^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0-or-later
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * Security plug functions
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) * Copyright (C) 2001-2002 Greg Kroah-Hartman <greg@kroah.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) * Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) * Copyright (C) 2016 Mellanox Technologies
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) #define pr_fmt(fmt) "LSM: " fmt
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) #include <linux/bpf.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) #include <linux/capability.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #include <linux/dcache.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) #include <linux/export.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #include <linux/init.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) #include <linux/kernel.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) #include <linux/kernel_read_file.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) #include <linux/lsm_hooks.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) #include <linux/integrity.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) #include <linux/ima.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) #include <linux/evm.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) #include <linux/fsnotify.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) #include <linux/mman.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) #include <linux/mount.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) #include <linux/personality.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) #include <linux/backing-dev.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) #include <linux/string.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) #include <linux/msg.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) #include <net/flow.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) #define MAX_LSM_EVM_XATTR 2
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) /* How many LSMs were built into the kernel? */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) #define LSM_COUNT (__end_lsm_info - __start_lsm_info)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) struct security_hook_heads security_hook_heads __lsm_ro_after_init;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) static BLOCKING_NOTIFIER_HEAD(blocking_lsm_notifier_chain);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) static struct kmem_cache *lsm_file_cache;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) static struct kmem_cache *lsm_inode_cache;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) char *lsm_names;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) static struct lsm_blob_sizes blob_sizes __lsm_ro_after_init;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) /* Boot-time LSM user choice */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) static __initdata const char *chosen_lsm_order;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) static __initdata const char *chosen_major_lsm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) static __initconst const char * const builtin_lsm_order = CONFIG_LSM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) /* Ordered list of LSMs to initialize. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) static __initdata struct lsm_info **ordered_lsms;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) static __initdata struct lsm_info *exclusive;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) static __initdata bool debug;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) #define init_debug(...) \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) do { \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) if (debug) \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) pr_info(__VA_ARGS__); \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) } while (0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) static bool __init is_enabled(struct lsm_info *lsm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) if (!lsm->enabled)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) return false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) return *lsm->enabled;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) /* Mark an LSM's enabled flag. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) static int lsm_enabled_true __initdata = 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) static int lsm_enabled_false __initdata = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) static void __init set_enabled(struct lsm_info *lsm, bool enabled)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) * When an LSM hasn't configured an enable variable, we can use
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) * a hard-coded location for storing the default enabled state.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) if (!lsm->enabled) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) if (enabled)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) lsm->enabled = &lsm_enabled_true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) lsm->enabled = &lsm_enabled_false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) } else if (lsm->enabled == &lsm_enabled_true) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) if (!enabled)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) lsm->enabled = &lsm_enabled_false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) } else if (lsm->enabled == &lsm_enabled_false) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) if (enabled)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) lsm->enabled = &lsm_enabled_true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) *lsm->enabled = enabled;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) /* Is an LSM already listed in the ordered LSMs list? */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) static bool __init exists_ordered_lsm(struct lsm_info *lsm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) struct lsm_info **check;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) for (check = ordered_lsms; *check; check++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) if (*check == lsm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) return true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) return false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) /* Append an LSM to the list of ordered LSMs to initialize. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) static int last_lsm __initdata;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) static void __init append_ordered_lsm(struct lsm_info *lsm, const char *from)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) /* Ignore duplicate selections. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) if (exists_ordered_lsm(lsm))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) if (WARN(last_lsm == LSM_COUNT, "%s: out of LSM slots!?\n", from))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) /* Enable this LSM, if it is not already set. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) if (!lsm->enabled)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) lsm->enabled = &lsm_enabled_true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) ordered_lsms[last_lsm++] = lsm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) init_debug("%s ordering: %s (%sabled)\n", from, lsm->name,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) is_enabled(lsm) ? "en" : "dis");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) /* Is an LSM allowed to be initialized? */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) static bool __init lsm_allowed(struct lsm_info *lsm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) /* Skip if the LSM is disabled. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) if (!is_enabled(lsm))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) return false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) /* Not allowed if another exclusive LSM already initialized. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && exclusive) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) init_debug("exclusive disabled: %s\n", lsm->name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) return false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) return true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) static void __init lsm_set_blob_size(int *need, int *lbs)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) int offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) if (*need > 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) offset = *lbs;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) *lbs += *need;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) *need = offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) static void __init lsm_set_blob_sizes(struct lsm_blob_sizes *needed)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) if (!needed)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) lsm_set_blob_size(&needed->lbs_cred, &blob_sizes.lbs_cred);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) lsm_set_blob_size(&needed->lbs_file, &blob_sizes.lbs_file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) * The inode blob gets an rcu_head in addition to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) * what the modules might need.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) if (needed->lbs_inode && blob_sizes.lbs_inode == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) blob_sizes.lbs_inode = sizeof(struct rcu_head);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) lsm_set_blob_size(&needed->lbs_inode, &blob_sizes.lbs_inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) lsm_set_blob_size(&needed->lbs_ipc, &blob_sizes.lbs_ipc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) lsm_set_blob_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) lsm_set_blob_size(&needed->lbs_task, &blob_sizes.lbs_task);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) /* Prepare LSM for initialization. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) static void __init prepare_lsm(struct lsm_info *lsm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) int enabled = lsm_allowed(lsm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) /* Record enablement (to handle any following exclusive LSMs). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) set_enabled(lsm, enabled);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) /* If enabled, do pre-initialization work. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) if (enabled) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && !exclusive) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) exclusive = lsm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) init_debug("exclusive chosen: %s\n", lsm->name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) lsm_set_blob_sizes(lsm->blobs);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) /* Initialize a given LSM, if it is enabled. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) static void __init initialize_lsm(struct lsm_info *lsm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) if (is_enabled(lsm)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) init_debug("initializing %s\n", lsm->name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) ret = lsm->init();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) WARN(ret, "%s failed to initialize: %d\n", lsm->name, ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) /* Populate ordered LSMs list from comma-separated LSM name list. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) static void __init ordered_lsm_parse(const char *order, const char *origin)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) struct lsm_info *lsm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) char *sep, *name, *next;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) /* LSM_ORDER_FIRST is always first. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213) for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) if (lsm->order == LSM_ORDER_FIRST)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) append_ordered_lsm(lsm, "first");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) /* Process "security=", if given. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) if (chosen_major_lsm) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) struct lsm_info *major;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) * To match the original "security=" behavior, this
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) * explicitly does NOT fallback to another Legacy Major
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225) * if the selected one was separately disabled: disable
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226) * all non-matching Legacy Major LSMs.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228) for (major = __start_lsm_info; major < __end_lsm_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229) major++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230) if ((major->flags & LSM_FLAG_LEGACY_MAJOR) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231) strcmp(major->name, chosen_major_lsm) != 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232) set_enabled(major, false);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233) init_debug("security=%s disabled: %s\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234) chosen_major_lsm, major->name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239) sep = kstrdup(order, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) next = sep;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241) /* Walk the list, looking for matching LSMs. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242) while ((name = strsep(&next, ",")) != NULL) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243) bool found = false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245) for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246) if (lsm->order == LSM_ORDER_MUTABLE &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247) strcmp(lsm->name, name) == 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248) append_ordered_lsm(lsm, origin);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249) found = true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253) if (!found)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254) init_debug("%s ignored: %s\n", origin, name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257) /* Process "security=", if given. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258) if (chosen_major_lsm) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259) for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260) if (exists_ordered_lsm(lsm))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262) if (strcmp(lsm->name, chosen_major_lsm) == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263) append_ordered_lsm(lsm, "security=");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) /* Disable all LSMs not in the ordered list. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268) for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 269) if (exists_ordered_lsm(lsm))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 270) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 271) set_enabled(lsm, false);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 272) init_debug("%s disabled: %s\n", origin, lsm->name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 273) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 274)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 275) kfree(sep);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 276) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 277)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 278) static void __init lsm_early_cred(struct cred *cred);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 279) static void __init lsm_early_task(struct task_struct *task);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 280)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 281) static int lsm_append(const char *new, char **result);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 282)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 283) static void __init ordered_lsm_init(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 284) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 285) struct lsm_info **lsm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 286)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 287) ordered_lsms = kcalloc(LSM_COUNT + 1, sizeof(*ordered_lsms),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 288) GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 289)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 290) if (chosen_lsm_order) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 291) if (chosen_major_lsm) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 292) pr_info("security= is ignored because it is superseded by lsm=\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 293) chosen_major_lsm = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 294) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 295) ordered_lsm_parse(chosen_lsm_order, "cmdline");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 296) } else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 297) ordered_lsm_parse(builtin_lsm_order, "builtin");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 298)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 299) for (lsm = ordered_lsms; *lsm; lsm++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 300) prepare_lsm(*lsm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 301)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 302) init_debug("cred blob size = %d\n", blob_sizes.lbs_cred);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 303) init_debug("file blob size = %d\n", blob_sizes.lbs_file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 304) init_debug("inode blob size = %d\n", blob_sizes.lbs_inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 305) init_debug("ipc blob size = %d\n", blob_sizes.lbs_ipc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 306) init_debug("msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 307) init_debug("task blob size = %d\n", blob_sizes.lbs_task);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 308)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 309) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 310) * Create any kmem_caches needed for blobs
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 311) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 312) if (blob_sizes.lbs_file)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 313) lsm_file_cache = kmem_cache_create("lsm_file_cache",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 314) blob_sizes.lbs_file, 0,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 315) SLAB_PANIC, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 316) if (blob_sizes.lbs_inode)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 317) lsm_inode_cache = kmem_cache_create("lsm_inode_cache",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 318) blob_sizes.lbs_inode, 0,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 319) SLAB_PANIC, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 320)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 321) lsm_early_cred((struct cred *) current->cred);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 322) lsm_early_task(current);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 323) for (lsm = ordered_lsms; *lsm; lsm++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 324) initialize_lsm(*lsm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 325)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 326) kfree(ordered_lsms);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 327) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 328)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 329) int __init early_security_init(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 330) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 331) int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 332) struct hlist_head *list = (struct hlist_head *) &security_hook_heads;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 333) struct lsm_info *lsm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 334)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 335) for (i = 0; i < sizeof(security_hook_heads) / sizeof(struct hlist_head);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 336) i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 337) INIT_HLIST_HEAD(&list[i]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 338)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 339) for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 340) if (!lsm->enabled)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 341) lsm->enabled = &lsm_enabled_true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 342) prepare_lsm(lsm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 343) initialize_lsm(lsm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 344) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 345)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 346) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 347) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 348)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 349) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 350) * security_init - initializes the security framework
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 351) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 352) * This should be called early in the kernel initialization sequence.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 353) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 354) int __init security_init(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 355) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 356) struct lsm_info *lsm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 357)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 358) pr_info("Security Framework initializing\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 359)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 360) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 361) * Append the names of the early LSM modules now that kmalloc() is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 362) * available
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 363) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 364) for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 365) if (lsm->enabled)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 366) lsm_append(lsm->name, &lsm_names);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 367) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 368)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 369) /* Load LSMs in specified order. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 370) ordered_lsm_init();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 371)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 372) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 373) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 374)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 375) /* Save user chosen LSM */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 376) static int __init choose_major_lsm(char *str)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 377) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 378) chosen_major_lsm = str;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 379) return 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 380) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 381) __setup("security=", choose_major_lsm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 382)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 383) /* Explicitly choose LSM initialization order. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 384) static int __init choose_lsm_order(char *str)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 385) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 386) chosen_lsm_order = str;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 387) return 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 388) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 389) __setup("lsm=", choose_lsm_order);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 390)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 391) /* Enable LSM order debugging. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 392) static int __init enable_debug(char *str)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 393) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 394) debug = true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 395) return 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 396) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 397) __setup("lsm.debug", enable_debug);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 398)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 399) static bool match_last_lsm(const char *list, const char *lsm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 400) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 401) const char *last;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 402)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 403) if (WARN_ON(!list || !lsm))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 404) return false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 405) last = strrchr(list, ',');
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 406) if (last)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 407) /* Pass the comma, strcmp() will check for '\0' */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 408) last++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 409) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 410) last = list;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 411) return !strcmp(last, lsm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 412) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 413)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 414) static int lsm_append(const char *new, char **result)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 415) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 416) char *cp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 417)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 418) if (*result == NULL) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 419) *result = kstrdup(new, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 420) if (*result == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 421) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 422) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 423) /* Check if it is the last registered name */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 424) if (match_last_lsm(*result, new))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 425) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 426) cp = kasprintf(GFP_KERNEL, "%s,%s", *result, new);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 427) if (cp == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 428) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 429) kfree(*result);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 430) *result = cp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 431) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 432) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 433) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 434)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 435) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 436) * security_add_hooks - Add a modules hooks to the hook lists.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 437) * @hooks: the hooks to add
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 438) * @count: the number of hooks to add
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 439) * @lsm: the name of the security module
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 440) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 441) * Each LSM has to register its hooks with the infrastructure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 442) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 443) void __init security_add_hooks(struct security_hook_list *hooks, int count,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 444) char *lsm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 445) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 446) int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 447)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 448) for (i = 0; i < count; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 449) hooks[i].lsm = lsm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 450) hlist_add_tail_rcu(&hooks[i].list, hooks[i].head);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 451) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 452)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 453) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 454) * Don't try to append during early_security_init(), we'll come back
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 455) * and fix this up afterwards.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 456) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 457) if (slab_is_available()) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 458) if (lsm_append(lsm, &lsm_names) < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 459) panic("%s - Cannot get early memory.\n", __func__);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 460) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 461) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 462)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 463) int call_blocking_lsm_notifier(enum lsm_event event, void *data)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 464) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 465) return blocking_notifier_call_chain(&blocking_lsm_notifier_chain,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 466) event, data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 467) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 468) EXPORT_SYMBOL(call_blocking_lsm_notifier);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 469)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 470) int register_blocking_lsm_notifier(struct notifier_block *nb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 471) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 472) return blocking_notifier_chain_register(&blocking_lsm_notifier_chain,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 473) nb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 474) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 475) EXPORT_SYMBOL(register_blocking_lsm_notifier);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 476)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 477) int unregister_blocking_lsm_notifier(struct notifier_block *nb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 478) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 479) return blocking_notifier_chain_unregister(&blocking_lsm_notifier_chain,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 480) nb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 481) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 482) EXPORT_SYMBOL(unregister_blocking_lsm_notifier);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 483)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 484) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 485) * lsm_cred_alloc - allocate a composite cred blob
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 486) * @cred: the cred that needs a blob
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 487) * @gfp: allocation type
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 488) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 489) * Allocate the cred blob for all the modules
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 490) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 491) * Returns 0, or -ENOMEM if memory can't be allocated.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 492) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 493) static int lsm_cred_alloc(struct cred *cred, gfp_t gfp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 494) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 495) if (blob_sizes.lbs_cred == 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 496) cred->security = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 497) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 498) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 499)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 500) cred->security = kzalloc(blob_sizes.lbs_cred, gfp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 501) if (cred->security == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 502) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 503) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 504) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 505)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 506) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 507) * lsm_early_cred - during initialization allocate a composite cred blob
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 508) * @cred: the cred that needs a blob
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 509) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 510) * Allocate the cred blob for all the modules
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 511) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 512) static void __init lsm_early_cred(struct cred *cred)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 513) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 514) int rc = lsm_cred_alloc(cred, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 515)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 516) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 517) panic("%s: Early cred alloc failed.\n", __func__);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 518) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 519)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 520) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 521) * lsm_file_alloc - allocate a composite file blob
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 522) * @file: the file that needs a blob
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 523) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 524) * Allocate the file blob for all the modules
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 525) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 526) * Returns 0, or -ENOMEM if memory can't be allocated.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 527) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 528) static int lsm_file_alloc(struct file *file)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 529) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 530) if (!lsm_file_cache) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 531) file->f_security = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 532) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 533) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 534)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 535) file->f_security = kmem_cache_zalloc(lsm_file_cache, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 536) if (file->f_security == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 537) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 538) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 539) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 540)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 541) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 542) * lsm_inode_alloc - allocate a composite inode blob
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 543) * @inode: the inode that needs a blob
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 544) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 545) * Allocate the inode blob for all the modules
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 546) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 547) * Returns 0, or -ENOMEM if memory can't be allocated.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 548) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 549) int lsm_inode_alloc(struct inode *inode)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 550) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 551) if (!lsm_inode_cache) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 552) inode->i_security = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 553) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 554) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 555)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 556) inode->i_security = kmem_cache_zalloc(lsm_inode_cache, GFP_NOFS);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 557) if (inode->i_security == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 558) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 559) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 560) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 561)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 562) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 563) * lsm_task_alloc - allocate a composite task blob
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 564) * @task: the task that needs a blob
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 565) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 566) * Allocate the task blob for all the modules
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 567) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 568) * Returns 0, or -ENOMEM if memory can't be allocated.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 569) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 570) static int lsm_task_alloc(struct task_struct *task)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 571) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 572) if (blob_sizes.lbs_task == 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 573) task->security = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 574) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 575) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 576)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 577) task->security = kzalloc(blob_sizes.lbs_task, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 578) if (task->security == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 579) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 580) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 581) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 582)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 583) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 584) * lsm_ipc_alloc - allocate a composite ipc blob
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 585) * @kip: the ipc that needs a blob
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 586) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 587) * Allocate the ipc blob for all the modules
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 588) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 589) * Returns 0, or -ENOMEM if memory can't be allocated.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 590) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 591) static int lsm_ipc_alloc(struct kern_ipc_perm *kip)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 592) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 593) if (blob_sizes.lbs_ipc == 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 594) kip->security = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 595) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 596) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 597)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 598) kip->security = kzalloc(blob_sizes.lbs_ipc, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 599) if (kip->security == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 600) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 601) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 602) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 603)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 604) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 605) * lsm_msg_msg_alloc - allocate a composite msg_msg blob
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 606) * @mp: the msg_msg that needs a blob
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 607) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 608) * Allocate the ipc blob for all the modules
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 609) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 610) * Returns 0, or -ENOMEM if memory can't be allocated.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 611) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 612) static int lsm_msg_msg_alloc(struct msg_msg *mp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 613) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 614) if (blob_sizes.lbs_msg_msg == 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 615) mp->security = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 616) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 617) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 618)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 619) mp->security = kzalloc(blob_sizes.lbs_msg_msg, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 620) if (mp->security == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 621) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 622) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 623) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 624)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 625) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 626) * lsm_early_task - during initialization allocate a composite task blob
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 627) * @task: the task that needs a blob
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 628) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 629) * Allocate the task blob for all the modules
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 630) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 631) static void __init lsm_early_task(struct task_struct *task)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 632) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 633) int rc = lsm_task_alloc(task);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 634)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 635) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 636) panic("%s: Early task alloc failed.\n", __func__);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 637) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 638)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 639) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 640) * The default value of the LSM hook is defined in linux/lsm_hook_defs.h and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 641) * can be accessed with:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 642) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 643) * LSM_RET_DEFAULT(<hook_name>)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 644) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 645) * The macros below define static constants for the default value of each
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 646) * LSM hook.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 647) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 648) #define LSM_RET_DEFAULT(NAME) (NAME##_default)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 649) #define DECLARE_LSM_RET_DEFAULT_void(DEFAULT, NAME)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 650) #define DECLARE_LSM_RET_DEFAULT_int(DEFAULT, NAME) \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 651) static const int LSM_RET_DEFAULT(NAME) = (DEFAULT);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 652) #define LSM_HOOK(RET, DEFAULT, NAME, ...) \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 653) DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 654)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 655) #include <linux/lsm_hook_defs.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 656) #undef LSM_HOOK
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 657)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 658) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 659) * Hook list operation macros.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 660) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 661) * call_void_hook:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 662) * This is a hook that does not return a value.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 663) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 664) * call_int_hook:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 665) * This is a hook that returns a value.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 666) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 667)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 668) #define call_void_hook(FUNC, ...) \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 669) do { \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 670) struct security_hook_list *P; \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 671) \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 672) hlist_for_each_entry(P, &security_hook_heads.FUNC, list) \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 673) P->hook.FUNC(__VA_ARGS__); \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 674) } while (0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 675)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 676) #define call_int_hook(FUNC, IRC, ...) ({ \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 677) int RC = IRC; \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 678) do { \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 679) struct security_hook_list *P; \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 680) \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 681) hlist_for_each_entry(P, &security_hook_heads.FUNC, list) { \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 682) RC = P->hook.FUNC(__VA_ARGS__); \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 683) if (RC != 0) \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 684) break; \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 685) } \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 686) } while (0); \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 687) RC; \
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 688) })
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 689)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 690) /* Security operations */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 691)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 692) int security_binder_set_context_mgr(const struct cred *mgr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 693) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 694) return call_int_hook(binder_set_context_mgr, 0, mgr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 695) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 696)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 697) int security_binder_transaction(const struct cred *from,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 698) const struct cred *to)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 699) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 700) return call_int_hook(binder_transaction, 0, from, to);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 701) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 702)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 703) int security_binder_transfer_binder(const struct cred *from,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 704) const struct cred *to)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 705) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 706) return call_int_hook(binder_transfer_binder, 0, from, to);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 707) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 708)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 709) int security_binder_transfer_file(const struct cred *from,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 710) const struct cred *to, struct file *file)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 711) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 712) return call_int_hook(binder_transfer_file, 0, from, to, file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 713) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 714)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 715) int security_ptrace_access_check(struct task_struct *child, unsigned int mode)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 716) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 717) return call_int_hook(ptrace_access_check, 0, child, mode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 718) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 719)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 720) int security_ptrace_traceme(struct task_struct *parent)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 721) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 722) return call_int_hook(ptrace_traceme, 0, parent);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 723) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 724)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 725) int security_capget(struct task_struct *target,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 726) kernel_cap_t *effective,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 727) kernel_cap_t *inheritable,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 728) kernel_cap_t *permitted)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 729) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 730) return call_int_hook(capget, 0, target,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 731) effective, inheritable, permitted);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 732) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 733)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 734) int security_capset(struct cred *new, const struct cred *old,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 735) const kernel_cap_t *effective,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 736) const kernel_cap_t *inheritable,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 737) const kernel_cap_t *permitted)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 738) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 739) return call_int_hook(capset, 0, new, old,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 740) effective, inheritable, permitted);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 741) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 742)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 743) int security_capable(const struct cred *cred,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 744) struct user_namespace *ns,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 745) int cap,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 746) unsigned int opts)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 747) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 748) return call_int_hook(capable, 0, cred, ns, cap, opts);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 749) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 750)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 751) int security_quotactl(int cmds, int type, int id, struct super_block *sb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 752) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 753) return call_int_hook(quotactl, 0, cmds, type, id, sb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 754) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 755)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 756) int security_quota_on(struct dentry *dentry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 757) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 758) return call_int_hook(quota_on, 0, dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 759) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 760)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 761) int security_syslog(int type)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 762) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 763) return call_int_hook(syslog, 0, type);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 764) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 765)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 766) int security_settime64(const struct timespec64 *ts, const struct timezone *tz)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 767) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 768) return call_int_hook(settime, 0, ts, tz);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 769) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 770)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 771) int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 772) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 773) struct security_hook_list *hp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 774) int cap_sys_admin = 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 775) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 776)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 777) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 778) * The module will respond with a positive value if
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 779) * it thinks the __vm_enough_memory() call should be
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 780) * made with the cap_sys_admin set. If all of the modules
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 781) * agree that it should be set it will. If any module
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 782) * thinks it should not be set it won't.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 783) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 784) hlist_for_each_entry(hp, &security_hook_heads.vm_enough_memory, list) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 785) rc = hp->hook.vm_enough_memory(mm, pages);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 786) if (rc <= 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 787) cap_sys_admin = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 788) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 789) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 790) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 791) return __vm_enough_memory(mm, pages, cap_sys_admin);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 792) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 793)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 794) int security_bprm_creds_for_exec(struct linux_binprm *bprm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 795) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 796) return call_int_hook(bprm_creds_for_exec, 0, bprm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 797) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 798)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 799) int security_bprm_creds_from_file(struct linux_binprm *bprm, struct file *file)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 800) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 801) return call_int_hook(bprm_creds_from_file, 0, bprm, file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 802) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 803)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 804) int security_bprm_check(struct linux_binprm *bprm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 805) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 806) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 807)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 808) ret = call_int_hook(bprm_check_security, 0, bprm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 809) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 810) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 811) return ima_bprm_check(bprm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 812) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 813)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 814) void security_bprm_committing_creds(struct linux_binprm *bprm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 815) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 816) call_void_hook(bprm_committing_creds, bprm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 817) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 818)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 819) void security_bprm_committed_creds(struct linux_binprm *bprm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 820) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 821) call_void_hook(bprm_committed_creds, bprm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 822) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 823)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 824) int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 825) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 826) return call_int_hook(fs_context_dup, 0, fc, src_fc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 827) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 828)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 829) int security_fs_context_parse_param(struct fs_context *fc,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 830) struct fs_parameter *param)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 831) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 832) struct security_hook_list *hp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 833) int trc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 834) int rc = -ENOPARAM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 835)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 836) hlist_for_each_entry(hp, &security_hook_heads.fs_context_parse_param,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 837) list) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 838) trc = hp->hook.fs_context_parse_param(fc, param);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 839) if (trc == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 840) rc = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 841) else if (trc != -ENOPARAM)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 842) return trc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 843) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 844) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 845) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 846)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 847) int security_sb_alloc(struct super_block *sb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 848) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 849) return call_int_hook(sb_alloc_security, 0, sb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 850) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 851)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 852) void security_sb_free(struct super_block *sb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 853) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 854) call_void_hook(sb_free_security, sb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 855) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 856)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 857) void security_free_mnt_opts(void **mnt_opts)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 858) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 859) if (!*mnt_opts)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 860) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 861) call_void_hook(sb_free_mnt_opts, *mnt_opts);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 862) *mnt_opts = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 863) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 864) EXPORT_SYMBOL(security_free_mnt_opts);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 865)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 866) int security_sb_eat_lsm_opts(char *options, void **mnt_opts)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 867) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 868) return call_int_hook(sb_eat_lsm_opts, 0, options, mnt_opts);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 869) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 870) EXPORT_SYMBOL(security_sb_eat_lsm_opts);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 871)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 872) int security_sb_remount(struct super_block *sb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 873) void *mnt_opts)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 874) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 875) return call_int_hook(sb_remount, 0, sb, mnt_opts);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 876) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 877) EXPORT_SYMBOL(security_sb_remount);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 878)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 879) int security_sb_kern_mount(struct super_block *sb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 880) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 881) return call_int_hook(sb_kern_mount, 0, sb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 882) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 883)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 884) int security_sb_show_options(struct seq_file *m, struct super_block *sb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 885) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 886) return call_int_hook(sb_show_options, 0, m, sb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 887) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 888)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 889) int security_sb_statfs(struct dentry *dentry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 890) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 891) return call_int_hook(sb_statfs, 0, dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 892) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 893)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 894) int security_sb_mount(const char *dev_name, const struct path *path,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 895) const char *type, unsigned long flags, void *data)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 896) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 897) return call_int_hook(sb_mount, 0, dev_name, path, type, flags, data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 898) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 899)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 900) int security_sb_umount(struct vfsmount *mnt, int flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 901) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 902) return call_int_hook(sb_umount, 0, mnt, flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 903) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 904)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 905) int security_sb_pivotroot(const struct path *old_path, const struct path *new_path)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 906) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 907) return call_int_hook(sb_pivotroot, 0, old_path, new_path);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 908) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 909)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 910) int security_sb_set_mnt_opts(struct super_block *sb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 911) void *mnt_opts,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 912) unsigned long kern_flags,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 913) unsigned long *set_kern_flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 914) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 915) return call_int_hook(sb_set_mnt_opts,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 916) mnt_opts ? -EOPNOTSUPP : 0, sb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 917) mnt_opts, kern_flags, set_kern_flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 918) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 919) EXPORT_SYMBOL(security_sb_set_mnt_opts);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 920)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 921) int security_sb_clone_mnt_opts(const struct super_block *oldsb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 922) struct super_block *newsb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 923) unsigned long kern_flags,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 924) unsigned long *set_kern_flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 925) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 926) return call_int_hook(sb_clone_mnt_opts, 0, oldsb, newsb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 927) kern_flags, set_kern_flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 928) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 929) EXPORT_SYMBOL(security_sb_clone_mnt_opts);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 930)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 931) int security_add_mnt_opt(const char *option, const char *val, int len,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 932) void **mnt_opts)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 933) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 934) return call_int_hook(sb_add_mnt_opt, -EINVAL,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 935) option, val, len, mnt_opts);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 936) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 937) EXPORT_SYMBOL(security_add_mnt_opt);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 938)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 939) int security_move_mount(const struct path *from_path, const struct path *to_path)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 940) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 941) return call_int_hook(move_mount, 0, from_path, to_path);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 942) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 943)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 944) int security_path_notify(const struct path *path, u64 mask,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 945) unsigned int obj_type)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 946) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 947) return call_int_hook(path_notify, 0, path, mask, obj_type);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 948) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 949)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 950) int security_inode_alloc(struct inode *inode)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 951) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 952) int rc = lsm_inode_alloc(inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 953)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 954) if (unlikely(rc))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 955) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 956) rc = call_int_hook(inode_alloc_security, 0, inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 957) if (unlikely(rc))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 958) security_inode_free(inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 959) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 960) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 961)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 962) static void inode_free_by_rcu(struct rcu_head *head)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 963) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 964) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 965) * The rcu head is at the start of the inode blob
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 966) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 967) kmem_cache_free(lsm_inode_cache, head);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 968) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 969)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 970) void security_inode_free(struct inode *inode)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 971) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 972) integrity_inode_free(inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 973) call_void_hook(inode_free_security, inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 974) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 975) * The inode may still be referenced in a path walk and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 976) * a call to security_inode_permission() can be made
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 977) * after inode_free_security() is called. Ideally, the VFS
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 978) * wouldn't do this, but fixing that is a much harder
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 979) * job. For now, simply free the i_security via RCU, and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 980) * leave the current inode->i_security pointer intact.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 981) * The inode will be freed after the RCU grace period too.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 982) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 983) if (inode->i_security)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 984) call_rcu((struct rcu_head *)inode->i_security,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 985) inode_free_by_rcu);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 986) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 987)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 988) int security_dentry_init_security(struct dentry *dentry, int mode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 989) const struct qstr *name, void **ctx,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 990) u32 *ctxlen)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 991) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 992) return call_int_hook(dentry_init_security, -EOPNOTSUPP, dentry, mode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 993) name, ctx, ctxlen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 994) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 995) EXPORT_SYMBOL(security_dentry_init_security);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 996)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 997) int security_dentry_create_files_as(struct dentry *dentry, int mode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 998) struct qstr *name,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 999) const struct cred *old, struct cred *new)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1000) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1001) return call_int_hook(dentry_create_files_as, 0, dentry, mode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1002) name, old, new);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1003) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1004) EXPORT_SYMBOL(security_dentry_create_files_as);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1005)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1006) int security_inode_init_security(struct inode *inode, struct inode *dir,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1007) const struct qstr *qstr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1008) const initxattrs initxattrs, void *fs_data)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1009) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1010) struct xattr new_xattrs[MAX_LSM_EVM_XATTR + 1];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1011) struct xattr *lsm_xattr, *evm_xattr, *xattr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1012) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1013)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1014) if (unlikely(IS_PRIVATE(inode)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1015) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1016)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1017) if (!initxattrs)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1018) return call_int_hook(inode_init_security, -EOPNOTSUPP, inode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1019) dir, qstr, NULL, NULL, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1020) memset(new_xattrs, 0, sizeof(new_xattrs));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1021) lsm_xattr = new_xattrs;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1022) ret = call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir, qstr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1023) &lsm_xattr->name,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1024) &lsm_xattr->value,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1025) &lsm_xattr->value_len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1026) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1027) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1028)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1029) evm_xattr = lsm_xattr + 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1030) ret = evm_inode_init_security(inode, lsm_xattr, evm_xattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1031) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1032) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1033) ret = initxattrs(inode, new_xattrs, fs_data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1034) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1035) for (xattr = new_xattrs; xattr->value != NULL; xattr++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1036) kfree(xattr->value);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1037) return (ret == -EOPNOTSUPP) ? 0 : ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1038) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1039) EXPORT_SYMBOL(security_inode_init_security);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1040)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1041) int security_inode_init_security_anon(struct inode *inode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1042) const struct qstr *name,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1043) const struct inode *context_inode)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1044) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1045) return call_int_hook(inode_init_security_anon, 0, inode, name,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1046) context_inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1047) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1048)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1049) int security_old_inode_init_security(struct inode *inode, struct inode *dir,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1050) const struct qstr *qstr, const char **name,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1051) void **value, size_t *len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1052) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1053) if (unlikely(IS_PRIVATE(inode)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1054) return -EOPNOTSUPP;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1055) return call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1056) qstr, name, value, len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1057) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1058) EXPORT_SYMBOL(security_old_inode_init_security);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1059)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1060) #ifdef CONFIG_SECURITY_PATH
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1061) int security_path_mknod(const struct path *dir, struct dentry *dentry, umode_t mode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1062) unsigned int dev)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1063) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1064) if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1065) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1066) return call_int_hook(path_mknod, 0, dir, dentry, mode, dev);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1067) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1068) EXPORT_SYMBOL(security_path_mknod);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1069)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1070) int security_path_mkdir(const struct path *dir, struct dentry *dentry, umode_t mode)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1071) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1072) if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1073) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1074) return call_int_hook(path_mkdir, 0, dir, dentry, mode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1075) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1076) EXPORT_SYMBOL(security_path_mkdir);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1077)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1078) int security_path_rmdir(const struct path *dir, struct dentry *dentry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1079) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1080) if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1081) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1082) return call_int_hook(path_rmdir, 0, dir, dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1083) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1084)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1085) int security_path_unlink(const struct path *dir, struct dentry *dentry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1086) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1087) if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1088) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1089) return call_int_hook(path_unlink, 0, dir, dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1090) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1091) EXPORT_SYMBOL(security_path_unlink);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1092)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1093) int security_path_symlink(const struct path *dir, struct dentry *dentry,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1094) const char *old_name)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1095) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1096) if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1097) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1098) return call_int_hook(path_symlink, 0, dir, dentry, old_name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1099) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1100)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1101) int security_path_link(struct dentry *old_dentry, const struct path *new_dir,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1102) struct dentry *new_dentry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1103) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1104) if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1105) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1106) return call_int_hook(path_link, 0, old_dentry, new_dir, new_dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1107) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1108)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1109) int security_path_rename(const struct path *old_dir, struct dentry *old_dentry,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1110) const struct path *new_dir, struct dentry *new_dentry,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1111) unsigned int flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1112) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1113) if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry)) ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1114) (d_is_positive(new_dentry) && IS_PRIVATE(d_backing_inode(new_dentry)))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1115) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1116)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1117) if (flags & RENAME_EXCHANGE) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1118) int err = call_int_hook(path_rename, 0, new_dir, new_dentry,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1119) old_dir, old_dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1120) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1121) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1122) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1123)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1124) return call_int_hook(path_rename, 0, old_dir, old_dentry, new_dir,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1125) new_dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1126) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1127) EXPORT_SYMBOL(security_path_rename);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1128)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1129) int security_path_truncate(const struct path *path)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1130) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1131) if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1132) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1133) return call_int_hook(path_truncate, 0, path);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1134) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1135)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1136) int security_path_chmod(const struct path *path, umode_t mode)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1137) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1138) if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1139) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1140) return call_int_hook(path_chmod, 0, path, mode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1141) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1142)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1143) int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1144) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1145) if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1146) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1147) return call_int_hook(path_chown, 0, path, uid, gid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1148) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1149)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1150) int security_path_chroot(const struct path *path)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1151) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1152) return call_int_hook(path_chroot, 0, path);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1153) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1154) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1155)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1156) int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1157) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1158) if (unlikely(IS_PRIVATE(dir)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1159) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1160) return call_int_hook(inode_create, 0, dir, dentry, mode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1161) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1162) EXPORT_SYMBOL_GPL(security_inode_create);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1163)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1164) int security_inode_link(struct dentry *old_dentry, struct inode *dir,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1165) struct dentry *new_dentry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1166) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1167) if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1168) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1169) return call_int_hook(inode_link, 0, old_dentry, dir, new_dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1170) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1171)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1172) int security_inode_unlink(struct inode *dir, struct dentry *dentry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1173) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1174) if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1175) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1176) return call_int_hook(inode_unlink, 0, dir, dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1177) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1178)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1179) int security_inode_symlink(struct inode *dir, struct dentry *dentry,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1180) const char *old_name)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1181) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1182) if (unlikely(IS_PRIVATE(dir)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1183) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1184) return call_int_hook(inode_symlink, 0, dir, dentry, old_name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1185) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1186)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1187) int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1188) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1189) if (unlikely(IS_PRIVATE(dir)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1190) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1191) return call_int_hook(inode_mkdir, 0, dir, dentry, mode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1192) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1193) EXPORT_SYMBOL_GPL(security_inode_mkdir);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1194)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1195) int security_inode_rmdir(struct inode *dir, struct dentry *dentry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1196) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1197) if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1198) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1199) return call_int_hook(inode_rmdir, 0, dir, dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1200) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1201)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1202) int security_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1203) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1204) if (unlikely(IS_PRIVATE(dir)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1205) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1206) return call_int_hook(inode_mknod, 0, dir, dentry, mode, dev);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1207) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1208)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1209) int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1210) struct inode *new_dir, struct dentry *new_dentry,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1211) unsigned int flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1212) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1213) if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry)) ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1214) (d_is_positive(new_dentry) && IS_PRIVATE(d_backing_inode(new_dentry)))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1215) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1216)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1217) if (flags & RENAME_EXCHANGE) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1218) int err = call_int_hook(inode_rename, 0, new_dir, new_dentry,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1219) old_dir, old_dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1220) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1221) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1222) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1223)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1224) return call_int_hook(inode_rename, 0, old_dir, old_dentry,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1225) new_dir, new_dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1226) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1227)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1228) int security_inode_readlink(struct dentry *dentry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1229) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1230) if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1231) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1232) return call_int_hook(inode_readlink, 0, dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1233) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1234)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1235) int security_inode_follow_link(struct dentry *dentry, struct inode *inode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1236) bool rcu)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1237) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1238) if (unlikely(IS_PRIVATE(inode)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1239) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1240) return call_int_hook(inode_follow_link, 0, dentry, inode, rcu);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1241) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1242)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1243) int security_inode_permission(struct inode *inode, int mask)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1244) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1245) if (unlikely(IS_PRIVATE(inode)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1246) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1247) return call_int_hook(inode_permission, 0, inode, mask);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1248) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1249)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1250) int security_inode_setattr(struct dentry *dentry, struct iattr *attr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1251) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1252) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1253)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1254) if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1255) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1256) ret = call_int_hook(inode_setattr, 0, dentry, attr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1257) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1258) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1259) return evm_inode_setattr(dentry, attr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1260) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1261) EXPORT_SYMBOL_GPL(security_inode_setattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1262)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1263) int security_inode_getattr(const struct path *path)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1264) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1265) if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1266) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1267) return call_int_hook(inode_getattr, 0, path);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1268) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1269)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1270) int security_inode_setxattr(struct dentry *dentry, const char *name,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1271) const void *value, size_t size, int flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1272) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1273) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1274)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1275) if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1276) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1277) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1278) * SELinux and Smack integrate the cap call,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1279) * so assume that all LSMs supplying this call do so.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1280) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1281) ret = call_int_hook(inode_setxattr, 1, dentry, name, value, size,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1282) flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1283)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1284) if (ret == 1)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1285) ret = cap_inode_setxattr(dentry, name, value, size, flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1286) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1287) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1288) ret = ima_inode_setxattr(dentry, name, value, size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1289) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1290) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1291) return evm_inode_setxattr(dentry, name, value, size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1292) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1293)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1294) void security_inode_post_setxattr(struct dentry *dentry, const char *name,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1295) const void *value, size_t size, int flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1296) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1297) if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1298) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1299) call_void_hook(inode_post_setxattr, dentry, name, value, size, flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1300) evm_inode_post_setxattr(dentry, name, value, size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1301) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1302)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1303) int security_inode_getxattr(struct dentry *dentry, const char *name)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1304) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1305) if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1306) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1307) return call_int_hook(inode_getxattr, 0, dentry, name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1308) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1309)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1310) int security_inode_listxattr(struct dentry *dentry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1311) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1312) if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1313) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1314) return call_int_hook(inode_listxattr, 0, dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1315) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1316)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1317) int security_inode_removexattr(struct dentry *dentry, const char *name)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1318) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1319) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1320)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1321) if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1322) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1323) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1324) * SELinux and Smack integrate the cap call,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1325) * so assume that all LSMs supplying this call do so.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1326) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1327) ret = call_int_hook(inode_removexattr, 1, dentry, name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1328) if (ret == 1)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1329) ret = cap_inode_removexattr(dentry, name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1330) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1331) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1332) ret = ima_inode_removexattr(dentry, name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1333) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1334) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1335) return evm_inode_removexattr(dentry, name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1336) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1337)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1338) int security_inode_need_killpriv(struct dentry *dentry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1339) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1340) return call_int_hook(inode_need_killpriv, 0, dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1341) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1342)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1343) int security_inode_killpriv(struct dentry *dentry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1344) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1345) return call_int_hook(inode_killpriv, 0, dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1346) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1347)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1348) int security_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1349) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1350) struct security_hook_list *hp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1351) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1352)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1353) if (unlikely(IS_PRIVATE(inode)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1354) return LSM_RET_DEFAULT(inode_getsecurity);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1355) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1356) * Only one module will provide an attribute with a given name.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1357) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1358) hlist_for_each_entry(hp, &security_hook_heads.inode_getsecurity, list) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1359) rc = hp->hook.inode_getsecurity(inode, name, buffer, alloc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1360) if (rc != LSM_RET_DEFAULT(inode_getsecurity))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1361) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1362) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1363) return LSM_RET_DEFAULT(inode_getsecurity);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1364) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1365)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1366) int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1367) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1368) struct security_hook_list *hp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1369) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1370)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1371) if (unlikely(IS_PRIVATE(inode)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1372) return LSM_RET_DEFAULT(inode_setsecurity);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1373) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1374) * Only one module will provide an attribute with a given name.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1375) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1376) hlist_for_each_entry(hp, &security_hook_heads.inode_setsecurity, list) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1377) rc = hp->hook.inode_setsecurity(inode, name, value, size,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1378) flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1379) if (rc != LSM_RET_DEFAULT(inode_setsecurity))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1380) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1381) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1382) return LSM_RET_DEFAULT(inode_setsecurity);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1383) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1384)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1385) int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1386) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1387) if (unlikely(IS_PRIVATE(inode)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1388) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1389) return call_int_hook(inode_listsecurity, 0, inode, buffer, buffer_size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1390) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1391) EXPORT_SYMBOL(security_inode_listsecurity);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1392)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1393) void security_inode_getsecid(struct inode *inode, u32 *secid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1394) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1395) call_void_hook(inode_getsecid, inode, secid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1396) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1397)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1398) int security_inode_copy_up(struct dentry *src, struct cred **new)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1399) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1400) return call_int_hook(inode_copy_up, 0, src, new);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1401) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1402) EXPORT_SYMBOL(security_inode_copy_up);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1403)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1404) int security_inode_copy_up_xattr(const char *name)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1405) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1406) struct security_hook_list *hp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1407) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1408)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1409) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1410) * The implementation can return 0 (accept the xattr), 1 (discard the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1411) * xattr), -EOPNOTSUPP if it does not know anything about the xattr or
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1412) * any other error code incase of an error.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1413) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1414) hlist_for_each_entry(hp,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1415) &security_hook_heads.inode_copy_up_xattr, list) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1416) rc = hp->hook.inode_copy_up_xattr(name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1417) if (rc != LSM_RET_DEFAULT(inode_copy_up_xattr))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1418) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1419) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1420)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1421) return LSM_RET_DEFAULT(inode_copy_up_xattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1422) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1423) EXPORT_SYMBOL(security_inode_copy_up_xattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1424)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1425) int security_kernfs_init_security(struct kernfs_node *kn_dir,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1426) struct kernfs_node *kn)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1427) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1428) return call_int_hook(kernfs_init_security, 0, kn_dir, kn);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1429) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1430)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1431) int security_file_permission(struct file *file, int mask)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1432) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1433) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1434)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1435) ret = call_int_hook(file_permission, 0, file, mask);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1436) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1437) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1438)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1439) return fsnotify_perm(file, mask);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1440) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1441)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1442) int security_file_alloc(struct file *file)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1443) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1444) int rc = lsm_file_alloc(file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1445)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1446) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1447) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1448) rc = call_int_hook(file_alloc_security, 0, file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1449) if (unlikely(rc))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1450) security_file_free(file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1451) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1452) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1453)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1454) void security_file_free(struct file *file)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1455) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1456) void *blob;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1457)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1458) call_void_hook(file_free_security, file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1459)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1460) blob = file->f_security;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1461) if (blob) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1462) file->f_security = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1463) kmem_cache_free(lsm_file_cache, blob);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1464) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1465) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1466)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1467) int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1468) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1469) return call_int_hook(file_ioctl, 0, file, cmd, arg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1470) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1471) EXPORT_SYMBOL_GPL(security_file_ioctl);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1472)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1473) static inline unsigned long mmap_prot(struct file *file, unsigned long prot)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1474) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1475) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1476) * Does we have PROT_READ and does the application expect
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1477) * it to imply PROT_EXEC? If not, nothing to talk about...
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1478) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1479) if ((prot & (PROT_READ | PROT_EXEC)) != PROT_READ)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1480) return prot;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1481) if (!(current->personality & READ_IMPLIES_EXEC))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1482) return prot;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1483) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1484) * if that's an anonymous mapping, let it.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1485) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1486) if (!file)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1487) return prot | PROT_EXEC;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1488) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1489) * ditto if it's not on noexec mount, except that on !MMU we need
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1490) * NOMMU_MAP_EXEC (== VM_MAYEXEC) in this case
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1491) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1492) if (!path_noexec(&file->f_path)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1493) #ifndef CONFIG_MMU
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1494) if (file->f_op->mmap_capabilities) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1495) unsigned caps = file->f_op->mmap_capabilities(file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1496) if (!(caps & NOMMU_MAP_EXEC))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1497) return prot;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1498) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1499) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1500) return prot | PROT_EXEC;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1501) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1502) /* anything on noexec mount won't get PROT_EXEC */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1503) return prot;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1504) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1505)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1506) int security_mmap_file(struct file *file, unsigned long prot,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1507) unsigned long flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1508) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1509) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1510) ret = call_int_hook(mmap_file, 0, file, prot,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1511) mmap_prot(file, prot), flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1512) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1513) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1514) return ima_file_mmap(file, prot);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1515) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1516)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1517) int security_mmap_addr(unsigned long addr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1518) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1519) return call_int_hook(mmap_addr, 0, addr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1520) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1521)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1522) int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1523) unsigned long prot)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1524) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1525) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1526)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1527) ret = call_int_hook(file_mprotect, 0, vma, reqprot, prot);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1528) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1529) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1530) return ima_file_mprotect(vma, prot);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1531) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1532)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1533) int security_file_lock(struct file *file, unsigned int cmd)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1534) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1535) return call_int_hook(file_lock, 0, file, cmd);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1536) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1537)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1538) int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1539) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1540) return call_int_hook(file_fcntl, 0, file, cmd, arg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1541) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1542)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1543) void security_file_set_fowner(struct file *file)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1544) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1545) call_void_hook(file_set_fowner, file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1546) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1547)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1548) int security_file_send_sigiotask(struct task_struct *tsk,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1549) struct fown_struct *fown, int sig)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1550) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1551) return call_int_hook(file_send_sigiotask, 0, tsk, fown, sig);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1552) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1553)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1554) int security_file_receive(struct file *file)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1555) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1556) return call_int_hook(file_receive, 0, file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1557) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1558)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1559) int security_file_open(struct file *file)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1560) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1561) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1562)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1563) ret = call_int_hook(file_open, 0, file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1564) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1565) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1566)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1567) return fsnotify_perm(file, MAY_OPEN);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1568) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1569)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1570) int security_task_alloc(struct task_struct *task, unsigned long clone_flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1571) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1572) int rc = lsm_task_alloc(task);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1573)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1574) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1575) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1576) rc = call_int_hook(task_alloc, 0, task, clone_flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1577) if (unlikely(rc))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1578) security_task_free(task);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1579) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1580) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1581)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1582) void security_task_free(struct task_struct *task)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1583) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1584) call_void_hook(task_free, task);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1585)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1586) kfree(task->security);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1587) task->security = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1588) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1589)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1590) int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1591) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1592) int rc = lsm_cred_alloc(cred, gfp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1593)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1594) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1595) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1596)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1597) rc = call_int_hook(cred_alloc_blank, 0, cred, gfp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1598) if (unlikely(rc))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1599) security_cred_free(cred);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1600) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1601) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1602)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1603) void security_cred_free(struct cred *cred)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1604) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1605) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1606) * There is a failure case in prepare_creds() that
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1607) * may result in a call here with ->security being NULL.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1608) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1609) if (unlikely(cred->security == NULL))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1610) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1611)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1612) call_void_hook(cred_free, cred);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1613)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1614) kfree(cred->security);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1615) cred->security = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1616) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1617)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1618) int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1619) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1620) int rc = lsm_cred_alloc(new, gfp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1621)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1622) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1623) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1624)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1625) rc = call_int_hook(cred_prepare, 0, new, old, gfp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1626) if (unlikely(rc))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1627) security_cred_free(new);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1628) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1629) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1630)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1631) void security_transfer_creds(struct cred *new, const struct cred *old)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1632) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1633) call_void_hook(cred_transfer, new, old);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1634) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1635)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1636) void security_cred_getsecid(const struct cred *c, u32 *secid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1637) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1638) *secid = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1639) call_void_hook(cred_getsecid, c, secid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1640) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1641) EXPORT_SYMBOL(security_cred_getsecid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1642)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1643) int security_kernel_act_as(struct cred *new, u32 secid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1644) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1645) return call_int_hook(kernel_act_as, 0, new, secid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1646) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1647)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1648) int security_kernel_create_files_as(struct cred *new, struct inode *inode)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1649) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1650) return call_int_hook(kernel_create_files_as, 0, new, inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1651) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1652)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1653) int security_kernel_module_request(char *kmod_name)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1654) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1655) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1656)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1657) ret = call_int_hook(kernel_module_request, 0, kmod_name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1658) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1659) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1660) return integrity_kernel_module_request(kmod_name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1661) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1662)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1663) int security_kernel_read_file(struct file *file, enum kernel_read_file_id id,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1664) bool contents)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1665) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1666) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1667)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1668) ret = call_int_hook(kernel_read_file, 0, file, id, contents);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1669) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1670) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1671) return ima_read_file(file, id, contents);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1672) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1673) EXPORT_SYMBOL_GPL(security_kernel_read_file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1674)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1675) int security_kernel_post_read_file(struct file *file, char *buf, loff_t size,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1676) enum kernel_read_file_id id)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1677) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1678) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1679)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1680) ret = call_int_hook(kernel_post_read_file, 0, file, buf, size, id);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1681) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1682) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1683) return ima_post_read_file(file, buf, size, id);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1684) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1685) EXPORT_SYMBOL_GPL(security_kernel_post_read_file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1686)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1687) int security_kernel_load_data(enum kernel_load_data_id id, bool contents)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1688) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1689) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1690)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1691) ret = call_int_hook(kernel_load_data, 0, id, contents);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1692) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1693) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1694) return ima_load_data(id, contents);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1695) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1696) EXPORT_SYMBOL_GPL(security_kernel_load_data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1697)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1698) int security_kernel_post_load_data(char *buf, loff_t size,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1699) enum kernel_load_data_id id,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1700) char *description)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1701) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1702) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1703)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1704) ret = call_int_hook(kernel_post_load_data, 0, buf, size, id,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1705) description);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1706) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1707) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1708) return ima_post_load_data(buf, size, id, description);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1709) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1710) EXPORT_SYMBOL_GPL(security_kernel_post_load_data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1711)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1712) int security_task_fix_setuid(struct cred *new, const struct cred *old,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1713) int flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1714) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1715) return call_int_hook(task_fix_setuid, 0, new, old, flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1716) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1717)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1718) int security_task_fix_setgid(struct cred *new, const struct cred *old,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1719) int flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1720) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1721) return call_int_hook(task_fix_setgid, 0, new, old, flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1722) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1723)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1724) int security_task_setpgid(struct task_struct *p, pid_t pgid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1725) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1726) return call_int_hook(task_setpgid, 0, p, pgid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1727) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1728)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1729) int security_task_getpgid(struct task_struct *p)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1730) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1731) return call_int_hook(task_getpgid, 0, p);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1732) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1733)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1734) int security_task_getsid(struct task_struct *p)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1735) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1736) return call_int_hook(task_getsid, 0, p);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1737) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1738)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1739) void security_task_getsecid(struct task_struct *p, u32 *secid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1740) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1741) *secid = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1742) call_void_hook(task_getsecid, p, secid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1743) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1744) EXPORT_SYMBOL(security_task_getsecid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1745)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1746) int security_task_setnice(struct task_struct *p, int nice)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1747) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1748) return call_int_hook(task_setnice, 0, p, nice);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1749) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1750)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1751) int security_task_setioprio(struct task_struct *p, int ioprio)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1752) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1753) return call_int_hook(task_setioprio, 0, p, ioprio);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1754) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1755)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1756) int security_task_getioprio(struct task_struct *p)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1757) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1758) return call_int_hook(task_getioprio, 0, p);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1759) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1760)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1761) int security_task_prlimit(const struct cred *cred, const struct cred *tcred,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1762) unsigned int flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1763) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1764) return call_int_hook(task_prlimit, 0, cred, tcred, flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1765) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1766)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1767) int security_task_setrlimit(struct task_struct *p, unsigned int resource,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1768) struct rlimit *new_rlim)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1769) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1770) return call_int_hook(task_setrlimit, 0, p, resource, new_rlim);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1771) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1772)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1773) int security_task_setscheduler(struct task_struct *p)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1774) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1775) return call_int_hook(task_setscheduler, 0, p);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1776) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1777)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1778) int security_task_getscheduler(struct task_struct *p)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1779) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1780) return call_int_hook(task_getscheduler, 0, p);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1781) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1782)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1783) int security_task_movememory(struct task_struct *p)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1784) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1785) return call_int_hook(task_movememory, 0, p);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1786) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1787)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1788) int security_task_kill(struct task_struct *p, struct kernel_siginfo *info,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1789) int sig, const struct cred *cred)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1790) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1791) return call_int_hook(task_kill, 0, p, info, sig, cred);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1792) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1793)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1794) int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1795) unsigned long arg4, unsigned long arg5)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1796) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1797) int thisrc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1798) int rc = LSM_RET_DEFAULT(task_prctl);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1799) struct security_hook_list *hp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1800)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1801) hlist_for_each_entry(hp, &security_hook_heads.task_prctl, list) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1802) thisrc = hp->hook.task_prctl(option, arg2, arg3, arg4, arg5);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1803) if (thisrc != LSM_RET_DEFAULT(task_prctl)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1804) rc = thisrc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1805) if (thisrc != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1806) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1807) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1808) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1809) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1810) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1811)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1812) void security_task_to_inode(struct task_struct *p, struct inode *inode)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1813) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1814) call_void_hook(task_to_inode, p, inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1815) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1816)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1817) int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1818) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1819) return call_int_hook(ipc_permission, 0, ipcp, flag);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1820) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1821)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1822) void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1823) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1824) *secid = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1825) call_void_hook(ipc_getsecid, ipcp, secid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1826) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1827)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1828) int security_msg_msg_alloc(struct msg_msg *msg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1829) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1830) int rc = lsm_msg_msg_alloc(msg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1831)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1832) if (unlikely(rc))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1833) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1834) rc = call_int_hook(msg_msg_alloc_security, 0, msg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1835) if (unlikely(rc))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1836) security_msg_msg_free(msg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1837) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1838) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1839)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1840) void security_msg_msg_free(struct msg_msg *msg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1841) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1842) call_void_hook(msg_msg_free_security, msg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1843) kfree(msg->security);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1844) msg->security = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1845) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1846)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1847) int security_msg_queue_alloc(struct kern_ipc_perm *msq)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1848) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1849) int rc = lsm_ipc_alloc(msq);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1850)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1851) if (unlikely(rc))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1852) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1853) rc = call_int_hook(msg_queue_alloc_security, 0, msq);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1854) if (unlikely(rc))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1855) security_msg_queue_free(msq);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1856) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1857) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1858)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1859) void security_msg_queue_free(struct kern_ipc_perm *msq)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1860) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1861) call_void_hook(msg_queue_free_security, msq);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1862) kfree(msq->security);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1863) msq->security = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1864) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1865)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1866) int security_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1867) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1868) return call_int_hook(msg_queue_associate, 0, msq, msqflg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1869) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1870)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1871) int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1872) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1873) return call_int_hook(msg_queue_msgctl, 0, msq, cmd);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1874) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1875)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1876) int security_msg_queue_msgsnd(struct kern_ipc_perm *msq,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1877) struct msg_msg *msg, int msqflg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1878) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1879) return call_int_hook(msg_queue_msgsnd, 0, msq, msg, msqflg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1880) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1881)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1882) int security_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1883) struct task_struct *target, long type, int mode)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1884) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1885) return call_int_hook(msg_queue_msgrcv, 0, msq, msg, target, type, mode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1886) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1887)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1888) int security_shm_alloc(struct kern_ipc_perm *shp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1889) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1890) int rc = lsm_ipc_alloc(shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1891)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1892) if (unlikely(rc))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1893) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1894) rc = call_int_hook(shm_alloc_security, 0, shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1895) if (unlikely(rc))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1896) security_shm_free(shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1897) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1898) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1899)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1900) void security_shm_free(struct kern_ipc_perm *shp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1901) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1902) call_void_hook(shm_free_security, shp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1903) kfree(shp->security);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1904) shp->security = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1905) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1906)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1907) int security_shm_associate(struct kern_ipc_perm *shp, int shmflg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1908) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1909) return call_int_hook(shm_associate, 0, shp, shmflg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1910) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1911)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1912) int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1913) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1914) return call_int_hook(shm_shmctl, 0, shp, cmd);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1915) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1916)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1917) int security_shm_shmat(struct kern_ipc_perm *shp, char __user *shmaddr, int shmflg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1918) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1919) return call_int_hook(shm_shmat, 0, shp, shmaddr, shmflg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1920) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1921)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1922) int security_sem_alloc(struct kern_ipc_perm *sma)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1923) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1924) int rc = lsm_ipc_alloc(sma);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1925)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1926) if (unlikely(rc))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1927) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1928) rc = call_int_hook(sem_alloc_security, 0, sma);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1929) if (unlikely(rc))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1930) security_sem_free(sma);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1931) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1932) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1933)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1934) void security_sem_free(struct kern_ipc_perm *sma)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1935) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1936) call_void_hook(sem_free_security, sma);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1937) kfree(sma->security);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1938) sma->security = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1939) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1940)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1941) int security_sem_associate(struct kern_ipc_perm *sma, int semflg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1942) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1943) return call_int_hook(sem_associate, 0, sma, semflg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1944) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1945)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1946) int security_sem_semctl(struct kern_ipc_perm *sma, int cmd)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1947) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1948) return call_int_hook(sem_semctl, 0, sma, cmd);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1949) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1950)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1951) int security_sem_semop(struct kern_ipc_perm *sma, struct sembuf *sops,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1952) unsigned nsops, int alter)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1953) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1954) return call_int_hook(sem_semop, 0, sma, sops, nsops, alter);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1955) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1956)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1957) void security_d_instantiate(struct dentry *dentry, struct inode *inode)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1958) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1959) if (unlikely(inode && IS_PRIVATE(inode)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1960) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1961) call_void_hook(d_instantiate, dentry, inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1962) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1963) EXPORT_SYMBOL(security_d_instantiate);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1964)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1965) int security_getprocattr(struct task_struct *p, const char *lsm, char *name,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1966) char **value)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1967) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1968) struct security_hook_list *hp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1969)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1970) hlist_for_each_entry(hp, &security_hook_heads.getprocattr, list) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1971) if (lsm != NULL && strcmp(lsm, hp->lsm))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1972) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1973) return hp->hook.getprocattr(p, name, value);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1974) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1975) return LSM_RET_DEFAULT(getprocattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1976) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1977)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1978) int security_setprocattr(const char *lsm, const char *name, void *value,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1979) size_t size)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1980) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1981) struct security_hook_list *hp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1982)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1983) hlist_for_each_entry(hp, &security_hook_heads.setprocattr, list) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1984) if (lsm != NULL && strcmp(lsm, hp->lsm))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1985) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1986) return hp->hook.setprocattr(name, value, size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1987) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1988) return LSM_RET_DEFAULT(setprocattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1989) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1990)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1991) int security_netlink_send(struct sock *sk, struct sk_buff *skb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1992) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1993) return call_int_hook(netlink_send, 0, sk, skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1994) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1995)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1996) int security_ismaclabel(const char *name)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1997) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1998) return call_int_hook(ismaclabel, 0, name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1999) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2000) EXPORT_SYMBOL(security_ismaclabel);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2001)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2002) int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2003) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2004) struct security_hook_list *hp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2005) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2006)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2007) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2008) * Currently, only one LSM can implement secid_to_secctx (i.e this
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2009) * LSM hook is not "stackable").
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2010) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2011) hlist_for_each_entry(hp, &security_hook_heads.secid_to_secctx, list) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2012) rc = hp->hook.secid_to_secctx(secid, secdata, seclen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2013) if (rc != LSM_RET_DEFAULT(secid_to_secctx))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2014) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2015) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2016)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2017) return LSM_RET_DEFAULT(secid_to_secctx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2018) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2019) EXPORT_SYMBOL(security_secid_to_secctx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2020)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2021) int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2022) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2023) *secid = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2024) return call_int_hook(secctx_to_secid, 0, secdata, seclen, secid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2025) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2026) EXPORT_SYMBOL(security_secctx_to_secid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2027)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2028) void security_release_secctx(char *secdata, u32 seclen)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2029) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2030) call_void_hook(release_secctx, secdata, seclen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2031) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2032) EXPORT_SYMBOL(security_release_secctx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2033)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2034) void security_inode_invalidate_secctx(struct inode *inode)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2035) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2036) call_void_hook(inode_invalidate_secctx, inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2037) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2038) EXPORT_SYMBOL(security_inode_invalidate_secctx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2039)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2040) int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2041) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2042) return call_int_hook(inode_notifysecctx, 0, inode, ctx, ctxlen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2043) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2044) EXPORT_SYMBOL(security_inode_notifysecctx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2045)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2046) int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2047) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2048) return call_int_hook(inode_setsecctx, 0, dentry, ctx, ctxlen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2049) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2050) EXPORT_SYMBOL(security_inode_setsecctx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2051)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2052) int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2053) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2054) return call_int_hook(inode_getsecctx, -EOPNOTSUPP, inode, ctx, ctxlen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2055) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2056) EXPORT_SYMBOL(security_inode_getsecctx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2057)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2058) #ifdef CONFIG_WATCH_QUEUE
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2059) int security_post_notification(const struct cred *w_cred,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2060) const struct cred *cred,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2061) struct watch_notification *n)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2062) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2063) return call_int_hook(post_notification, 0, w_cred, cred, n);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2064) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2065) #endif /* CONFIG_WATCH_QUEUE */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2066)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2067) #ifdef CONFIG_KEY_NOTIFICATIONS
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2068) int security_watch_key(struct key *key)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2069) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2070) return call_int_hook(watch_key, 0, key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2071) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2072) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2073)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2074) #ifdef CONFIG_SECURITY_NETWORK
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2075)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2076) int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2077) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2078) return call_int_hook(unix_stream_connect, 0, sock, other, newsk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2079) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2080) EXPORT_SYMBOL(security_unix_stream_connect);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2081)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2082) int security_unix_may_send(struct socket *sock, struct socket *other)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2083) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2084) return call_int_hook(unix_may_send, 0, sock, other);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2085) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2086) EXPORT_SYMBOL(security_unix_may_send);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2087)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2088) int security_socket_create(int family, int type, int protocol, int kern)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2089) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2090) return call_int_hook(socket_create, 0, family, type, protocol, kern);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2091) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2092)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2093) int security_socket_post_create(struct socket *sock, int family,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2094) int type, int protocol, int kern)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2095) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2096) return call_int_hook(socket_post_create, 0, sock, family, type,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2097) protocol, kern);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2098) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2099)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2100) int security_socket_socketpair(struct socket *socka, struct socket *sockb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2101) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2102) return call_int_hook(socket_socketpair, 0, socka, sockb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2103) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2104) EXPORT_SYMBOL(security_socket_socketpair);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2105)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2106) int security_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2107) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2108) return call_int_hook(socket_bind, 0, sock, address, addrlen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2109) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2110)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2111) int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2112) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2113) return call_int_hook(socket_connect, 0, sock, address, addrlen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2114) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2115)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2116) int security_socket_listen(struct socket *sock, int backlog)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2117) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2118) return call_int_hook(socket_listen, 0, sock, backlog);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2119) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2120)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2121) int security_socket_accept(struct socket *sock, struct socket *newsock)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2122) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2123) return call_int_hook(socket_accept, 0, sock, newsock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2124) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2125)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2126) int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2127) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2128) return call_int_hook(socket_sendmsg, 0, sock, msg, size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2129) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2130)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2131) int security_socket_recvmsg(struct socket *sock, struct msghdr *msg,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2132) int size, int flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2133) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2134) return call_int_hook(socket_recvmsg, 0, sock, msg, size, flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2135) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2136)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2137) int security_socket_getsockname(struct socket *sock)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2138) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2139) return call_int_hook(socket_getsockname, 0, sock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2140) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2141)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2142) int security_socket_getpeername(struct socket *sock)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2143) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2144) return call_int_hook(socket_getpeername, 0, sock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2145) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2146)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2147) int security_socket_getsockopt(struct socket *sock, int level, int optname)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2148) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2149) return call_int_hook(socket_getsockopt, 0, sock, level, optname);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2150) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2151)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2152) int security_socket_setsockopt(struct socket *sock, int level, int optname)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2153) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2154) return call_int_hook(socket_setsockopt, 0, sock, level, optname);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2155) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2156)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2157) int security_socket_shutdown(struct socket *sock, int how)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2158) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2159) return call_int_hook(socket_shutdown, 0, sock, how);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2160) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2161)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2162) int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2163) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2164) return call_int_hook(socket_sock_rcv_skb, 0, sk, skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2165) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2166) EXPORT_SYMBOL(security_sock_rcv_skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2167)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2168) int security_socket_getpeersec_stream(struct socket *sock, char __user *optval,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2169) int __user *optlen, unsigned len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2170) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2171) return call_int_hook(socket_getpeersec_stream, -ENOPROTOOPT, sock,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2172) optval, optlen, len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2173) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2174)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2175) int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2176) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2177) return call_int_hook(socket_getpeersec_dgram, -ENOPROTOOPT, sock,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2178) skb, secid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2179) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2180) EXPORT_SYMBOL(security_socket_getpeersec_dgram);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2181)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2182) int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2183) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2184) return call_int_hook(sk_alloc_security, 0, sk, family, priority);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2185) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2186)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2187) void security_sk_free(struct sock *sk)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2188) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2189) call_void_hook(sk_free_security, sk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2190) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2191)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2192) void security_sk_clone(const struct sock *sk, struct sock *newsk)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2193) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2194) call_void_hook(sk_clone_security, sk, newsk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2195) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2196) EXPORT_SYMBOL(security_sk_clone);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2197)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2198) void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2199) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2200) call_void_hook(sk_getsecid, sk, &fl->flowi_secid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2201) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2202) EXPORT_SYMBOL(security_sk_classify_flow);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2203)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2204) void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2205) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2206) call_void_hook(req_classify_flow, req, fl);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2207) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2208) EXPORT_SYMBOL(security_req_classify_flow);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2209)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2210) void security_sock_graft(struct sock *sk, struct socket *parent)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2211) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2212) call_void_hook(sock_graft, sk, parent);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2213) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2214) EXPORT_SYMBOL(security_sock_graft);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2215)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2216) int security_inet_conn_request(struct sock *sk,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2217) struct sk_buff *skb, struct request_sock *req)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2218) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2219) return call_int_hook(inet_conn_request, 0, sk, skb, req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2220) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2221) EXPORT_SYMBOL(security_inet_conn_request);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2222)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2223) void security_inet_csk_clone(struct sock *newsk,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2224) const struct request_sock *req)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2225) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2226) call_void_hook(inet_csk_clone, newsk, req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2227) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2228)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2229) void security_inet_conn_established(struct sock *sk,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2230) struct sk_buff *skb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2231) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2232) call_void_hook(inet_conn_established, sk, skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2233) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2234) EXPORT_SYMBOL(security_inet_conn_established);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2235)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2236) int security_secmark_relabel_packet(u32 secid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2237) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2238) return call_int_hook(secmark_relabel_packet, 0, secid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2239) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2240) EXPORT_SYMBOL(security_secmark_relabel_packet);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2241)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2242) void security_secmark_refcount_inc(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2243) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2244) call_void_hook(secmark_refcount_inc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2245) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2246) EXPORT_SYMBOL(security_secmark_refcount_inc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2247)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2248) void security_secmark_refcount_dec(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2249) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2250) call_void_hook(secmark_refcount_dec);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2251) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2252) EXPORT_SYMBOL(security_secmark_refcount_dec);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2253)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2254) int security_tun_dev_alloc_security(void **security)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2255) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2256) return call_int_hook(tun_dev_alloc_security, 0, security);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2257) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2258) EXPORT_SYMBOL(security_tun_dev_alloc_security);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2259)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2260) void security_tun_dev_free_security(void *security)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2261) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2262) call_void_hook(tun_dev_free_security, security);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2263) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2264) EXPORT_SYMBOL(security_tun_dev_free_security);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2265)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2266) int security_tun_dev_create(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2267) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2268) return call_int_hook(tun_dev_create, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2269) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2270) EXPORT_SYMBOL(security_tun_dev_create);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2271)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2272) int security_tun_dev_attach_queue(void *security)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2273) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2274) return call_int_hook(tun_dev_attach_queue, 0, security);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2275) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2276) EXPORT_SYMBOL(security_tun_dev_attach_queue);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2277)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2278) int security_tun_dev_attach(struct sock *sk, void *security)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2279) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2280) return call_int_hook(tun_dev_attach, 0, sk, security);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2281) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2282) EXPORT_SYMBOL(security_tun_dev_attach);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2283)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2284) int security_tun_dev_open(void *security)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2285) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2286) return call_int_hook(tun_dev_open, 0, security);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2287) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2288) EXPORT_SYMBOL(security_tun_dev_open);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2289)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2290) int security_sctp_assoc_request(struct sctp_endpoint *ep, struct sk_buff *skb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2291) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2292) return call_int_hook(sctp_assoc_request, 0, ep, skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2293) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2294) EXPORT_SYMBOL(security_sctp_assoc_request);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2295)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2296) int security_sctp_bind_connect(struct sock *sk, int optname,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2297) struct sockaddr *address, int addrlen)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2298) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2299) return call_int_hook(sctp_bind_connect, 0, sk, optname,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2300) address, addrlen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2301) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2302) EXPORT_SYMBOL(security_sctp_bind_connect);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2303)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2304) void security_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2305) struct sock *newsk)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2306) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2307) call_void_hook(sctp_sk_clone, ep, sk, newsk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2308) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2309) EXPORT_SYMBOL(security_sctp_sk_clone);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2310)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2311) #endif /* CONFIG_SECURITY_NETWORK */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2312)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2313) #ifdef CONFIG_SECURITY_INFINIBAND
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2314)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2315) int security_ib_pkey_access(void *sec, u64 subnet_prefix, u16 pkey)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2316) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2317) return call_int_hook(ib_pkey_access, 0, sec, subnet_prefix, pkey);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2318) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2319) EXPORT_SYMBOL(security_ib_pkey_access);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2320)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2321) int security_ib_endport_manage_subnet(void *sec, const char *dev_name, u8 port_num)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2322) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2323) return call_int_hook(ib_endport_manage_subnet, 0, sec, dev_name, port_num);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2324) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2325) EXPORT_SYMBOL(security_ib_endport_manage_subnet);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2326)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2327) int security_ib_alloc_security(void **sec)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2328) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2329) return call_int_hook(ib_alloc_security, 0, sec);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2330) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2331) EXPORT_SYMBOL(security_ib_alloc_security);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2332)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2333) void security_ib_free_security(void *sec)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2334) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2335) call_void_hook(ib_free_security, sec);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2336) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2337) EXPORT_SYMBOL(security_ib_free_security);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2338) #endif /* CONFIG_SECURITY_INFINIBAND */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2339)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2340) #ifdef CONFIG_SECURITY_NETWORK_XFRM
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2341)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2342) int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2343) struct xfrm_user_sec_ctx *sec_ctx,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2344) gfp_t gfp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2345) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2346) return call_int_hook(xfrm_policy_alloc_security, 0, ctxp, sec_ctx, gfp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2347) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2348) EXPORT_SYMBOL(security_xfrm_policy_alloc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2349)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2350) int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2351) struct xfrm_sec_ctx **new_ctxp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2352) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2353) return call_int_hook(xfrm_policy_clone_security, 0, old_ctx, new_ctxp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2354) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2355)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2356) void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2357) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2358) call_void_hook(xfrm_policy_free_security, ctx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2359) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2360) EXPORT_SYMBOL(security_xfrm_policy_free);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2361)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2362) int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2363) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2364) return call_int_hook(xfrm_policy_delete_security, 0, ctx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2365) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2366)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2367) int security_xfrm_state_alloc(struct xfrm_state *x,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2368) struct xfrm_user_sec_ctx *sec_ctx)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2369) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2370) return call_int_hook(xfrm_state_alloc, 0, x, sec_ctx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2371) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2372) EXPORT_SYMBOL(security_xfrm_state_alloc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2373)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2374) int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2375) struct xfrm_sec_ctx *polsec, u32 secid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2376) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2377) return call_int_hook(xfrm_state_alloc_acquire, 0, x, polsec, secid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2378) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2379)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2380) int security_xfrm_state_delete(struct xfrm_state *x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2381) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2382) return call_int_hook(xfrm_state_delete_security, 0, x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2383) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2384) EXPORT_SYMBOL(security_xfrm_state_delete);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2385)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2386) void security_xfrm_state_free(struct xfrm_state *x)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2387) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2388) call_void_hook(xfrm_state_free_security, x);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2389) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2390)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2391) int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2392) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2393) return call_int_hook(xfrm_policy_lookup, 0, ctx, fl_secid, dir);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2394) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2395)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2396) int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2397) struct xfrm_policy *xp,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2398) const struct flowi *fl)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2399) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2400) struct security_hook_list *hp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2401) int rc = LSM_RET_DEFAULT(xfrm_state_pol_flow_match);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2402)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2403) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2404) * Since this function is expected to return 0 or 1, the judgment
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2405) * becomes difficult if multiple LSMs supply this call. Fortunately,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2406) * we can use the first LSM's judgment because currently only SELinux
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2407) * supplies this call.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2408) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2409) * For speed optimization, we explicitly break the loop rather than
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2410) * using the macro
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2411) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2412) hlist_for_each_entry(hp, &security_hook_heads.xfrm_state_pol_flow_match,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2413) list) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2414) rc = hp->hook.xfrm_state_pol_flow_match(x, xp, fl);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2415) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2416) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2417) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2418) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2419)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2420) int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2421) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2422) return call_int_hook(xfrm_decode_session, 0, skb, secid, 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2423) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2424)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2425) void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2426) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2427) int rc = call_int_hook(xfrm_decode_session, 0, skb, &fl->flowi_secid,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2428) 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2429)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2430) BUG_ON(rc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2431) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2432) EXPORT_SYMBOL(security_skb_classify_flow);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2433)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2434) #endif /* CONFIG_SECURITY_NETWORK_XFRM */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2435)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2436) #ifdef CONFIG_KEYS
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2437)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2438) int security_key_alloc(struct key *key, const struct cred *cred,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2439) unsigned long flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2440) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2441) return call_int_hook(key_alloc, 0, key, cred, flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2442) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2443)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2444) void security_key_free(struct key *key)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2445) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2446) call_void_hook(key_free, key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2447) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2448)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2449) int security_key_permission(key_ref_t key_ref, const struct cred *cred,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2450) enum key_need_perm need_perm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2451) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2452) return call_int_hook(key_permission, 0, key_ref, cred, need_perm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2453) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2454)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2455) int security_key_getsecurity(struct key *key, char **_buffer)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2456) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2457) *_buffer = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2458) return call_int_hook(key_getsecurity, 0, key, _buffer);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2459) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2460)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2461) #endif /* CONFIG_KEYS */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2462)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2463) #ifdef CONFIG_AUDIT
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2464)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2465) int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2466) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2467) return call_int_hook(audit_rule_init, 0, field, op, rulestr, lsmrule);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2468) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2469)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2470) int security_audit_rule_known(struct audit_krule *krule)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2471) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2472) return call_int_hook(audit_rule_known, 0, krule);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2473) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2474)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2475) void security_audit_rule_free(void *lsmrule)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2476) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2477) call_void_hook(audit_rule_free, lsmrule);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2478) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2479)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2480) int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2481) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2482) return call_int_hook(audit_rule_match, 0, secid, field, op, lsmrule);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2483) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2484) #endif /* CONFIG_AUDIT */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2485)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2486) #ifdef CONFIG_BPF_SYSCALL
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2487) int security_bpf(int cmd, union bpf_attr *attr, unsigned int size)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2488) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2489) return call_int_hook(bpf, 0, cmd, attr, size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2490) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2491) int security_bpf_map(struct bpf_map *map, fmode_t fmode)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2492) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2493) return call_int_hook(bpf_map, 0, map, fmode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2494) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2495) int security_bpf_prog(struct bpf_prog *prog)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2496) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2497) return call_int_hook(bpf_prog, 0, prog);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2498) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2499) int security_bpf_map_alloc(struct bpf_map *map)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2500) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2501) return call_int_hook(bpf_map_alloc_security, 0, map);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2502) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2503) int security_bpf_prog_alloc(struct bpf_prog_aux *aux)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2504) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2505) return call_int_hook(bpf_prog_alloc_security, 0, aux);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2506) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2507) void security_bpf_map_free(struct bpf_map *map)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2508) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2509) call_void_hook(bpf_map_free_security, map);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2510) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2511) void security_bpf_prog_free(struct bpf_prog_aux *aux)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2512) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2513) call_void_hook(bpf_prog_free_security, aux);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2514) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2515) #endif /* CONFIG_BPF_SYSCALL */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2516)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2517) int security_locked_down(enum lockdown_reason what)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2518) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2519) return call_int_hook(locked_down, 0, what);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2520) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2521) EXPORT_SYMBOL(security_locked_down);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2522)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2523) #ifdef CONFIG_PERF_EVENTS
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2524) int security_perf_event_open(struct perf_event_attr *attr, int type)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2525) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2526) return call_int_hook(perf_event_open, 0, attr, type);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2527) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2528)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2529) int security_perf_event_alloc(struct perf_event *event)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2530) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2531) return call_int_hook(perf_event_alloc, 0, event);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2532) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2533)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2534) void security_perf_event_free(struct perf_event *event)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2535) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2536) call_void_hook(perf_event_free, event);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2537) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2538)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2539) int security_perf_event_read(struct perf_event *event)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2540) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2541) return call_int_hook(perf_event_read, 0, event);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2542) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2543)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2544) int security_perf_event_write(struct perf_event *event)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2545) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2546) return call_int_hook(perf_event_write, 0, event);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2547) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2548) #endif /* CONFIG_PERF_EVENTS */
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags