Line data Source code
1 : /*
2 : * Linux Security plug
3 : *
4 : * Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com>
5 : * Copyright (C) 2001 Greg Kroah-Hartman <greg@kroah.com>
6 : * Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com>
7 : * Copyright (C) 2001 James Morris <jmorris@intercode.com.au>
8 : * Copyright (C) 2001 Silicon Graphics, Inc. (Trust Technology Group)
9 : * Copyright (C) 2016 Mellanox Techonologies
10 : *
11 : * This program is free software; you can redistribute it and/or modify
12 : * it under the terms of the GNU General Public License as published by
13 : * the Free Software Foundation; either version 2 of the License, or
14 : * (at your option) any later version.
15 : *
16 : * Due to this file being licensed under the GPL there is controversy over
17 : * whether this permits you to write a module that #includes this file
18 : * without placing your module under the GPL. Please consult a lawyer for
19 : * advice before doing this.
20 : *
21 : */
22 :
23 : #ifndef __LINUX_SECURITY_H
24 : #define __LINUX_SECURITY_H
25 :
26 : #include <linux/kernel_read_file.h>
27 : #include <linux/key.h>
28 : #include <linux/capability.h>
29 : #include <linux/fs.h>
30 : #include <linux/slab.h>
31 : #include <linux/err.h>
32 : #include <linux/string.h>
33 : #include <linux/mm.h>
34 : #include <linux/sockptr.h>
35 :
36 : struct linux_binprm;
37 : struct cred;
38 : struct rlimit;
39 : struct kernel_siginfo;
40 : struct sembuf;
41 : struct kern_ipc_perm;
42 : struct audit_context;
43 : struct super_block;
44 : struct inode;
45 : struct dentry;
46 : struct file;
47 : struct vfsmount;
48 : struct path;
49 : struct qstr;
50 : struct iattr;
51 : struct fown_struct;
52 : struct file_operations;
53 : struct msg_msg;
54 : struct xattr;
55 : struct kernfs_node;
56 : struct xfrm_sec_ctx;
57 : struct mm_struct;
58 : struct fs_context;
59 : struct fs_parameter;
60 : enum fs_value_type;
61 : struct watch;
62 : struct watch_notification;
63 :
64 : /* Default (no) options for the capable function */
65 : #define CAP_OPT_NONE 0x0
66 : /* If capable should audit the security request */
67 : #define CAP_OPT_NOAUDIT BIT(1)
68 : /* If capable is being called by a setid function */
69 : #define CAP_OPT_INSETID BIT(2)
70 :
71 : /* LSM Agnostic defines for fs_context::lsm_flags */
72 : #define SECURITY_LSM_NATIVE_LABELS 1
73 :
74 : struct ctl_table;
75 : struct audit_krule;
76 : struct user_namespace;
77 : struct timezone;
78 :
79 : enum lsm_event {
80 : LSM_POLICY_CHANGE,
81 : };
82 :
83 : /*
84 : * These are reasons that can be passed to the security_locked_down()
85 : * LSM hook. Lockdown reasons that protect kernel integrity (ie, the
86 : * ability for userland to modify kernel code) are placed before
87 : * LOCKDOWN_INTEGRITY_MAX. Lockdown reasons that protect kernel
88 : * confidentiality (ie, the ability for userland to extract
89 : * information from the running kernel that would otherwise be
90 : * restricted) are placed before LOCKDOWN_CONFIDENTIALITY_MAX.
91 : *
92 : * LSM authors should note that the semantics of any given lockdown
93 : * reason are not guaranteed to be stable - the same reason may block
94 : * one set of features in one kernel release, and a slightly different
95 : * set of features in a later kernel release. LSMs that seek to expose
96 : * lockdown policy at any level of granularity other than "none",
97 : * "integrity" or "confidentiality" are responsible for either
98 : * ensuring that they expose a consistent level of functionality to
99 : * userland, or ensuring that userland is aware that this is
100 : * potentially a moving target. It is easy to misuse this information
101 : * in a way that could break userspace. Please be careful not to do
102 : * so.
103 : *
104 : * If you add to this, remember to extend lockdown_reasons in
105 : * security/lockdown/lockdown.c.
106 : */
107 : enum lockdown_reason {
108 : LOCKDOWN_NONE,
109 : LOCKDOWN_MODULE_SIGNATURE,
110 : LOCKDOWN_DEV_MEM,
111 : LOCKDOWN_EFI_TEST,
112 : LOCKDOWN_KEXEC,
113 : LOCKDOWN_HIBERNATION,
114 : LOCKDOWN_PCI_ACCESS,
115 : LOCKDOWN_IOPORT,
116 : LOCKDOWN_MSR,
117 : LOCKDOWN_ACPI_TABLES,
118 : LOCKDOWN_DEVICE_TREE,
119 : LOCKDOWN_PCMCIA_CIS,
120 : LOCKDOWN_TIOCSSERIAL,
121 : LOCKDOWN_MODULE_PARAMETERS,
122 : LOCKDOWN_MMIOTRACE,
123 : LOCKDOWN_DEBUGFS,
124 : LOCKDOWN_XMON_WR,
125 : LOCKDOWN_BPF_WRITE_USER,
126 : LOCKDOWN_DBG_WRITE_KERNEL,
127 : LOCKDOWN_RTAS_ERROR_INJECTION,
128 : LOCKDOWN_INTEGRITY_MAX,
129 : LOCKDOWN_KCORE,
130 : LOCKDOWN_KPROBES,
131 : LOCKDOWN_BPF_READ_KERNEL,
132 : LOCKDOWN_DBG_READ_KERNEL,
133 : LOCKDOWN_PERF,
134 : LOCKDOWN_TRACEFS,
135 : LOCKDOWN_XMON_RW,
136 : LOCKDOWN_XFRM_SECRET,
137 : LOCKDOWN_CONFIDENTIALITY_MAX,
138 : };
139 :
140 : extern const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1];
141 :
142 : /* These functions are in security/commoncap.c */
143 : extern int cap_capable(const struct cred *cred, struct user_namespace *ns,
144 : int cap, unsigned int opts);
145 : extern int cap_settime(const struct timespec64 *ts, const struct timezone *tz);
146 : extern int cap_ptrace_access_check(struct task_struct *child, unsigned int mode);
147 : extern int cap_ptrace_traceme(struct task_struct *parent);
148 : extern int cap_capget(struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);
149 : extern int cap_capset(struct cred *new, const struct cred *old,
150 : const kernel_cap_t *effective,
151 : const kernel_cap_t *inheritable,
152 : const kernel_cap_t *permitted);
153 : extern int cap_bprm_creds_from_file(struct linux_binprm *bprm, struct file *file);
154 : int cap_inode_setxattr(struct dentry *dentry, const char *name,
155 : const void *value, size_t size, int flags);
156 : int cap_inode_removexattr(struct mnt_idmap *idmap,
157 : struct dentry *dentry, const char *name);
158 : int cap_inode_need_killpriv(struct dentry *dentry);
159 : int cap_inode_killpriv(struct mnt_idmap *idmap, struct dentry *dentry);
160 : int cap_inode_getsecurity(struct mnt_idmap *idmap,
161 : struct inode *inode, const char *name, void **buffer,
162 : bool alloc);
163 : extern int cap_mmap_addr(unsigned long addr);
164 : extern int cap_mmap_file(struct file *file, unsigned long reqprot,
165 : unsigned long prot, unsigned long flags);
166 : extern int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags);
167 : extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
168 : unsigned long arg4, unsigned long arg5);
169 : extern int cap_task_setscheduler(struct task_struct *p);
170 : extern int cap_task_setioprio(struct task_struct *p, int ioprio);
171 : extern int cap_task_setnice(struct task_struct *p, int nice);
172 : extern int cap_vm_enough_memory(struct mm_struct *mm, long pages);
173 :
174 : struct msghdr;
175 : struct sk_buff;
176 : struct sock;
177 : struct sockaddr;
178 : struct socket;
179 : struct flowi_common;
180 : struct dst_entry;
181 : struct xfrm_selector;
182 : struct xfrm_policy;
183 : struct xfrm_state;
184 : struct xfrm_user_sec_ctx;
185 : struct seq_file;
186 : struct sctp_association;
187 :
188 : #ifdef CONFIG_MMU
189 : extern unsigned long mmap_min_addr;
190 : extern unsigned long dac_mmap_min_addr;
191 : #else
192 : #define mmap_min_addr 0UL
193 : #define dac_mmap_min_addr 0UL
194 : #endif
195 :
196 : /*
197 : * Values used in the task_security_ops calls
198 : */
199 : /* setuid or setgid, id0 == uid or gid */
200 : #define LSM_SETID_ID 1
201 :
202 : /* setreuid or setregid, id0 == real, id1 == eff */
203 : #define LSM_SETID_RE 2
204 :
205 : /* setresuid or setresgid, id0 == real, id1 == eff, uid2 == saved */
206 : #define LSM_SETID_RES 4
207 :
208 : /* setfsuid or setfsgid, id0 == fsuid or fsgid */
209 : #define LSM_SETID_FS 8
210 :
211 : /* Flags for security_task_prlimit(). */
212 : #define LSM_PRLIMIT_READ 1
213 : #define LSM_PRLIMIT_WRITE 2
214 :
215 : /* forward declares to avoid warnings */
216 : struct sched_param;
217 : struct request_sock;
218 :
219 : /* bprm->unsafe reasons */
220 : #define LSM_UNSAFE_SHARE 1
221 : #define LSM_UNSAFE_PTRACE 2
222 : #define LSM_UNSAFE_NO_NEW_PRIVS 4
223 :
224 : #ifdef CONFIG_MMU
225 : extern int mmap_min_addr_handler(struct ctl_table *table, int write,
226 : void *buffer, size_t *lenp, loff_t *ppos);
227 : #endif
228 :
229 : /* security_inode_init_security callback function to write xattrs */
230 : typedef int (*initxattrs) (struct inode *inode,
231 : const struct xattr *xattr_array, void *fs_data);
232 :
233 :
234 : /* Keep the kernel_load_data_id enum in sync with kernel_read_file_id */
235 : #define __data_id_enumify(ENUM, dummy) LOADING_ ## ENUM,
236 : #define __data_id_stringify(dummy, str) #str,
237 :
238 : enum kernel_load_data_id {
239 : __kernel_read_file_id(__data_id_enumify)
240 : };
241 :
242 : static const char * const kernel_load_data_str[] = {
243 : __kernel_read_file_id(__data_id_stringify)
244 : };
245 :
246 : static inline const char *kernel_load_data_id_str(enum kernel_load_data_id id)
247 : {
248 : if ((unsigned)id >= LOADING_MAX_ID)
249 : return kernel_load_data_str[LOADING_UNKNOWN];
250 :
251 : return kernel_load_data_str[id];
252 : }
253 :
254 : #ifdef CONFIG_SECURITY
255 :
256 : int call_blocking_lsm_notifier(enum lsm_event event, void *data);
257 : int register_blocking_lsm_notifier(struct notifier_block *nb);
258 : int unregister_blocking_lsm_notifier(struct notifier_block *nb);
259 :
260 : /* prototypes */
261 : extern int security_init(void);
262 : extern int early_security_init(void);
263 :
264 : /* Security operations */
265 : int security_binder_set_context_mgr(const struct cred *mgr);
266 : int security_binder_transaction(const struct cred *from,
267 : const struct cred *to);
268 : int security_binder_transfer_binder(const struct cred *from,
269 : const struct cred *to);
270 : int security_binder_transfer_file(const struct cred *from,
271 : const struct cred *to, struct file *file);
272 : int security_ptrace_access_check(struct task_struct *child, unsigned int mode);
273 : int security_ptrace_traceme(struct task_struct *parent);
274 : int security_capget(struct task_struct *target,
275 : kernel_cap_t *effective,
276 : kernel_cap_t *inheritable,
277 : kernel_cap_t *permitted);
278 : int security_capset(struct cred *new, const struct cred *old,
279 : const kernel_cap_t *effective,
280 : const kernel_cap_t *inheritable,
281 : const kernel_cap_t *permitted);
282 : int security_capable(const struct cred *cred,
283 : struct user_namespace *ns,
284 : int cap,
285 : unsigned int opts);
286 : int security_quotactl(int cmds, int type, int id, struct super_block *sb);
287 : int security_quota_on(struct dentry *dentry);
288 : int security_syslog(int type);
289 : int security_settime64(const struct timespec64 *ts, const struct timezone *tz);
290 : int security_vm_enough_memory_mm(struct mm_struct *mm, long pages);
291 : int security_bprm_creds_for_exec(struct linux_binprm *bprm);
292 : int security_bprm_creds_from_file(struct linux_binprm *bprm, struct file *file);
293 : int security_bprm_check(struct linux_binprm *bprm);
294 : void security_bprm_committing_creds(struct linux_binprm *bprm);
295 : void security_bprm_committed_creds(struct linux_binprm *bprm);
296 : int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc);
297 : int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param);
298 : int security_sb_alloc(struct super_block *sb);
299 : void security_sb_delete(struct super_block *sb);
300 : void security_sb_free(struct super_block *sb);
301 : void security_free_mnt_opts(void **mnt_opts);
302 : int security_sb_eat_lsm_opts(char *options, void **mnt_opts);
303 : int security_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts);
304 : int security_sb_remount(struct super_block *sb, void *mnt_opts);
305 : int security_sb_kern_mount(struct super_block *sb);
306 : int security_sb_show_options(struct seq_file *m, struct super_block *sb);
307 : int security_sb_statfs(struct dentry *dentry);
308 : int security_sb_mount(const char *dev_name, const struct path *path,
309 : const char *type, unsigned long flags, void *data);
310 : int security_sb_umount(struct vfsmount *mnt, int flags);
311 : int security_sb_pivotroot(const struct path *old_path, const struct path *new_path);
312 : int security_sb_set_mnt_opts(struct super_block *sb,
313 : void *mnt_opts,
314 : unsigned long kern_flags,
315 : unsigned long *set_kern_flags);
316 : int security_sb_clone_mnt_opts(const struct super_block *oldsb,
317 : struct super_block *newsb,
318 : unsigned long kern_flags,
319 : unsigned long *set_kern_flags);
320 : int security_move_mount(const struct path *from_path, const struct path *to_path);
321 : int security_dentry_init_security(struct dentry *dentry, int mode,
322 : const struct qstr *name,
323 : const char **xattr_name, void **ctx,
324 : u32 *ctxlen);
325 : int security_dentry_create_files_as(struct dentry *dentry, int mode,
326 : struct qstr *name,
327 : const struct cred *old,
328 : struct cred *new);
329 : int security_path_notify(const struct path *path, u64 mask,
330 : unsigned int obj_type);
331 : int security_inode_alloc(struct inode *inode);
332 : void security_inode_free(struct inode *inode);
333 : int security_inode_init_security(struct inode *inode, struct inode *dir,
334 : const struct qstr *qstr,
335 : initxattrs initxattrs, void *fs_data);
336 : int security_inode_init_security_anon(struct inode *inode,
337 : const struct qstr *name,
338 : const struct inode *context_inode);
339 : int security_old_inode_init_security(struct inode *inode, struct inode *dir,
340 : const struct qstr *qstr, const char **name,
341 : void **value, size_t *len);
342 : int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode);
343 : int security_inode_link(struct dentry *old_dentry, struct inode *dir,
344 : struct dentry *new_dentry);
345 : int security_inode_unlink(struct inode *dir, struct dentry *dentry);
346 : int security_inode_symlink(struct inode *dir, struct dentry *dentry,
347 : const char *old_name);
348 : int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode);
349 : int security_inode_rmdir(struct inode *dir, struct dentry *dentry);
350 : int security_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev);
351 : int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
352 : struct inode *new_dir, struct dentry *new_dentry,
353 : unsigned int flags);
354 : int security_inode_readlink(struct dentry *dentry);
355 : int security_inode_follow_link(struct dentry *dentry, struct inode *inode,
356 : bool rcu);
357 : int security_inode_permission(struct inode *inode, int mask);
358 : int security_inode_setattr(struct mnt_idmap *idmap,
359 : struct dentry *dentry, struct iattr *attr);
360 : int security_inode_getattr(const struct path *path);
361 : int security_inode_setxattr(struct mnt_idmap *idmap,
362 : struct dentry *dentry, const char *name,
363 : const void *value, size_t size, int flags);
364 : int security_inode_set_acl(struct mnt_idmap *idmap,
365 : struct dentry *dentry, const char *acl_name,
366 : struct posix_acl *kacl);
367 : int security_inode_get_acl(struct mnt_idmap *idmap,
368 : struct dentry *dentry, const char *acl_name);
369 : int security_inode_remove_acl(struct mnt_idmap *idmap,
370 : struct dentry *dentry, const char *acl_name);
371 : void security_inode_post_setxattr(struct dentry *dentry, const char *name,
372 : const void *value, size_t size, int flags);
373 : int security_inode_getxattr(struct dentry *dentry, const char *name);
374 : int security_inode_listxattr(struct dentry *dentry);
375 : int security_inode_removexattr(struct mnt_idmap *idmap,
376 : struct dentry *dentry, const char *name);
377 : int security_inode_need_killpriv(struct dentry *dentry);
378 : int security_inode_killpriv(struct mnt_idmap *idmap, struct dentry *dentry);
379 : int security_inode_getsecurity(struct mnt_idmap *idmap,
380 : struct inode *inode, const char *name,
381 : void **buffer, bool alloc);
382 : int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags);
383 : int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size);
384 : void security_inode_getsecid(struct inode *inode, u32 *secid);
385 : int security_inode_copy_up(struct dentry *src, struct cred **new);
386 : int security_inode_copy_up_xattr(const char *name);
387 : int security_kernfs_init_security(struct kernfs_node *kn_dir,
388 : struct kernfs_node *kn);
389 : int security_file_permission(struct file *file, int mask);
390 : int security_file_alloc(struct file *file);
391 : void security_file_free(struct file *file);
392 : int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
393 : int security_mmap_file(struct file *file, unsigned long prot,
394 : unsigned long flags);
395 : int security_mmap_addr(unsigned long addr);
396 : int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
397 : unsigned long prot);
398 : int security_file_lock(struct file *file, unsigned int cmd);
399 : int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg);
400 : void security_file_set_fowner(struct file *file);
401 : int security_file_send_sigiotask(struct task_struct *tsk,
402 : struct fown_struct *fown, int sig);
403 : int security_file_receive(struct file *file);
404 : int security_file_open(struct file *file);
405 : int security_file_truncate(struct file *file);
406 : int security_task_alloc(struct task_struct *task, unsigned long clone_flags);
407 : void security_task_free(struct task_struct *task);
408 : int security_cred_alloc_blank(struct cred *cred, gfp_t gfp);
409 : void security_cred_free(struct cred *cred);
410 : int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp);
411 : void security_transfer_creds(struct cred *new, const struct cred *old);
412 : void security_cred_getsecid(const struct cred *c, u32 *secid);
413 : int security_kernel_act_as(struct cred *new, u32 secid);
414 : int security_kernel_create_files_as(struct cred *new, struct inode *inode);
415 : int security_kernel_module_request(char *kmod_name);
416 : int security_kernel_load_data(enum kernel_load_data_id id, bool contents);
417 : int security_kernel_post_load_data(char *buf, loff_t size,
418 : enum kernel_load_data_id id,
419 : char *description);
420 : int security_kernel_read_file(struct file *file, enum kernel_read_file_id id,
421 : bool contents);
422 : int security_kernel_post_read_file(struct file *file, char *buf, loff_t size,
423 : enum kernel_read_file_id id);
424 : int security_task_fix_setuid(struct cred *new, const struct cred *old,
425 : int flags);
426 : int security_task_fix_setgid(struct cred *new, const struct cred *old,
427 : int flags);
428 : int security_task_fix_setgroups(struct cred *new, const struct cred *old);
429 : int security_task_setpgid(struct task_struct *p, pid_t pgid);
430 : int security_task_getpgid(struct task_struct *p);
431 : int security_task_getsid(struct task_struct *p);
432 : void security_current_getsecid_subj(u32 *secid);
433 : void security_task_getsecid_obj(struct task_struct *p, u32 *secid);
434 : int security_task_setnice(struct task_struct *p, int nice);
435 : int security_task_setioprio(struct task_struct *p, int ioprio);
436 : int security_task_getioprio(struct task_struct *p);
437 : int security_task_prlimit(const struct cred *cred, const struct cred *tcred,
438 : unsigned int flags);
439 : int security_task_setrlimit(struct task_struct *p, unsigned int resource,
440 : struct rlimit *new_rlim);
441 : int security_task_setscheduler(struct task_struct *p);
442 : int security_task_getscheduler(struct task_struct *p);
443 : int security_task_movememory(struct task_struct *p);
444 : int security_task_kill(struct task_struct *p, struct kernel_siginfo *info,
445 : int sig, const struct cred *cred);
446 : int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
447 : unsigned long arg4, unsigned long arg5);
448 : void security_task_to_inode(struct task_struct *p, struct inode *inode);
449 : int security_create_user_ns(const struct cred *cred);
450 : int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag);
451 : void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid);
452 : int security_msg_msg_alloc(struct msg_msg *msg);
453 : void security_msg_msg_free(struct msg_msg *msg);
454 : int security_msg_queue_alloc(struct kern_ipc_perm *msq);
455 : void security_msg_queue_free(struct kern_ipc_perm *msq);
456 : int security_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg);
457 : int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd);
458 : int security_msg_queue_msgsnd(struct kern_ipc_perm *msq,
459 : struct msg_msg *msg, int msqflg);
460 : int security_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
461 : struct task_struct *target, long type, int mode);
462 : int security_shm_alloc(struct kern_ipc_perm *shp);
463 : void security_shm_free(struct kern_ipc_perm *shp);
464 : int security_shm_associate(struct kern_ipc_perm *shp, int shmflg);
465 : int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd);
466 : int security_shm_shmat(struct kern_ipc_perm *shp, char __user *shmaddr, int shmflg);
467 : int security_sem_alloc(struct kern_ipc_perm *sma);
468 : void security_sem_free(struct kern_ipc_perm *sma);
469 : int security_sem_associate(struct kern_ipc_perm *sma, int semflg);
470 : int security_sem_semctl(struct kern_ipc_perm *sma, int cmd);
471 : int security_sem_semop(struct kern_ipc_perm *sma, struct sembuf *sops,
472 : unsigned nsops, int alter);
473 : void security_d_instantiate(struct dentry *dentry, struct inode *inode);
474 : int security_getprocattr(struct task_struct *p, const char *lsm, const char *name,
475 : char **value);
476 : int security_setprocattr(const char *lsm, const char *name, void *value,
477 : size_t size);
478 : int security_netlink_send(struct sock *sk, struct sk_buff *skb);
479 : int security_ismaclabel(const char *name);
480 : int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);
481 : int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
482 : void security_release_secctx(char *secdata, u32 seclen);
483 : void security_inode_invalidate_secctx(struct inode *inode);
484 : int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen);
485 : int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
486 : int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen);
487 : int security_locked_down(enum lockdown_reason what);
488 : #else /* CONFIG_SECURITY */
489 :
490 : static inline int call_blocking_lsm_notifier(enum lsm_event event, void *data)
491 : {
492 : return 0;
493 : }
494 :
495 : static inline int register_blocking_lsm_notifier(struct notifier_block *nb)
496 : {
497 : return 0;
498 : }
499 :
500 : static inline int unregister_blocking_lsm_notifier(struct notifier_block *nb)
501 : {
502 : return 0;
503 : }
504 :
505 : static inline void security_free_mnt_opts(void **mnt_opts)
506 : {
507 : }
508 :
509 : /*
510 : * This is the default capabilities functionality. Most of these functions
511 : * are just stubbed out, but a few must call the proper capable code.
512 : */
513 :
514 : static inline int security_init(void)
515 : {
516 : return 0;
517 : }
518 :
519 : static inline int early_security_init(void)
520 : {
521 : return 0;
522 : }
523 :
524 : static inline int security_binder_set_context_mgr(const struct cred *mgr)
525 : {
526 : return 0;
527 : }
528 :
529 : static inline int security_binder_transaction(const struct cred *from,
530 : const struct cred *to)
531 : {
532 : return 0;
533 : }
534 :
535 : static inline int security_binder_transfer_binder(const struct cred *from,
536 : const struct cred *to)
537 : {
538 : return 0;
539 : }
540 :
541 : static inline int security_binder_transfer_file(const struct cred *from,
542 : const struct cred *to,
543 : struct file *file)
544 : {
545 : return 0;
546 : }
547 :
548 : static inline int security_ptrace_access_check(struct task_struct *child,
549 : unsigned int mode)
550 : {
551 0 : return cap_ptrace_access_check(child, mode);
552 : }
553 :
554 : static inline int security_ptrace_traceme(struct task_struct *parent)
555 : {
556 0 : return cap_ptrace_traceme(parent);
557 : }
558 :
559 : static inline int security_capget(struct task_struct *target,
560 : kernel_cap_t *effective,
561 : kernel_cap_t *inheritable,
562 : kernel_cap_t *permitted)
563 : {
564 0 : return cap_capget(target, effective, inheritable, permitted);
565 : }
566 :
567 : static inline int security_capset(struct cred *new,
568 : const struct cred *old,
569 : const kernel_cap_t *effective,
570 : const kernel_cap_t *inheritable,
571 : const kernel_cap_t *permitted)
572 : {
573 0 : return cap_capset(new, old, effective, inheritable, permitted);
574 : }
575 :
576 : static inline int security_capable(const struct cred *cred,
577 : struct user_namespace *ns,
578 : int cap,
579 : unsigned int opts)
580 : {
581 1 : return cap_capable(cred, ns, cap, opts);
582 : }
583 :
584 : static inline int security_quotactl(int cmds, int type, int id,
585 : struct super_block *sb)
586 : {
587 : return 0;
588 : }
589 :
590 : static inline int security_quota_on(struct dentry *dentry)
591 : {
592 : return 0;
593 : }
594 :
595 : static inline int security_syslog(int type)
596 : {
597 : return 0;
598 : }
599 :
600 : static inline int security_settime64(const struct timespec64 *ts,
601 : const struct timezone *tz)
602 : {
603 0 : return cap_settime(ts, tz);
604 : }
605 :
606 0 : static inline int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
607 : {
608 0 : return __vm_enough_memory(mm, pages, cap_vm_enough_memory(mm, pages));
609 : }
610 :
611 : static inline int security_bprm_creds_for_exec(struct linux_binprm *bprm)
612 : {
613 : return 0;
614 : }
615 :
616 : static inline int security_bprm_creds_from_file(struct linux_binprm *bprm,
617 : struct file *file)
618 : {
619 0 : return cap_bprm_creds_from_file(bprm, file);
620 : }
621 :
622 : static inline int security_bprm_check(struct linux_binprm *bprm)
623 : {
624 : return 0;
625 : }
626 :
627 : static inline void security_bprm_committing_creds(struct linux_binprm *bprm)
628 : {
629 : }
630 :
631 : static inline void security_bprm_committed_creds(struct linux_binprm *bprm)
632 : {
633 : }
634 :
635 : static inline int security_fs_context_dup(struct fs_context *fc,
636 : struct fs_context *src_fc)
637 : {
638 : return 0;
639 : }
640 : static inline int security_fs_context_parse_param(struct fs_context *fc,
641 : struct fs_parameter *param)
642 : {
643 : return -ENOPARAM;
644 : }
645 :
646 : static inline int security_sb_alloc(struct super_block *sb)
647 : {
648 : return 0;
649 : }
650 :
651 : static inline void security_sb_delete(struct super_block *sb)
652 : { }
653 :
654 : static inline void security_sb_free(struct super_block *sb)
655 : { }
656 :
657 : static inline int security_sb_eat_lsm_opts(char *options,
658 : void **mnt_opts)
659 : {
660 : return 0;
661 : }
662 :
663 : static inline int security_sb_remount(struct super_block *sb,
664 : void *mnt_opts)
665 : {
666 : return 0;
667 : }
668 :
669 : static inline int security_sb_mnt_opts_compat(struct super_block *sb,
670 : void *mnt_opts)
671 : {
672 : return 0;
673 : }
674 :
675 :
676 : static inline int security_sb_kern_mount(struct super_block *sb)
677 : {
678 : return 0;
679 : }
680 :
681 : static inline int security_sb_show_options(struct seq_file *m,
682 : struct super_block *sb)
683 : {
684 : return 0;
685 : }
686 :
687 : static inline int security_sb_statfs(struct dentry *dentry)
688 : {
689 : return 0;
690 : }
691 :
692 : static inline int security_sb_mount(const char *dev_name, const struct path *path,
693 : const char *type, unsigned long flags,
694 : void *data)
695 : {
696 : return 0;
697 : }
698 :
699 : static inline int security_sb_umount(struct vfsmount *mnt, int flags)
700 : {
701 : return 0;
702 : }
703 :
704 : static inline int security_sb_pivotroot(const struct path *old_path,
705 : const struct path *new_path)
706 : {
707 : return 0;
708 : }
709 :
710 : static inline int security_sb_set_mnt_opts(struct super_block *sb,
711 : void *mnt_opts,
712 : unsigned long kern_flags,
713 : unsigned long *set_kern_flags)
714 : {
715 : return 0;
716 : }
717 :
718 : static inline int security_sb_clone_mnt_opts(const struct super_block *oldsb,
719 : struct super_block *newsb,
720 : unsigned long kern_flags,
721 : unsigned long *set_kern_flags)
722 : {
723 : return 0;
724 : }
725 :
726 : static inline int security_move_mount(const struct path *from_path,
727 : const struct path *to_path)
728 : {
729 : return 0;
730 : }
731 :
732 : static inline int security_path_notify(const struct path *path, u64 mask,
733 : unsigned int obj_type)
734 : {
735 : return 0;
736 : }
737 :
738 : static inline int security_inode_alloc(struct inode *inode)
739 : {
740 : return 0;
741 : }
742 :
743 : static inline void security_inode_free(struct inode *inode)
744 : { }
745 :
746 : static inline int security_dentry_init_security(struct dentry *dentry,
747 : int mode,
748 : const struct qstr *name,
749 : const char **xattr_name,
750 : void **ctx,
751 : u32 *ctxlen)
752 : {
753 : return -EOPNOTSUPP;
754 : }
755 :
756 : static inline int security_dentry_create_files_as(struct dentry *dentry,
757 : int mode, struct qstr *name,
758 : const struct cred *old,
759 : struct cred *new)
760 : {
761 : return 0;
762 : }
763 :
764 :
765 : static inline int security_inode_init_security(struct inode *inode,
766 : struct inode *dir,
767 : const struct qstr *qstr,
768 : const initxattrs xattrs,
769 : void *fs_data)
770 : {
771 : return 0;
772 : }
773 :
774 : static inline int security_inode_init_security_anon(struct inode *inode,
775 : const struct qstr *name,
776 : const struct inode *context_inode)
777 : {
778 : return 0;
779 : }
780 :
781 : static inline int security_old_inode_init_security(struct inode *inode,
782 : struct inode *dir,
783 : const struct qstr *qstr,
784 : const char **name,
785 : void **value, size_t *len)
786 : {
787 : return -EOPNOTSUPP;
788 : }
789 :
790 : static inline int security_inode_create(struct inode *dir,
791 : struct dentry *dentry,
792 : umode_t mode)
793 : {
794 : return 0;
795 : }
796 :
797 : static inline int security_inode_link(struct dentry *old_dentry,
798 : struct inode *dir,
799 : struct dentry *new_dentry)
800 : {
801 : return 0;
802 : }
803 :
804 : static inline int security_inode_unlink(struct inode *dir,
805 : struct dentry *dentry)
806 : {
807 : return 0;
808 : }
809 :
810 : static inline int security_inode_symlink(struct inode *dir,
811 : struct dentry *dentry,
812 : const char *old_name)
813 : {
814 : return 0;
815 : }
816 :
817 : static inline int security_inode_mkdir(struct inode *dir,
818 : struct dentry *dentry,
819 : int mode)
820 : {
821 : return 0;
822 : }
823 :
824 : static inline int security_inode_rmdir(struct inode *dir,
825 : struct dentry *dentry)
826 : {
827 : return 0;
828 : }
829 :
830 : static inline int security_inode_mknod(struct inode *dir,
831 : struct dentry *dentry,
832 : int mode, dev_t dev)
833 : {
834 : return 0;
835 : }
836 :
837 : static inline int security_inode_rename(struct inode *old_dir,
838 : struct dentry *old_dentry,
839 : struct inode *new_dir,
840 : struct dentry *new_dentry,
841 : unsigned int flags)
842 : {
843 : return 0;
844 : }
845 :
846 : static inline int security_inode_readlink(struct dentry *dentry)
847 : {
848 : return 0;
849 : }
850 :
851 : static inline int security_inode_follow_link(struct dentry *dentry,
852 : struct inode *inode,
853 : bool rcu)
854 : {
855 : return 0;
856 : }
857 :
858 : static inline int security_inode_permission(struct inode *inode, int mask)
859 : {
860 : return 0;
861 : }
862 :
863 : static inline int security_inode_setattr(struct mnt_idmap *idmap,
864 : struct dentry *dentry,
865 : struct iattr *attr)
866 : {
867 : return 0;
868 : }
869 :
870 : static inline int security_inode_getattr(const struct path *path)
871 : {
872 : return 0;
873 : }
874 :
875 : static inline int security_inode_setxattr(struct mnt_idmap *idmap,
876 : struct dentry *dentry, const char *name, const void *value,
877 : size_t size, int flags)
878 : {
879 0 : return cap_inode_setxattr(dentry, name, value, size, flags);
880 : }
881 :
882 : static inline int security_inode_set_acl(struct mnt_idmap *idmap,
883 : struct dentry *dentry,
884 : const char *acl_name,
885 : struct posix_acl *kacl)
886 : {
887 : return 0;
888 : }
889 :
890 : static inline int security_inode_get_acl(struct mnt_idmap *idmap,
891 : struct dentry *dentry,
892 : const char *acl_name)
893 : {
894 : return 0;
895 : }
896 :
897 : static inline int security_inode_remove_acl(struct mnt_idmap *idmap,
898 : struct dentry *dentry,
899 : const char *acl_name)
900 : {
901 : return 0;
902 : }
903 :
904 : static inline void security_inode_post_setxattr(struct dentry *dentry,
905 : const char *name, const void *value, size_t size, int flags)
906 : { }
907 :
908 : static inline int security_inode_getxattr(struct dentry *dentry,
909 : const char *name)
910 : {
911 : return 0;
912 : }
913 :
914 : static inline int security_inode_listxattr(struct dentry *dentry)
915 : {
916 : return 0;
917 : }
918 :
919 : static inline int security_inode_removexattr(struct mnt_idmap *idmap,
920 : struct dentry *dentry,
921 : const char *name)
922 : {
923 0 : return cap_inode_removexattr(idmap, dentry, name);
924 : }
925 :
926 : static inline int security_inode_need_killpriv(struct dentry *dentry)
927 : {
928 0 : return cap_inode_need_killpriv(dentry);
929 : }
930 :
931 : static inline int security_inode_killpriv(struct mnt_idmap *idmap,
932 : struct dentry *dentry)
933 : {
934 0 : return cap_inode_killpriv(idmap, dentry);
935 : }
936 :
937 : static inline int security_inode_getsecurity(struct mnt_idmap *idmap,
938 : struct inode *inode,
939 : const char *name, void **buffer,
940 : bool alloc)
941 : {
942 0 : return cap_inode_getsecurity(idmap, inode, name, buffer, alloc);
943 : }
944 :
945 : static inline int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
946 : {
947 : return -EOPNOTSUPP;
948 : }
949 :
950 : static inline int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
951 : {
952 : return 0;
953 : }
954 :
955 : static inline void security_inode_getsecid(struct inode *inode, u32 *secid)
956 : {
957 : *secid = 0;
958 : }
959 :
960 : static inline int security_inode_copy_up(struct dentry *src, struct cred **new)
961 : {
962 : return 0;
963 : }
964 :
965 : static inline int security_kernfs_init_security(struct kernfs_node *kn_dir,
966 : struct kernfs_node *kn)
967 : {
968 : return 0;
969 : }
970 :
971 : static inline int security_inode_copy_up_xattr(const char *name)
972 : {
973 : return -EOPNOTSUPP;
974 : }
975 :
976 : static inline int security_file_permission(struct file *file, int mask)
977 : {
978 : return 0;
979 : }
980 :
981 : static inline int security_file_alloc(struct file *file)
982 : {
983 : return 0;
984 : }
985 :
986 : static inline void security_file_free(struct file *file)
987 : { }
988 :
989 : static inline int security_file_ioctl(struct file *file, unsigned int cmd,
990 : unsigned long arg)
991 : {
992 : return 0;
993 : }
994 :
995 : static inline int security_mmap_file(struct file *file, unsigned long prot,
996 : unsigned long flags)
997 : {
998 : return 0;
999 : }
1000 :
1001 : static inline int security_mmap_addr(unsigned long addr)
1002 : {
1003 0 : return cap_mmap_addr(addr);
1004 : }
1005 :
1006 : static inline int security_file_mprotect(struct vm_area_struct *vma,
1007 : unsigned long reqprot,
1008 : unsigned long prot)
1009 : {
1010 : return 0;
1011 : }
1012 :
1013 : static inline int security_file_lock(struct file *file, unsigned int cmd)
1014 : {
1015 : return 0;
1016 : }
1017 :
1018 : static inline int security_file_fcntl(struct file *file, unsigned int cmd,
1019 : unsigned long arg)
1020 : {
1021 : return 0;
1022 : }
1023 :
1024 : static inline void security_file_set_fowner(struct file *file)
1025 : {
1026 : return;
1027 : }
1028 :
1029 : static inline int security_file_send_sigiotask(struct task_struct *tsk,
1030 : struct fown_struct *fown,
1031 : int sig)
1032 : {
1033 : return 0;
1034 : }
1035 :
1036 : static inline int security_file_receive(struct file *file)
1037 : {
1038 : return 0;
1039 : }
1040 :
1041 : static inline int security_file_open(struct file *file)
1042 : {
1043 : return 0;
1044 : }
1045 :
1046 : static inline int security_file_truncate(struct file *file)
1047 : {
1048 : return 0;
1049 : }
1050 :
1051 : static inline int security_task_alloc(struct task_struct *task,
1052 : unsigned long clone_flags)
1053 : {
1054 : return 0;
1055 : }
1056 :
1057 : static inline void security_task_free(struct task_struct *task)
1058 : { }
1059 :
1060 : static inline int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)
1061 : {
1062 : return 0;
1063 : }
1064 :
1065 : static inline void security_cred_free(struct cred *cred)
1066 : { }
1067 :
1068 : static inline int security_prepare_creds(struct cred *new,
1069 : const struct cred *old,
1070 : gfp_t gfp)
1071 : {
1072 : return 0;
1073 : }
1074 :
1075 : static inline void security_transfer_creds(struct cred *new,
1076 : const struct cred *old)
1077 : {
1078 : }
1079 :
1080 : static inline void security_cred_getsecid(const struct cred *c, u32 *secid)
1081 : {
1082 : *secid = 0;
1083 : }
1084 :
1085 : static inline int security_kernel_act_as(struct cred *cred, u32 secid)
1086 : {
1087 : return 0;
1088 : }
1089 :
1090 : static inline int security_kernel_create_files_as(struct cred *cred,
1091 : struct inode *inode)
1092 : {
1093 : return 0;
1094 : }
1095 :
1096 : static inline int security_kernel_module_request(char *kmod_name)
1097 : {
1098 : return 0;
1099 : }
1100 :
1101 : static inline int security_kernel_load_data(enum kernel_load_data_id id, bool contents)
1102 : {
1103 : return 0;
1104 : }
1105 :
1106 : static inline int security_kernel_post_load_data(char *buf, loff_t size,
1107 : enum kernel_load_data_id id,
1108 : char *description)
1109 : {
1110 : return 0;
1111 : }
1112 :
1113 : static inline int security_kernel_read_file(struct file *file,
1114 : enum kernel_read_file_id id,
1115 : bool contents)
1116 : {
1117 : return 0;
1118 : }
1119 :
1120 : static inline int security_kernel_post_read_file(struct file *file,
1121 : char *buf, loff_t size,
1122 : enum kernel_read_file_id id)
1123 : {
1124 : return 0;
1125 : }
1126 :
1127 : static inline int security_task_fix_setuid(struct cred *new,
1128 : const struct cred *old,
1129 : int flags)
1130 : {
1131 0 : return cap_task_fix_setuid(new, old, flags);
1132 : }
1133 :
1134 : static inline int security_task_fix_setgid(struct cred *new,
1135 : const struct cred *old,
1136 : int flags)
1137 : {
1138 : return 0;
1139 : }
1140 :
1141 : static inline int security_task_fix_setgroups(struct cred *new,
1142 : const struct cred *old)
1143 : {
1144 : return 0;
1145 : }
1146 :
1147 : static inline int security_task_setpgid(struct task_struct *p, pid_t pgid)
1148 : {
1149 : return 0;
1150 : }
1151 :
1152 : static inline int security_task_getpgid(struct task_struct *p)
1153 : {
1154 : return 0;
1155 : }
1156 :
1157 : static inline int security_task_getsid(struct task_struct *p)
1158 : {
1159 : return 0;
1160 : }
1161 :
1162 : static inline void security_current_getsecid_subj(u32 *secid)
1163 : {
1164 : *secid = 0;
1165 : }
1166 :
1167 : static inline void security_task_getsecid_obj(struct task_struct *p, u32 *secid)
1168 : {
1169 : *secid = 0;
1170 : }
1171 :
1172 : static inline int security_task_setnice(struct task_struct *p, int nice)
1173 : {
1174 0 : return cap_task_setnice(p, nice);
1175 : }
1176 :
1177 : static inline int security_task_setioprio(struct task_struct *p, int ioprio)
1178 : {
1179 0 : return cap_task_setioprio(p, ioprio);
1180 : }
1181 :
1182 : static inline int security_task_getioprio(struct task_struct *p)
1183 : {
1184 : return 0;
1185 : }
1186 :
1187 : static inline int security_task_prlimit(const struct cred *cred,
1188 : const struct cred *tcred,
1189 : unsigned int flags)
1190 : {
1191 : return 0;
1192 : }
1193 :
1194 : static inline int security_task_setrlimit(struct task_struct *p,
1195 : unsigned int resource,
1196 : struct rlimit *new_rlim)
1197 : {
1198 : return 0;
1199 : }
1200 :
1201 : static inline int security_task_setscheduler(struct task_struct *p)
1202 : {
1203 0 : return cap_task_setscheduler(p);
1204 : }
1205 :
1206 : static inline int security_task_getscheduler(struct task_struct *p)
1207 : {
1208 : return 0;
1209 : }
1210 :
1211 : static inline int security_task_movememory(struct task_struct *p)
1212 : {
1213 : return 0;
1214 : }
1215 :
1216 : static inline int security_task_kill(struct task_struct *p,
1217 : struct kernel_siginfo *info, int sig,
1218 : const struct cred *cred)
1219 : {
1220 : return 0;
1221 : }
1222 :
1223 : static inline int security_task_prctl(int option, unsigned long arg2,
1224 : unsigned long arg3,
1225 : unsigned long arg4,
1226 : unsigned long arg5)
1227 : {
1228 0 : return cap_task_prctl(option, arg2, arg3, arg4, arg5);
1229 : }
1230 :
1231 : static inline void security_task_to_inode(struct task_struct *p, struct inode *inode)
1232 : { }
1233 :
1234 : static inline int security_create_user_ns(const struct cred *cred)
1235 : {
1236 : return 0;
1237 : }
1238 :
1239 : static inline int security_ipc_permission(struct kern_ipc_perm *ipcp,
1240 : short flag)
1241 : {
1242 : return 0;
1243 : }
1244 :
1245 : static inline void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
1246 : {
1247 : *secid = 0;
1248 : }
1249 :
1250 : static inline int security_msg_msg_alloc(struct msg_msg *msg)
1251 : {
1252 : return 0;
1253 : }
1254 :
1255 : static inline void security_msg_msg_free(struct msg_msg *msg)
1256 : { }
1257 :
1258 : static inline int security_msg_queue_alloc(struct kern_ipc_perm *msq)
1259 : {
1260 : return 0;
1261 : }
1262 :
1263 : static inline void security_msg_queue_free(struct kern_ipc_perm *msq)
1264 : { }
1265 :
1266 : static inline int security_msg_queue_associate(struct kern_ipc_perm *msq,
1267 : int msqflg)
1268 : {
1269 : return 0;
1270 : }
1271 :
1272 : static inline int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
1273 : {
1274 : return 0;
1275 : }
1276 :
1277 : static inline int security_msg_queue_msgsnd(struct kern_ipc_perm *msq,
1278 : struct msg_msg *msg, int msqflg)
1279 : {
1280 : return 0;
1281 : }
1282 :
1283 : static inline int security_msg_queue_msgrcv(struct kern_ipc_perm *msq,
1284 : struct msg_msg *msg,
1285 : struct task_struct *target,
1286 : long type, int mode)
1287 : {
1288 : return 0;
1289 : }
1290 :
1291 : static inline int security_shm_alloc(struct kern_ipc_perm *shp)
1292 : {
1293 : return 0;
1294 : }
1295 :
1296 : static inline void security_shm_free(struct kern_ipc_perm *shp)
1297 : { }
1298 :
1299 : static inline int security_shm_associate(struct kern_ipc_perm *shp,
1300 : int shmflg)
1301 : {
1302 : return 0;
1303 : }
1304 :
1305 : static inline int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
1306 : {
1307 : return 0;
1308 : }
1309 :
1310 : static inline int security_shm_shmat(struct kern_ipc_perm *shp,
1311 : char __user *shmaddr, int shmflg)
1312 : {
1313 : return 0;
1314 : }
1315 :
1316 : static inline int security_sem_alloc(struct kern_ipc_perm *sma)
1317 : {
1318 : return 0;
1319 : }
1320 :
1321 : static inline void security_sem_free(struct kern_ipc_perm *sma)
1322 : { }
1323 :
1324 : static inline int security_sem_associate(struct kern_ipc_perm *sma, int semflg)
1325 : {
1326 : return 0;
1327 : }
1328 :
1329 : static inline int security_sem_semctl(struct kern_ipc_perm *sma, int cmd)
1330 : {
1331 : return 0;
1332 : }
1333 :
1334 : static inline int security_sem_semop(struct kern_ipc_perm *sma,
1335 : struct sembuf *sops, unsigned nsops,
1336 : int alter)
1337 : {
1338 : return 0;
1339 : }
1340 :
1341 : static inline void security_d_instantiate(struct dentry *dentry,
1342 : struct inode *inode)
1343 : { }
1344 :
1345 : static inline int security_getprocattr(struct task_struct *p, const char *lsm,
1346 : const char *name, char **value)
1347 : {
1348 : return -EINVAL;
1349 : }
1350 :
1351 : static inline int security_setprocattr(const char *lsm, char *name,
1352 : void *value, size_t size)
1353 : {
1354 : return -EINVAL;
1355 : }
1356 :
1357 : static inline int security_netlink_send(struct sock *sk, struct sk_buff *skb)
1358 : {
1359 : return 0;
1360 : }
1361 :
1362 : static inline int security_ismaclabel(const char *name)
1363 : {
1364 : return 0;
1365 : }
1366 :
1367 : static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
1368 : {
1369 : return -EOPNOTSUPP;
1370 : }
1371 :
1372 : static inline int security_secctx_to_secid(const char *secdata,
1373 : u32 seclen,
1374 : u32 *secid)
1375 : {
1376 : return -EOPNOTSUPP;
1377 : }
1378 :
1379 : static inline void security_release_secctx(char *secdata, u32 seclen)
1380 : {
1381 : }
1382 :
1383 : static inline void security_inode_invalidate_secctx(struct inode *inode)
1384 : {
1385 : }
1386 :
1387 : static inline int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
1388 : {
1389 : return -EOPNOTSUPP;
1390 : }
1391 : static inline int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
1392 : {
1393 : return -EOPNOTSUPP;
1394 : }
1395 : static inline int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
1396 : {
1397 : return -EOPNOTSUPP;
1398 : }
1399 : static inline int security_locked_down(enum lockdown_reason what)
1400 : {
1401 : return 0;
1402 : }
1403 : #endif /* CONFIG_SECURITY */
1404 :
1405 : #if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE)
1406 : int security_post_notification(const struct cred *w_cred,
1407 : const struct cred *cred,
1408 : struct watch_notification *n);
1409 : #else
1410 : static inline int security_post_notification(const struct cred *w_cred,
1411 : const struct cred *cred,
1412 : struct watch_notification *n)
1413 : {
1414 : return 0;
1415 : }
1416 : #endif
1417 :
1418 : #if defined(CONFIG_SECURITY) && defined(CONFIG_KEY_NOTIFICATIONS)
1419 : int security_watch_key(struct key *key);
1420 : #else
1421 : static inline int security_watch_key(struct key *key)
1422 : {
1423 : return 0;
1424 : }
1425 : #endif
1426 :
1427 : #ifdef CONFIG_SECURITY_NETWORK
1428 :
1429 : int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk);
1430 : int security_unix_may_send(struct socket *sock, struct socket *other);
1431 : int security_socket_create(int family, int type, int protocol, int kern);
1432 : int security_socket_post_create(struct socket *sock, int family,
1433 : int type, int protocol, int kern);
1434 : int security_socket_socketpair(struct socket *socka, struct socket *sockb);
1435 : int security_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen);
1436 : int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen);
1437 : int security_socket_listen(struct socket *sock, int backlog);
1438 : int security_socket_accept(struct socket *sock, struct socket *newsock);
1439 : int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size);
1440 : int security_socket_recvmsg(struct socket *sock, struct msghdr *msg,
1441 : int size, int flags);
1442 : int security_socket_getsockname(struct socket *sock);
1443 : int security_socket_getpeername(struct socket *sock);
1444 : int security_socket_getsockopt(struct socket *sock, int level, int optname);
1445 : int security_socket_setsockopt(struct socket *sock, int level, int optname);
1446 : int security_socket_shutdown(struct socket *sock, int how);
1447 : int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb);
1448 : int security_socket_getpeersec_stream(struct socket *sock, sockptr_t optval,
1449 : sockptr_t optlen, unsigned int len);
1450 : int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid);
1451 : int security_sk_alloc(struct sock *sk, int family, gfp_t priority);
1452 : void security_sk_free(struct sock *sk);
1453 : void security_sk_clone(const struct sock *sk, struct sock *newsk);
1454 : void security_sk_classify_flow(struct sock *sk, struct flowi_common *flic);
1455 : void security_req_classify_flow(const struct request_sock *req,
1456 : struct flowi_common *flic);
1457 : void security_sock_graft(struct sock*sk, struct socket *parent);
1458 : int security_inet_conn_request(const struct sock *sk,
1459 : struct sk_buff *skb, struct request_sock *req);
1460 : void security_inet_csk_clone(struct sock *newsk,
1461 : const struct request_sock *req);
1462 : void security_inet_conn_established(struct sock *sk,
1463 : struct sk_buff *skb);
1464 : int security_secmark_relabel_packet(u32 secid);
1465 : void security_secmark_refcount_inc(void);
1466 : void security_secmark_refcount_dec(void);
1467 : int security_tun_dev_alloc_security(void **security);
1468 : void security_tun_dev_free_security(void *security);
1469 : int security_tun_dev_create(void);
1470 : int security_tun_dev_attach_queue(void *security);
1471 : int security_tun_dev_attach(struct sock *sk, void *security);
1472 : int security_tun_dev_open(void *security);
1473 : int security_sctp_assoc_request(struct sctp_association *asoc, struct sk_buff *skb);
1474 : int security_sctp_bind_connect(struct sock *sk, int optname,
1475 : struct sockaddr *address, int addrlen);
1476 : void security_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk,
1477 : struct sock *newsk);
1478 : int security_sctp_assoc_established(struct sctp_association *asoc,
1479 : struct sk_buff *skb);
1480 :
1481 : #else /* CONFIG_SECURITY_NETWORK */
1482 : static inline int security_unix_stream_connect(struct sock *sock,
1483 : struct sock *other,
1484 : struct sock *newsk)
1485 : {
1486 : return 0;
1487 : }
1488 :
1489 : static inline int security_unix_may_send(struct socket *sock,
1490 : struct socket *other)
1491 : {
1492 : return 0;
1493 : }
1494 :
1495 : static inline int security_socket_create(int family, int type,
1496 : int protocol, int kern)
1497 : {
1498 : return 0;
1499 : }
1500 :
1501 : static inline int security_socket_post_create(struct socket *sock,
1502 : int family,
1503 : int type,
1504 : int protocol, int kern)
1505 : {
1506 : return 0;
1507 : }
1508 :
1509 : static inline int security_socket_socketpair(struct socket *socka,
1510 : struct socket *sockb)
1511 : {
1512 : return 0;
1513 : }
1514 :
1515 : static inline int security_socket_bind(struct socket *sock,
1516 : struct sockaddr *address,
1517 : int addrlen)
1518 : {
1519 : return 0;
1520 : }
1521 :
1522 : static inline int security_socket_connect(struct socket *sock,
1523 : struct sockaddr *address,
1524 : int addrlen)
1525 : {
1526 : return 0;
1527 : }
1528 :
1529 : static inline int security_socket_listen(struct socket *sock, int backlog)
1530 : {
1531 : return 0;
1532 : }
1533 :
1534 : static inline int security_socket_accept(struct socket *sock,
1535 : struct socket *newsock)
1536 : {
1537 : return 0;
1538 : }
1539 :
1540 : static inline int security_socket_sendmsg(struct socket *sock,
1541 : struct msghdr *msg, int size)
1542 : {
1543 : return 0;
1544 : }
1545 :
1546 : static inline int security_socket_recvmsg(struct socket *sock,
1547 : struct msghdr *msg, int size,
1548 : int flags)
1549 : {
1550 : return 0;
1551 : }
1552 :
1553 : static inline int security_socket_getsockname(struct socket *sock)
1554 : {
1555 : return 0;
1556 : }
1557 :
1558 : static inline int security_socket_getpeername(struct socket *sock)
1559 : {
1560 : return 0;
1561 : }
1562 :
1563 : static inline int security_socket_getsockopt(struct socket *sock,
1564 : int level, int optname)
1565 : {
1566 : return 0;
1567 : }
1568 :
1569 : static inline int security_socket_setsockopt(struct socket *sock,
1570 : int level, int optname)
1571 : {
1572 : return 0;
1573 : }
1574 :
1575 : static inline int security_socket_shutdown(struct socket *sock, int how)
1576 : {
1577 : return 0;
1578 : }
1579 : static inline int security_sock_rcv_skb(struct sock *sk,
1580 : struct sk_buff *skb)
1581 : {
1582 : return 0;
1583 : }
1584 :
1585 : static inline int security_socket_getpeersec_stream(struct socket *sock,
1586 : sockptr_t optval,
1587 : sockptr_t optlen,
1588 : unsigned int len)
1589 : {
1590 : return -ENOPROTOOPT;
1591 : }
1592 :
1593 : static inline int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
1594 : {
1595 : return -ENOPROTOOPT;
1596 : }
1597 :
1598 : static inline int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
1599 : {
1600 : return 0;
1601 : }
1602 :
1603 : static inline void security_sk_free(struct sock *sk)
1604 : {
1605 : }
1606 :
1607 : static inline void security_sk_clone(const struct sock *sk, struct sock *newsk)
1608 : {
1609 : }
1610 :
1611 : static inline void security_sk_classify_flow(struct sock *sk,
1612 : struct flowi_common *flic)
1613 : {
1614 : }
1615 :
1616 : static inline void security_req_classify_flow(const struct request_sock *req,
1617 : struct flowi_common *flic)
1618 : {
1619 : }
1620 :
1621 : static inline void security_sock_graft(struct sock *sk, struct socket *parent)
1622 : {
1623 : }
1624 :
1625 : static inline int security_inet_conn_request(const struct sock *sk,
1626 : struct sk_buff *skb, struct request_sock *req)
1627 : {
1628 : return 0;
1629 : }
1630 :
1631 : static inline void security_inet_csk_clone(struct sock *newsk,
1632 : const struct request_sock *req)
1633 : {
1634 : }
1635 :
1636 : static inline void security_inet_conn_established(struct sock *sk,
1637 : struct sk_buff *skb)
1638 : {
1639 : }
1640 :
1641 : static inline int security_secmark_relabel_packet(u32 secid)
1642 : {
1643 : return 0;
1644 : }
1645 :
1646 : static inline void security_secmark_refcount_inc(void)
1647 : {
1648 : }
1649 :
1650 : static inline void security_secmark_refcount_dec(void)
1651 : {
1652 : }
1653 :
1654 : static inline int security_tun_dev_alloc_security(void **security)
1655 : {
1656 : return 0;
1657 : }
1658 :
1659 : static inline void security_tun_dev_free_security(void *security)
1660 : {
1661 : }
1662 :
1663 : static inline int security_tun_dev_create(void)
1664 : {
1665 : return 0;
1666 : }
1667 :
1668 : static inline int security_tun_dev_attach_queue(void *security)
1669 : {
1670 : return 0;
1671 : }
1672 :
1673 : static inline int security_tun_dev_attach(struct sock *sk, void *security)
1674 : {
1675 : return 0;
1676 : }
1677 :
1678 : static inline int security_tun_dev_open(void *security)
1679 : {
1680 : return 0;
1681 : }
1682 :
1683 : static inline int security_sctp_assoc_request(struct sctp_association *asoc,
1684 : struct sk_buff *skb)
1685 : {
1686 : return 0;
1687 : }
1688 :
1689 : static inline int security_sctp_bind_connect(struct sock *sk, int optname,
1690 : struct sockaddr *address,
1691 : int addrlen)
1692 : {
1693 : return 0;
1694 : }
1695 :
1696 : static inline void security_sctp_sk_clone(struct sctp_association *asoc,
1697 : struct sock *sk,
1698 : struct sock *newsk)
1699 : {
1700 : }
1701 :
1702 : static inline int security_sctp_assoc_established(struct sctp_association *asoc,
1703 : struct sk_buff *skb)
1704 : {
1705 : return 0;
1706 : }
1707 : #endif /* CONFIG_SECURITY_NETWORK */
1708 :
1709 : #ifdef CONFIG_SECURITY_INFINIBAND
1710 : int security_ib_pkey_access(void *sec, u64 subnet_prefix, u16 pkey);
1711 : int security_ib_endport_manage_subnet(void *sec, const char *name, u8 port_num);
1712 : int security_ib_alloc_security(void **sec);
1713 : void security_ib_free_security(void *sec);
1714 : #else /* CONFIG_SECURITY_INFINIBAND */
1715 : static inline int security_ib_pkey_access(void *sec, u64 subnet_prefix, u16 pkey)
1716 : {
1717 : return 0;
1718 : }
1719 :
1720 : static inline int security_ib_endport_manage_subnet(void *sec, const char *dev_name, u8 port_num)
1721 : {
1722 : return 0;
1723 : }
1724 :
1725 : static inline int security_ib_alloc_security(void **sec)
1726 : {
1727 : return 0;
1728 : }
1729 :
1730 : static inline void security_ib_free_security(void *sec)
1731 : {
1732 : }
1733 : #endif /* CONFIG_SECURITY_INFINIBAND */
1734 :
1735 : #ifdef CONFIG_SECURITY_NETWORK_XFRM
1736 :
1737 : int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
1738 : struct xfrm_user_sec_ctx *sec_ctx, gfp_t gfp);
1739 : int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctxp);
1740 : void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
1741 : int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx);
1742 : int security_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx);
1743 : int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
1744 : struct xfrm_sec_ctx *polsec, u32 secid);
1745 : int security_xfrm_state_delete(struct xfrm_state *x);
1746 : void security_xfrm_state_free(struct xfrm_state *x);
1747 : int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid);
1748 : int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
1749 : struct xfrm_policy *xp,
1750 : const struct flowi_common *flic);
1751 : int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid);
1752 : void security_skb_classify_flow(struct sk_buff *skb, struct flowi_common *flic);
1753 :
1754 : #else /* CONFIG_SECURITY_NETWORK_XFRM */
1755 :
1756 : static inline int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
1757 : struct xfrm_user_sec_ctx *sec_ctx,
1758 : gfp_t gfp)
1759 : {
1760 : return 0;
1761 : }
1762 :
1763 : static inline int security_xfrm_policy_clone(struct xfrm_sec_ctx *old, struct xfrm_sec_ctx **new_ctxp)
1764 : {
1765 : return 0;
1766 : }
1767 :
1768 : static inline void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
1769 : {
1770 : }
1771 :
1772 : static inline int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
1773 : {
1774 : return 0;
1775 : }
1776 :
1777 : static inline int security_xfrm_state_alloc(struct xfrm_state *x,
1778 : struct xfrm_user_sec_ctx *sec_ctx)
1779 : {
1780 : return 0;
1781 : }
1782 :
1783 : static inline int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
1784 : struct xfrm_sec_ctx *polsec, u32 secid)
1785 : {
1786 : return 0;
1787 : }
1788 :
1789 : static inline void security_xfrm_state_free(struct xfrm_state *x)
1790 : {
1791 : }
1792 :
1793 : static inline int security_xfrm_state_delete(struct xfrm_state *x)
1794 : {
1795 : return 0;
1796 : }
1797 :
1798 : static inline int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid)
1799 : {
1800 : return 0;
1801 : }
1802 :
1803 : static inline int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
1804 : struct xfrm_policy *xp,
1805 : const struct flowi_common *flic)
1806 : {
1807 : return 1;
1808 : }
1809 :
1810 : static inline int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
1811 : {
1812 : return 0;
1813 : }
1814 :
1815 : static inline void security_skb_classify_flow(struct sk_buff *skb,
1816 : struct flowi_common *flic)
1817 : {
1818 : }
1819 :
1820 : #endif /* CONFIG_SECURITY_NETWORK_XFRM */
1821 :
1822 : #ifdef CONFIG_SECURITY_PATH
1823 : int security_path_unlink(const struct path *dir, struct dentry *dentry);
1824 : int security_path_mkdir(const struct path *dir, struct dentry *dentry, umode_t mode);
1825 : int security_path_rmdir(const struct path *dir, struct dentry *dentry);
1826 : int security_path_mknod(const struct path *dir, struct dentry *dentry, umode_t mode,
1827 : unsigned int dev);
1828 : int security_path_truncate(const struct path *path);
1829 : int security_path_symlink(const struct path *dir, struct dentry *dentry,
1830 : const char *old_name);
1831 : int security_path_link(struct dentry *old_dentry, const struct path *new_dir,
1832 : struct dentry *new_dentry);
1833 : int security_path_rename(const struct path *old_dir, struct dentry *old_dentry,
1834 : const struct path *new_dir, struct dentry *new_dentry,
1835 : unsigned int flags);
1836 : int security_path_chmod(const struct path *path, umode_t mode);
1837 : int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid);
1838 : int security_path_chroot(const struct path *path);
1839 : #else /* CONFIG_SECURITY_PATH */
1840 : static inline int security_path_unlink(const struct path *dir, struct dentry *dentry)
1841 : {
1842 : return 0;
1843 : }
1844 :
1845 : static inline int security_path_mkdir(const struct path *dir, struct dentry *dentry,
1846 : umode_t mode)
1847 : {
1848 : return 0;
1849 : }
1850 :
1851 : static inline int security_path_rmdir(const struct path *dir, struct dentry *dentry)
1852 : {
1853 : return 0;
1854 : }
1855 :
1856 : static inline int security_path_mknod(const struct path *dir, struct dentry *dentry,
1857 : umode_t mode, unsigned int dev)
1858 : {
1859 : return 0;
1860 : }
1861 :
1862 : static inline int security_path_truncate(const struct path *path)
1863 : {
1864 : return 0;
1865 : }
1866 :
1867 : static inline int security_path_symlink(const struct path *dir, struct dentry *dentry,
1868 : const char *old_name)
1869 : {
1870 : return 0;
1871 : }
1872 :
1873 : static inline int security_path_link(struct dentry *old_dentry,
1874 : const struct path *new_dir,
1875 : struct dentry *new_dentry)
1876 : {
1877 : return 0;
1878 : }
1879 :
1880 : static inline int security_path_rename(const struct path *old_dir,
1881 : struct dentry *old_dentry,
1882 : const struct path *new_dir,
1883 : struct dentry *new_dentry,
1884 : unsigned int flags)
1885 : {
1886 : return 0;
1887 : }
1888 :
1889 : static inline int security_path_chmod(const struct path *path, umode_t mode)
1890 : {
1891 : return 0;
1892 : }
1893 :
1894 : static inline int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
1895 : {
1896 : return 0;
1897 : }
1898 :
1899 : static inline int security_path_chroot(const struct path *path)
1900 : {
1901 : return 0;
1902 : }
1903 : #endif /* CONFIG_SECURITY_PATH */
1904 :
1905 : #ifdef CONFIG_KEYS
1906 : #ifdef CONFIG_SECURITY
1907 :
1908 : int security_key_alloc(struct key *key, const struct cred *cred, unsigned long flags);
1909 : void security_key_free(struct key *key);
1910 : int security_key_permission(key_ref_t key_ref, const struct cred *cred,
1911 : enum key_need_perm need_perm);
1912 : int security_key_getsecurity(struct key *key, char **_buffer);
1913 :
1914 : #else
1915 :
1916 : static inline int security_key_alloc(struct key *key,
1917 : const struct cred *cred,
1918 : unsigned long flags)
1919 : {
1920 : return 0;
1921 : }
1922 :
1923 : static inline void security_key_free(struct key *key)
1924 : {
1925 : }
1926 :
1927 : static inline int security_key_permission(key_ref_t key_ref,
1928 : const struct cred *cred,
1929 : enum key_need_perm need_perm)
1930 : {
1931 : return 0;
1932 : }
1933 :
1934 : static inline int security_key_getsecurity(struct key *key, char **_buffer)
1935 : {
1936 : *_buffer = NULL;
1937 : return 0;
1938 : }
1939 :
1940 : #endif
1941 : #endif /* CONFIG_KEYS */
1942 :
1943 : #ifdef CONFIG_AUDIT
1944 : #ifdef CONFIG_SECURITY
1945 : int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule);
1946 : int security_audit_rule_known(struct audit_krule *krule);
1947 : int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule);
1948 : void security_audit_rule_free(void *lsmrule);
1949 :
1950 : #else
1951 :
1952 : static inline int security_audit_rule_init(u32 field, u32 op, char *rulestr,
1953 : void **lsmrule)
1954 : {
1955 : return 0;
1956 : }
1957 :
1958 : static inline int security_audit_rule_known(struct audit_krule *krule)
1959 : {
1960 : return 0;
1961 : }
1962 :
1963 : static inline int security_audit_rule_match(u32 secid, u32 field, u32 op,
1964 : void *lsmrule)
1965 : {
1966 : return 0;
1967 : }
1968 :
1969 : static inline void security_audit_rule_free(void *lsmrule)
1970 : { }
1971 :
1972 : #endif /* CONFIG_SECURITY */
1973 : #endif /* CONFIG_AUDIT */
1974 :
1975 : #ifdef CONFIG_SECURITYFS
1976 :
1977 : extern struct dentry *securityfs_create_file(const char *name, umode_t mode,
1978 : struct dentry *parent, void *data,
1979 : const struct file_operations *fops);
1980 : extern struct dentry *securityfs_create_dir(const char *name, struct dentry *parent);
1981 : struct dentry *securityfs_create_symlink(const char *name,
1982 : struct dentry *parent,
1983 : const char *target,
1984 : const struct inode_operations *iops);
1985 : extern void securityfs_remove(struct dentry *dentry);
1986 :
1987 : #else /* CONFIG_SECURITYFS */
1988 :
1989 : static inline struct dentry *securityfs_create_dir(const char *name,
1990 : struct dentry *parent)
1991 : {
1992 : return ERR_PTR(-ENODEV);
1993 : }
1994 :
1995 : static inline struct dentry *securityfs_create_file(const char *name,
1996 : umode_t mode,
1997 : struct dentry *parent,
1998 : void *data,
1999 : const struct file_operations *fops)
2000 : {
2001 : return ERR_PTR(-ENODEV);
2002 : }
2003 :
2004 : static inline struct dentry *securityfs_create_symlink(const char *name,
2005 : struct dentry *parent,
2006 : const char *target,
2007 : const struct inode_operations *iops)
2008 : {
2009 : return ERR_PTR(-ENODEV);
2010 : }
2011 :
2012 : static inline void securityfs_remove(struct dentry *dentry)
2013 : {}
2014 :
2015 : #endif
2016 :
2017 : #ifdef CONFIG_BPF_SYSCALL
2018 : union bpf_attr;
2019 : struct bpf_map;
2020 : struct bpf_prog;
2021 : struct bpf_prog_aux;
2022 : #ifdef CONFIG_SECURITY
2023 : extern int security_bpf(int cmd, union bpf_attr *attr, unsigned int size);
2024 : extern int security_bpf_map(struct bpf_map *map, fmode_t fmode);
2025 : extern int security_bpf_prog(struct bpf_prog *prog);
2026 : extern int security_bpf_map_alloc(struct bpf_map *map);
2027 : extern void security_bpf_map_free(struct bpf_map *map);
2028 : extern int security_bpf_prog_alloc(struct bpf_prog_aux *aux);
2029 : extern void security_bpf_prog_free(struct bpf_prog_aux *aux);
2030 : #else
2031 : static inline int security_bpf(int cmd, union bpf_attr *attr,
2032 : unsigned int size)
2033 : {
2034 : return 0;
2035 : }
2036 :
2037 : static inline int security_bpf_map(struct bpf_map *map, fmode_t fmode)
2038 : {
2039 : return 0;
2040 : }
2041 :
2042 : static inline int security_bpf_prog(struct bpf_prog *prog)
2043 : {
2044 : return 0;
2045 : }
2046 :
2047 : static inline int security_bpf_map_alloc(struct bpf_map *map)
2048 : {
2049 : return 0;
2050 : }
2051 :
2052 : static inline void security_bpf_map_free(struct bpf_map *map)
2053 : { }
2054 :
2055 : static inline int security_bpf_prog_alloc(struct bpf_prog_aux *aux)
2056 : {
2057 : return 0;
2058 : }
2059 :
2060 : static inline void security_bpf_prog_free(struct bpf_prog_aux *aux)
2061 : { }
2062 : #endif /* CONFIG_SECURITY */
2063 : #endif /* CONFIG_BPF_SYSCALL */
2064 :
2065 : #ifdef CONFIG_PERF_EVENTS
2066 : struct perf_event_attr;
2067 : struct perf_event;
2068 :
2069 : #ifdef CONFIG_SECURITY
2070 : extern int security_perf_event_open(struct perf_event_attr *attr, int type);
2071 : extern int security_perf_event_alloc(struct perf_event *event);
2072 : extern void security_perf_event_free(struct perf_event *event);
2073 : extern int security_perf_event_read(struct perf_event *event);
2074 : extern int security_perf_event_write(struct perf_event *event);
2075 : #else
2076 : static inline int security_perf_event_open(struct perf_event_attr *attr,
2077 : int type)
2078 : {
2079 : return 0;
2080 : }
2081 :
2082 : static inline int security_perf_event_alloc(struct perf_event *event)
2083 : {
2084 : return 0;
2085 : }
2086 :
2087 : static inline void security_perf_event_free(struct perf_event *event)
2088 : {
2089 : }
2090 :
2091 : static inline int security_perf_event_read(struct perf_event *event)
2092 : {
2093 : return 0;
2094 : }
2095 :
2096 : static inline int security_perf_event_write(struct perf_event *event)
2097 : {
2098 : return 0;
2099 : }
2100 : #endif /* CONFIG_SECURITY */
2101 : #endif /* CONFIG_PERF_EVENTS */
2102 :
2103 : #ifdef CONFIG_IO_URING
2104 : #ifdef CONFIG_SECURITY
2105 : extern int security_uring_override_creds(const struct cred *new);
2106 : extern int security_uring_sqpoll(void);
2107 : extern int security_uring_cmd(struct io_uring_cmd *ioucmd);
2108 : #else
2109 : static inline int security_uring_override_creds(const struct cred *new)
2110 : {
2111 : return 0;
2112 : }
2113 : static inline int security_uring_sqpoll(void)
2114 : {
2115 : return 0;
2116 : }
2117 : static inline int security_uring_cmd(struct io_uring_cmd *ioucmd)
2118 : {
2119 : return 0;
2120 : }
2121 : #endif /* CONFIG_SECURITY */
2122 : #endif /* CONFIG_IO_URING */
2123 :
2124 : #endif /* ! __LINUX_SECURITY_H */
|
