
821 : {
822 : return 0;
823 : }
824 :
825 : static inline int security_inode_rename(struct inode *old_dir,
826 : struct dentry *old_dentry,
827 : struct inode *new_dir,
828 : struct dentry *new_dentry,
829 : unsigned int flags)
830 : {
831 : return 0;
832 : }
833 :
834 : static inline int security_inode_readlink(struct dentry *dentry)
835 : {
836 : return 0;
837 : }
838 :
839 : static inline int security_inode_follow_link(struct dentry *dentry,
840 : struct inode *inode,
841 : bool rcu)
842 : {
843 : return 0;
844 : }
845 :
846 : static inline int security_inode_permission(struct inode *inode, int mask)
847 : {
848 : return 0;
849 : }
850 :
851 : static inline int security_inode_setattr(struct mnt_idmap *idmap,
852 : struct dentry *dentry,
853 : struct iattr *attr)
854 : {
855 : return 0;
856 : }
857 :
858 : static inline int security_inode_getattr(const struct path *path)
859 : {
860 : return 0;
861 : }
862 :
863 : static inline int security_inode_setxattr(struct mnt_idmap *idmap,
864 : struct dentry *dentry, const char *name, const void *value,
865 : size_t size, int flags)
866 : {
867 0 : return cap_inode_setxattr(dentry, name, value, size, flags);
868 : }
869 :
870 : static inline int security_inode_set_acl(struct mnt_idmap *idmap,
871 : struct dentry *dentry,
872 : const char *acl_name,
873 : struct posix_acl *kacl)
874 : {
875 : return 0;
876 : }
877 :
878 : static inline int security_inode_get_acl(struct mnt_idmap *idmap,
879 : struct dentry *dentry,
880 : const char *acl_name)
881 : {
882 : return 0;
883 : }
884 :
885 : static inline int security_inode_remove_acl(struct mnt_idmap *idmap,
886 : struct dentry *dentry,
887 : const char *acl_name)
888 : {
889 : return 0;
890 : }
891 :
892 : static inline void security_inode_post_setxattr(struct dentry *dentry,
893 : const char *name, const void *value, size_t size, int flags)
894 : { }
895 :
896 : static inline int security_inode_getxattr(struct dentry *dentry,
897 : const char *name)
898 : {
899 : return 0;
900 : }
901 :
902 : static inline int security_inode_listxattr(struct dentry *dentry)
903 : {
904 : return 0;
905 : }
906 :
907 : static inline int security_inode_removexattr(struct mnt_idmap *idmap,
908 : struct dentry *dentry,
909 : const char *name)
910 : {
911 0 : return cap_inode_removexattr(idmap, dentry, name);
912 : }
913 :
914 : static inline int security_inode_need_killpriv(struct dentry *dentry)
915 : {
916 0 : return cap_inode_need_killpriv(dentry);
917 : }
918 :
919 : static inline int security_inode_killpriv(struct mnt_idmap *idmap,
920 : struct dentry *dentry)
921 : {
922 0 : return cap_inode_killpriv(idmap, dentry);
923 : }
924 :
925 : static inline int security_inode_getsecurity(struct mnt_idmap *idmap,
926 : struct inode *inode,
927 : const char *name, void **buffer,
928 : bool alloc)
929 : {
930 0 : return cap_inode_getsecurity(idmap, inode, name, buffer, alloc);
931 : }
932 :
933 : static inline int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
934 : {
935 : return -EOPNOTSUPP;
936 : }
937 :
938 : static inline int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
939 : {
940 : return 0;
941 : }
942 :
943 : static inline void security_inode_getsecid(struct inode *inode, u32 *secid)
944 : {
945 : *secid = 0;
946 : }
947 :
948 : static inline int security_inode_copy_up(struct dentry *src, struct cred **new)
949 : {
950 : return 0;
951 : }
952 :
953 : static inline int security_kernfs_init_security(struct kernfs_node *kn_dir,
954 : struct kernfs_node *kn)
955 : {
956 : return 0;
957 : }
958 :
959 : static inline int security_inode_copy_up_xattr(const char *name)
960 : {
961 : return -EOPNOTSUPP;
962 : }
963 :
964 : static inline int security_file_permission(struct file *file, int mask)
965 : {
966 : return 0;
967 : }
968 :
969 : static inline int security_file_alloc(struct file *file)
970 : {
971 : return 0;
972 : }
973 :
974 : static inline void security_file_free(struct file *file)
975 : { }
976 :
977 : static inline int security_file_ioctl(struct file *file, unsigned int cmd,
978 : unsigned long arg)
979 : {
980 : return 0;
981 : }
982 :
983 : static inline int security_mmap_file(struct file *file, unsigned long prot,
984 : unsigned long flags)
985 : {
986 : return 0;
987 : }
988 :
989 : static inline int security_mmap_addr(unsigned long addr)
990 : {
991 0 : return cap_mmap_addr(addr);
992 : }
993 :
994 : static inline int security_file_mprotect(struct vm_area_struct *vma,
995 : unsigned long reqprot,
996 : unsigned long prot)
997 : {
998 : return 0;
999 : }
1000 :
1001 : static inline int security_file_lock(struct file *file, unsigned int cmd)
1002 : {
1003 : return 0;
1004 : }
1005 :
1006 : static inline int security_file_fcntl(struct file *file, unsigned int cmd,
1007 : unsigned long arg)
1008 : {
1009 : return 0;
1010 : }
1011 :
1012 : static inline void security_file_set_fowner(struct file *file)
1013 : {
1014 : return;
1015 : }
1016 :
1017 : static inline int security_file_send_sigiotask(struct task_struct *tsk,
1018 : struct fown_struct *fown,
1019 : int sig)
1020 : {
1021 : return 0;
1022 : }
1023 :
1024 : static inline int security_file_receive(struct file *file)
1025 : {
1026 : return 0;
1027 : }
1028 :
1029 : static inline int security_file_open(struct file *file)
1030 : {
1031 : return 0;
1032 : }
1033 :
1034 : static inline int security_file_truncate(struct file *file)
1035 : {
1036 : return 0;
1037 : }
1038 :
1039 : static inline int security_task_alloc(struct task_struct *task,
1040 : unsigned long clone_flags)
1041 : {
1042 : return 0;
1043 : }
1044 :
1045 : static inline void security_task_free(struct task_struct *task)
1046 : { }
1047 :
1048 : static inline int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)
1049 : {
1050 : return 0;
1051 : }
1052 :
1053 : static inline void security_cred_free(struct cred *cred)
1054 : { }
1055 :
1056 : static inline int security_prepare_creds(struct cred *new,
1057 : const struct cred *old,
1058 : gfp_t gfp)
1059 : {
1060 : return 0;
1061 : }
1062 :
1063 : static inline void security_transfer_creds(struct cred *new,
1064 : const struct cred *old)
1065 : {
1066 : }
1067 :
1068 : static inline void security_cred_getsecid(const struct cred *c, u32 *secid)
1069 : {
1070 : *secid = 0;
1071 : }
1072 :
1073 : static inline int security_kernel_act_as(struct cred *cred, u32 secid)
1074 : {
1075 : return 0;
1076 : }
1077 :
1078 : static inline int security_kernel_create_files_as(struct cred *cred,
1079 : struct inode *inode)
1080 : {
1081 : return 0;
1082 : }
1083 :
1084 : static inline int security_kernel_module_request(char *kmod_name)
1085 : {
1086 : return 0;
1087 : }
1088 :
1089 : static inline int security_kernel_load_data(enum kernel_load_data_id id, bool contents)
1090 : {
1091 : return 0;
1092 : }
1093 :
1094 : static inline int security_kernel_post_load_data(char *buf, loff_t size,
1095 : enum kernel_load_data_id id,
1096 : char *description)
1097 : {
1098 : return 0;
1099 : }
1100 :
1101 : static inline int security_kernel_read_file(struct file *file,
1102 : enum kernel_read_file_id id,
1103 : bool contents)
1104 : {
1105 : return 0;
1106 : }
1107 :
1108 : static inline int security_kernel_post_read_file(struct file *file,
1109 : char *buf, loff_t size,
1110 : enum kernel_read_file_id id)
1111 : {
1112 : return 0;
1113 : }
1114 :
1115 : static inline int security_task_fix_setuid(struct cred *new,
1116 : const struct cred *old,
1117 : int flags)
1118 : {
1119 0 : return cap_task_fix_setuid(new, old, flags);
1120 : }
1121 :
1122 : static inline int security_task_fix_setgid(struct cred *new,
1123 : const struct cred *old,
1124 : int flags)
1125 : {
1126 : return 0;
1127 : }
1128 :
1129 : static inline int security_task_fix_setgroups(struct cred *new,
1130 : const struct cred *old)
1131 : {
1132 : return 0;
1133 : }
1134 :
1135 : static inline int security_task_setpgid(struct task_struct *p, pid_t pgid)
1136 : {
1137 : return 0;
1138 : }
1139 :
1140 : static inline int security_task_getpgid(struct task_struct *p)
1141 : {
1142 : return 0;
1143 : }
1144 :
1145 : static inline int security_task_getsid(struct task_struct *p)
1146 : {
1147 : return 0;
1148 : }
1149 :
1150 : static inline void security_current_getsecid_subj(u32 *secid)
1151 : {
1152 : *secid = 0;
1153 : }
1154 :
1155 : static inline void security_task_getsecid_obj(struct task_struct *p, u32 *secid)
1156 : {
1157 : *secid = 0;
1158 : }
1159 :
1160 : static inline int security_task_setnice(struct task_struct *p, int nice)
1161 : {
1162 0 : return cap_task_setnice(p, nice);
1163 : }
1164 :
1165 : static inline int security_task_setioprio(struct task_struct *p, int ioprio)
1166 : {
1167 0 : return cap_task_setioprio(p, ioprio);
1168 : }
1169 :
1170 : static inline int security_task_getioprio(struct task_struct *p)
1171 : {
1172 : return 0;
1173 : }
1174 :
1175 : static inline int security_task_prlimit(const struct cred *cred,
1176 : const struct cred *tcred,
1177 : unsigned int flags)
1178 : {
1179 : return 0;
1180 : }
1181 :
1182 : static inline int security_task_setrlimit(struct task_struct *p,
1183 : unsigned int resource,
1184 : struct rlimit *new_rlim)
1185 : {
1186 : return 0;
1187 : }
1188 :
1189 : static inline int security_task_setscheduler(struct task_struct *p)
1190 : {
1191 0 : return cap_task_setscheduler(p);
1192 : }
1193 :
1194 : static inline int security_task_getscheduler(struct task_struct *p)
1195 : {
1196 : return 0;
1197 : }
1198 :
1199 : static inline int security_task_movememory(struct task_struct *p)
1200 : {
1201 : return 0;
1202 : }
1203 :
1204 : static inline int security_task_kill(struct task_struct *p,
1205 : struct kernel_siginfo *info, int sig,
1206 : const struct cred *cred)
1207 : {
1208 : return 0;
1209 : }
1210 :
1211 : static inline int security_task_prctl(int option, unsigned long arg2,
1212 : unsigned long arg3,
1213 : unsigned long arg4,
1214 : unsigned long arg5)
1215 : {
1216 0 : return cap_task_prctl(option, arg2, arg3, arg4, arg5);
1217 : }
1218 :
1219 : static inline void security_task_to_inode(struct task_struct *p, struct inode *inode)
1220 : { }
1221 :
1222 : static inline int security_create_user_ns(const struct cred *cred)
1223 : {
1224 : return 0;
1225 : }
1226 :
1227 : static inline int security_ipc_permission(struct kern_ipc_perm *ipcp,
1228 : short flag)
1229 : {
1230 : return 0;
1231 : }
1232 :
1233 : static inline void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
1234 : {
1235 : *secid = 0;
1236 : }
1237 :
1238 : static inline int security_msg_msg_alloc(struct msg_msg *msg)
1239 : {
1240 : return 0;
1241 : }
1242 :
1243 : static inline void security_msg_msg_free(struct msg_msg *msg)
1244 : { }
1245 :
1246 : static inline int security_msg_queue_alloc(struct kern_ipc_perm *msq)
1247 : {
1248 : return 0;
1249 : }
1250 :
1251 : static inline void security_msg_queue_free(struct kern_ipc_perm *msq)
1252 : { }
1253 :
1254 : static inline int security_msg_queue_associate(struct kern_ipc_perm *msq,
1255 : int msqflg)
1256 : {
1257 : return 0;
1258 : }
1259 :
1260 : static inline int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
1261 : {
1262 : return 0;
1263 : }
1264 :
1265 : static inline int security_msg_queue_msgsnd(struct kern_ipc_perm *msq,
1266 : struct msg_msg *msg, int msqflg)
1267 : {
1268 : return 0;
1269 : }
1270 :
1271 : static inline int security_msg_queue_msgrcv(struct kern_ipc_perm *msq,
1272 : struct msg_msg *msg,
1273 : struct task_struct *target,
1274 : long type, int mode)
1275 : {
1276 : return 0;
1277 : }
1278 :
1279 : static inline int security_shm_alloc(struct kern_ipc_perm *shp)
1280 : {
1281 : return 0;
1282 : }
1283 :
1284 : static inline void security_shm_free(struct kern_ipc_perm *shp)
1285 : { }
1286 :
1287 : static inline int security_shm_associate(struct kern_ipc_perm *shp,
1288 : int shmflg)
1289 : {
1290 : return 0;
1291 : }
1292 :
1293 : static inline int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
1294 : {
1295 : return 0;
1296 : }
1297 :
1298 : static inline int security_shm_shmat(struct kern_ipc_perm *shp,
1299 : char __user *shmaddr, int shmflg)
1300 : {
1301 : return 0;
1302 : }
1303 :
1304 : static inline int security_sem_alloc(struct kern_ipc_perm *sma)
1305 : {
1306 : return 0;
1307 : }
1308 :
1309 : static inline void security_sem_free(struct kern_ipc_perm *sma)
1310 : { }
1311 :
1312 : static inline int security_sem_associate(struct kern_ipc_perm *sma, int semflg)
1313 : {
1314 : return 0;
1315 : }
1316 :
1317 : static inline int security_sem_semctl(struct kern_ipc_perm *sma, int cmd)
1318 : {
1319 : return 0;
1320 : }
1321 :
1322 : static inline int security_sem_semop(struct kern_ipc_perm *sma,
1323 : struct sembuf *sops, unsigned nsops,
1324 : int alter)
1325 : {
1326 : return 0;
1327 : }
1328 :
1329 : static inline void security_d_instantiate(struct dentry *dentry,
1330 : struct inode *inode)
1331 : { }
1332 :
1333 : static inline int security_getprocattr(struct task_struct *p, const char *lsm,
1334 : const char *name, char **value)
1335 : {
1336 : return -EINVAL;
1337 : }
1338 :
1339 : static inline int security_setprocattr(const char *lsm, char *name,
1340 : void *value, size_t size)
1341 : {
1342 : return -EINVAL;
1343 : }
1344 :
1345 : static inline int security_netlink_send(struct sock *sk, struct sk_buff *skb)
1346 : {
1347 : return 0;
1348 : }
1349 :
1350 : static inline int security_ismaclabel(const char *name)
1351 : {
1352 : return 0;
1353 : }
1354 :
1355 : static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
1356 : {
1357 : return -EOPNOTSUPP;
1358 : }
1359 :
1360 : static inline int security_secctx_to_secid(const char *secdata,
1361 : u32 seclen,
1362 : u32 *secid)
1363 : {
1364 : return -EOPNOTSUPP;
1365 : }
1366 :
1367 : static inline void security_release_secctx(char *secdata, u32 seclen)
1368 : {
1369 : }
1370 :
1371 : static inline void security_inode_invalidate_secctx(struct inode *inode)
1372 : {
1373 : }
1374 :
1375 : static inline int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
1376 : {
1377 : return -EOPNOTSUPP;
1378 : }
1379 : static inline int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
1380 : {
1381 : return -EOPNOTSUPP;
1382 : }
1383 : static inline int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
1384 : {
1385 : return -EOPNOTSUPP;
1386 : }
1387 : static inline int security_locked_down(enum lockdown_reason what)
1388 : {
1389 : return 0;
1390 : }
1391 : #endif /* CONFIG_SECURITY */
1392 :
1393 : #if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE)
1394 : int security_post_notification(const struct cred *w_cred,
1395 : const struct cred *cred,
1396 : struct watch_notification *n);
1397 : #else
1398 : static inline int security_post_notification(const struct cred *w_cred,
1399 : const struct cred *cred,
1400 : struct watch_notification *n)
1401 : {
1402 : return 0;
1403 : }
1404 : #endif
1405 :
1406 : #if defined(CONFIG_SECURITY) && defined(CONFIG_KEY_NOTIFICATIONS)
1407 : int security_watch_key(struct key *key);
1408 : #else
1409 : static inline int security_watch_key(struct key *key)
1410 : {
1411 : return 0;
1412 : }
1413 : #endif
1414 :
1415 : #ifdef CONFIG_SECURITY_NETWORK
1416 :
1417 : int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk);
1418 : int security_unix_may_send(struct socket *sock, struct socket *other);
1419 : int security_socket_create(int family, int type, int protocol, int kern);
1420 : int security_socket_post_create(struct socket *sock, int family,
1421 : int type, int protocol, int kern);
1422 : int security_socket_socketpair(struct socket *socka, struct socket *sockb);
1423 : int security_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen);
1424 : int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen);
1425 : int security_socket_listen(struct socket *sock, int backlog);
1426 : int security_socket_accept(struct socket *sock, struct socket *newsock);
1427 : int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size);
1428 : int security_socket_recvmsg(struct socket *sock, struct msghdr *msg,
1429 : int size, int flags);
1430 : int security_socket_getsockname(struct socket *sock);
1431 : int security_socket_getpeername(struct socket *sock);
1432 : int security_socket_getsockopt(struct socket *sock, int level, int optname);
1433 : int security_socket_setsockopt(struct socket *sock, int level, int optname);
1434 : int security_socket_shutdown(struct socket *sock, int how);
1435 : int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb);
1436 : int security_socket_getpeersec_stream(struct socket *sock, sockptr_t optval,
1437 : sockptr_t optlen, unsigned int len);
1438 : int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid);
1439 : int security_sk_alloc(struct sock *sk, int family, gfp_t priority);
1440 : void security_sk_free(struct sock *sk);
1441 : void security_sk_clone(const struct sock *sk, struct sock *newsk);
1442 : void security_sk_classify_flow(struct sock *sk, struct flowi_common *flic);
1443 : void security_req_classify_flow(const struct request_sock *req,
1444 : struct flowi_common *flic);
1445 : void security_sock_graft(struct sock*sk, struct socket *parent);
1446 : int security_inet_conn_request(const struct sock *sk,
1447 : struct sk_buff *skb, struct request_sock *req);
1448 : void security_inet_csk_clone(struct sock *newsk,
1449 : const struct request_sock *req);
1450 : void security_inet_conn_established(struct sock *sk,
1451 : struct sk_buff *skb);
1452 : int security_secmark_relabel_packet(u32 secid);
1453 : void security_secmark_refcount_inc(void);
1454 : void security_secmark_refcount_dec(void);
1455 : int security_tun_dev_alloc_security(void **security);
1456 : void security_tun_dev_free_security(void *security);
1457 : int security_tun_dev_create(void);
1458 : int security_tun_dev_attach_queue(void *security);
1459 : int security_tun_dev_attach(struct sock *sk, void *security);
1460 : int security_tun_dev_open(void *security);
1461 : int security_sctp_assoc_request(struct sctp_association *asoc, struct sk_buff *skb);
1462 : int security_sctp_bind_connect(struct sock *sk, int optname,
1463 : struct sockaddr *address, int addrlen);
1464 : void security_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk,
1465 : struct sock *newsk);
1466 : int security_sctp_assoc_established(struct sctp_association *asoc,
1467 : struct sk_buff *skb);
1468 : int security_mptcp_add_subflow(struct sock *sk, struct sock *ssk);
1469 :
1470 : #else /* CONFIG_SECURITY_NETWORK */
1471 : static inline int security_unix_stream_connect(struct sock *sock,
1472 : struct sock *other,
1473 : struct sock *newsk)
1474 : {
1475 : return 0;
1476 : }
1477 :
1478 : static inline int security_unix_may_send(struct socket *sock,
1479 : struct socket *other)
1480 : {
1481 : return 0;
1482 : }
1483 :
1484 : static inline int security_socket_create(int family, int type,
1485 : int protocol, int kern)
1486 : {
1487 : return 0;
1488 : }
1489 :
1490 : static inline int security_socket_post_create(struct socket *sock,
1491 : int family,
1492 : int type,
1493 : int protocol, int kern)
1494 : {
1495 : return 0;
1496 : }
1497 :
1498 : static inline int security_socket_socketpair(struct socket *socka,
1499 : struct socket *sockb)
1500 : {
1501 : return 0;
1502 : }
1503 :
1504 : static inline int security_socket_bind(struct socket *sock,
1505 : struct sockaddr *address,
1506 : int addrlen)
1507 : {
1508 : return 0;
1509 : }
1510 :
1511 : static inline int security_socket_connect(struct socket *sock,
1512 : struct sockaddr *address,
1513 : int addrlen)
1514 : {
1515 : return 0;
1516 : }
1517 :
1518 : static inline int security_socket_listen(struct socket *sock, int backlog)
1519 : {
1520 : return 0;
1521 : }
1522 :
1523 : static inline int security_socket_accept(struct socket *sock,
1524 : struct socket *newsock)
1525 : {
1526 : return 0;
1527 : }
1528 :
1529 : static inline int security_socket_sendmsg(struct socket *sock,
1530 : struct msghdr *msg, int size)
1531 : {
1532 : return 0;
1533 : }
1534 :
1535 : static inline int security_socket_recvmsg(struct socket *sock,
1536 : struct msghdr *msg, int size,
1537 : int flags)
1538 : {
1539 : return 0;
1540 : }
1541 :
1542 : static inline int security_socket_getsockname(struct socket *sock)
1543 : {
1544 : return 0;
1545 : }
1546 :
1547 : static inline int security_socket_getpeername(struct socket *sock)
1548 : {
1549 : return 0;
1550 : }
1551 :
1552 : static inline int security_socket_getsockopt(struct socket *sock,
1553 : int level, int optname)
1554 : {
1555 : return 0;
1556 : }
1557 :
1558 : static inline int security_socket_setsockopt(struct socket *sock,
1559 : int level, int optname)
1560 : {
1561 : return 0;
1562 : }
1563 :
1564 : static inline int security_socket_shutdown(struct socket *sock, int how)
1565 : {
1566 : return 0;
1567 : }
1568 : static inline int security_sock_rcv_skb(struct sock *sk,
1569 : struct sk_buff *skb)
1570 : {
1571 : return 0;
1572 : }
1573 :
1574 : static inline int security_socket_getpeersec_stream(struct socket *sock,
1575 : sockptr_t optval,
1576 : sockptr_t optlen,
1577 : unsigned int len)
1578 : {
1579 : return -ENOPROTOOPT;
1580 : }
1581 :
1582 : static inline int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
1583 : {
1584 : return -ENOPROTOOPT;
1585 : }
1586 :
1587 : static inline int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
1588 : {
1589 : return 0;
1590 : }
1591 :
1592 : static inline void security_sk_free(struct sock *sk)
1593 : {
1594 : }
1595 :
1596 : static inline void security_sk_clone(const struct sock *sk, struct sock *newsk)
1597 : {
1598 : }
1599 :
1600 : static inline void security_sk_classify_flow(struct sock *sk,
1601 : struct flowi_common *flic)
1602 : {
1603 : }
1604 :
1605 : static inline void security_req_classify_flow(const struct request_sock *req,
1606 : struct flowi_common *flic)
1607 : {
1608 : }
1609 :
1610 : static inline void security_sock_graft(struct sock *sk, struct socket *parent)
1611 : {
1612 : }
1613 :
1614 : static inline int security_inet_conn_request(const struct sock *sk,
1615 : struct sk_buff *skb, struct request_sock *req)
1616 : {
1617 : return 0;
1618 : }
1619 :
1620 : static inline void security_inet_csk_clone(struct sock *newsk,
1621 : const struct request_sock *req)
1622 : {
1623 : }
1624 :
1625 : static inline void security_inet_conn_established(struct sock *sk,
1626 : struct sk_buff *skb)
1627 : {
1628 : }
1629 :
1630 : static inline int security_secmark_relabel_packet(u32 secid)
1631 : {
1632 : return 0;
1633 : }
1634 :
1635 : static inline void security_secmark_refcount_inc(void)
1636 : {
1637 : }
1638 :
1639 : static inline void security_secmark_refcount_dec(void)
1640 : {
1641 : }
1642 :
1643 : static inline int security_tun_dev_alloc_security(void **security)
1644 : {
1645 : return 0;
1646 : }
1647 :
1648 : static inline void security_tun_dev_free_security(void *security)
1649 : {
1650 : }
1651 :
1652 : static inline int security_tun_dev_create(void)
1653 : {
1654 : return 0;
1655 : }
1656 :
1657 : static inline int security_tun_dev_attach_queue(void *security)
1658 : {
1659 : return 0;
1660 : }
1661 :
1662 : static inline int security_tun_dev_attach(struct sock *sk, void *security)
1663 : {
1664 : return 0;
1665 : }
1666 :
1667 : static inline int security_tun_dev_open(void *security)
1668 : {
1669 : return 0;
1670 : }
1671 :
1672 : static inline int security_sctp_assoc_request(struct sctp_association *asoc,
1673 : struct sk_buff *skb)
1674 : {
1675 : return 0;
1676 : }
1677 :
1678 : static inline int security_sctp_bind_connect(struct sock *sk, int optname,
1679 : struct sockaddr *address,
1680 : int addrlen)
1681 : {
1682 : return 0;
1683 : }
1684 :
1685 : static inline void security_sctp_sk_clone(struct sctp_association *asoc,
1686 : struct sock *sk,
1687 : struct sock *newsk)
1688 : {
1689 : }
1690 :
1691 : static inline int security_sctp_assoc_established(struct sctp_association *asoc,
1692 : struct sk_buff *skb)
1693 : {
1694 : return 0;
1695 : }
1696 :
1697 : static inline int security_mptcp_add_subflow(struct sock *sk, struct sock *ssk)
1698 : {
1699 : return 0;
1700 : }
1701 : #endif /* CONFIG_SECURITY_NETWORK */
1702 :
1703 : #ifdef CONFIG_SECURITY_INFINIBAND
1704 : int security_ib_pkey_access(void *sec, u64 subnet_prefix, u16 pkey);
1705 : int security_ib_endport_manage_subnet(void *sec, const char *name, u8 port_num);
1706 : int security_ib_alloc_security(void **sec);
1707 : void security_ib_free_security(void *sec);
1708 : #else /* CONFIG_SECURITY_INFINIBAND */
1709 : static inline int security_ib_pkey_access(void *sec, u64 subnet_prefix, u16 pkey)
1710 : {
1711 : return 0;
1712 : }
1713 :
1714 : static inline int security_ib_endport_manage_subnet(void *sec, const char *dev_name, u8 port_num)
1715 : {
1716 : return 0;
1717 : }
1718 :
1719 : static inline int security_ib_alloc_security(void **sec)
1720 : {
1721 : return 0;
1722 : }
1723 :
1724 : static inline void security_ib_free_security(void *sec)
1725 : {
1726 : }
1727 : #endif /* CONFIG_SECURITY_INFINIBAND */
1728 :
1729 : #ifdef CONFIG_SECURITY_NETWORK_XFRM
1730 :
1731 : int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
1732 : struct xfrm_user_sec_ctx *sec_ctx, gfp_t gfp);
1733 : int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctxp);
1734 : void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
1735 : int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx);
1736 : int security_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx);
1737 : int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
1738 : struct xfrm_sec_ctx *polsec, u32 secid);
1739 : int security_xfrm_state_delete(struct xfrm_state *x);
1740 : void security_xfrm_state_free(struct xfrm_state *x);
1741 : int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid);
1742 : int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
1743 : struct xfrm_policy *xp,
1744 : const struct flowi_common *flic);
1745 : int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid);
1746 : void security_skb_classify_flow(struct sk_buff *skb, struct flowi_common *flic);
1747 :
1748 : #else /* CONFIG_SECURITY_NETWORK_XFRM */
1749 :
1750 : static inline int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
1751 : struct xfrm_user_sec_ctx *sec_ctx,
1752 : gfp_t gfp)
1753 : {
1754 : return 0;
1755 : }
1756 :
1757 : static inline int security_xfrm_policy_clone(struct xfrm_sec_ctx *old, struct xfrm_sec_ctx **new_ctxp)
1758 : {
1759 : return 0;
1760 : }
1761 :
1762 : static inline void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
1763 : {
1764 : }
1765 :
1766 : static inline int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
1767 : {
1768 : return 0;
1769 : }
1770 :
1771 : static inline int security_xfrm_state_alloc(struct xfrm_state *x,
1772 : struct xfrm_user_sec_ctx *sec_ctx)
1773 : {
1774 : return 0;
1775 : }
1776 :
1777 : static inline int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
1778 : struct xfrm_sec_ctx *polsec, u32 secid)
1779 : {
1780 : return 0;
1781 : }
1782 :
1783 : static inline void security_xfrm_state_free(struct xfrm_state *x)
1784 : {
1785 : }
1786 :
1787 : static inline int security_xfrm_state_delete(struct xfrm_state *x)
1788 : {
1789 : return 0;
1790 : }
1791 :
1792 : static inline int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid)
1793 : {
1794 : return 0;
1795 : }
1796 :
1797 : static inline int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
1798 : struct xfrm_policy *xp,
1799 : const struct flowi_common *flic)
1800 : {
1801 : return 1;
1802 : }
1803 :
1804 : static inline int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
1805 : {
1806 : return 0;
1807 : }
1808 :
1809 : static inline void security_skb_classify_flow(struct sk_buff *skb,
1810 : struct flowi_common *flic)
1811 : {
1812 : }
1813 :
1814 : #endif /* CONFIG_SECURITY_NETWORK_XFRM */
1815 :
1816 : #ifdef CONFIG_SECURITY_PATH
1817 : int security_path_unlink(const struct path *dir, struct dentry *dentry);
1818 : int security_path_mkdir(const struct path *dir, struct dentry *dentry, umode_t mode);
1819 : int security_path_rmdir(const struct path *dir, struct dentry *dentry);
1820 : int security_path_mknod(const struct path *dir, struct dentry *dentry, umode_t mode,
1821 : unsigned int dev);
1822 : int security_path_truncate(const struct path *path);
1823 : int security_path_symlink(const struct path *dir, struct dentry *dentry,
1824 : const char *old_name);
1825 : int security_path_link(struct dentry *old_dentry, const struct path *new_dir,
1826 : struct dentry *new_dentry);
1827 : int security_path_rename(const struct path *old_dir, struct dentry *old_dentry,
1828 : const struct path *new_dir, struct dentry *new_dentry,
1829 : unsigned int flags);
1830 : int security_path_chmod(const struct path *path, umode_t mode);
1831 : int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid);
1832 : int security_path_chroot(const struct path *path);
1833 : #else /* CONFIG_SECURITY_PATH */
1834 : static inline int security_path_unlink(const struct path *dir, struct dentry *dentry)
1835 : {
1836 : return 0;
1837 : }
1838 :
1839 : static inline int security_path_mkdir(const struct path *dir, struct dentry *dentry,
1840 : umode_t mode)
1841 : {
1842 : return 0;
1843 : }
1844 :
1845 : static inline int security_path_rmdir(const struct path *dir, struct dentry *dentry)
1846 : {
1847 : return 0;
1848 : }
1849 :
1850 : static inline int security_path_mknod(const struct path *dir, struct dentry *dentry,
1851 : umode_t mode, unsigned int dev)
1852 : {
1853 : return 0;
1854 : }
1855 :
1856 : static inline int security_path_truncate(const struct path *path)
1857 : {
1858 : return 0;
1859 : }
1860 :
1861 : static inline int security_path_symlink(const struct path *dir, struct dentry *dentry,
1862 : const char *old_name)
1863 : {
1864 : return 0;
1865 : }
1866 :
1867 : static inline int security_path_link(struct dentry *old_dentry,
1868 : const struct path *new_dir,
1869 : struct dentry *new_dentry)
1870 : {
1871 : return 0;
1872 : }
1873 :
1874 : static inline int security_path_rename(const struct path *old_dir,
1875 : struct dentry *old_dentry,
1876 : const struct path *new_dir,
1877 : struct dentry *new_dentry,
1878 : unsigned int flags)
1879 : {
1880 : return 0;
1881 : }
1882 :
1883 : static inline int security_path_chmod(const struct path *path, umode_t mode)
1884 : {
1885 : return 0;
1886 : }
1887 :
1888 : static inline int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
1889 : {
1890 : return 0;
1891 : }
1892 :
1893 : static inline int security_path_chroot(const struct path *path)
1894 : {
1895 : return 0;
1896 : }
1897 : #endif /* CONFIG_SECURITY_PATH */
1898 :
1899 : #ifdef CONFIG_KEYS
1900 : #ifdef CONFIG_SECURITY
1901 :
1902 : int security_key_alloc(struct key *key, const struct cred *cred, unsigned long flags);
1903 : void security_key_free(struct key *key);
1904 : int security_key_permission(key_ref_t key_ref, const struct cred *cred,
1905 : enum key_need_perm need_perm);
1906 : int security_key_getsecurity(struct key *key, char **_buffer);
1907 :
1908 : #else
1909 :
1910 : static inline int security_key_alloc(struct key *key,
1911 : const struct cred *cred,
1912 : unsigned long flags)
1913 : {
1914 : return 0;
1915 : }
1916 :
1917 : static inline void security_key_free(struct key *key)
1918 : {
1919 : }
1920 :
1921 : static inline int security_key_permission(key_ref_t key_ref,
1922 : const struct cred *cred,
1923 : enum key_need_perm need_perm)
1924 : {
1925 : return 0;
1926 : }
1927 :
1928 : static inline int security_key_getsecurity(struct key *key, char **_buffer)
1929 : {
1930 : *_buffer = NULL;
1931 : return 0;
1932 : }
1933 :
1934 : #endif
1935 : #endif /* CONFIG_KEYS */
1936 :
1937 : #ifdef CONFIG_AUDIT
1938 : #ifdef CONFIG_SECURITY
1939 : int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule);
1940 : int security_audit_rule_known(struct audit_krule *krule);
1941 : int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule);
1942 : void security_audit_rule_free(void *lsmrule);
1943 :
1944 : #else
1945 :
1946 : static inline int security_audit_rule_init(u32 field, u32 op, char *rulestr,
1947 : void **lsmrule)
1948 : {
1949 : return 0;
1950 : }
1951 :
1952 : static inline int security_audit_rule_known(struct audit_krule *krule)
1953 : {
1954 : return 0;
1955 : }
1956 :
1957 : static inline int security_audit_rule_match(u32 secid, u32 field, u32 op,
1958 : void *lsmrule)
1959 : {
1960 : return 0;
1961 : }
1962 :
1963 : static inline void security_audit_rule_free(void *lsmrule)
1964 : { }
1965 :
1966 : #endif /* CONFIG_SECURITY */
1967 : #endif /* CONFIG_AUDIT */
1968 :
1969 : #ifdef CONFIG_SECURITYFS
1970 :
1971 : extern struct dentry *securityfs_create_file(const char *name, umode_t mode,
1972 : struct dentry *parent, void *data,
1973 : const struct file_operations *fops);
1974 : extern struct dentry *securityfs_create_dir(const char *name, struct dentry *parent);
1975 : struct dentry *securityfs_create_symlink(const char *name,
1976 : struct dentry *parent,
1977 : const char *target,
1978 : const struct inode_operations *iops);
1979 : extern void securityfs_remove(struct dentry *dentry);
1980 :
1981 : #else /* CONFIG_SECURITYFS */
1982 :
1983 : static inline struct dentry *securityfs_create_dir(const char *name,
1984 : struct dentry *parent)
1985 : {
1986 : return ERR_PTR(-ENODEV);
1987 : }
1988 :
1989 : static inline struct dentry *securityfs_create_file(const char *name,
1990 : umode_t mode,
1991 : struct dentry *parent,
1992 : void *data,
1993 : const struct file_operations *fops)
1994 : {
1995 : return ERR_PTR(-ENODEV);
1996 : }
1997 :
1998 : static inline struct dentry *securityfs_create_symlink(const char *name,
1999 : struct dentry *parent,
2000 : const char *target,
2001 : const struct inode_operations *iops)
2002 : {
2003 : return ERR_PTR(-ENODEV);
2004 : }
2005 :
2006 : static inline void securityfs_remove(struct dentry *dentry)
2007 : {}
2008 :
2009 : #endif
2010 :
2011 : #ifdef CONFIG_BPF_SYSCALL
2012 : union bpf_attr;
2013 : struct bpf_map;
2014 : struct bpf_prog;
2015 : struct bpf_prog_aux;
2016 : #ifdef CONFIG_SECURITY
2017 : extern int security_bpf(int cmd, union bpf_attr *attr, unsigned int size);
2018 : extern int security_bpf_map(struct bpf_map *map, fmode_t fmode);
2019 : extern int security_bpf_prog(struct bpf_prog *prog);
2020 : extern int security_bpf_map_alloc(struct bpf_map *map);
2021 : extern void security_bpf_map_free(struct bpf_map *map);
2022 : extern int security_bpf_prog_alloc(struct bpf_prog_aux *aux);
2023 : extern void security_bpf_prog_free(struct bpf_prog_aux *aux);
2024 : #else
2025 : static inline int security_bpf(int cmd, union bpf_attr *attr,
2026 : unsigned int size)
2027 : {
2028 : return 0;
2029 : }
2030 :
2031 : static inline int security_bpf_map(struct bpf_map *map, fmode_t fmode)
2032 : {
2033 : return 0;
2034 : }
2035 :
2036 : static inline int security_bpf_prog(struct bpf_prog *prog)
2037 : {
2038 : return 0;
2039 : }
2040 :
2041 : static inline int security_bpf_map_alloc(struct bpf_map *map)
2042 : {
2043 : return 0;
2044 : }
2045 :
2046 : static inline void security_bpf_map_free(struct bpf_map *map)
2047 : { }
2048 :
2049 : static inline int security_bpf_prog_alloc(struct bpf_prog_aux *aux)
2050 : {
2051 : return 0;
2052 : }
2053 :
2054 : static inline void security_bpf_prog_free(struct bpf_prog_aux *aux)
2055 : { }
2056 : #endif /* CONFIG_SECURITY */
2057 : #endif /* CONFIG_BPF_SYSCALL */
2058 :
2059 : #ifdef CONFIG_PERF_EVENTS
2060 : struct perf_event_attr;
2061 : struct perf_event;
2062 :
2063 : #ifdef CONFIG_SECURITY
2064 : extern int security_perf_event_open(struct perf_event_attr *attr, int type);
2065 : extern int security_perf_event_alloc(struct perf_event *event);
2066 : extern void security_perf_event_free(struct perf_event *event);
2067 : extern int security_perf_event_read(struct perf_event *event);
2068 : extern int security_perf_event_write(struct perf_event *event);
2069 : #else
2070 : static inline int security_perf_event_open(struct perf_event_attr *attr,
2071 : int type)
2072 : {
2073 : return 0;
2074 : }
2075 :
2076 : static inline int security_perf_event_alloc(struct perf_event *event)
2077 : {
2078 : return 0;
2079 : }
2080 :
2081 : static inline void security_perf_event_free(struct perf_event *event)
2082 : {
2083 : }
2084 :
2085 : static inline int security_perf_event_read(struct perf_event *event)
2086 : {
2087 : return 0;
2088 : }
2089 :
2090 : static inline int security_perf_event_write(struct perf_event *event)
2091 : {
2092 : return 0;
2093 : }
2094 : #endif /* CONFIG_SECURITY */
2095 : #endif /* CONFIG_PERF_EVENTS */
2096 :
2097 : #ifdef CONFIG_IO_URING
2098 : #ifdef CONFIG_SECURITY
2099 : extern int security_uring_override_creds(const struct cred *new);
2100 : extern int security_uring_sqpoll(void);
2101 : extern int security_uring_cmd(struct io_uring_cmd *ioucmd);
2102 : #else
2103 : static inline int security_uring_override_creds(const struct cred *new)
2104 : {
2105 : return 0;
2106 : }
2107 : static inline int security_uring_sqpoll(void)
2108 : {
2109 : return 0;
2110 : }
2111 : static inline int security_uring_cmd(struct io_uring_cmd *ioucmd)
2112 : {
2113 : return 0;
2114 : }
2115 : #endif /* CONFIG_SECURITY */
2116 : #endif /* CONFIG_IO_URING */
2117 :
2118 : #endif /* ! __LINUX_SECURITY_H */
|
