1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * Security plug functions
4  *
5  * Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com>
6  * Copyright (C) 2001-2002 Greg Kroah-Hartman <greg@kroah.com>
7  * Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com>
8  * Copyright (C) 2016 Mellanox Technologies
9  * Copyright (C) 2023 Microsoft Corporation <paul@paul-moore.com>
10  */
11 
12 #define pr_fmt(fmt) "LSM: " fmt
13 
14 #include <linux/bpf.h>
15 #include <linux/capability.h>
16 #include <linux/dcache.h>
17 #include <linux/export.h>
18 #include <linux/init.h>
19 #include <linux/kernel.h>
20 #include <linux/kernel_read_file.h>
21 #include <linux/lsm_hooks.h>
22 #include <linux/integrity.h>
23 #include <linux/ima.h>
24 #include <linux/evm.h>
25 #include <linux/fsnotify.h>
26 #include <linux/mman.h>
27 #include <linux/mount.h>
28 #include <linux/personality.h>
29 #include <linux/backing-dev.h>
30 #include <linux/string.h>
31 #include <linux/msg.h>
32 #include <net/flow.h>
33 
34 /* How many LSMs were built into the kernel? */
35 #define LSM_COUNT (__end_lsm_info - __start_lsm_info)
36 
37 /*
38  * These are descriptions of the reasons that can be passed to the
39  * security_locked_down() LSM hook. Placing this array here allows
40  * all security modules to use the same descriptions for auditing
41  * purposes.
42  */
43 const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX + 1] = {
44 	[LOCKDOWN_NONE] = "none",
45 	[LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading",
46 	[LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port",
47 	[LOCKDOWN_EFI_TEST] = "/dev/efi_test access",
48 	[LOCKDOWN_KEXEC] = "kexec of unsigned images",
49 	[LOCKDOWN_HIBERNATION] = "hibernation",
50 	[LOCKDOWN_PCI_ACCESS] = "direct PCI access",
51 	[LOCKDOWN_IOPORT] = "raw io port access",
52 	[LOCKDOWN_MSR] = "raw MSR access",
53 	[LOCKDOWN_ACPI_TABLES] = "modifying ACPI tables",
54 	[LOCKDOWN_DEVICE_TREE] = "modifying device tree contents",
55 	[LOCKDOWN_PCMCIA_CIS] = "direct PCMCIA CIS storage",
56 	[LOCKDOWN_TIOCSSERIAL] = "reconfiguration of serial port IO",
57 	[LOCKDOWN_MODULE_PARAMETERS] = "unsafe module parameters",
58 	[LOCKDOWN_MMIOTRACE] = "unsafe mmio",
59 	[LOCKDOWN_DEBUGFS] = "debugfs access",
60 	[LOCKDOWN_XMON_WR] = "xmon write access",
61 	[LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM",
62 	[LOCKDOWN_DBG_WRITE_KERNEL] = "use of kgdb/kdb to write kernel RAM",
63 	[LOCKDOWN_RTAS_ERROR_INJECTION] = "RTAS error injection",
64 	[LOCKDOWN_INTEGRITY_MAX] = "integrity",
65 	[LOCKDOWN_KCORE] = "/proc/kcore access",
66 	[LOCKDOWN_KPROBES] = "use of kprobes",
67 	[LOCKDOWN_BPF_READ_KERNEL] = "use of bpf to read kernel RAM",
68 	[LOCKDOWN_DBG_READ_KERNEL] = "use of kgdb/kdb to read kernel RAM",
69 	[LOCKDOWN_PERF] = "unsafe use of perf",
70 	[LOCKDOWN_TRACEFS] = "use of tracefs",
71 	[LOCKDOWN_XMON_RW] = "xmon read and write access",
72 	[LOCKDOWN_XFRM_SECRET] = "xfrm SA secret",
73 	[LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality",
74 };
75 
76 struct security_hook_heads security_hook_heads __ro_after_init;
77 static BLOCKING_NOTIFIER_HEAD(blocking_lsm_notifier_chain);
78 
79 static struct kmem_cache *lsm_file_cache;
80 static struct kmem_cache *lsm_inode_cache;
81 
82 char *lsm_names;
83 static struct lsm_blob_sizes blob_sizes __ro_after_init;
84 
85 /* Boot-time LSM user choice */
86 static __initdata const char *chosen_lsm_order;
87 static __initdata const char *chosen_major_lsm;
88 
89 static __initconst const char *const builtin_lsm_order = CONFIG_LSM;
90 
91 /* Ordered list of LSMs to initialize. */
92 static __initdata struct lsm_info **ordered_lsms;
93 static __initdata struct lsm_info *exclusive;
94 
95 static __initdata bool debug;
96 #define init_debug(...)						\
97 	do {							\
98 		if (debug)					\
99 			pr_info(__VA_ARGS__);			\
100 	} while (0)
101 
is_enabled(struct lsm_info * lsm)102 static bool __init is_enabled(struct lsm_info *lsm)
103 {
104 	if (!lsm->enabled)
105 		return false;
106 
107 	return *lsm->enabled;
108 }
109 
110 /* Mark an LSM's enabled flag. */
111 static int lsm_enabled_true __initdata = 1;
112 static int lsm_enabled_false __initdata = 0;
set_enabled(struct lsm_info * lsm,bool enabled)113 static void __init set_enabled(struct lsm_info *lsm, bool enabled)
114 {
115 	/*
116 	 * When an LSM hasn't configured an enable variable, we can use
117 	 * a hard-coded location for storing the default enabled state.
118 	 */
119 	if (!lsm->enabled) {
120 		if (enabled)
121 			lsm->enabled = &lsm_enabled_true;
122 		else
123 			lsm->enabled = &lsm_enabled_false;
124 	} else if (lsm->enabled == &lsm_enabled_true) {
125 		if (!enabled)
126 			lsm->enabled = &lsm_enabled_false;
127 	} else if (lsm->enabled == &lsm_enabled_false) {
128 		if (enabled)
129 			lsm->enabled = &lsm_enabled_true;
130 	} else {
131 		*lsm->enabled = enabled;
132 	}
133 }
134 
135 /* Is an LSM already listed in the ordered LSMs list? */
exists_ordered_lsm(struct lsm_info * lsm)136 static bool __init exists_ordered_lsm(struct lsm_info *lsm)
137 {
138 	struct lsm_info **check;
139 
140 	for (check = ordered_lsms; *check; check++)
141 		if (*check == lsm)
142 			return true;
143 
144 	return false;
145 }
146 
147 /* Append an LSM to the list of ordered LSMs to initialize. */
148 static int last_lsm __initdata;
append_ordered_lsm(struct lsm_info * lsm,const char * from)149 static void __init append_ordered_lsm(struct lsm_info *lsm, const char *from)
150 {
151 	/* Ignore duplicate selections. */
152 	if (exists_ordered_lsm(lsm))
153 		return;
154 
155 	if (WARN(last_lsm == LSM_COUNT, "%s: out of LSM slots!?\n", from))
156 		return;
157 
158 	/* Enable this LSM, if it is not already set. */
159 	if (!lsm->enabled)
160 		lsm->enabled = &lsm_enabled_true;
161 	ordered_lsms[last_lsm++] = lsm;
162 
163 	init_debug("%s ordered: %s (%s)\n", from, lsm->name,
164 		   is_enabled(lsm) ? "enabled" : "disabled");
165 }
166 
167 /* Is an LSM allowed to be initialized? */
lsm_allowed(struct lsm_info * lsm)168 static bool __init lsm_allowed(struct lsm_info *lsm)
169 {
170 	/* Skip if the LSM is disabled. */
171 	if (!is_enabled(lsm))
172 		return false;
173 
174 	/* Not allowed if another exclusive LSM already initialized. */
175 	if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && exclusive) {
176 		init_debug("exclusive disabled: %s\n", lsm->name);
177 		return false;
178 	}
179 
180 	return true;
181 }
182 
lsm_set_blob_size(int * need,int * lbs)183 static void __init lsm_set_blob_size(int *need, int *lbs)
184 {
185 	int offset;
186 
187 	if (*need <= 0)
188 		return;
189 
190 	offset = ALIGN(*lbs, sizeof(void *));
191 	*lbs = offset + *need;
192 	*need = offset;
193 }
194 
lsm_set_blob_sizes(struct lsm_blob_sizes * needed)195 static void __init lsm_set_blob_sizes(struct lsm_blob_sizes *needed)
196 {
197 	if (!needed)
198 		return;
199 
200 	lsm_set_blob_size(&needed->lbs_cred, &blob_sizes.lbs_cred);
201 	lsm_set_blob_size(&needed->lbs_file, &blob_sizes.lbs_file);
202 	/*
203 	 * The inode blob gets an rcu_head in addition to
204 	 * what the modules might need.
205 	 */
206 	if (needed->lbs_inode && blob_sizes.lbs_inode == 0)
207 		blob_sizes.lbs_inode = sizeof(struct rcu_head);
208 	lsm_set_blob_size(&needed->lbs_inode, &blob_sizes.lbs_inode);
209 	lsm_set_blob_size(&needed->lbs_ipc, &blob_sizes.lbs_ipc);
210 	lsm_set_blob_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg);
211 	lsm_set_blob_size(&needed->lbs_superblock, &blob_sizes.lbs_superblock);
212 	lsm_set_blob_size(&needed->lbs_task, &blob_sizes.lbs_task);
213 	lsm_set_blob_size(&needed->lbs_xattr_count,
214 			  &blob_sizes.lbs_xattr_count);
215 }
216 
217 /* Prepare LSM for initialization. */
prepare_lsm(struct lsm_info * lsm)218 static void __init prepare_lsm(struct lsm_info *lsm)
219 {
220 	int enabled = lsm_allowed(lsm);
221 
222 	/* Record enablement (to handle any following exclusive LSMs). */
223 	set_enabled(lsm, enabled);
224 
225 	/* If enabled, do pre-initialization work. */
226 	if (enabled) {
227 		if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && !exclusive) {
228 			exclusive = lsm;
229 			init_debug("exclusive chosen:   %s\n", lsm->name);
230 		}
231 
232 		lsm_set_blob_sizes(lsm->blobs);
233 	}
234 }
235 
236 /* Initialize a given LSM, if it is enabled. */
initialize_lsm(struct lsm_info * lsm)237 static void __init initialize_lsm(struct lsm_info *lsm)
238 {
239 	if (is_enabled(lsm)) {
240 		int ret;
241 
242 		init_debug("initializing %s\n", lsm->name);
243 		ret = lsm->init();
244 		WARN(ret, "%s failed to initialize: %d\n", lsm->name, ret);
245 	}
246 }
247 
248 /* Populate ordered LSMs list from comma-separated LSM name list. */
ordered_lsm_parse(const char * order,const char * origin)249 static void __init ordered_lsm_parse(const char *order, const char *origin)
250 {
251 	struct lsm_info *lsm;
252 	char *sep, *name, *next;
253 
254 	/* LSM_ORDER_FIRST is always first. */
255 	for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
256 		if (lsm->order == LSM_ORDER_FIRST)
257 			append_ordered_lsm(lsm, "  first");
258 	}
259 
260 	/* Process "security=", if given. */
261 	if (chosen_major_lsm) {
262 		struct lsm_info *major;
263 
264 		/*
265 		 * To match the original "security=" behavior, this
266 		 * explicitly does NOT fallback to another Legacy Major
267 		 * if the selected one was separately disabled: disable
268 		 * all non-matching Legacy Major LSMs.
269 		 */
270 		for (major = __start_lsm_info; major < __end_lsm_info;
271 		     major++) {
272 			if ((major->flags & LSM_FLAG_LEGACY_MAJOR) &&
273 			    strcmp(major->name, chosen_major_lsm) != 0) {
274 				set_enabled(major, false);
275 				init_debug("security=%s disabled: %s (only one legacy major LSM)\n",
276 					   chosen_major_lsm, major->name);
277 			}
278 		}
279 	}
280 
281 	sep = kstrdup(order, GFP_KERNEL);
282 	next = sep;
283 	/* Walk the list, looking for matching LSMs. */
284 	while ((name = strsep(&next, ",")) != NULL) {
285 		bool found = false;
286 
287 		for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
288 			if (strcmp(lsm->name, name) == 0) {
289 				if (lsm->order == LSM_ORDER_MUTABLE)
290 					append_ordered_lsm(lsm, origin);
291 				found = true;
292 			}
293 		}
294 
295 		if (!found)
296 			init_debug("%s ignored: %s (not built into kernel)\n",
297 				   origin, name);
298 	}
299 
300 	/* Process "security=", if given. */
301 	if (chosen_major_lsm) {
302 		for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
303 			if (exists_ordered_lsm(lsm))
304 				continue;
305 			if (strcmp(lsm->name, chosen_major_lsm) == 0)
306 				append_ordered_lsm(lsm, "security=");
307 		}
308 	}
309 
310 	/* LSM_ORDER_LAST is always last. */
311 	for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
312 		if (lsm->order == LSM_ORDER_LAST)
313 			append_ordered_lsm(lsm, "   last");
314 	}
315 
316 	/* Disable all LSMs not in the ordered list. */
317 	for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
318 		if (exists_ordered_lsm(lsm))
319 			continue;
320 		set_enabled(lsm, false);
321 		init_debug("%s skipped: %s (not in requested order)\n",
322 			   origin, lsm->name);
323 	}
324 
325 	kfree(sep);
326 }
327 
328 static void __init lsm_early_cred(struct cred *cred);
329 static void __init lsm_early_task(struct task_struct *task);
330 
331 static int lsm_append(const char *new, char **result);
332 
report_lsm_order(void)333 static void __init report_lsm_order(void)
334 {
335 	struct lsm_info **lsm, *early;
336 	int first = 0;
337 
338 	pr_info("initializing lsm=");
339 
340 	/* Report each enabled LSM name, comma separated. */
341 	for (early = __start_early_lsm_info;
342 	     early < __end_early_lsm_info; early++)
343 		if (is_enabled(early))
344 			pr_cont("%s%s", first++ == 0 ? "" : ",", early->name);
345 	for (lsm = ordered_lsms; *lsm; lsm++)
346 		if (is_enabled(*lsm))
347 			pr_cont("%s%s", first++ == 0 ? "" : ",", (*lsm)->name);
348 
349 	pr_cont("\n");
350 }
351 
ordered_lsm_init(void)352 static void __init ordered_lsm_init(void)
353 {
354 	struct lsm_info **lsm;
355 
356 	ordered_lsms = kcalloc(LSM_COUNT + 1, sizeof(*ordered_lsms),
357 			       GFP_KERNEL);
358 
359 	if (chosen_lsm_order) {
360 		if (chosen_major_lsm) {
361 			pr_warn("security=%s is ignored because it is superseded by lsm=%s\n",
362 				chosen_major_lsm, chosen_lsm_order);
363 			chosen_major_lsm = NULL;
364 		}
365 		ordered_lsm_parse(chosen_lsm_order, "cmdline");
366 	} else
367 		ordered_lsm_parse(builtin_lsm_order, "builtin");
368 
369 	for (lsm = ordered_lsms; *lsm; lsm++)
370 		prepare_lsm(*lsm);
371 
372 	report_lsm_order();
373 
374 	init_debug("cred blob size       = %d\n", blob_sizes.lbs_cred);
375 	init_debug("file blob size       = %d\n", blob_sizes.lbs_file);
376 	init_debug("inode blob size      = %d\n", blob_sizes.lbs_inode);
377 	init_debug("ipc blob size        = %d\n", blob_sizes.lbs_ipc);
378 	init_debug("msg_msg blob size    = %d\n", blob_sizes.lbs_msg_msg);
379 	init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock);
380 	init_debug("task blob size       = %d\n", blob_sizes.lbs_task);
381 	init_debug("xattr slots          = %d\n", blob_sizes.lbs_xattr_count);
382 
383 	/*
384 	 * Create any kmem_caches needed for blobs
385 	 */
386 	if (blob_sizes.lbs_file)
387 		lsm_file_cache = kmem_cache_create("lsm_file_cache",
388 						   blob_sizes.lbs_file, 0,
389 						   SLAB_PANIC, NULL);
390 	if (blob_sizes.lbs_inode)
391 		lsm_inode_cache = kmem_cache_create("lsm_inode_cache",
392 						    blob_sizes.lbs_inode, 0,
393 						    SLAB_PANIC, NULL);
394 
395 	lsm_early_cred((struct cred *) current->cred);
396 	lsm_early_task(current);
397 	for (lsm = ordered_lsms; *lsm; lsm++)
398 		initialize_lsm(*lsm);
399 
400 	kfree(ordered_lsms);
401 }
402 
early_security_init(void)403 int __init early_security_init(void)
404 {
405 	struct lsm_info *lsm;
406 
407 #define LSM_HOOK(RET, DEFAULT, NAME, ...) \
408 	INIT_HLIST_HEAD(&security_hook_heads.NAME);
409 #include "linux/lsm_hook_defs.h"
410 #undef LSM_HOOK
411 
412 	for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) {
413 		if (!lsm->enabled)
414 			lsm->enabled = &lsm_enabled_true;
415 		prepare_lsm(lsm);
416 		initialize_lsm(lsm);
417 	}
418 
419 	return 0;
420 }
421 
422 /**
423  * security_init - initializes the security framework
424  *
425  * This should be called early in the kernel initialization sequence.
426  */
security_init(void)427 int __init security_init(void)
428 {
429 	struct lsm_info *lsm;
430 
431 	init_debug("legacy security=%s\n", chosen_major_lsm ? : " *unspecified*");
432 	init_debug("  CONFIG_LSM=%s\n", builtin_lsm_order);
433 	init_debug("boot arg lsm=%s\n", chosen_lsm_order ? : " *unspecified*");
434 
435 	/*
436 	 * Append the names of the early LSM modules now that kmalloc() is
437 	 * available
438 	 */
439 	for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) {
440 		init_debug("  early started: %s (%s)\n", lsm->name,
441 			   is_enabled(lsm) ? "enabled" : "disabled");
442 		if (lsm->enabled)
443 			lsm_append(lsm->name, &lsm_names);
444 	}
445 
446 	/* Load LSMs in specified order. */
447 	ordered_lsm_init();
448 
449 	return 0;
450 }
451 
452 /* Save user chosen LSM */
choose_major_lsm(char * str)453 static int __init choose_major_lsm(char *str)
454 {
455 	chosen_major_lsm = str;
456 	return 1;
457 }
458 __setup("security=", choose_major_lsm);
459 
460 /* Explicitly choose LSM initialization order. */
choose_lsm_order(char * str)461 static int __init choose_lsm_order(char *str)
462 {
463 	chosen_lsm_order = str;
464 	return 1;
465 }
466 __setup("lsm=", choose_lsm_order);
467 
468 /* Enable LSM order debugging. */
enable_debug(char * str)469 static int __init enable_debug(char *str)
470 {
471 	debug = true;
472 	return 1;
473 }
474 __setup("lsm.debug", enable_debug);
475 
match_last_lsm(const char * list,const char * lsm)476 static bool match_last_lsm(const char *list, const char *lsm)
477 {
478 	const char *last;
479 
480 	if (WARN_ON(!list || !lsm))
481 		return false;
482 	last = strrchr(list, ',');
483 	if (last)
484 		/* Pass the comma, strcmp() will check for '\0' */
485 		last++;
486 	else
487 		last = list;
488 	return !strcmp(last, lsm);
489 }
490 
lsm_append(const char * new,char ** result)491 static int lsm_append(const char *new, char **result)
492 {
493 	char *cp;
494 
495 	if (*result == NULL) {
496 		*result = kstrdup(new, GFP_KERNEL);
497 		if (*result == NULL)
498 			return -ENOMEM;
499 	} else {
500 		/* Check if it is the last registered name */
501 		if (match_last_lsm(*result, new))
502 			return 0;
503 		cp = kasprintf(GFP_KERNEL, "%s,%s", *result, new);
504 		if (cp == NULL)
505 			return -ENOMEM;
506 		kfree(*result);
507 		*result = cp;
508 	}
509 	return 0;
510 }
511 
512 /**
513  * security_add_hooks - Add a modules hooks to the hook lists.
514  * @hooks: the hooks to add
515  * @count: the number of hooks to add
516  * @lsm: the name of the security module
517  *
518  * Each LSM has to register its hooks with the infrastructure.
519  */
security_add_hooks(struct security_hook_list * hooks,int count,const char * lsm)520 void __init security_add_hooks(struct security_hook_list *hooks, int count,
521 			       const char *lsm)
522 {
523 	int i;
524 
525 	for (i = 0; i < count; i++) {
526 		hooks[i].lsm = lsm;
527 		hlist_add_tail_rcu(&hooks[i].list, hooks[i].head);
528 	}
529 
530 	/*
531 	 * Don't try to append during early_security_init(), we'll come back
532 	 * and fix this up afterwards.
533 	 */
534 	if (slab_is_available()) {
535 		if (lsm_append(lsm, &lsm_names) < 0)
536 			panic("%s - Cannot get early memory.\n", __func__);
537 	}
538 }
539 
call_blocking_lsm_notifier(enum lsm_event event,void * data)540 int call_blocking_lsm_notifier(enum lsm_event event, void *data)
541 {
542 	return blocking_notifier_call_chain(&blocking_lsm_notifier_chain,
543 					    event, data);
544 }
545 EXPORT_SYMBOL(call_blocking_lsm_notifier);
546 
register_blocking_lsm_notifier(struct notifier_block * nb)547 int register_blocking_lsm_notifier(struct notifier_block *nb)
548 {
549 	return blocking_notifier_chain_register(&blocking_lsm_notifier_chain,
550 						nb);
551 }
552 EXPORT_SYMBOL(register_blocking_lsm_notifier);
553 
unregister_blocking_lsm_notifier(struct notifier_block * nb)554 int unregister_blocking_lsm_notifier(struct notifier_block *nb)
555 {
556 	return blocking_notifier_chain_unregister(&blocking_lsm_notifier_chain,
557 						  nb);
558 }
559 EXPORT_SYMBOL(unregister_blocking_lsm_notifier);
560 
561 /**
562  * lsm_cred_alloc - allocate a composite cred blob
563  * @cred: the cred that needs a blob
564  * @gfp: allocation type
565  *
566  * Allocate the cred blob for all the modules
567  *
568  * Returns 0, or -ENOMEM if memory can't be allocated.
569  */
lsm_cred_alloc(struct cred * cred,gfp_t gfp)570 static int lsm_cred_alloc(struct cred *cred, gfp_t gfp)
571 {
572 	if (blob_sizes.lbs_cred == 0) {
573 		cred->security = NULL;
574 		return 0;
575 	}
576 
577 	cred->security = kzalloc(blob_sizes.lbs_cred, gfp);
578 	if (cred->security == NULL)
579 		return -ENOMEM;
580 	return 0;
581 }
582 
583 /**
584  * lsm_early_cred - during initialization allocate a composite cred blob
585  * @cred: the cred that needs a blob
586  *
587  * Allocate the cred blob for all the modules
588  */
lsm_early_cred(struct cred * cred)589 static void __init lsm_early_cred(struct cred *cred)
590 {
591 	int rc = lsm_cred_alloc(cred, GFP_KERNEL);
592 
593 	if (rc)
594 		panic("%s: Early cred alloc failed.\n", __func__);
595 }
596 
597 /**
598  * lsm_file_alloc - allocate a composite file blob
599  * @file: the file that needs a blob
600  *
601  * Allocate the file blob for all the modules
602  *
603  * Returns 0, or -ENOMEM if memory can't be allocated.
604  */
lsm_file_alloc(struct file * file)605 static int lsm_file_alloc(struct file *file)
606 {
607 	if (!lsm_file_cache) {
608 		file->f_security = NULL;
609 		return 0;
610 	}
611 
612 	file->f_security = kmem_cache_zalloc(lsm_file_cache, GFP_KERNEL);
613 	if (file->f_security == NULL)
614 		return -ENOMEM;
615 	return 0;
616 }
617 
618 /**
619  * lsm_inode_alloc - allocate a composite inode blob
620  * @inode: the inode that needs a blob
621  *
622  * Allocate the inode blob for all the modules
623  *
624  * Returns 0, or -ENOMEM if memory can't be allocated.
625  */
lsm_inode_alloc(struct inode * inode)626 int lsm_inode_alloc(struct inode *inode)
627 {
628 	if (!lsm_inode_cache) {
629 		inode->i_security = NULL;
630 		return 0;
631 	}
632 
633 	inode->i_security = kmem_cache_zalloc(lsm_inode_cache, GFP_NOFS);
634 	if (inode->i_security == NULL)
635 		return -ENOMEM;
636 	return 0;
637 }
638 
639 /**
640  * lsm_task_alloc - allocate a composite task blob
641  * @task: the task that needs a blob
642  *
643  * Allocate the task blob for all the modules
644  *
645  * Returns 0, or -ENOMEM if memory can't be allocated.
646  */
lsm_task_alloc(struct task_struct * task)647 static int lsm_task_alloc(struct task_struct *task)
648 {
649 	if (blob_sizes.lbs_task == 0) {
650 		task->security = NULL;
651 		return 0;
652 	}
653 
654 	task->security = kzalloc(blob_sizes.lbs_task, GFP_KERNEL);
655 	if (task->security == NULL)
656 		return -ENOMEM;
657 	return 0;
658 }
659 
660 /**
661  * lsm_ipc_alloc - allocate a composite ipc blob
662  * @kip: the ipc that needs a blob
663  *
664  * Allocate the ipc blob for all the modules
665  *
666  * Returns 0, or -ENOMEM if memory can't be allocated.
667  */
lsm_ipc_alloc(struct kern_ipc_perm * kip)668 static int lsm_ipc_alloc(struct kern_ipc_perm *kip)
669 {
670 	if (blob_sizes.lbs_ipc == 0) {
671 		kip->security = NULL;
672 		return 0;
673 	}
674 
675 	kip->security = kzalloc(blob_sizes.lbs_ipc, GFP_KERNEL);
676 	if (kip->security == NULL)
677 		return -ENOMEM;
678 	return 0;
679 }
680 
681 /**
682  * lsm_msg_msg_alloc - allocate a composite msg_msg blob
683  * @mp: the msg_msg that needs a blob
684  *
685  * Allocate the ipc blob for all the modules
686  *
687  * Returns 0, or -ENOMEM if memory can't be allocated.
688  */
lsm_msg_msg_alloc(struct msg_msg * mp)689 static int lsm_msg_msg_alloc(struct msg_msg *mp)
690 {
691 	if (blob_sizes.lbs_msg_msg == 0) {
692 		mp->security = NULL;
693 		return 0;
694 	}
695 
696 	mp->security = kzalloc(blob_sizes.lbs_msg_msg, GFP_KERNEL);
697 	if (mp->security == NULL)
698 		return -ENOMEM;
699 	return 0;
700 }
701 
702 /**
703  * lsm_early_task - during initialization allocate a composite task blob
704  * @task: the task that needs a blob
705  *
706  * Allocate the task blob for all the modules
707  */
lsm_early_task(struct task_struct * task)708 static void __init lsm_early_task(struct task_struct *task)
709 {
710 	int rc = lsm_task_alloc(task);
711 
712 	if (rc)
713 		panic("%s: Early task alloc failed.\n", __func__);
714 }
715 
716 /**
717  * lsm_superblock_alloc - allocate a composite superblock blob
718  * @sb: the superblock that needs a blob
719  *
720  * Allocate the superblock blob for all the modules
721  *
722  * Returns 0, or -ENOMEM if memory can't be allocated.
723  */
lsm_superblock_alloc(struct super_block * sb)724 static int lsm_superblock_alloc(struct super_block *sb)
725 {
726 	if (blob_sizes.lbs_superblock == 0) {
727 		sb->s_security = NULL;
728 		return 0;
729 	}
730 
731 	sb->s_security = kzalloc(blob_sizes.lbs_superblock, GFP_KERNEL);
732 	if (sb->s_security == NULL)
733 		return -ENOMEM;
734 	return 0;
735 }
736 
737 /*
738  * The default value of the LSM hook is defined in linux/lsm_hook_defs.h and
739  * can be accessed with:
740  *
741  *	LSM_RET_DEFAULT(<hook_name>)
742  *
743  * The macros below define static constants for the default value of each
744  * LSM hook.
745  */
746 #define LSM_RET_DEFAULT(NAME) (NAME##_default)
747 #define DECLARE_LSM_RET_DEFAULT_void(DEFAULT, NAME)
748 #define DECLARE_LSM_RET_DEFAULT_int(DEFAULT, NAME) \
749 	static const int __maybe_unused LSM_RET_DEFAULT(NAME) = (DEFAULT);
750 #define LSM_HOOK(RET, DEFAULT, NAME, ...) \
751 	DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME)
752 
753 #include <linux/lsm_hook_defs.h>
754 #undef LSM_HOOK
755 
756 /*
757  * Hook list operation macros.
758  *
759  * call_void_hook:
760  *	This is a hook that does not return a value.
761  *
762  * call_int_hook:
763  *	This is a hook that returns a value.
764  */
765 
766 #define call_void_hook(FUNC, ...)				\
767 	do {							\
768 		struct security_hook_list *P;			\
769 								\
770 		hlist_for_each_entry(P, &security_hook_heads.FUNC, list) \
771 			P->hook.FUNC(__VA_ARGS__);		\
772 	} while (0)
773 
774 #define call_int_hook(FUNC, IRC, ...) ({			\
775 	int RC = IRC;						\
776 	do {							\
777 		struct security_hook_list *P;			\
778 								\
779 		hlist_for_each_entry(P, &security_hook_heads.FUNC, list) { \
780 			RC = P->hook.FUNC(__VA_ARGS__);		\
781 			if (RC != 0)				\
782 				break;				\
783 		}						\
784 	} while (0);						\
785 	RC;							\
786 })
787 
788 /* Security operations */
789 
790 /**
791  * security_binder_set_context_mgr() - Check if becoming binder ctx mgr is ok
792  * @mgr: task credentials of current binder process
793  *
794  * Check whether @mgr is allowed to be the binder context manager.
795  *
796  * Return: Return 0 if permission is granted.
797  */
security_binder_set_context_mgr(const struct cred * mgr)798 int security_binder_set_context_mgr(const struct cred *mgr)
799 {
800 	return call_int_hook(binder_set_context_mgr, 0, mgr);
801 }
802 
803 /**
804  * security_binder_transaction() - Check if a binder transaction is allowed
805  * @from: sending process
806  * @to: receiving process
807  *
808  * Check whether @from is allowed to invoke a binder transaction call to @to.
809  *
810  * Return: Returns 0 if permission is granted.
811  */
security_binder_transaction(const struct cred * from,const struct cred * to)812 int security_binder_transaction(const struct cred *from,
813 				const struct cred *to)
814 {
815 	return call_int_hook(binder_transaction, 0, from, to);
816 }
817 
818 /**
819  * security_binder_transfer_binder() - Check if a binder transfer is allowed
820  * @from: sending process
821  * @to: receiving process
822  *
823  * Check whether @from is allowed to transfer a binder reference to @to.
824  *
825  * Return: Returns 0 if permission is granted.
826  */
security_binder_transfer_binder(const struct cred * from,const struct cred * to)827 int security_binder_transfer_binder(const struct cred *from,
828 				    const struct cred *to)
829 {
830 	return call_int_hook(binder_transfer_binder, 0, from, to);
831 }
832 
833 /**
834  * security_binder_transfer_file() - Check if a binder file xfer is allowed
835  * @from: sending process
836  * @to: receiving process
837  * @file: file being transferred
838  *
839  * Check whether @from is allowed to transfer @file to @to.
840  *
841  * Return: Returns 0 if permission is granted.
842  */
security_binder_transfer_file(const struct cred * from,const struct cred * to,const struct file * file)843 int security_binder_transfer_file(const struct cred *from,
844 				  const struct cred *to, const struct file *file)
845 {
846 	return call_int_hook(binder_transfer_file, 0, from, to, file);
847 }
848 
849 /**
850  * security_ptrace_access_check() - Check if tracing is allowed
851  * @child: target process
852  * @mode: PTRACE_MODE flags
853  *
854  * Check permission before allowing the current process to trace the @child
855  * process.  Security modules may also want to perform a process tracing check
856  * during an execve in the set_security or apply_creds hooks of tracing check
857  * during an execve in the bprm_set_creds hook of binprm_security_ops if the
858  * process is being traced and its security attributes would be changed by the
859  * execve.
860  *
861  * Return: Returns 0 if permission is granted.
862  */
security_ptrace_access_check(struct task_struct * child,unsigned int mode)863 int security_ptrace_access_check(struct task_struct *child, unsigned int mode)
864 {
865 	return call_int_hook(ptrace_access_check, 0, child, mode);
866 }
867 
868 /**
869  * security_ptrace_traceme() - Check if tracing is allowed
870  * @parent: tracing process
871  *
872  * Check that the @parent process has sufficient permission to trace the
873  * current process before allowing the current process to present itself to the
874  * @parent process for tracing.
875  *
876  * Return: Returns 0 if permission is granted.
877  */
security_ptrace_traceme(struct task_struct * parent)878 int security_ptrace_traceme(struct task_struct *parent)
879 {
880 	return call_int_hook(ptrace_traceme, 0, parent);
881 }
882 
883 /**
884  * security_capget() - Get the capability sets for a process
885  * @target: target process
886  * @effective: effective capability set
887  * @inheritable: inheritable capability set
888  * @permitted: permitted capability set
889  *
890  * Get the @effective, @inheritable, and @permitted capability sets for the
891  * @target process.  The hook may also perform permission checking to determine
892  * if the current process is allowed to see the capability sets of the @target
893  * process.
894  *
895  * Return: Returns 0 if the capability sets were successfully obtained.
896  */
security_capget(const struct task_struct * target,kernel_cap_t * effective,kernel_cap_t * inheritable,kernel_cap_t * permitted)897 int security_capget(const struct task_struct *target,
898 		    kernel_cap_t *effective,
899 		    kernel_cap_t *inheritable,
900 		    kernel_cap_t *permitted)
901 {
902 	return call_int_hook(capget, 0, target,
903 			     effective, inheritable, permitted);
904 }
905 
906 /**
907  * security_capset() - Set the capability sets for a process
908  * @new: new credentials for the target process
909  * @old: current credentials of the target process
910  * @effective: effective capability set
911  * @inheritable: inheritable capability set
912  * @permitted: permitted capability set
913  *
914  * Set the @effective, @inheritable, and @permitted capability sets for the
915  * current process.
916  *
917  * Return: Returns 0 and update @new if permission is granted.
918  */
security_capset(struct cred * new,const struct cred * old,const kernel_cap_t * effective,const kernel_cap_t * inheritable,const kernel_cap_t * permitted)919 int security_capset(struct cred *new, const struct cred *old,
920 		    const kernel_cap_t *effective,
921 		    const kernel_cap_t *inheritable,
922 		    const kernel_cap_t *permitted)
923 {
924 	return call_int_hook(capset, 0, new, old,
925 			     effective, inheritable, permitted);
926 }
927 
928 /**
929  * security_capable() - Check if a process has the necessary capability
930  * @cred: credentials to examine
931  * @ns: user namespace
932  * @cap: capability requested
933  * @opts: capability check options
934  *
935  * Check whether the @tsk process has the @cap capability in the indicated
936  * credentials.  @cap contains the capability <include/linux/capability.h>.
937  * @opts contains options for the capable check <include/linux/security.h>.
938  *
939  * Return: Returns 0 if the capability is granted.
940  */
security_capable(const struct cred * cred,struct user_namespace * ns,int cap,unsigned int opts)941 int security_capable(const struct cred *cred,
942 		     struct user_namespace *ns,
943 		     int cap,
944 		     unsigned int opts)
945 {
946 	return call_int_hook(capable, 0, cred, ns, cap, opts);
947 }
948 
949 /**
950  * security_quotactl() - Check if a quotactl() syscall is allowed for this fs
951  * @cmds: commands
952  * @type: type
953  * @id: id
954  * @sb: filesystem
955  *
956  * Check whether the quotactl syscall is allowed for this @sb.
957  *
958  * Return: Returns 0 if permission is granted.
959  */
security_quotactl(int cmds,int type,int id,struct super_block * sb)960 int security_quotactl(int cmds, int type, int id, struct super_block *sb)
961 {
962 	return call_int_hook(quotactl, 0, cmds, type, id, sb);
963 }
964 
965 /**
966  * security_quota_on() - Check if QUOTAON is allowed for a dentry
967  * @dentry: dentry
968  *
969  * Check whether QUOTAON is allowed for @dentry.
970  *
971  * Return: Returns 0 if permission is granted.
972  */
security_quota_on(struct dentry * dentry)973 int security_quota_on(struct dentry *dentry)
974 {
975 	return call_int_hook(quota_on, 0, dentry);
976 }
977 
978 /**
979  * security_syslog() - Check if accessing the kernel message ring is allowed
980  * @type: SYSLOG_ACTION_* type
981  *
982  * Check permission before accessing the kernel message ring or changing
983  * logging to the console.  See the syslog(2) manual page for an explanation of
984  * the @type values.
985  *
986  * Return: Return 0 if permission is granted.
987  */
security_syslog(int type)988 int security_syslog(int type)
989 {
990 	return call_int_hook(syslog, 0, type);
991 }
992 
993 /**
994  * security_settime64() - Check if changing the system time is allowed
995  * @ts: new time
996  * @tz: timezone
997  *
998  * Check permission to change the system time, struct timespec64 is defined in
999  * <include/linux/time64.h> and timezone is defined in <include/linux/time.h>.
1000  *
1001  * Return: Returns 0 if permission is granted.
1002  */
security_settime64(const struct timespec64 * ts,const struct timezone * tz)1003 int security_settime64(const struct timespec64 *ts, const struct timezone *tz)
1004 {
1005 	return call_int_hook(settime, 0, ts, tz);
1006 }
1007 
1008 /**
1009  * security_vm_enough_memory_mm() - Check if allocating a new mem map is allowed
1010  * @mm: mm struct
1011  * @pages: number of pages
1012  *
1013  * Check permissions for allocating a new virtual mapping.  If all LSMs return
1014  * a positive value, __vm_enough_memory() will be called with cap_sys_admin
1015  * set. If at least one LSM returns 0 or negative, __vm_enough_memory() will be
1016  * called with cap_sys_admin cleared.
1017  *
1018  * Return: Returns 0 if permission is granted by the LSM infrastructure to the
1019  *         caller.
1020  */
security_vm_enough_memory_mm(struct mm_struct * mm,long pages)1021 int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
1022 {
1023 	struct security_hook_list *hp;
1024 	int cap_sys_admin = 1;
1025 	int rc;
1026 
1027 	/*
1028 	 * The module will respond with a positive value if
1029 	 * it thinks the __vm_enough_memory() call should be
1030 	 * made with the cap_sys_admin set. If all of the modules
1031 	 * agree that it should be set it will. If any module
1032 	 * thinks it should not be set it won't.
1033 	 */
1034 	hlist_for_each_entry(hp, &security_hook_heads.vm_enough_memory, list) {
1035 		rc = hp->hook.vm_enough_memory(mm, pages);
1036 		if (rc <= 0) {
1037 			cap_sys_admin = 0;
1038 			break;
1039 		}
1040 	}
1041 	return __vm_enough_memory(mm, pages, cap_sys_admin);
1042 }
1043 
1044 /**
1045  * security_bprm_creds_for_exec() - Prepare the credentials for exec()
1046  * @bprm: binary program information
1047  *
1048  * If the setup in prepare_exec_creds did not setup @bprm->cred->security
1049  * properly for executing @bprm->file, update the LSM's portion of
1050  * @bprm->cred->security to be what commit_creds needs to install for the new
1051  * program.  This hook may also optionally check permissions (e.g. for
1052  * transitions between security domains).  The hook must set @bprm->secureexec
1053  * to 1 if AT_SECURE should be set to request libc enable secure mode.  @bprm
1054  * contains the linux_binprm structure.
1055  *
1056  * Return: Returns 0 if the hook is successful and permission is granted.
1057  */
security_bprm_creds_for_exec(struct linux_binprm * bprm)1058 int security_bprm_creds_for_exec(struct linux_binprm *bprm)
1059 {
1060 	return call_int_hook(bprm_creds_for_exec, 0, bprm);
1061 }
1062 
1063 /**
1064  * security_bprm_creds_from_file() - Update linux_binprm creds based on file
1065  * @bprm: binary program information
1066  * @file: associated file
1067  *
1068  * If @file is setpcap, suid, sgid or otherwise marked to change privilege upon
1069  * exec, update @bprm->cred to reflect that change. This is called after
1070  * finding the binary that will be executed without an interpreter.  This
1071  * ensures that the credentials will not be derived from a script that the
1072  * binary will need to reopen, which when reopend may end up being a completely
1073  * different file.  This hook may also optionally check permissions (e.g. for
1074  * transitions between security domains).  The hook must set @bprm->secureexec
1075  * to 1 if AT_SECURE should be set to request libc enable secure mode.  The
1076  * hook must add to @bprm->per_clear any personality flags that should be
1077  * cleared from current->personality.  @bprm contains the linux_binprm
1078  * structure.
1079  *
1080  * Return: Returns 0 if the hook is successful and permission is granted.
1081  */
security_bprm_creds_from_file(struct linux_binprm * bprm,struct file * file)1082 int security_bprm_creds_from_file(struct linux_binprm *bprm, struct file *file)
1083 {
1084 	return call_int_hook(bprm_creds_from_file, 0, bprm, file);
1085 }
1086 
1087 /**
1088  * security_bprm_check() - Mediate binary handler search
1089  * @bprm: binary program information
1090  *
1091  * This hook mediates the point when a search for a binary handler will begin.
1092  * It allows a check against the @bprm->cred->security value which was set in
1093  * the preceding creds_for_exec call.  The argv list and envp list are reliably
1094  * available in @bprm.  This hook may be called multiple times during a single
1095  * execve.  @bprm contains the linux_binprm structure.
1096  *
1097  * Return: Returns 0 if the hook is successful and permission is granted.
1098  */
security_bprm_check(struct linux_binprm * bprm)1099 int security_bprm_check(struct linux_binprm *bprm)
1100 {
1101 	int ret;
1102 
1103 	ret = call_int_hook(bprm_check_security, 0, bprm);
1104 	if (ret)
1105 		return ret;
1106 	return ima_bprm_check(bprm);
1107 }
1108 
1109 /**
1110  * security_bprm_committing_creds() - Install creds for a process during exec()
1111  * @bprm: binary program information
1112  *
1113  * Prepare to install the new security attributes of a process being
1114  * transformed by an execve operation, based on the old credentials pointed to
1115  * by @current->cred and the information set in @bprm->cred by the
1116  * bprm_creds_for_exec hook.  @bprm points to the linux_binprm structure.  This
1117  * hook is a good place to perform state changes on the process such as closing
1118  * open file descriptors to which access will no longer be granted when the
1119  * attributes are changed.  This is called immediately before commit_creds().
1120  */
security_bprm_committing_creds(struct linux_binprm * bprm)1121 void security_bprm_committing_creds(struct linux_binprm *bprm)
1122 {
1123 	call_void_hook(bprm_committing_creds, bprm);
1124 }
1125 
1126 /**
1127  * security_bprm_committed_creds() - Tidy up after cred install during exec()
1128  * @bprm: binary program information
1129  *
1130  * Tidy up after the installation of the new security attributes of a process
1131  * being transformed by an execve operation.  The new credentials have, by this
1132  * point, been set to @current->cred.  @bprm points to the linux_binprm
1133  * structure.  This hook is a good place to perform state changes on the
1134  * process such as clearing out non-inheritable signal state.  This is called
1135  * immediately after commit_creds().
1136  */
security_bprm_committed_creds(struct linux_binprm * bprm)1137 void security_bprm_committed_creds(struct linux_binprm *bprm)
1138 {
1139 	call_void_hook(bprm_committed_creds, bprm);
1140 }
1141 
1142 /**
1143  * security_fs_context_submount() - Initialise fc->security
1144  * @fc: new filesystem context
1145  * @reference: dentry reference for submount/remount
1146  *
1147  * Fill out the ->security field for a new fs_context.
1148  *
1149  * Return: Returns 0 on success or negative error code on failure.
1150  */
security_fs_context_submount(struct fs_context * fc,struct super_block * reference)1151 int security_fs_context_submount(struct fs_context *fc, struct super_block *reference)
1152 {
1153 	return call_int_hook(fs_context_submount, 0, fc, reference);
1154 }
1155 
1156 /**
1157  * security_fs_context_dup() - Duplicate a fs_context LSM blob
1158  * @fc: destination filesystem context
1159  * @src_fc: source filesystem context
1160  *
1161  * Allocate and attach a security structure to sc->security.  This pointer is
1162  * initialised to NULL by the caller.  @fc indicates the new filesystem context.
1163  * @src_fc indicates the original filesystem context.
1164  *
1165  * Return: Returns 0 on success or a negative error code on failure.
1166  */
security_fs_context_dup(struct fs_context * fc,struct fs_context * src_fc)1167 int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc)
1168 {
1169 	return call_int_hook(fs_context_dup, 0, fc, src_fc);
1170 }
1171 
1172 /**
1173  * security_fs_context_parse_param() - Configure a filesystem context
1174  * @fc: filesystem context
1175  * @param: filesystem parameter
1176  *
1177  * Userspace provided a parameter to configure a superblock.  The LSM can
1178  * consume the parameter or return it to the caller for use elsewhere.
1179  *
1180  * Return: If the parameter is used by the LSM it should return 0, if it is
1181  *         returned to the caller -ENOPARAM is returned, otherwise a negative
1182  *         error code is returned.
1183  */
security_fs_context_parse_param(struct fs_context * fc,struct fs_parameter * param)1184 int security_fs_context_parse_param(struct fs_context *fc,
1185 				    struct fs_parameter *param)
1186 {
1187 	struct security_hook_list *hp;
1188 	int trc;
1189 	int rc = -ENOPARAM;
1190 
1191 	hlist_for_each_entry(hp, &security_hook_heads.fs_context_parse_param,
1192 			     list) {
1193 		trc = hp->hook.fs_context_parse_param(fc, param);
1194 		if (trc == 0)
1195 			rc = 0;
1196 		else if (trc != -ENOPARAM)
1197 			return trc;
1198 	}
1199 	return rc;
1200 }
1201 
1202 /**
1203  * security_sb_alloc() - Allocate a super_block LSM blob
1204  * @sb: filesystem superblock
1205  *
1206  * Allocate and attach a security structure to the sb->s_security field.  The
1207  * s_security field is initialized to NULL when the structure is allocated.
1208  * @sb contains the super_block structure to be modified.
1209  *
1210  * Return: Returns 0 if operation was successful.
1211  */
security_sb_alloc(struct super_block * sb)1212 int security_sb_alloc(struct super_block *sb)
1213 {
1214 	int rc = lsm_superblock_alloc(sb);
1215 
1216 	if (unlikely(rc))
1217 		return rc;
1218 	rc = call_int_hook(sb_alloc_security, 0, sb);
1219 	if (unlikely(rc))
1220 		security_sb_free(sb);
1221 	return rc;
1222 }
1223 
1224 /**
1225  * security_sb_delete() - Release super_block LSM associated objects
1226  * @sb: filesystem superblock
1227  *
1228  * Release objects tied to a superblock (e.g. inodes).  @sb contains the
1229  * super_block structure being released.
1230  */
security_sb_delete(struct super_block * sb)1231 void security_sb_delete(struct super_block *sb)
1232 {
1233 	call_void_hook(sb_delete, sb);
1234 }
1235 
1236 /**
1237  * security_sb_free() - Free a super_block LSM blob
1238  * @sb: filesystem superblock
1239  *
1240  * Deallocate and clear the sb->s_security field.  @sb contains the super_block
1241  * structure to be modified.
1242  */
security_sb_free(struct super_block * sb)1243 void security_sb_free(struct super_block *sb)
1244 {
1245 	call_void_hook(sb_free_security, sb);
1246 	kfree(sb->s_security);
1247 	sb->s_security = NULL;
1248 }
1249 
1250 /**
1251  * security_free_mnt_opts() - Free memory associated with mount options
1252  * @mnt_opts: LSM processed mount options
1253  *
1254  * Free memory associated with @mnt_ops.
1255  */
security_free_mnt_opts(void ** mnt_opts)1256 void security_free_mnt_opts(void **mnt_opts)
1257 {
1258 	if (!*mnt_opts)
1259 		return;
1260 	call_void_hook(sb_free_mnt_opts, *mnt_opts);
1261 	*mnt_opts = NULL;
1262 }
1263 EXPORT_SYMBOL(security_free_mnt_opts);
1264 
1265 /**
1266  * security_sb_eat_lsm_opts() - Consume LSM mount options
1267  * @options: mount options
1268  * @mnt_opts: LSM processed mount options
1269  *
1270  * Eat (scan @options) and save them in @mnt_opts.
1271  *
1272  * Return: Returns 0 on success, negative values on failure.
1273  */
security_sb_eat_lsm_opts(char * options,void ** mnt_opts)1274 int security_sb_eat_lsm_opts(char *options, void **mnt_opts)
1275 {
1276 	return call_int_hook(sb_eat_lsm_opts, 0, options, mnt_opts);
1277 }
1278 EXPORT_SYMBOL(security_sb_eat_lsm_opts);
1279 
1280 /**
1281  * security_sb_mnt_opts_compat() - Check if new mount options are allowed
1282  * @sb: filesystem superblock
1283  * @mnt_opts: new mount options
1284  *
1285  * Determine if the new mount options in @mnt_opts are allowed given the
1286  * existing mounted filesystem at @sb.  @sb superblock being compared.
1287  *
1288  * Return: Returns 0 if options are compatible.
1289  */
security_sb_mnt_opts_compat(struct super_block * sb,void * mnt_opts)1290 int security_sb_mnt_opts_compat(struct super_block *sb,
1291 				void *mnt_opts)
1292 {
1293 	return call_int_hook(sb_mnt_opts_compat, 0, sb, mnt_opts);
1294 }
1295 EXPORT_SYMBOL(security_sb_mnt_opts_compat);
1296 
1297 /**
1298  * security_sb_remount() - Verify no incompatible mount changes during remount
1299  * @sb: filesystem superblock
1300  * @mnt_opts: (re)mount options
1301  *
1302  * Extracts security system specific mount options and verifies no changes are
1303  * being made to those options.
1304  *
1305  * Return: Returns 0 if permission is granted.
1306  */
security_sb_remount(struct super_block * sb,void * mnt_opts)1307 int security_sb_remount(struct super_block *sb,
1308 			void *mnt_opts)
1309 {
1310 	return call_int_hook(sb_remount, 0, sb, mnt_opts);
1311 }
1312 EXPORT_SYMBOL(security_sb_remount);
1313 
1314 /**
1315  * security_sb_kern_mount() - Check if a kernel mount is allowed
1316  * @sb: filesystem superblock
1317  *
1318  * Mount this @sb if allowed by permissions.
1319  *
1320  * Return: Returns 0 if permission is granted.
1321  */
security_sb_kern_mount(struct super_block * sb)1322 int security_sb_kern_mount(struct super_block *sb)
1323 {
1324 	return call_int_hook(sb_kern_mount, 0, sb);
1325 }
1326 
1327 /**
1328  * security_sb_show_options() - Output the mount options for a superblock
1329  * @m: output file
1330  * @sb: filesystem superblock
1331  *
1332  * Show (print on @m) mount options for this @sb.
1333  *
1334  * Return: Returns 0 on success, negative values on failure.
1335  */
security_sb_show_options(struct seq_file * m,struct super_block * sb)1336 int security_sb_show_options(struct seq_file *m, struct super_block *sb)
1337 {
1338 	return call_int_hook(sb_show_options, 0, m, sb);
1339 }
1340 
1341 /**
1342  * security_sb_statfs() - Check if accessing fs stats is allowed
1343  * @dentry: superblock handle
1344  *
1345  * Check permission before obtaining filesystem statistics for the @mnt
1346  * mountpoint.  @dentry is a handle on the superblock for the filesystem.
1347  *
1348  * Return: Returns 0 if permission is granted.
1349  */
security_sb_statfs(struct dentry * dentry)1350 int security_sb_statfs(struct dentry *dentry)
1351 {
1352 	return call_int_hook(sb_statfs, 0, dentry);
1353 }
1354 
1355 /**
1356  * security_sb_mount() - Check permission for mounting a filesystem
1357  * @dev_name: filesystem backing device
1358  * @path: mount point
1359  * @type: filesystem type
1360  * @flags: mount flags
1361  * @data: filesystem specific data
1362  *
1363  * Check permission before an object specified by @dev_name is mounted on the
1364  * mount point named by @nd.  For an ordinary mount, @dev_name identifies a
1365  * device if the file system type requires a device.  For a remount
1366  * (@flags & MS_REMOUNT), @dev_name is irrelevant.  For a loopback/bind mount
1367  * (@flags & MS_BIND), @dev_name identifies the	pathname of the object being
1368  * mounted.
1369  *
1370  * Return: Returns 0 if permission is granted.
1371  */
security_sb_mount(const char * dev_name,const struct path * path,const char * type,unsigned long flags,void * data)1372 int security_sb_mount(const char *dev_name, const struct path *path,
1373 		      const char *type, unsigned long flags, void *data)
1374 {
1375 	return call_int_hook(sb_mount, 0, dev_name, path, type, flags, data);
1376 }
1377 
1378 /**
1379  * security_sb_umount() - Check permission for unmounting a filesystem
1380  * @mnt: mounted filesystem
1381  * @flags: unmount flags
1382  *
1383  * Check permission before the @mnt file system is unmounted.
1384  *
1385  * Return: Returns 0 if permission is granted.
1386  */
security_sb_umount(struct vfsmount * mnt,int flags)1387 int security_sb_umount(struct vfsmount *mnt, int flags)
1388 {
1389 	return call_int_hook(sb_umount, 0, mnt, flags);
1390 }
1391 
1392 /**
1393  * security_sb_pivotroot() - Check permissions for pivoting the rootfs
1394  * @old_path: new location for current rootfs
1395  * @new_path: location of the new rootfs
1396  *
1397  * Check permission before pivoting the root filesystem.
1398  *
1399  * Return: Returns 0 if permission is granted.
1400  */
security_sb_pivotroot(const struct path * old_path,const struct path * new_path)1401 int security_sb_pivotroot(const struct path *old_path,
1402 			  const struct path *new_path)
1403 {
1404 	return call_int_hook(sb_pivotroot, 0, old_path, new_path);
1405 }
1406 
1407 /**
1408  * security_sb_set_mnt_opts() - Set the mount options for a filesystem
1409  * @sb: filesystem superblock
1410  * @mnt_opts: binary mount options
1411  * @kern_flags: kernel flags (in)
1412  * @set_kern_flags: kernel flags (out)
1413  *
1414  * Set the security relevant mount options used for a superblock.
1415  *
1416  * Return: Returns 0 on success, error on failure.
1417  */
security_sb_set_mnt_opts(struct super_block * sb,void * mnt_opts,unsigned long kern_flags,unsigned long * set_kern_flags)1418 int security_sb_set_mnt_opts(struct super_block *sb,
1419 			     void *mnt_opts,
1420 			     unsigned long kern_flags,
1421 			     unsigned long *set_kern_flags)
1422 {
1423 	return call_int_hook(sb_set_mnt_opts,
1424 			     mnt_opts ? -EOPNOTSUPP : 0, sb,
1425 			     mnt_opts, kern_flags, set_kern_flags);
1426 }
1427 EXPORT_SYMBOL(security_sb_set_mnt_opts);
1428 
1429 /**
1430  * security_sb_clone_mnt_opts() - Duplicate superblock mount options
1431  * @oldsb: source superblock
1432  * @newsb: destination superblock
1433  * @kern_flags: kernel flags (in)
1434  * @set_kern_flags: kernel flags (out)
1435  *
1436  * Copy all security options from a given superblock to another.
1437  *
1438  * Return: Returns 0 on success, error on failure.
1439  */
security_sb_clone_mnt_opts(const struct super_block * oldsb,struct super_block * newsb,unsigned long kern_flags,unsigned long * set_kern_flags)1440 int security_sb_clone_mnt_opts(const struct super_block *oldsb,
1441 			       struct super_block *newsb,
1442 			       unsigned long kern_flags,
1443 			       unsigned long *set_kern_flags)
1444 {
1445 	return call_int_hook(sb_clone_mnt_opts, 0, oldsb, newsb,
1446 			     kern_flags, set_kern_flags);
1447 }
1448 EXPORT_SYMBOL(security_sb_clone_mnt_opts);
1449 
1450 /**
1451  * security_move_mount() - Check permissions for moving a mount
1452  * @from_path: source mount point
1453  * @to_path: destination mount point
1454  *
1455  * Check permission before a mount is moved.
1456  *
1457  * Return: Returns 0 if permission is granted.
1458  */
security_move_mount(const struct path * from_path,const struct path * to_path)1459 int security_move_mount(const struct path *from_path,
1460 			const struct path *to_path)
1461 {
1462 	return call_int_hook(move_mount, 0, from_path, to_path);
1463 }
1464 
1465 /**
1466  * security_path_notify() - Check if setting a watch is allowed
1467  * @path: file path
1468  * @mask: event mask
1469  * @obj_type: file path type
1470  *
1471  * Check permissions before setting a watch on events as defined by @mask, on
1472  * an object at @path, whose type is defined by @obj_type.
1473  *
1474  * Return: Returns 0 if permission is granted.
1475  */
security_path_notify(const struct path * path,u64 mask,unsigned int obj_type)1476 int security_path_notify(const struct path *path, u64 mask,
1477 			 unsigned int obj_type)
1478 {
1479 	return call_int_hook(path_notify, 0, path, mask, obj_type);
1480 }
1481 
1482 /**
1483  * security_inode_alloc() - Allocate an inode LSM blob
1484  * @inode: the inode
1485  *
1486  * Allocate and attach a security structure to @inode->i_security.  The
1487  * i_security field is initialized to NULL when the inode structure is
1488  * allocated.
1489  *
1490  * Return: Return 0 if operation was successful.
1491  */
security_inode_alloc(struct inode * inode)1492 int security_inode_alloc(struct inode *inode)
1493 {
1494 	int rc = lsm_inode_alloc(inode);
1495 
1496 	if (unlikely(rc))
1497 		return rc;
1498 	rc = call_int_hook(inode_alloc_security, 0, inode);
1499 	if (unlikely(rc))
1500 		security_inode_free(inode);
1501 	return rc;
1502 }
1503 
inode_free_by_rcu(struct rcu_head * head)1504 static void inode_free_by_rcu(struct rcu_head *head)
1505 {
1506 	/*
1507 	 * The rcu head is at the start of the inode blob
1508 	 */
1509 	kmem_cache_free(lsm_inode_cache, head);
1510 }
1511 
1512 /**
1513  * security_inode_free() - Free an inode's LSM blob
1514  * @inode: the inode
1515  *
1516  * Deallocate the inode security structure and set @inode->i_security to NULL.
1517  */
security_inode_free(struct inode * inode)1518 void security_inode_free(struct inode *inode)
1519 {
1520 	integrity_inode_free(inode);
1521 	call_void_hook(inode_free_security, inode);
1522 	/*
1523 	 * The inode may still be referenced in a path walk and
1524 	 * a call to security_inode_permission() can be made
1525 	 * after inode_free_security() is called. Ideally, the VFS
1526 	 * wouldn't do this, but fixing that is a much harder
1527 	 * job. For now, simply free the i_security via RCU, and
1528 	 * leave the current inode->i_security pointer intact.
1529 	 * The inode will be freed after the RCU grace period too.
1530 	 */
1531 	if (inode->i_security)
1532 		call_rcu((struct rcu_head *)inode->i_security,
1533 			 inode_free_by_rcu);
1534 }
1535 
1536 /**
1537  * security_dentry_init_security() - Perform dentry initialization
1538  * @dentry: the dentry to initialize
1539  * @mode: mode used to determine resource type
1540  * @name: name of the last path component
1541  * @xattr_name: name of the security/LSM xattr
1542  * @ctx: pointer to the resulting LSM context
1543  * @ctxlen: length of @ctx
1544  *
1545  * Compute a context for a dentry as the inode is not yet available since NFSv4
1546  * has no label backed by an EA anyway.  It is important to note that
1547  * @xattr_name does not need to be free'd by the caller, it is a static string.
1548  *
1549  * Return: Returns 0 on success, negative values on failure.
1550  */
security_dentry_init_security(struct dentry * dentry,int mode,const struct qstr * name,const char ** xattr_name,void ** ctx,u32 * ctxlen)1551 int security_dentry_init_security(struct dentry *dentry, int mode,
1552 				  const struct qstr *name,
1553 				  const char **xattr_name, void **ctx,
1554 				  u32 *ctxlen)
1555 {
1556 	struct security_hook_list *hp;
1557 	int rc;
1558 
1559 	/*
1560 	 * Only one module will provide a security context.
1561 	 */
1562 	hlist_for_each_entry(hp, &security_hook_heads.dentry_init_security,
1563 			     list) {
1564 		rc = hp->hook.dentry_init_security(dentry, mode, name,
1565 						   xattr_name, ctx, ctxlen);
1566 		if (rc != LSM_RET_DEFAULT(dentry_init_security))
1567 			return rc;
1568 	}
1569 	return LSM_RET_DEFAULT(dentry_init_security);
1570 }
1571 EXPORT_SYMBOL(security_dentry_init_security);
1572 
1573 /**
1574  * security_dentry_create_files_as() - Perform dentry initialization
1575  * @dentry: the dentry to initialize
1576  * @mode: mode used to determine resource type
1577  * @name: name of the last path component
1578  * @old: creds to use for LSM context calculations
1579  * @new: creds to modify
1580  *
1581  * Compute a context for a dentry as the inode is not yet available and set
1582  * that context in passed in creds so that new files are created using that
1583  * context. Context is calculated using the passed in creds and not the creds
1584  * of the caller.
1585  *
1586  * Return: Returns 0 on success, error on failure.
1587  */
security_dentry_create_files_as(struct dentry * dentry,int mode,struct qstr * name,const struct cred * old,struct cred * new)1588 int security_dentry_create_files_as(struct dentry *dentry, int mode,
1589 				    struct qstr *name,
1590 				    const struct cred *old, struct cred *new)
1591 {
1592 	return call_int_hook(dentry_create_files_as, 0, dentry, mode,
1593 			     name, old, new);
1594 }
1595 EXPORT_SYMBOL(security_dentry_create_files_as);
1596 
1597 /**
1598  * security_inode_init_security() - Initialize an inode's LSM context
1599  * @inode: the inode
1600  * @dir: parent directory
1601  * @qstr: last component of the pathname
1602  * @initxattrs: callback function to write xattrs
1603  * @fs_data: filesystem specific data
1604  *
1605  * Obtain the security attribute name suffix and value to set on a newly
1606  * created inode and set up the incore security field for the new inode.  This
1607  * hook is called by the fs code as part of the inode creation transaction and
1608  * provides for atomic labeling of the inode, unlike the post_create/mkdir/...
1609  * hooks called by the VFS.
1610  *
1611  * The hook function is expected to populate the xattrs array, by calling
1612  * lsm_get_xattr_slot() to retrieve the slots reserved by the security module
1613  * with the lbs_xattr_count field of the lsm_blob_sizes structure.  For each
1614  * slot, the hook function should set ->name to the attribute name suffix
1615  * (e.g. selinux), to allocate ->value (will be freed by the caller) and set it
1616  * to the attribute value, to set ->value_len to the length of the value.  If
1617  * the security module does not use security attributes or does not wish to put
1618  * a security attribute on this particular inode, then it should return
1619  * -EOPNOTSUPP to skip this processing.
1620  *
1621  * Return: Returns 0 if the LSM successfully initialized all of the inode
1622  *         security attributes that are required, negative values otherwise.
1623  */
security_inode_init_security(struct inode * inode,struct inode * dir,const struct qstr * qstr,const initxattrs initxattrs,void * fs_data)1624 int security_inode_init_security(struct inode *inode, struct inode *dir,
1625 				 const struct qstr *qstr,
1626 				 const initxattrs initxattrs, void *fs_data)
1627 {
1628 	struct security_hook_list *hp;
1629 	struct xattr *new_xattrs = NULL;
1630 	int ret = -EOPNOTSUPP, xattr_count = 0;
1631 
1632 	if (unlikely(IS_PRIVATE(inode)))
1633 		return 0;
1634 
1635 	if (!blob_sizes.lbs_xattr_count)
1636 		return 0;
1637 
1638 	if (initxattrs) {
1639 		/* Allocate +1 for EVM and +1 as terminator. */
1640 		new_xattrs = kcalloc(blob_sizes.lbs_xattr_count + 2,
1641 				     sizeof(*new_xattrs), GFP_NOFS);
1642 		if (!new_xattrs)
1643 			return -ENOMEM;
1644 	}
1645 
1646 	hlist_for_each_entry(hp, &security_hook_heads.inode_init_security,
1647 			     list) {
1648 		ret = hp->hook.inode_init_security(inode, dir, qstr, new_xattrs,
1649 						  &xattr_count);
1650 		if (ret && ret != -EOPNOTSUPP)
1651 			goto out;
1652 		/*
1653 		 * As documented in lsm_hooks.h, -EOPNOTSUPP in this context
1654 		 * means that the LSM is not willing to provide an xattr, not
1655 		 * that it wants to signal an error. Thus, continue to invoke
1656 		 * the remaining LSMs.
1657 		 */
1658 	}
1659 
1660 	/* If initxattrs() is NULL, xattr_count is zero, skip the call. */
1661 	if (!xattr_count)
1662 		goto out;
1663 
1664 	ret = evm_inode_init_security(inode, dir, qstr, new_xattrs,
1665 				      &xattr_count);
1666 	if (ret)
1667 		goto out;
1668 	ret = initxattrs(inode, new_xattrs, fs_data);
1669 out:
1670 	for (; xattr_count > 0; xattr_count--)
1671 		kfree(new_xattrs[xattr_count - 1].value);
1672 	kfree(new_xattrs);
1673 	return (ret == -EOPNOTSUPP) ? 0 : ret;
1674 }
1675 EXPORT_SYMBOL(security_inode_init_security);
1676 
1677 /**
1678  * security_inode_init_security_anon() - Initialize an anonymous inode
1679  * @inode: the inode
1680  * @name: the anonymous inode class
1681  * @context_inode: an optional related inode
1682  *
1683  * Set up the incore security field for the new anonymous inode and return
1684  * whether the inode creation is permitted by the security module or not.
1685  *
1686  * Return: Returns 0 on success, -EACCES if the security module denies the
1687  * creation of this inode, or another -errno upon other errors.
1688  */
security_inode_init_security_anon(struct inode * inode,const struct qstr * name,const struct inode * context_inode)1689 int security_inode_init_security_anon(struct inode *inode,
1690 				      const struct qstr *name,
1691 				      const struct inode *context_inode)
1692 {
1693 	return call_int_hook(inode_init_security_anon, 0, inode, name,
1694 			     context_inode);
1695 }
1696 
1697 #ifdef CONFIG_SECURITY_PATH
1698 /**
1699  * security_path_mknod() - Check if creating a special file is allowed
1700  * @dir: parent directory
1701  * @dentry: new file
1702  * @mode: new file mode
1703  * @dev: device number
1704  *
1705  * Check permissions when creating a file. Note that this hook is called even
1706  * if mknod operation is being done for a regular file.
1707  *
1708  * Return: Returns 0 if permission is granted.
1709  */
security_path_mknod(const struct path * dir,struct dentry * dentry,umode_t mode,unsigned int dev)1710 int security_path_mknod(const struct path *dir, struct dentry *dentry,
1711 			umode_t mode, unsigned int dev)
1712 {
1713 	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
1714 		return 0;
1715 	return call_int_hook(path_mknod, 0, dir, dentry, mode, dev);
1716 }
1717 EXPORT_SYMBOL(security_path_mknod);
1718 
1719 /**
1720  * security_path_mkdir() - Check if creating a new directory is allowed
1721  * @dir: parent directory
1722  * @dentry: new directory
1723  * @mode: new directory mode
1724  *
1725  * Check permissions to create a new directory in the existing directory.
1726  *
1727  * Return: Returns 0 if permission is granted.
1728  */
security_path_mkdir(const struct path * dir,struct dentry * dentry,umode_t mode)1729 int security_path_mkdir(const struct path *dir, struct dentry *dentry,
1730 			umode_t mode)
1731 {
1732 	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
1733 		return 0;
1734 	return call_int_hook(path_mkdir, 0, dir, dentry, mode);
1735 }
1736 EXPORT_SYMBOL(security_path_mkdir);
1737 
1738 /**
1739  * security_path_rmdir() - Check if removing a directory is allowed
1740  * @dir: parent directory
1741  * @dentry: directory to remove
1742  *
1743  * Check the permission to remove a directory.
1744  *
1745  * Return: Returns 0 if permission is granted.
1746  */
security_path_rmdir(const struct path * dir,struct dentry * dentry)1747 int security_path_rmdir(const struct path *dir, struct dentry *dentry)
1748 {
1749 	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
1750 		return 0;
1751 	return call_int_hook(path_rmdir, 0, dir, dentry);
1752 }
1753 
1754 /**
1755  * security_path_unlink() - Check if removing a hard link is allowed
1756  * @dir: parent directory
1757  * @dentry: file
1758  *
1759  * Check the permission to remove a hard link to a file.
1760  *
1761  * Return: Returns 0 if permission is granted.
1762  */
security_path_unlink(const struct path * dir,struct dentry * dentry)1763 int security_path_unlink(const struct path *dir, struct dentry *dentry)
1764 {
1765 	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
1766 		return 0;
1767 	return call_int_hook(path_unlink, 0, dir, dentry);
1768 }
1769 EXPORT_SYMBOL(security_path_unlink);
1770 
1771 /**
1772  * security_path_symlink() - Check if creating a symbolic link is allowed
1773  * @dir: parent directory
1774  * @dentry: symbolic link
1775  * @old_name: file pathname
1776  *
1777  * Check the permission to create a symbolic link to a file.
1778  *
1779  * Return: Returns 0 if permission is granted.
1780  */
security_path_symlink(const struct path * dir,struct dentry * dentry,const char * old_name)1781 int security_path_symlink(const struct path *dir, struct dentry *dentry,
1782 			  const char *old_name)
1783 {
1784 	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
1785 		return 0;
1786 	return call_int_hook(path_symlink, 0, dir, dentry, old_name);
1787 }
1788 
1789 /**
1790  * security_path_link - Check if creating a hard link is allowed
1791  * @old_dentry: existing file
1792  * @new_dir: new parent directory
1793  * @new_dentry: new link
1794  *
1795  * Check permission before creating a new hard link to a file.
1796  *
1797  * Return: Returns 0 if permission is granted.
1798  */
security_path_link(struct dentry * old_dentry,const struct path * new_dir,struct dentry * new_dentry)1799 int security_path_link(struct dentry *old_dentry, const struct path *new_dir,
1800 		       struct dentry *new_dentry)
1801 {
1802 	if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))
1803 		return 0;
1804 	return call_int_hook(path_link, 0, old_dentry, new_dir, new_dentry);
1805 }
1806 
1807 /**
1808  * security_path_rename() - Check if renaming a file is allowed
1809  * @old_dir: parent directory of the old file
1810  * @old_dentry: the old file
1811  * @new_dir: parent directory of the new file
1812  * @new_dentry: the new file
1813  * @flags: flags
1814  *
1815  * Check for permission to rename a file or directory.
1816  *
1817  * Return: Returns 0 if permission is granted.
1818  */
security_path_rename(const struct path * old_dir,struct dentry * old_dentry,const struct path * new_dir,struct dentry * new_dentry,unsigned int flags)1819 int security_path_rename(const struct path *old_dir, struct dentry *old_dentry,
1820 			 const struct path *new_dir, struct dentry *new_dentry,
1821 			 unsigned int flags)
1822 {
1823 	if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry)) ||
1824 		     (d_is_positive(new_dentry) &&
1825 		      IS_PRIVATE(d_backing_inode(new_dentry)))))
1826 		return 0;
1827 
1828 	return call_int_hook(path_rename, 0, old_dir, old_dentry, new_dir,
1829 			     new_dentry, flags);
1830 }
1831 EXPORT_SYMBOL(security_path_rename);
1832 
1833 /**
1834  * security_path_truncate() - Check if truncating a file is allowed
1835  * @path: file
1836  *
1837  * Check permission before truncating the file indicated by path.  Note that
1838  * truncation permissions may also be checked based on already opened files,
1839  * using the security_file_truncate() hook.
1840  *
1841  * Return: Returns 0 if permission is granted.
1842  */
security_path_truncate(const struct path * path)1843 int security_path_truncate(const struct path *path)
1844 {
1845 	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
1846 		return 0;
1847 	return call_int_hook(path_truncate, 0, path);
1848 }
1849 
1850 /**
1851  * security_path_chmod() - Check if changing the file's mode is allowed
1852  * @path: file
1853  * @mode: new mode
1854  *
1855  * Check for permission to change a mode of the file @path. The new mode is
1856  * specified in @mode which is a bitmask of constants from
1857  * <include/uapi/linux/stat.h>.
1858  *
1859  * Return: Returns 0 if permission is granted.
1860  */
security_path_chmod(const struct path * path,umode_t mode)1861 int security_path_chmod(const struct path *path, umode_t mode)
1862 {
1863 	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
1864 		return 0;
1865 	return call_int_hook(path_chmod, 0, path, mode);
1866 }
1867 
1868 /**
1869  * security_path_chown() - Check if changing the file's owner/group is allowed
1870  * @path: file
1871  * @uid: file owner
1872  * @gid: file group
1873  *
1874  * Check for permission to change owner/group of a file or directory.
1875  *
1876  * Return: Returns 0 if permission is granted.
1877  */
security_path_chown(const struct path * path,kuid_t uid,kgid_t gid)1878 int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
1879 {
1880 	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
1881 		return 0;
1882 	return call_int_hook(path_chown, 0, path, uid, gid);
1883 }
1884 
1885 /**
1886  * security_path_chroot() - Check if changing the root directory is allowed
1887  * @path: directory
1888  *
1889  * Check for permission to change root directory.
1890  *
1891  * Return: Returns 0 if permission is granted.
1892  */
security_path_chroot(const struct path * path)1893 int security_path_chroot(const struct path *path)
1894 {
1895 	return call_int_hook(path_chroot, 0, path);
1896 }
1897 #endif /* CONFIG_SECURITY_PATH */
1898 
1899 /**
1900  * security_inode_create() - Check if creating a file is allowed
1901  * @dir: the parent directory
1902  * @dentry: the file being created
1903  * @mode: requested file mode
1904  *
1905  * Check permission to create a regular file.
1906  *
1907  * Return: Returns 0 if permission is granted.
1908  */
security_inode_create(struct inode * dir,struct dentry * dentry,umode_t mode)1909 int security_inode_create(struct inode *dir, struct dentry *dentry,
1910 			  umode_t mode)
1911 {
1912 	if (unlikely(IS_PRIVATE(dir)))
1913 		return 0;
1914 	return call_int_hook(inode_create, 0, dir, dentry, mode);
1915 }
1916 EXPORT_SYMBOL_GPL(security_inode_create);
1917 
1918 /**
1919  * security_inode_link() - Check if creating a hard link is allowed
1920  * @old_dentry: existing file
1921  * @dir: new parent directory
1922  * @new_dentry: new link
1923  *
1924  * Check permission before creating a new hard link to a file.
1925  *
1926  * Return: Returns 0 if permission is granted.
1927  */
security_inode_link(struct dentry * old_dentry,struct inode * dir,struct dentry * new_dentry)1928 int security_inode_link(struct dentry *old_dentry, struct inode *dir,
1929 			struct dentry *new_dentry)
1930 {
1931 	if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))
1932 		return 0;
1933 	return call_int_hook(inode_link, 0, old_dentry, dir, new_dentry);
1934 }
1935 
1936 /**
1937  * security_inode_unlink() - Check if removing a hard link is allowed
1938  * @dir: parent directory
1939  * @dentry: file
1940  *
1941  * Check the permission to remove a hard link to a file.
1942  *
1943  * Return: Returns 0 if permission is granted.
1944  */
security_inode_unlink(struct inode * dir,struct dentry * dentry)1945 int security_inode_unlink(struct inode *dir, struct dentry *dentry)
1946 {
1947 	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
1948 		return 0;
1949 	return call_int_hook(inode_unlink, 0, dir, dentry);
1950 }
1951 
1952 /**
1953  * security_inode_symlink() - Check if creating a symbolic link is allowed
1954  * @dir: parent directory
1955  * @dentry: symbolic link
1956  * @old_name: existing filename
1957  *
1958  * Check the permission to create a symbolic link to a file.
1959  *
1960  * Return: Returns 0 if permission is granted.
1961  */
security_inode_symlink(struct inode * dir,struct dentry * dentry,const char * old_name)1962 int security_inode_symlink(struct inode *dir, struct dentry *dentry,
1963 			   const char *old_name)
1964 {
1965 	if (unlikely(IS_PRIVATE(dir)))
1966 		return 0;
1967 	return call_int_hook(inode_symlink, 0, dir, dentry, old_name);
1968 }
1969 
1970 /**
1971  * security_inode_mkdir() - Check if creation a new director is allowed
1972  * @dir: parent directory
1973  * @dentry: new directory
1974  * @mode: new directory mode
1975  *
1976  * Check permissions to create a new directory in the existing directory
1977  * associated with inode structure @dir.
1978  *
1979  * Return: Returns 0 if permission is granted.
1980  */
security_inode_mkdir(struct inode * dir,struct dentry * dentry,umode_t mode)1981 int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
1982 {
1983 	if (unlikely(IS_PRIVATE(dir)))
1984 		return 0;
1985 	return call_int_hook(inode_mkdir, 0, dir, dentry, mode);
1986 }
1987 EXPORT_SYMBOL_GPL(security_inode_mkdir);
1988 
1989 /**
1990  * security_inode_rmdir() - Check if removing a directory is allowed
1991  * @dir: parent directory
1992  * @dentry: directory to be removed
1993  *
1994  * Check the permission to remove a directory.
1995  *
1996  * Return: Returns 0 if permission is granted.
1997  */
security_inode_rmdir(struct inode * dir,struct dentry * dentry)1998 int security_inode_rmdir(struct inode *dir, struct dentry *dentry)
1999 {
2000 	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2001 		return 0;
2002 	return call_int_hook(inode_rmdir, 0, dir, dentry);
2003 }
2004 
2005 /**
2006  * security_inode_mknod() - Check if creating a special file is allowed
2007  * @dir: parent directory
2008  * @dentry: new file
2009  * @mode: new file mode
2010  * @dev: device number
2011  *
2012  * Check permissions when creating a special file (or a socket or a fifo file
2013  * created via the mknod system call).  Note that if mknod operation is being
2014  * done for a regular file, then the create hook will be called and not this
2015  * hook.
2016  *
2017  * Return: Returns 0 if permission is granted.
2018  */
security_inode_mknod(struct inode * dir,struct dentry * dentry,umode_t mode,dev_t dev)2019 int security_inode_mknod(struct inode *dir, struct dentry *dentry,
2020 			 umode_t mode, dev_t dev)
2021 {
2022 	if (unlikely(IS_PRIVATE(dir)))
2023 		return 0;
2024 	return call_int_hook(inode_mknod, 0, dir, dentry, mode, dev);
2025 }
2026 
2027 /**
2028  * security_inode_rename() - Check if renaming a file is allowed
2029  * @old_dir: parent directory of the old file
2030  * @old_dentry: the old file
2031  * @new_dir: parent directory of the new file
2032  * @new_dentry: the new file
2033  * @flags: flags
2034  *
2035  * Check for permission to rename a file or directory.
2036  *
2037  * Return: Returns 0 if permission is granted.
2038  */
security_inode_rename(struct inode * old_dir,struct dentry * old_dentry,struct inode * new_dir,struct dentry * new_dentry,unsigned int flags)2039 int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
2040 			  struct inode *new_dir, struct dentry *new_dentry,
2041 			  unsigned int flags)
2042 {
2043 	if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry)) ||
2044 		     (d_is_positive(new_dentry) &&
2045 		      IS_PRIVATE(d_backing_inode(new_dentry)))))
2046 		return 0;
2047 
2048 	if (flags & RENAME_EXCHANGE) {
2049 		int err = call_int_hook(inode_rename, 0, new_dir, new_dentry,
2050 					old_dir, old_dentry);
2051 		if (err)
2052 			return err;
2053 	}
2054 
2055 	return call_int_hook(inode_rename, 0, old_dir, old_dentry,
2056 			     new_dir, new_dentry);
2057 }
2058 
2059 /**
2060  * security_inode_readlink() - Check if reading a symbolic link is allowed
2061  * @dentry: link
2062  *
2063  * Check the permission to read the symbolic link.
2064  *
2065  * Return: Returns 0 if permission is granted.
2066  */
security_inode_readlink(struct dentry * dentry)2067 int security_inode_readlink(struct dentry *dentry)
2068 {
2069 	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2070 		return 0;
2071 	return call_int_hook(inode_readlink, 0, dentry);
2072 }
2073 
2074 /**
2075  * security_inode_follow_link() - Check if following a symbolic link is allowed
2076  * @dentry: link dentry
2077  * @inode: link inode
2078  * @rcu: true if in RCU-walk mode
2079  *
2080  * Check permission to follow a symbolic link when looking up a pathname.  If
2081  * @rcu is true, @inode is not stable.
2082  *
2083  * Return: Returns 0 if permission is granted.
2084  */
security_inode_follow_link(struct dentry * dentry,struct inode * inode,bool rcu)2085 int security_inode_follow_link(struct dentry *dentry, struct inode *inode,
2086 			       bool rcu)
2087 {
2088 	if (unlikely(IS_PRIVATE(inode)))
2089 		return 0;
2090 	return call_int_hook(inode_follow_link, 0, dentry, inode, rcu);
2091 }
2092 
2093 /**
2094  * security_inode_permission() - Check if accessing an inode is allowed
2095  * @inode: inode
2096  * @mask: access mask
2097  *
2098  * Check permission before accessing an inode.  This hook is called by the
2099  * existing Linux permission function, so a security module can use it to
2100  * provide additional checking for existing Linux permission checks.  Notice
2101  * that this hook is called when a file is opened (as well as many other
2102  * operations), whereas the file_security_ops permission hook is called when
2103  * the actual read/write operations are performed.
2104  *
2105  * Return: Returns 0 if permission is granted.
2106  */
security_inode_permission(struct inode * inode,int mask)2107 int security_inode_permission(struct inode *inode, int mask)
2108 {
2109 	if (unlikely(IS_PRIVATE(inode)))
2110 		return 0;
2111 	return call_int_hook(inode_permission, 0, inode, mask);
2112 }
2113 
2114 /**
2115  * security_inode_setattr() - Check if setting file attributes is allowed
2116  * @idmap: idmap of the mount
2117  * @dentry: file
2118  * @attr: new attributes
2119  *
2120  * Check permission before setting file attributes.  Note that the kernel call
2121  * to notify_change is performed from several locations, whenever file
2122  * attributes change (such as when a file is truncated, chown/chmod operations,
2123  * transferring disk quotas, etc).
2124  *
2125  * Return: Returns 0 if permission is granted.
2126  */
security_inode_setattr(struct mnt_idmap * idmap,struct dentry * dentry,struct iattr * attr)2127 int security_inode_setattr(struct mnt_idmap *idmap,
2128 			   struct dentry *dentry, struct iattr *attr)
2129 {
2130 	int ret;
2131 
2132 	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2133 		return 0;
2134 	ret = call_int_hook(inode_setattr, 0, dentry, attr);
2135 	if (ret)
2136 		return ret;
2137 	return evm_inode_setattr(idmap, dentry, attr);
2138 }
2139 EXPORT_SYMBOL_GPL(security_inode_setattr);
2140 
2141 /**
2142  * security_inode_getattr() - Check if getting file attributes is allowed
2143  * @path: file
2144  *
2145  * Check permission before obtaining file attributes.
2146  *
2147  * Return: Returns 0 if permission is granted.
2148  */
security_inode_getattr(const struct path * path)2149 int security_inode_getattr(const struct path *path)
2150 {
2151 	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
2152 		return 0;
2153 	return call_int_hook(inode_getattr, 0, path);
2154 }
2155 
2156 /**
2157  * security_inode_setxattr() - Check if setting file xattrs is allowed
2158  * @idmap: idmap of the mount
2159  * @dentry: file
2160  * @name: xattr name
2161  * @value: xattr value
2162  * @size: size of xattr value
2163  * @flags: flags
2164  *
2165  * Check permission before setting the extended attributes.
2166  *
2167  * Return: Returns 0 if permission is granted.
2168  */
security_inode_setxattr(struct mnt_idmap * idmap,struct dentry * dentry,const char * name,const void * value,size_t size,int flags)2169 int security_inode_setxattr(struct mnt_idmap *idmap,
2170 			    struct dentry *dentry, const char *name,
2171 			    const void *value, size_t size, int flags)
2172 {
2173 	int ret;
2174 
2175 	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2176 		return 0;
2177 	/*
2178 	 * SELinux and Smack integrate the cap call,
2179 	 * so assume that all LSMs supplying this call do so.
2180 	 */
2181 	ret = call_int_hook(inode_setxattr, 1, idmap, dentry, name, value,
2182 			    size, flags);
2183 
2184 	if (ret == 1)
2185 		ret = cap_inode_setxattr(dentry, name, value, size, flags);
2186 	if (ret)
2187 		return ret;
2188 	ret = ima_inode_setxattr(dentry, name, value, size);
2189 	if (ret)
2190 		return ret;
2191 	return evm_inode_setxattr(idmap, dentry, name, value, size);
2192 }
2193 
2194 /**
2195  * security_inode_set_acl() - Check if setting posix acls is allowed
2196  * @idmap: idmap of the mount
2197  * @dentry: file
2198  * @acl_name: acl name
2199  * @kacl: acl struct
2200  *
2201  * Check permission before setting posix acls, the posix acls in @kacl are
2202  * identified by @acl_name.
2203  *
2204  * Return: Returns 0 if permission is granted.
2205  */
security_inode_set_acl(struct mnt_idmap * idmap,struct dentry * dentry,const char * acl_name,struct posix_acl * kacl)2206 int security_inode_set_acl(struct mnt_idmap *idmap,
2207 			   struct dentry *dentry, const char *acl_name,
2208 			   struct posix_acl *kacl)
2209 {
2210 	int ret;
2211 
2212 	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2213 		return 0;
2214 	ret = call_int_hook(inode_set_acl, 0, idmap, dentry, acl_name,
2215 			    kacl);
2216 	if (ret)
2217 		return ret;
2218 	ret = ima_inode_set_acl(idmap, dentry, acl_name, kacl);
2219 	if (ret)
2220 		return ret;
2221 	return evm_inode_set_acl(idmap, dentry, acl_name, kacl);
2222 }
2223 
2224 /**
2225  * security_inode_get_acl() - Check if reading posix acls is allowed
2226  * @idmap: idmap of the mount
2227  * @dentry: file
2228  * @acl_name: acl name
2229  *
2230  * Check permission before getting osix acls, the posix acls are identified by
2231  * @acl_name.
2232  *
2233  * Return: Returns 0 if permission is granted.
2234  */
security_inode_get_acl(struct mnt_idmap * idmap,struct dentry * dentry,const char * acl_name)2235 int security_inode_get_acl(struct mnt_idmap *idmap,
2236 			   struct dentry *dentry, const char *acl_name)
2237 {
2238 	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2239 		return 0;
2240 	return call_int_hook(inode_get_acl, 0, idmap, dentry, acl_name);
2241 }
2242 
2243 /**
2244  * security_inode_remove_acl() - Check if removing a posix acl is allowed
2245  * @idmap: idmap of the mount
2246  * @dentry: file
2247  * @acl_name: acl name
2248  *
2249  * Check permission before removing posix acls, the posix acls are identified
2250  * by @acl_name.
2251  *
2252  * Return: Returns 0 if permission is granted.
2253  */
security_inode_remove_acl(struct mnt_idmap * idmap,struct dentry * dentry,const char * acl_name)2254 int security_inode_remove_acl(struct mnt_idmap *idmap,
2255 			      struct dentry *dentry, const char *acl_name)
2256 {
2257 	int ret;
2258 
2259 	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2260 		return 0;
2261 	ret = call_int_hook(inode_remove_acl, 0, idmap, dentry, acl_name);
2262 	if (ret)
2263 		return ret;
2264 	ret = ima_inode_remove_acl(idmap, dentry, acl_name);
2265 	if (ret)
2266 		return ret;
2267 	return evm_inode_remove_acl(idmap, dentry, acl_name);
2268 }
2269 
2270 /**
2271  * security_inode_post_setxattr() - Update the inode after a setxattr operation
2272  * @dentry: file
2273  * @name: xattr name
2274  * @value: xattr value
2275  * @size: xattr value size
2276  * @flags: flags
2277  *
2278  * Update inode security field after successful setxattr operation.
2279  */
security_inode_post_setxattr(struct dentry * dentry,const char * name,const void * value,size_t size,int flags)2280 void security_inode_post_setxattr(struct dentry *dentry, const char *name,
2281 				  const void *value, size_t size, int flags)
2282 {
2283 	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2284 		return;
2285 	call_void_hook(inode_post_setxattr, dentry, name, value, size, flags);
2286 	evm_inode_post_setxattr(dentry, name, value, size);
2287 }
2288 
2289 /**
2290  * security_inode_getxattr() - Check if xattr access is allowed
2291  * @dentry: file
2292  * @name: xattr name
2293  *
2294  * Check permission before obtaining the extended attributes identified by
2295  * @name for @dentry.
2296  *
2297  * Return: Returns 0 if permission is granted.
2298  */
security_inode_getxattr(struct dentry * dentry,const char * name)2299 int security_inode_getxattr(struct dentry *dentry, const char *name)
2300 {
2301 	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2302 		return 0;
2303 	return call_int_hook(inode_getxattr, 0, dentry, name);
2304 }
2305 
2306 /**
2307  * security_inode_listxattr() - Check if listing xattrs is allowed
2308  * @dentry: file
2309  *
2310  * Check permission before obtaining the list of extended attribute names for
2311  * @dentry.
2312  *
2313  * Return: Returns 0 if permission is granted.
2314  */
security_inode_listxattr(struct dentry * dentry)2315 int security_inode_listxattr(struct dentry *dentry)
2316 {
2317 	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2318 		return 0;
2319 	return call_int_hook(inode_listxattr, 0, dentry);
2320 }
2321 
2322 /**
2323  * security_inode_removexattr() - Check if removing an xattr is allowed
2324  * @idmap: idmap of the mount
2325  * @dentry: file
2326  * @name: xattr name
2327  *
2328  * Check permission before removing the extended attribute identified by @name
2329  * for @dentry.
2330  *
2331  * Return: Returns 0 if permission is granted.
2332  */
security_inode_removexattr(struct mnt_idmap * idmap,struct dentry * dentry,const char * name)2333 int security_inode_removexattr(struct mnt_idmap *idmap,
2334 			       struct dentry *dentry, const char *name)
2335 {
2336 	int ret;
2337 
2338 	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2339 		return 0;
2340 	/*
2341 	 * SELinux and Smack integrate the cap call,
2342 	 * so assume that all LSMs supplying this call do so.
2343 	 */
2344 	ret = call_int_hook(inode_removexattr, 1, idmap, dentry, name);
2345 	if (ret == 1)
2346 		ret = cap_inode_removexattr(idmap, dentry, name);
2347 	if (ret)
2348 		return ret;
2349 	ret = ima_inode_removexattr(dentry, name);
2350 	if (ret)
2351 		return ret;
2352 	return evm_inode_removexattr(idmap, dentry, name);
2353 }
2354 
2355 /**
2356  * security_inode_need_killpriv() - Check if security_inode_killpriv() required
2357  * @dentry: associated dentry
2358  *
2359  * Called when an inode has been changed to determine if
2360  * security_inode_killpriv() should be called.
2361  *
2362  * Return: Return <0 on error to abort the inode change operation, return 0 if
2363  *         security_inode_killpriv() does not need to be called, return >0 if
2364  *         security_inode_killpriv() does need to be called.
2365  */
security_inode_need_killpriv(struct dentry * dentry)2366 int security_inode_need_killpriv(struct dentry *dentry)
2367 {
2368 	return call_int_hook(inode_need_killpriv, 0, dentry);
2369 }
2370 
2371 /**
2372  * security_inode_killpriv() - The setuid bit is removed, update LSM state
2373  * @idmap: idmap of the mount
2374  * @dentry: associated dentry
2375  *
2376  * The @dentry's setuid bit is being removed.  Remove similar security labels.
2377  * Called with the dentry->d_inode->i_mutex held.
2378  *
2379  * Return: Return 0 on success.  If error is returned, then the operation
2380  *         causing setuid bit removal is failed.
2381  */
security_inode_killpriv(struct mnt_idmap * idmap,struct dentry * dentry)2382 int security_inode_killpriv(struct mnt_idmap *idmap,
2383 			    struct dentry *dentry)
2384 {
2385 	return call_int_hook(inode_killpriv, 0, idmap, dentry);
2386 }
2387 
2388 /**
2389  * security_inode_getsecurity() - Get the xattr security label of an inode
2390  * @idmap: idmap of the mount
2391  * @inode: inode
2392  * @name: xattr name
2393  * @buffer: security label buffer
2394  * @alloc: allocation flag
2395  *
2396  * Retrieve a copy of the extended attribute representation of the security
2397  * label associated with @name for @inode via @buffer.  Note that @name is the
2398  * remainder of the attribute name after the security prefix has been removed.
2399  * @alloc is used to specify if the call should return a value via the buffer
2400  * or just the value length.
2401  *
2402  * Return: Returns size of buffer on success.
2403  */
security_inode_getsecurity(struct mnt_idmap * idmap,struct inode * inode,const char * name,void ** buffer,bool alloc)2404 int security_inode_getsecurity(struct mnt_idmap *idmap,
2405 			       struct inode *inode, const char *name,
2406 			       void **buffer, bool alloc)
2407 {
2408 	struct security_hook_list *hp;
2409 	int rc;
2410 
2411 	if (unlikely(IS_PRIVATE(inode)))
2412 		return LSM_RET_DEFAULT(inode_getsecurity);
2413 	/*
2414 	 * Only one module will provide an attribute with a given name.
2415 	 */
2416 	hlist_for_each_entry(hp, &security_hook_heads.inode_getsecurity, list) {
2417 		rc = hp->hook.inode_getsecurity(idmap, inode, name, buffer,
2418 						alloc);
2419 		if (rc != LSM_RET_DEFAULT(inode_getsecurity))
2420 			return rc;
2421 	}
2422 	return LSM_RET_DEFAULT(inode_getsecurity);
2423 }
2424 
2425 /**
2426  * security_inode_setsecurity() - Set the xattr security label of an inode
2427  * @inode: inode
2428  * @name: xattr name
2429  * @value: security label
2430  * @size: length of security label
2431  * @flags: flags
2432  *
2433  * Set the security label associated with @name for @inode from the extended
2434  * attribute value @value.  @size indicates the size of the @value in bytes.
2435  * @flags may be XATTR_CREATE, XATTR_REPLACE, or 0. Note that @name is the
2436  * remainder of the attribute name after the security. prefix has been removed.
2437  *
2438  * Return: Returns 0 on success.
2439  */
security_inode_setsecurity(struct inode * inode,const char * name,const void * value,size_t size,int flags)2440 int security_inode_setsecurity(struct inode *inode, const char *name,
2441 			       const void *value, size_t size, int flags)
2442 {
2443 	struct security_hook_list *hp;
2444 	int rc;
2445 
2446 	if (unlikely(IS_PRIVATE(inode)))
2447 		return LSM_RET_DEFAULT(inode_setsecurity);
2448 	/*
2449 	 * Only one module will provide an attribute with a given name.
2450 	 */
2451 	hlist_for_each_entry(hp, &security_hook_heads.inode_setsecurity, list) {
2452 		rc = hp->hook.inode_setsecurity(inode, name, value, size,
2453 						flags);
2454 		if (rc != LSM_RET_DEFAULT(inode_setsecurity))
2455 			return rc;
2456 	}
2457 	return LSM_RET_DEFAULT(inode_setsecurity);
2458 }
2459 
2460 /**
2461  * security_inode_listsecurity() - List the xattr security label names
2462  * @inode: inode
2463  * @buffer: buffer
2464  * @buffer_size: size of buffer
2465  *
2466  * Copy the extended attribute names for the security labels associated with
2467  * @inode into @buffer.  The maximum size of @buffer is specified by
2468  * @buffer_size.  @buffer may be NULL to request the size of the buffer
2469  * required.
2470  *
2471  * Return: Returns number of bytes used/required on success.
2472  */
security_inode_listsecurity(struct inode * inode,char * buffer,size_t buffer_size)2473 int security_inode_listsecurity(struct inode *inode,
2474 				char *buffer, size_t buffer_size)
2475 {
2476 	if (unlikely(IS_PRIVATE(inode)))
2477 		return 0;
2478 	return call_int_hook(inode_listsecurity, 0, inode, buffer, buffer_size);
2479 }
2480 EXPORT_SYMBOL(security_inode_listsecurity);
2481 
2482 /**
2483  * security_inode_getsecid() - Get an inode's secid
2484  * @inode: inode
2485  * @secid: secid to return
2486  *
2487  * Get the secid associated with the node.  In case of failure, @secid will be
2488  * set to zero.
2489  */
security_inode_getsecid(struct inode * inode,u32 * secid)2490 void security_inode_getsecid(struct inode *inode, u32 *secid)
2491 {
2492 	call_void_hook(inode_getsecid, inode, secid);
2493 }
2494 
2495 /**
2496  * security_inode_copy_up() - Create new creds for an overlayfs copy-up op
2497  * @src: union dentry of copy-up file
2498  * @new: newly created creds
2499  *
2500  * A file is about to be copied up from lower layer to upper layer of overlay
2501  * filesystem. Security module can prepare a set of new creds and modify as
2502  * need be and return new creds. Caller will switch to new creds temporarily to
2503  * create new file and release newly allocated creds.
2504  *
2505  * Return: Returns 0 on success or a negative error code on error.
2506  */
security_inode_copy_up(struct dentry * src,struct cred ** new)2507 int security_inode_copy_up(struct dentry *src, struct cred **new)
2508 {
2509 	return call_int_hook(inode_copy_up, 0, src, new);
2510 }
2511 EXPORT_SYMBOL(security_inode_copy_up);
2512 
2513 /**
2514  * security_inode_copy_up_xattr() - Filter xattrs in an overlayfs copy-up op
2515  * @name: xattr name
2516  *
2517  * Filter the xattrs being copied up when a unioned file is copied up from a
2518  * lower layer to the union/overlay layer.   The caller is responsible for
2519  * reading and writing the xattrs, this hook is merely a filter.
2520  *
2521  * Return: Returns 0 to accept the xattr, 1 to discard the xattr, -EOPNOTSUPP
2522  *         if the security module does not know about attribute, or a negative
2523  *         error code to abort the copy up.
2524  */
security_inode_copy_up_xattr(const char * name)2525 int security_inode_copy_up_xattr(const char *name)
2526 {
2527 	struct security_hook_list *hp;
2528 	int rc;
2529 
2530 	/*
2531 	 * The implementation can return 0 (accept the xattr), 1 (discard the
2532 	 * xattr), -EOPNOTSUPP if it does not know anything about the xattr or
2533 	 * any other error code in case of an error.
2534 	 */
2535 	hlist_for_each_entry(hp,
2536 			     &security_hook_heads.inode_copy_up_xattr, list) {
2537 		rc = hp->hook.inode_copy_up_xattr(name);
2538 		if (rc != LSM_RET_DEFAULT(inode_copy_up_xattr))
2539 			return rc;
2540 	}
2541 
2542 	return LSM_RET_DEFAULT(inode_copy_up_xattr);
2543 }
2544 EXPORT_SYMBOL(security_inode_copy_up_xattr);
2545 
2546 /**
2547  * security_kernfs_init_security() - Init LSM context for a kernfs node
2548  * @kn_dir: parent kernfs node
2549  * @kn: the kernfs node to initialize
2550  *
2551  * Initialize the security context of a newly created kernfs node based on its
2552  * own and its parent's attributes.
2553  *
2554  * Return: Returns 0 if permission is granted.
2555  */
security_kernfs_init_security(struct kernfs_node * kn_dir,struct kernfs_node * kn)2556 int security_kernfs_init_security(struct kernfs_node *kn_dir,
2557 				  struct kernfs_node *kn)
2558 {
2559 	return call_int_hook(kernfs_init_security, 0, kn_dir, kn);
2560 }
2561 
2562 /**
2563  * security_file_permission() - Check file permissions
2564  * @file: file
2565  * @mask: requested permissions
2566  *
2567  * Check file permissions before accessing an open file.  This hook is called
2568  * by various operations that read or write files.  A security module can use
2569  * this hook to perform additional checking on these operations, e.g. to
2570  * revalidate permissions on use to support privilege bracketing or policy
2571  * changes.  Notice that this hook is used when the actual read/write
2572  * operations are performed, whereas the inode_security_ops hook is called when
2573  * a file is opened (as well as many other operations).  Although this hook can
2574  * be used to revalidate permissions for various system call operations that
2575  * read or write files, it does not address the revalidation of permissions for
2576  * memory-mapped files.  Security modules must handle this separately if they
2577  * need such revalidation.
2578  *
2579  * Return: Returns 0 if permission is granted.
2580  */
security_file_permission(struct file * file,int mask)2581 int security_file_permission(struct file *file, int mask)
2582 {
2583 	int ret;
2584 
2585 	ret = call_int_hook(file_permission, 0, file, mask);
2586 	if (ret)
2587 		return ret;
2588 
2589 	return fsnotify_perm(file, mask);
2590 }
2591 
2592 /**
2593  * security_file_alloc() - Allocate and init a file's LSM blob
2594  * @file: the file
2595  *
2596  * Allocate and attach a security structure to the file->f_security field.  The
2597  * security field is initialized to NULL when the structure is first created.
2598  *
2599  * Return: Return 0 if the hook is successful and permission is granted.
2600  */
security_file_alloc(struct file * file)2601 int security_file_alloc(struct file *file)
2602 {
2603 	int rc = lsm_file_alloc(file);
2604 
2605 	if (rc)
2606 		return rc;
2607 	rc = call_int_hook(file_alloc_security, 0, file);
2608 	if (unlikely(rc))
2609 		security_file_free(file);
2610 	return rc;
2611 }
2612 
2613 /**
2614  * security_file_free() - Free a file's LSM blob
2615  * @file: the file
2616  *
2617  * Deallocate and free any security structures stored in file->f_security.
2618  */
security_file_free(struct file * file)2619 void security_file_free(struct file *file)
2620 {
2621 	void *blob;
2622 
2623 	call_void_hook(file_free_security, file);
2624 
2625 	blob = file->f_security;
2626 	if (blob) {
2627 		file->f_security = NULL;
2628 		kmem_cache_free(lsm_file_cache, blob);
2629 	}
2630 }
2631 
2632 /**
2633  * security_file_ioctl() - Check if an ioctl is allowed
2634  * @file: associated file
2635  * @cmd: ioctl cmd
2636  * @arg: ioctl arguments
2637  *
2638  * Check permission for an ioctl operation on @file.  Note that @arg sometimes
2639  * represents a user space pointer; in other cases, it may be a simple integer
2640  * value.  When @arg represents a user space pointer, it should never be used
2641  * by the security module.
2642  *
2643  * Return: Returns 0 if permission is granted.
2644  */
security_file_ioctl(struct file * file,unsigned int cmd,unsigned long arg)2645 int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2646 {
2647 	return call_int_hook(file_ioctl, 0, file, cmd, arg);
2648 }
2649 EXPORT_SYMBOL_GPL(security_file_ioctl);
2650 
2651 /**
2652  * security_file_ioctl_compat() - Check if an ioctl is allowed in compat mode
2653  * @file: associated file
2654  * @cmd: ioctl cmd
2655  * @arg: ioctl arguments
2656  *
2657  * Compat version of security_file_ioctl() that correctly handles 32-bit
2658  * processes running on 64-bit kernels.
2659  *
2660  * Return: Returns 0 if permission is granted.
2661  */
security_file_ioctl_compat(struct file * file,unsigned int cmd,unsigned long arg)2662 int security_file_ioctl_compat(struct file *file, unsigned int cmd,
2663 			       unsigned long arg)
2664 {
2665 	return call_int_hook(file_ioctl_compat, 0, file, cmd, arg);
2666 }
2667 EXPORT_SYMBOL_GPL(security_file_ioctl_compat);
2668 
mmap_prot(struct file * file,unsigned long prot)2669 static inline unsigned long mmap_prot(struct file *file, unsigned long prot)
2670 {
2671 	/*
2672 	 * Does we have PROT_READ and does the application expect
2673 	 * it to imply PROT_EXEC?  If not, nothing to talk about...
2674 	 */
2675 	if ((prot & (PROT_READ | PROT_EXEC)) != PROT_READ)
2676 		return prot;
2677 	if (!(current->personality & READ_IMPLIES_EXEC))
2678 		return prot;
2679 	/*
2680 	 * if that's an anonymous mapping, let it.
2681 	 */
2682 	if (!file)
2683 		return prot | PROT_EXEC;
2684 	/*
2685 	 * ditto if it's not on noexec mount, except that on !MMU we need
2686 	 * NOMMU_MAP_EXEC (== VM_MAYEXEC) in this case
2687 	 */
2688 	if (!path_noexec(&file->f_path)) {
2689 #ifndef CONFIG_MMU
2690 		if (file->f_op->mmap_capabilities) {
2691 			unsigned caps = file->f_op->mmap_capabilities(file);
2692 			if (!(caps & NOMMU_MAP_EXEC))
2693 				return prot;
2694 		}
2695 #endif
2696 		return prot | PROT_EXEC;
2697 	}
2698 	/* anything on noexec mount won't get PROT_EXEC */
2699 	return prot;
2700 }
2701 
2702 /**
2703  * security_mmap_file() - Check if mmap'ing a file is allowed
2704  * @file: file
2705  * @prot: protection applied by the kernel
2706  * @flags: flags
2707  *
2708  * Check permissions for a mmap operation.  The @file may be NULL, e.g. if
2709  * mapping anonymous memory.
2710  *
2711  * Return: Returns 0 if permission is granted.
2712  */
security_mmap_file(struct file * file,unsigned long prot,unsigned long flags)2713 int security_mmap_file(struct file *file, unsigned long prot,
2714 		       unsigned long flags)
2715 {
2716 	unsigned long prot_adj = mmap_prot(file, prot);
2717 	int ret;
2718 
2719 	ret = call_int_hook(mmap_file, 0, file, prot, prot_adj, flags);
2720 	if (ret)
2721 		return ret;
2722 	return ima_file_mmap(file, prot, prot_adj, flags);
2723 }
2724 
2725 /**
2726  * security_mmap_addr() - Check if mmap'ing an address is allowed
2727  * @addr: address
2728  *
2729  * Check permissions for a mmap operation at @addr.
2730  *
2731  * Return: Returns 0 if permission is granted.
2732  */
security_mmap_addr(unsigned long addr)2733 int security_mmap_addr(unsigned long addr)
2734 {
2735 	return call_int_hook(mmap_addr, 0, addr);
2736 }
2737 
2738 /**
2739  * security_file_mprotect() - Check if changing memory protections is allowed
2740  * @vma: memory region
2741  * @reqprot: application requested protection
2742  * @prot: protection applied by the kernel
2743  *
2744  * Check permissions before changing memory access permissions.
2745  *
2746  * Return: Returns 0 if permission is granted.
2747  */
security_file_mprotect(struct vm_area_struct * vma,unsigned long reqprot,unsigned long prot)2748 int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
2749 			   unsigned long prot)
2750 {
2751 	int ret;
2752 
2753 	ret = call_int_hook(file_mprotect, 0, vma, reqprot, prot);
2754 	if (ret)
2755 		return ret;
2756 	return ima_file_mprotect(vma, prot);
2757 }
2758 
2759 /**
2760  * security_file_lock() - Check if a file lock is allowed
2761  * @file: file
2762  * @cmd: lock operation (e.g. F_RDLCK, F_WRLCK)
2763  *
2764  * Check permission before performing file locking operations.  Note the hook
2765  * mediates both flock and fcntl style locks.
2766  *
2767  * Return: Returns 0 if permission is granted.
2768  */
security_file_lock(struct file * file,unsigned int cmd)2769 int security_file_lock(struct file *file, unsigned int cmd)
2770 {
2771 	return call_int_hook(file_lock, 0, file, cmd);
2772 }
2773 
2774 /**
2775  * security_file_fcntl() - Check if fcntl() op is allowed
2776  * @file: file
2777  * @cmd: fcntl command
2778  * @arg: command argument
2779  *
2780  * Check permission before allowing the file operation specified by @cmd from
2781  * being performed on the file @file.  Note that @arg sometimes represents a
2782  * user space pointer; in other cases, it may be a simple integer value.  When
2783  * @arg represents a user space pointer, it should never be used by the
2784  * security module.
2785  *
2786  * Return: Returns 0 if permission is granted.
2787  */
security_file_fcntl(struct file * file,unsigned int cmd,unsigned long arg)2788 int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
2789 {
2790 	return call_int_hook(file_fcntl, 0, file, cmd, arg);
2791 }
2792 
2793 /**
2794  * security_file_set_fowner() - Set the file owner info in the LSM blob
2795  * @file: the file
2796  *
2797  * Save owner security information (typically from current->security) in
2798  * file->f_security for later use by the send_sigiotask hook.
2799  *
2800  * Return: Returns 0 on success.
2801  */
security_file_set_fowner(struct file * file)2802 void security_file_set_fowner(struct file *file)
2803 {
2804 	call_void_hook(file_set_fowner, file);
2805 }
2806 
2807 /**
2808  * security_file_send_sigiotask() - Check if sending SIGIO/SIGURG is allowed
2809  * @tsk: target task
2810  * @fown: signal sender
2811  * @sig: signal to be sent, SIGIO is sent if 0
2812  *
2813  * Check permission for the file owner @fown to send SIGIO or SIGURG to the
2814  * process @tsk.  Note that this hook is sometimes called from interrupt.  Note
2815  * that the fown_struct, @fown, is never outside the context of a struct file,
2816  * so the file structure (and associated security information) can always be
2817  * obtained: container_of(fown, struct file, f_owner).
2818  *
2819  * Return: Returns 0 if permission is granted.
2820  */
security_file_send_sigiotask(struct task_struct * tsk,struct fown_struct * fown,int sig)2821 int security_file_send_sigiotask(struct task_struct *tsk,
2822 				 struct fown_struct *fown, int sig)
2823 {
2824 	return call_int_hook(file_send_sigiotask, 0, tsk, fown, sig);
2825 }
2826 
2827 /**
2828  * security_file_receive() - Check is receiving a file via IPC is allowed
2829  * @file: file being received
2830  *
2831  * This hook allows security modules to control the ability of a process to
2832  * receive an open file descriptor via socket IPC.
2833  *
2834  * Return: Returns 0 if permission is granted.
2835  */
security_file_receive(struct file * file)2836 int security_file_receive(struct file *file)
2837 {
2838 	return call_int_hook(file_receive, 0, file);
2839 }
2840 
2841 /**
2842  * security_file_open() - Save open() time state for late use by the LSM
2843  * @file:
2844  *
2845  * Save open-time permission checking state for later use upon file_permission,
2846  * and recheck access if anything has changed since inode_permission.
2847  *
2848  * Return: Returns 0 if permission is granted.
2849  */
security_file_open(struct file * file)2850 int security_file_open(struct file *file)
2851 {
2852 	int ret;
2853 
2854 	ret = call_int_hook(file_open, 0, file);
2855 	if (ret)
2856 		return ret;
2857 
2858 	return fsnotify_perm(file, MAY_OPEN);
2859 }
2860 
2861 /**
2862  * security_file_truncate() - Check if truncating a file is allowed
2863  * @file: file
2864  *
2865  * Check permission before truncating a file, i.e. using ftruncate.  Note that
2866  * truncation permission may also be checked based on the path, using the
2867  * @path_truncate hook.
2868  *
2869  * Return: Returns 0 if permission is granted.
2870  */
security_file_truncate(struct file * file)2871 int security_file_truncate(struct file *file)
2872 {
2873 	return call_int_hook(file_truncate, 0, file);
2874 }
2875 
2876 /**
2877  * security_task_alloc() - Allocate a task's LSM blob
2878  * @task: the task
2879  * @clone_flags: flags indicating what is being shared
2880  *
2881  * Handle allocation of task-related resources.
2882  *
2883  * Return: Returns a zero on success, negative values on failure.
2884  */
security_task_alloc(struct task_struct * task,unsigned long clone_flags)2885 int security_task_alloc(struct task_struct *task, unsigned long clone_flags)
2886 {
2887 	int rc = lsm_task_alloc(task);
2888 
2889 	if (rc)
2890 		return rc;
2891 	rc = call_int_hook(task_alloc, 0, task, clone_flags);
2892 	if (unlikely(rc))
2893 		security_task_free(task);
2894 	return rc;
2895 }
2896 
2897 /**
2898  * security_task_free() - Free a task's LSM blob and related resources
2899  * @task: task
2900  *
2901  * Handle release of task-related resources.  Note that this can be called from
2902  * interrupt context.
2903  */
security_task_free(struct task_struct * task)2904 void security_task_free(struct task_struct *task)
2905 {
2906 	call_void_hook(task_free, task);
2907 
2908 	kfree(task->security);
2909 	task->security = NULL;
2910 }
2911 
2912 /**
2913  * security_cred_alloc_blank() - Allocate the min memory to allow cred_transfer
2914  * @cred: credentials
2915  * @gfp: gfp flags
2916  *
2917  * Only allocate sufficient memory and attach to @cred such that
2918  * cred_transfer() will not get ENOMEM.
2919  *
2920  * Return: Returns 0 on success, negative values on failure.
2921  */
security_cred_alloc_blank(struct cred * cred,gfp_t gfp)2922 int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)
2923 {
2924 	int rc = lsm_cred_alloc(cred, gfp);
2925 
2926 	if (rc)
2927 		return rc;
2928 
2929 	rc = call_int_hook(cred_alloc_blank, 0, cred, gfp);
2930 	if (unlikely(rc))
2931 		security_cred_free(cred);
2932 	return rc;
2933 }
2934 
2935 /**
2936  * security_cred_free() - Free the cred's LSM blob and associated resources
2937  * @cred: credentials
2938  *
2939  * Deallocate and clear the cred->security field in a set of credentials.
2940  */
security_cred_free(struct cred * cred)2941 void security_cred_free(struct cred *cred)
2942 {
2943 	/*
2944 	 * There is a failure case in prepare_creds() that
2945 	 * may result in a call here with ->security being NULL.
2946 	 */
2947 	if (unlikely(cred->security == NULL))
2948 		return;
2949 
2950 	call_void_hook(cred_free, cred);
2951 
2952 	kfree(cred->security);
2953 	cred->security = NULL;
2954 }
2955 
2956 /**
2957  * security_prepare_creds() - Prepare a new set of credentials
2958  * @new: new credentials
2959  * @old: original credentials
2960  * @gfp: gfp flags
2961  *
2962  * Prepare a new set of credentials by copying the data from the old set.
2963  *
2964  * Return: Returns 0 on success, negative values on failure.
2965  */
security_prepare_creds(struct cred * new,const struct cred * old,gfp_t gfp)2966 int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp)
2967 {
2968 	int rc = lsm_cred_alloc(new, gfp);
2969 
2970 	if (rc)
2971 		return rc;
2972 
2973 	rc = call_int_hook(cred_prepare, 0, new, old, gfp);
2974 	if (unlikely(rc))
2975 		security_cred_free(new);
2976 	return rc;
2977 }
2978 
2979 /**
2980  * security_transfer_creds() - Transfer creds
2981  * @new: target credentials
2982  * @old: original credentials
2983  *
2984  * Transfer data from original creds to new creds.
2985  */
security_transfer_creds(struct cred * new,const struct cred * old)2986 void security_transfer_creds(struct cred *new, const struct cred *old)
2987 {
2988 	call_void_hook(cred_transfer, new, old);
2989 }
2990 
2991 /**
2992  * security_cred_getsecid() - Get the secid from a set of credentials
2993  * @c: credentials
2994  * @secid: secid value
2995  *
2996  * Retrieve the security identifier of the cred structure @c.  In case of
2997  * failure, @secid will be set to zero.
2998  */
security_cred_getsecid(const struct cred * c,u32 * secid)2999 void security_cred_getsecid(const struct cred *c, u32 *secid)
3000 {
3001 	*secid = 0;
3002 	call_void_hook(cred_getsecid, c, secid);
3003 }
3004 EXPORT_SYMBOL(security_cred_getsecid);
3005 
3006 /**
3007  * security_kernel_act_as() - Set the kernel credentials to act as secid
3008  * @new: credentials
3009  * @secid: secid
3010  *
3011  * Set the credentials for a kernel service to act as (subjective context).
3012  * The current task must be the one that nominated @secid.
3013  *
3014  * Return: Returns 0 if successful.
3015  */
security_kernel_act_as(struct cred * new,u32 secid)3016 int security_kernel_act_as(struct cred *new, u32 secid)
3017 {
3018 	return call_int_hook(kernel_act_as, 0, new, secid);
3019 }
3020 
3021 /**
3022  * security_kernel_create_files_as() - Set file creation context using an inode
3023  * @new: target credentials
3024  * @inode: reference inode
3025  *
3026  * Set the file creation context in a set of credentials to be the same as the
3027  * objective context of the specified inode.  The current task must be the one
3028  * that nominated @inode.
3029  *
3030  * Return: Returns 0 if successful.
3031  */
security_kernel_create_files_as(struct cred * new,struct inode * inode)3032 int security_kernel_create_files_as(struct cred *new, struct inode *inode)
3033 {
3034 	return call_int_hook(kernel_create_files_as, 0, new, inode);
3035 }
3036 
3037 /**
3038  * security_kernel_module_request() - Check is loading a module is allowed
3039  * @kmod_name: module name
3040  *
3041  * Ability to trigger the kernel to automatically upcall to userspace for
3042  * userspace to load a kernel module with the given name.
3043  *
3044  * Return: Returns 0 if successful.
3045  */
security_kernel_module_request(char * kmod_name)3046 int security_kernel_module_request(char *kmod_name)
3047 {
3048 	int ret;
3049 
3050 	ret = call_int_hook(kernel_module_request, 0, kmod_name);
3051 	if (ret)
3052 		return ret;
3053 	return integrity_kernel_module_request(kmod_name);
3054 }
3055 
3056 /**
3057  * security_kernel_read_file() - Read a file specified by userspace
3058  * @file: file
3059  * @id: file identifier
3060  * @contents: trust if security_kernel_post_read_file() will be called
3061  *
3062  * Read a file specified by userspace.
3063  *
3064  * Return: Returns 0 if permission is granted.
3065  */
security_kernel_read_file(struct file * file,enum kernel_read_file_id id,bool contents)3066 int security_kernel_read_file(struct file *file, enum kernel_read_file_id id,
3067 			      bool contents)
3068 {
3069 	int ret;
3070 
3071 	ret = call_int_hook(kernel_read_file, 0, file, id, contents);
3072 	if (ret)
3073 		return ret;
3074 	return ima_read_file(file, id, contents);
3075 }
3076 EXPORT_SYMBOL_GPL(security_kernel_read_file);
3077 
3078 /**
3079  * security_kernel_post_read_file() - Read a file specified by userspace
3080  * @file: file
3081  * @buf: file contents
3082  * @size: size of file contents
3083  * @id: file identifier
3084  *
3085  * Read a file specified by userspace.  This must be paired with a prior call
3086  * to security_kernel_read_file() call that indicated this hook would also be
3087  * called, see security_kernel_read_file() for more information.
3088  *
3089  * Return: Returns 0 if permission is granted.
3090  */
security_kernel_post_read_file(struct file * file,char * buf,loff_t size,enum kernel_read_file_id id)3091 int security_kernel_post_read_file(struct file *file, char *buf, loff_t size,
3092 				   enum kernel_read_file_id id)
3093 {
3094 	int ret;
3095 
3096 	ret = call_int_hook(kernel_post_read_file, 0, file, buf, size, id);
3097 	if (ret)
3098 		return ret;
3099 	return ima_post_read_file(file, buf, size, id);
3100 }
3101 EXPORT_SYMBOL_GPL(security_kernel_post_read_file);
3102 
3103 /**
3104  * security_kernel_load_data() - Load data provided by userspace
3105  * @id: data identifier
3106  * @contents: true if security_kernel_post_load_data() will be called
3107  *
3108  * Load data provided by userspace.
3109  *
3110  * Return: Returns 0 if permission is granted.
3111  */
security_kernel_load_data(enum kernel_load_data_id id,bool contents)3112 int security_kernel_load_data(enum kernel_load_data_id id, bool contents)
3113 {
3114 	int ret;
3115 
3116 	ret = call_int_hook(kernel_load_data, 0, id, contents);
3117 	if (ret)
3118 		return ret;
3119 	return ima_load_data(id, contents);
3120 }
3121 EXPORT_SYMBOL_GPL(security_kernel_load_data);
3122 
3123 /**
3124  * security_kernel_post_load_data() - Load userspace data from a non-file source
3125  * @buf: data
3126  * @size: size of data
3127  * @id: data identifier
3128  * @description: text description of data, specific to the id value
3129  *
3130  * Load data provided by a non-file source (usually userspace buffer).  This
3131  * must be paired with a prior security_kernel_load_data() call that indicated
3132  * this hook would also be called, see security_kernel_load_data() for more
3133  * information.
3134  *
3135  * Return: Returns 0 if permission is granted.
3136  */
security_kernel_post_load_data(char * buf,loff_t size,enum kernel_load_data_id id,char * description)3137 int security_kernel_post_load_data(char *buf, loff_t size,
3138 				   enum kernel_load_data_id id,
3139 				   char *description)
3140 {
3141 	int ret;
3142 
3143 	ret = call_int_hook(kernel_post_load_data, 0, buf, size, id,
3144 			    description);
3145 	if (ret)
3146 		return ret;
3147 	return ima_post_load_data(buf, size, id, description);
3148 }
3149 EXPORT_SYMBOL_GPL(security_kernel_post_load_data);
3150 
3151 /**
3152  * security_task_fix_setuid() - Update LSM with new user id attributes
3153  * @new: updated credentials
3154  * @old: credentials being replaced
3155  * @flags: LSM_SETID_* flag values
3156  *
3157  * Update the module's state after setting one or more of the user identity
3158  * attributes of the current process.  The @flags parameter indicates which of
3159  * the set*uid system calls invoked this hook.  If @new is the set of
3160  * credentials that will be installed.  Modifications should be made to this
3161  * rather than to @current->cred.
3162  *
3163  * Return: Returns 0 on success.
3164  */
security_task_fix_setuid(struct cred * new,const struct cred * old,int flags)3165 int security_task_fix_setuid(struct cred *new, const struct cred *old,
3166 			     int flags)
3167 {
3168 	return call_int_hook(task_fix_setuid, 0, new, old, flags);
3169 }
3170 
3171 /**
3172  * security_task_fix_setgid() - Update LSM with new group id attributes
3173  * @new: updated credentials
3174  * @old: credentials being replaced
3175  * @flags: LSM_SETID_* flag value
3176  *
3177  * Update the module's state after setting one or more of the group identity
3178  * attributes of the current process.  The @flags parameter indicates which of
3179  * the set*gid system calls invoked this hook.  @new is the set of credentials
3180  * that will be installed.  Modifications should be made to this rather than to
3181  * @current->cred.
3182  *
3183  * Return: Returns 0 on success.
3184  */
security_task_fix_setgid(struct cred * new,const struct cred * old,int flags)3185 int security_task_fix_setgid(struct cred *new, const struct cred *old,
3186 			     int flags)
3187 {
3188 	return call_int_hook(task_fix_setgid, 0, new, old, flags);
3189 }
3190 
3191 /**
3192  * security_task_fix_setgroups() - Update LSM with new supplementary groups
3193  * @new: updated credentials
3194  * @old: credentials being replaced
3195  *
3196  * Update the module's state after setting the supplementary group identity
3197  * attributes of the current process.  @new is the set of credentials that will
3198  * be installed.  Modifications should be made to this rather than to
3199  * @current->cred.
3200  *
3201  * Return: Returns 0 on success.
3202  */
security_task_fix_setgroups(struct cred * new,const struct cred * old)3203 int security_task_fix_setgroups(struct cred *new, const struct cred *old)
3204 {
3205 	return call_int_hook(task_fix_setgroups, 0, new, old);
3206 }
3207 
3208 /**
3209  * security_task_setpgid() - Check if setting the pgid is allowed
3210  * @p: task being modified
3211  * @pgid: new pgid
3212  *
3213  * Check permission before setting the process group identifier of the process
3214  * @p to @pgid.
3215  *
3216  * Return: Returns 0 if permission is granted.
3217  */
security_task_setpgid(struct task_struct * p,pid_t pgid)3218 int security_task_setpgid(struct task_struct *p, pid_t pgid)
3219 {
3220 	return call_int_hook(task_setpgid, 0, p, pgid);
3221 }
3222 
3223 /**
3224  * security_task_getpgid() - Check if getting the pgid is allowed
3225  * @p: task
3226  *
3227  * Check permission before getting the process group identifier of the process
3228  * @p.
3229  *
3230  * Return: Returns 0 if permission is granted.
3231  */
security_task_getpgid(struct task_struct * p)3232 int security_task_getpgid(struct task_struct *p)
3233 {
3234 	return call_int_hook(task_getpgid, 0, p);
3235 }
3236 
3237 /**
3238  * security_task_getsid() - Check if getting the session id is allowed
3239  * @p: task
3240  *
3241  * Check permission before getting the session identifier of the process @p.
3242  *
3243  * Return: Returns 0 if permission is granted.
3244  */
security_task_getsid(struct task_struct * p)3245 int security_task_getsid(struct task_struct *p)
3246 {
3247 	return call_int_hook(task_getsid, 0, p);
3248 }
3249 
3250 /**
3251  * security_current_getsecid_subj() - Get the current task's subjective secid
3252  * @secid: secid value
3253  *
3254  * Retrieve the subjective security identifier of the current task and return
3255  * it in @secid.  In case of failure, @secid will be set to zero.
3256  */
security_current_getsecid_subj(u32 * secid)3257 void security_current_getsecid_subj(u32 *secid)
3258 {
3259 	*secid = 0;
3260 	call_void_hook(current_getsecid_subj, secid);
3261 }
3262 EXPORT_SYMBOL(security_current_getsecid_subj);
3263 
3264 /**
3265  * security_task_getsecid_obj() - Get a task's objective secid
3266  * @p: target task
3267  * @secid: secid value
3268  *
3269  * Retrieve the objective security identifier of the task_struct in @p and
3270  * return it in @secid. In case of failure, @secid will be set to zero.
3271  */
security_task_getsecid_obj(struct task_struct * p,u32 * secid)3272 void security_task_getsecid_obj(struct task_struct *p, u32 *secid)
3273 {
3274 	*secid = 0;
3275 	call_void_hook(task_getsecid_obj, p, secid);
3276 }
3277 EXPORT_SYMBOL(security_task_getsecid_obj);
3278 
3279 /**
3280  * security_task_setnice() - Check if setting a task's nice value is allowed
3281  * @p: target task
3282  * @nice: nice value
3283  *
3284  * Check permission before setting the nice value of @p to @nice.
3285  *
3286  * Return: Returns 0 if permission is granted.
3287  */
security_task_setnice(struct task_struct * p,int nice)3288 int security_task_setnice(struct task_struct *p, int nice)
3289 {
3290 	return call_int_hook(task_setnice, 0, p, nice);
3291 }
3292 
3293 /**
3294  * security_task_setioprio() - Check if setting a task's ioprio is allowed
3295  * @p: target task
3296  * @ioprio: ioprio value
3297  *
3298  * Check permission before setting the ioprio value of @p to @ioprio.
3299  *
3300  * Return: Returns 0 if permission is granted.
3301  */
security_task_setioprio(struct task_struct * p,int ioprio)3302 int security_task_setioprio(struct task_struct *p, int ioprio)
3303 {
3304 	return call_int_hook(task_setioprio, 0, p, ioprio);
3305 }
3306 
3307 /**
3308  * security_task_getioprio() - Check if getting a task's ioprio is allowed
3309  * @p: task
3310  *
3311  * Check permission before getting the ioprio value of @p.
3312  *
3313  * Return: Returns 0 if permission is granted.
3314  */
security_task_getioprio(struct task_struct * p)3315 int security_task_getioprio(struct task_struct *p)
3316 {
3317 	return call_int_hook(task_getioprio, 0, p);
3318 }
3319 
3320 /**
3321  * security_task_prlimit() - Check if get/setting resources limits is allowed
3322  * @cred: current task credentials
3323  * @tcred: target task credentials
3324  * @flags: LSM_PRLIMIT_* flag bits indicating a get/set/both
3325  *
3326  * Check permission before getting and/or setting the resource limits of
3327  * another task.
3328  *
3329  * Return: Returns 0 if permission is granted.
3330  */
security_task_prlimit(const struct cred * cred,const struct cred * tcred,unsigned int flags)3331 int security_task_prlimit(const struct cred *cred, const struct cred *tcred,
3332 			  unsigned int flags)
3333 {
3334 	return call_int_hook(task_prlimit, 0, cred, tcred, flags);
3335 }
3336 
3337 /**
3338  * security_task_setrlimit() - Check if setting a new rlimit value is allowed
3339  * @p: target task's group leader
3340  * @resource: resource whose limit is being set
3341  * @new_rlim: new resource limit
3342  *
3343  * Check permission before setting the resource limits of process @p for
3344  * @resource to @new_rlim.  The old resource limit values can be examined by
3345  * dereferencing (p->signal->rlim + resource).
3346  *
3347  * Return: Returns 0 if permission is granted.
3348  */
security_task_setrlimit(struct task_struct * p,unsigned int resource,struct rlimit * new_rlim)3349 int security_task_setrlimit(struct task_struct *p, unsigned int resource,
3350 			    struct rlimit *new_rlim)
3351 {
3352 	return call_int_hook(task_setrlimit, 0, p, resource, new_rlim);
3353 }
3354 
3355 /**
3356  * security_task_setscheduler() - Check if setting sched policy/param is allowed
3357  * @p: target task
3358  *
3359  * Check permission before setting scheduling policy and/or parameters of
3360  * process @p.
3361  *
3362  * Return: Returns 0 if permission is granted.
3363  */
security_task_setscheduler(struct task_struct * p)3364 int security_task_setscheduler(struct task_struct *p)
3365 {
3366 	return call_int_hook(task_setscheduler, 0, p);
3367 }
3368 
3369 /**
3370  * security_task_getscheduler() - Check if getting scheduling info is allowed
3371  * @p: target task
3372  *
3373  * Check permission before obtaining scheduling information for process @p.
3374  *
3375  * Return: Returns 0 if permission is granted.
3376  */
security_task_getscheduler(struct task_struct * p)3377 int security_task_getscheduler(struct task_struct *p)
3378 {
3379 	return call_int_hook(task_getscheduler, 0, p);
3380 }
3381 
3382 /**
3383  * security_task_movememory() - Check if moving memory is allowed
3384  * @p: task
3385  *
3386  * Check permission before moving memory owned by process @p.
3387  *
3388  * Return: Returns 0 if permission is granted.
3389  */
security_task_movememory(struct task_struct * p)3390 int security_task_movememory(struct task_struct *p)
3391 {
3392 	return call_int_hook(task_movememory, 0, p);
3393 }
3394 
3395 /**
3396  * security_task_kill() - Check if sending a signal is allowed
3397  * @p: target process
3398  * @info: signal information
3399  * @sig: signal value
3400  * @cred: credentials of the signal sender, NULL if @current
3401  *
3402  * Check permission before sending signal @sig to @p.  @info can be NULL, the
3403  * constant 1, or a pointer to a kernel_siginfo structure.  If @info is 1 or
3404  * SI_FROMKERNEL(info) is true, then the signal should be viewed as coming from
3405  * the kernel and should typically be permitted.  SIGIO signals are handled
3406  * separately by the send_sigiotask hook in file_security_ops.
3407  *
3408  * Return: Returns 0 if permission is granted.
3409  */
security_task_kill(struct task_struct * p,struct kernel_siginfo * info,int sig,const struct cred * cred)3410 int security_task_kill(struct task_struct *p, struct kernel_siginfo *info,
3411 		       int sig, const struct cred *cred)
3412 {
3413 	return call_int_hook(task_kill, 0, p, info, sig, cred);
3414 }
3415 
3416 /**
3417  * security_task_prctl() - Check if a prctl op is allowed
3418  * @option: operation
3419  * @arg2: argument
3420  * @arg3: argument
3421  * @arg4: argument
3422  * @arg5: argument
3423  *
3424  * Check permission before performing a process control operation on the
3425  * current process.
3426  *
3427  * Return: Return -ENOSYS if no-one wanted to handle this op, any other value
3428  *         to cause prctl() to return immediately with that value.
3429  */
security_task_prctl(int option,unsigned long arg2,unsigned long arg3,unsigned long arg4,unsigned long arg5)3430 int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
3431 			unsigned long arg4, unsigned long arg5)
3432 {
3433 	int thisrc;
3434 	int rc = LSM_RET_DEFAULT(task_prctl);
3435 	struct security_hook_list *hp;
3436 
3437 	hlist_for_each_entry(hp, &security_hook_heads.task_prctl, list) {
3438 		thisrc = hp->hook.task_prctl(option, arg2, arg3, arg4, arg5);
3439 		if (thisrc != LSM_RET_DEFAULT(task_prctl)) {
3440 			rc = thisrc;
3441 			if (thisrc != 0)
3442 				break;
3443 		}
3444 	}
3445 	return rc;
3446 }
3447 
3448 /**
3449  * security_task_to_inode() - Set the security attributes of a task's inode
3450  * @p: task
3451  * @inode: inode
3452  *
3453  * Set the security attributes for an inode based on an associated task's
3454  * security attributes, e.g. for /proc/pid inodes.
3455  */
security_task_to_inode(struct task_struct * p,struct inode * inode)3456 void security_task_to_inode(struct task_struct *p, struct inode *inode)
3457 {
3458 	call_void_hook(task_to_inode, p, inode);
3459 }
3460 
3461 /**
3462  * security_create_user_ns() - Check if creating a new userns is allowed
3463  * @cred: prepared creds
3464  *
3465  * Check permission prior to creating a new user namespace.
3466  *
3467  * Return: Returns 0 if successful, otherwise < 0 error code.
3468  */
security_create_user_ns(const struct cred * cred)3469 int security_create_user_ns(const struct cred *cred)
3470 {
3471 	return call_int_hook(userns_create, 0, cred);
3472 }
3473 
3474 /**
3475  * security_ipc_permission() - Check if sysv ipc access is allowed
3476  * @ipcp: ipc permission structure
3477  * @flag: requested permissions
3478  *
3479  * Check permissions for access to IPC.
3480  *
3481  * Return: Returns 0 if permission is granted.
3482  */
security_ipc_permission(struct kern_ipc_perm * ipcp,short flag)3483 int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
3484 {
3485 	return call_int_hook(ipc_permission, 0, ipcp, flag);
3486 }
3487 
3488 /**
3489  * security_ipc_getsecid() - Get the sysv ipc object's secid
3490  * @ipcp: ipc permission structure
3491  * @secid: secid pointer
3492  *
3493  * Get the secid associated with the ipc object.  In case of failure, @secid
3494  * will be set to zero.
3495  */
security_ipc_getsecid(struct kern_ipc_perm * ipcp,u32 * secid)3496 void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
3497 {
3498 	*secid = 0;
3499 	call_void_hook(ipc_getsecid, ipcp, secid);
3500 }
3501 
3502 /**
3503  * security_msg_msg_alloc() - Allocate a sysv ipc message LSM blob
3504  * @msg: message structure
3505  *
3506  * Allocate and attach a security structure to the msg->security field.  The
3507  * security field is initialized to NULL when the structure is first created.
3508  *
3509  * Return: Return 0 if operation was successful and permission is granted.
3510  */
security_msg_msg_alloc(struct msg_msg * msg)3511 int security_msg_msg_alloc(struct msg_msg *msg)
3512 {
3513 	int rc = lsm_msg_msg_alloc(msg);
3514 
3515 	if (unlikely(rc))
3516 		return rc;
3517 	rc = call_int_hook(msg_msg_alloc_security, 0, msg);
3518 	if (unlikely(rc))
3519 		security_msg_msg_free(msg);
3520 	return rc;
3521 }
3522 
3523 /**
3524  * security_msg_msg_free() - Free a sysv ipc message LSM blob
3525  * @msg: message structure
3526  *
3527  * Deallocate the security structure for this message.
3528  */
security_msg_msg_free(struct msg_msg * msg)3529 void security_msg_msg_free(struct msg_msg *msg)
3530 {
3531 	call_void_hook(msg_msg_free_security, msg);
3532 	kfree(msg->security);
3533 	msg->security = NULL;
3534 }
3535 
3536 /**
3537  * security_msg_queue_alloc() - Allocate a sysv ipc msg queue LSM blob
3538  * @msq: sysv ipc permission structure
3539  *
3540  * Allocate and attach a security structure to @msg. The security field is
3541  * initialized to NULL when the structure is first created.
3542  *
3543  * Return: Returns 0 if operation was successful and permission is granted.
3544  */
security_msg_queue_alloc(struct kern_ipc_perm * msq)3545 int security_msg_queue_alloc(struct kern_ipc_perm *msq)
3546 {
3547 	int rc = lsm_ipc_alloc(msq);
3548 
3549 	if (unlikely(rc))
3550 		return rc;
3551 	rc = call_int_hook(msg_queue_alloc_security, 0, msq);
3552 	if (unlikely(rc))
3553 		security_msg_queue_free(msq);
3554 	return rc;
3555 }
3556 
3557 /**
3558  * security_msg_queue_free() - Free a sysv ipc msg queue LSM blob
3559  * @msq: sysv ipc permission structure
3560  *
3561  * Deallocate security field @perm->security for the message queue.
3562  */
security_msg_queue_free(struct kern_ipc_perm * msq)3563 void security_msg_queue_free(struct kern_ipc_perm *msq)
3564 {
3565 	call_void_hook(msg_queue_free_security, msq);
3566 	kfree(msq->security);
3567 	msq->security = NULL;
3568 }
3569 
3570 /**
3571  * security_msg_queue_associate() - Check if a msg queue operation is allowed
3572  * @msq: sysv ipc permission structure
3573  * @msqflg: operation flags
3574  *
3575  * Check permission when a message queue is requested through the msgget system
3576  * call. This hook is only called when returning the message queue identifier
3577  * for an existing message queue, not when a new message queue is created.
3578  *
3579  * Return: Return 0 if permission is granted.
3580  */
security_msg_queue_associate(struct kern_ipc_perm * msq,int msqflg)3581 int security_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
3582 {
3583 	return call_int_hook(msg_queue_associate, 0, msq, msqflg);
3584 }
3585 
3586 /**
3587  * security_msg_queue_msgctl() - Check if a msg queue operation is allowed
3588  * @msq: sysv ipc permission structure
3589  * @cmd: operation
3590  *
3591  * Check permission when a message control operation specified by @cmd is to be
3592  * performed on the message queue with permissions.
3593  *
3594  * Return: Returns 0 if permission is granted.
3595  */
security_msg_queue_msgctl(struct kern_ipc_perm * msq,int cmd)3596 int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
3597 {
3598 	return call_int_hook(msg_queue_msgctl, 0, msq, cmd);
3599 }
3600 
3601 /**
3602  * security_msg_queue_msgsnd() - Check if sending a sysv ipc message is allowed
3603  * @msq: sysv ipc permission structure
3604  * @msg: message
3605  * @msqflg: operation flags
3606  *
3607  * Check permission before a message, @msg, is enqueued on the message queue
3608  * with permissions specified in @msq.
3609  *
3610  * Return: Returns 0 if permission is granted.
3611  */
security_msg_queue_msgsnd(struct kern_ipc_perm * msq,struct msg_msg * msg,int msqflg)3612 int security_msg_queue_msgsnd(struct kern_ipc_perm *msq,
3613 			      struct msg_msg *msg, int msqflg)
3614 {
3615 	return call_int_hook(msg_queue_msgsnd, 0, msq, msg, msqflg);
3616 }
3617 
3618 /**
3619  * security_msg_queue_msgrcv() - Check if receiving a sysv ipc msg is allowed
3620  * @msq: sysv ipc permission structure
3621  * @msg: message
3622  * @target: target task
3623  * @type: type of message requested
3624  * @mode: operation flags
3625  *
3626  * Check permission before a message, @msg, is removed from the message	queue.
3627  * The @target task structure contains a pointer to the process that will be
3628  * receiving the message (not equal to the current process when inline receives
3629  * are being performed).
3630  *
3631  * Return: Returns 0 if permission is granted.
3632  */
security_msg_queue_msgrcv(struct kern_ipc_perm * msq,struct msg_msg * msg,struct task_struct * target,long type,int mode)3633 int security_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
3634 			      struct task_struct *target, long type, int mode)
3635 {
3636 	return call_int_hook(msg_queue_msgrcv, 0, msq, msg, target, type, mode);
3637 }
3638 
3639 /**
3640  * security_shm_alloc() - Allocate a sysv shm LSM blob
3641  * @shp: sysv ipc permission structure
3642  *
3643  * Allocate and attach a security structure to the @shp security field.  The
3644  * security field is initialized to NULL when the structure is first created.
3645  *
3646  * Return: Returns 0 if operation was successful and permission is granted.
3647  */
security_shm_alloc(struct kern_ipc_perm * shp)3648 int security_shm_alloc(struct kern_ipc_perm *shp)
3649 {
3650 	int rc = lsm_ipc_alloc(shp);
3651 
3652 	if (unlikely(rc))
3653 		return rc;
3654 	rc = call_int_hook(shm_alloc_security, 0, shp);
3655 	if (unlikely(rc))
3656 		security_shm_free(shp);
3657 	return rc;
3658 }
3659 
3660 /**
3661  * security_shm_free() - Free a sysv shm LSM blob
3662  * @shp: sysv ipc permission structure
3663  *
3664  * Deallocate the security structure @perm->security for the memory segment.
3665  */
security_shm_free(struct kern_ipc_perm * shp)3666 void security_shm_free(struct kern_ipc_perm *shp)
3667 {
3668 	call_void_hook(shm_free_security, shp);
3669 	kfree(shp->security);
3670 	shp->security = NULL;
3671 }
3672 
3673 /**
3674  * security_shm_associate() - Check if a sysv shm operation is allowed
3675  * @shp: sysv ipc permission structure
3676  * @shmflg: operation flags
3677  *
3678  * Check permission when a shared memory region is requested through the shmget
3679  * system call. This hook is only called when returning the shared memory
3680  * region identifier for an existing region, not when a new shared memory
3681  * region is created.
3682  *
3683  * Return: Returns 0 if permission is granted.
3684  */
security_shm_associate(struct kern_ipc_perm * shp,int shmflg)3685 int security_shm_associate(struct kern_ipc_perm *shp, int shmflg)
3686 {
3687 	return call_int_hook(shm_associate, 0, shp, shmflg);
3688 }
3689 
3690 /**
3691  * security_shm_shmctl() - Check if a sysv shm operation is allowed
3692  * @shp: sysv ipc permission structure
3693  * @cmd: operation
3694  *
3695  * Check permission when a shared memory control operation specified by @cmd is
3696  * to be performed on the shared memory region with permissions in @shp.
3697  *
3698  * Return: Return 0 if permission is granted.
3699  */
security_shm_shmctl(struct kern_ipc_perm * shp,int cmd)3700 int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
3701 {
3702 	return call_int_hook(shm_shmctl, 0, shp, cmd);
3703 }
3704 
3705 /**
3706  * security_shm_shmat() - Check if a sysv shm attach operation is allowed
3707  * @shp: sysv ipc permission structure
3708  * @shmaddr: address of memory region to attach
3709  * @shmflg: operation flags
3710  *
3711  * Check permissions prior to allowing the shmat system call to attach the
3712  * shared memory segment with permissions @shp to the data segment of the
3713  * calling process. The attaching address is specified by @shmaddr.
3714  *
3715  * Return: Returns 0 if permission is granted.
3716  */
security_shm_shmat(struct kern_ipc_perm * shp,char __user * shmaddr,int shmflg)3717 int security_shm_shmat(struct kern_ipc_perm *shp,
3718 		       char __user *shmaddr, int shmflg)
3719 {
3720 	return call_int_hook(shm_shmat, 0, shp, shmaddr, shmflg);
3721 }
3722 
3723 /**
3724  * security_sem_alloc() - Allocate a sysv semaphore LSM blob
3725  * @sma: sysv ipc permission structure
3726  *
3727  * Allocate and attach a security structure to the @sma security field. The
3728  * security field is initialized to NULL when the structure is first created.
3729  *
3730  * Return: Returns 0 if operation was successful and permission is granted.
3731  */
security_sem_alloc(struct kern_ipc_perm * sma)3732 int security_sem_alloc(struct kern_ipc_perm *sma)
3733 {
3734 	int rc = lsm_ipc_alloc(sma);
3735 
3736 	if (unlikely(rc))
3737 		return rc;
3738 	rc = call_int_hook(sem_alloc_security, 0, sma);
3739 	if (unlikely(rc))
3740 		security_sem_free(sma);
3741 	return rc;
3742 }
3743 
3744 /**
3745  * security_sem_free() - Free a sysv semaphore LSM blob
3746  * @sma: sysv ipc permission structure
3747  *
3748  * Deallocate security structure @sma->security for the semaphore.
3749  */
security_sem_free(struct kern_ipc_perm * sma)3750 void security_sem_free(struct kern_ipc_perm *sma)
3751 {
3752 	call_void_hook(sem_free_security, sma);
3753 	kfree(sma->security);
3754 	sma->security = NULL;
3755 }
3756 
3757 /**
3758  * security_sem_associate() - Check if a sysv semaphore operation is allowed
3759  * @sma: sysv ipc permission structure
3760  * @semflg: operation flags
3761  *
3762  * Check permission when a semaphore is requested through the semget system
3763  * call. This hook is only called when returning the semaphore identifier for
3764  * an existing semaphore, not when a new one must be created.
3765  *
3766  * Return: Returns 0 if permission is granted.
3767  */
security_sem_associate(struct kern_ipc_perm * sma,int semflg)3768 int security_sem_associate(struct kern_ipc_perm *sma, int semflg)
3769 {
3770 	return call_int_hook(sem_associate, 0, sma, semflg);
3771 }
3772 
3773 /**
3774  * security_sem_semctl() - Check if a sysv semaphore operation is allowed
3775  * @sma: sysv ipc permission structure
3776  * @cmd: operation
3777  *
3778  * Check permission when a semaphore operation specified by @cmd is to be
3779  * performed on the semaphore.
3780  *
3781  * Return: Returns 0 if permission is granted.
3782  */
security_sem_semctl(struct kern_ipc_perm * sma,int cmd)3783 int security_sem_semctl(struct kern_ipc_perm *sma, int cmd)
3784 {
3785 	return call_int_hook(sem_semctl, 0, sma, cmd);
3786 }
3787 
3788 /**
3789  * security_sem_semop() - Check if a sysv semaphore operation is allowed
3790  * @sma: sysv ipc permission structure
3791  * @sops: operations to perform
3792  * @nsops: number of operations
3793  * @alter: flag indicating changes will be made
3794  *
3795  * Check permissions before performing operations on members of the semaphore
3796  * set. If the @alter flag is nonzero, the semaphore set may be modified.
3797  *
3798  * Return: Returns 0 if permission is granted.
3799  */
security_sem_semop(struct kern_ipc_perm * sma,struct sembuf * sops,unsigned nsops,int alter)3800 int security_sem_semop(struct kern_ipc_perm *sma, struct sembuf *sops,
3801 		       unsigned nsops, int alter)
3802 {
3803 	return call_int_hook(sem_semop, 0, sma, sops, nsops, alter);
3804 }
3805 
3806 /**
3807  * security_d_instantiate() - Populate an inode's LSM state based on a dentry
3808  * @dentry: dentry
3809  * @inode: inode
3810  *
3811  * Fill in @inode security information for a @dentry if allowed.
3812  */
security_d_instantiate(struct dentry * dentry,struct inode * inode)3813 void security_d_instantiate(struct dentry *dentry, struct inode *inode)
3814 {
3815 	if (unlikely(inode && IS_PRIVATE(inode)))
3816 		return;
3817 	call_void_hook(d_instantiate, dentry, inode);
3818 }
3819 EXPORT_SYMBOL(security_d_instantiate);
3820 
3821 /**
3822  * security_getprocattr() - Read an attribute for a task
3823  * @p: the task
3824  * @lsm: LSM name
3825  * @name: attribute name
3826  * @value: attribute value
3827  *
3828  * Read attribute @name for task @p and store it into @value if allowed.
3829  *
3830  * Return: Returns the length of @value on success, a negative value otherwise.
3831  */
security_getprocattr(struct task_struct * p,const char * lsm,const char * name,char ** value)3832 int security_getprocattr(struct task_struct *p, const char *lsm,
3833 			 const char *name, char **value)
3834 {
3835 	struct security_hook_list *hp;
3836 
3837 	hlist_for_each_entry(hp, &security_hook_heads.getprocattr, list) {
3838 		if (lsm != NULL && strcmp(lsm, hp->lsm))
3839 			continue;
3840 		return hp->hook.getprocattr(p, name, value);
3841 	}
3842 	return LSM_RET_DEFAULT(getprocattr);
3843 }
3844 
3845 /**
3846  * security_setprocattr() - Set an attribute for a task
3847  * @lsm: LSM name
3848  * @name: attribute name
3849  * @value: attribute value
3850  * @size: attribute value size
3851  *
3852  * Write (set) the current task's attribute @name to @value, size @size if
3853  * allowed.
3854  *
3855  * Return: Returns bytes written on success, a negative value otherwise.
3856  */
security_setprocattr(const char * lsm,const char * name,void * value,size_t size)3857 int security_setprocattr(const char *lsm, const char *name, void *value,
3858 			 size_t size)
3859 {
3860 	struct security_hook_list *hp;
3861 
3862 	hlist_for_each_entry(hp, &security_hook_heads.setprocattr, list) {
3863 		if (lsm != NULL && strcmp(lsm, hp->lsm))
3864 			continue;
3865 		return hp->hook.setprocattr(name, value, size);
3866 	}
3867 	return LSM_RET_DEFAULT(setprocattr);
3868 }
3869 
3870 /**
3871  * security_netlink_send() - Save info and check if netlink sending is allowed
3872  * @sk: sending socket
3873  * @skb: netlink message
3874  *
3875  * Save security information for a netlink message so that permission checking
3876  * can be performed when the message is processed.  The security information
3877  * can be saved using the eff_cap field of the netlink_skb_parms structure.
3878  * Also may be used to provide fine grained control over message transmission.
3879  *
3880  * Return: Returns 0 if the information was successfully saved and message is
3881  *         allowed to be transmitted.
3882  */
security_netlink_send(struct sock * sk,struct sk_buff * skb)3883 int security_netlink_send(struct sock *sk, struct sk_buff *skb)
3884 {
3885 	return call_int_hook(netlink_send, 0, sk, skb);
3886 }
3887 
3888 /**
3889  * security_ismaclabel() - Check is the named attribute is a MAC label
3890  * @name: full extended attribute name
3891  *
3892  * Check if the extended attribute specified by @name represents a MAC label.
3893  *
3894  * Return: Returns 1 if name is a MAC attribute otherwise returns 0.
3895  */
security_ismaclabel(const char * name)3896 int security_ismaclabel(const char *name)
3897 {
3898 	return call_int_hook(ismaclabel, 0, name);
3899 }
3900 EXPORT_SYMBOL(security_ismaclabel);
3901 
3902 /**
3903  * security_secid_to_secctx() - Convert a secid to a secctx
3904  * @secid: secid
3905  * @secdata: secctx
3906  * @seclen: secctx length
3907  *
3908  * Convert secid to security context.  If @secdata is NULL the length of the
3909  * result will be returned in @seclen, but no @secdata will be returned.  This
3910  * does mean that the length could change between calls to check the length and
3911  * the next call which actually allocates and returns the @secdata.
3912  *
3913  * Return: Return 0 on success, error on failure.
3914  */
security_secid_to_secctx(u32 secid,char ** secdata,u32 * seclen)3915 int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
3916 {
3917 	struct security_hook_list *hp;
3918 	int rc;
3919 
3920 	/*
3921 	 * Currently, only one LSM can implement secid_to_secctx (i.e this
3922 	 * LSM hook is not "stackable").
3923 	 */
3924 	hlist_for_each_entry(hp, &security_hook_heads.secid_to_secctx, list) {
3925 		rc = hp->hook.secid_to_secctx(secid, secdata, seclen);
3926 		if (rc != LSM_RET_DEFAULT(secid_to_secctx))
3927 			return rc;
3928 	}
3929 
3930 	return LSM_RET_DEFAULT(secid_to_secctx);
3931 }
3932 EXPORT_SYMBOL(security_secid_to_secctx);
3933 
3934 /**
3935  * security_secctx_to_secid() - Convert a secctx to a secid
3936  * @secdata: secctx
3937  * @seclen: length of secctx
3938  * @secid: secid
3939  *
3940  * Convert security context to secid.
3941  *
3942  * Return: Returns 0 on success, error on failure.
3943  */
security_secctx_to_secid(const char * secdata,u32 seclen,u32 * secid)3944 int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
3945 {
3946 	*secid = 0;
3947 	return call_int_hook(secctx_to_secid, 0, secdata, seclen, secid);
3948 }
3949 EXPORT_SYMBOL(security_secctx_to_secid);
3950 
3951 /**
3952  * security_release_secctx() - Free a secctx buffer
3953  * @secdata: secctx
3954  * @seclen: length of secctx
3955  *
3956  * Release the security context.
3957  */
security_release_secctx(char * secdata,u32 seclen)3958 void security_release_secctx(char *secdata, u32 seclen)
3959 {
3960 	call_void_hook(release_secctx, secdata, seclen);
3961 }
3962 EXPORT_SYMBOL(security_release_secctx);
3963 
3964 /**
3965  * security_inode_invalidate_secctx() - Invalidate an inode's security label
3966  * @inode: inode
3967  *
3968  * Notify the security module that it must revalidate the security context of
3969  * an inode.
3970  */
security_inode_invalidate_secctx(struct inode * inode)3971 void security_inode_invalidate_secctx(struct inode *inode)
3972 {
3973 	call_void_hook(inode_invalidate_secctx, inode);
3974 }
3975 EXPORT_SYMBOL(security_inode_invalidate_secctx);
3976 
3977 /**
3978  * security_inode_notifysecctx() - Nofify the LSM of an inode's security label
3979  * @inode: inode
3980  * @ctx: secctx
3981  * @ctxlen: length of secctx
3982  *
3983  * Notify the security module of what the security context of an inode should
3984  * be.  Initializes the incore security context managed by the security module
3985  * for this inode.  Example usage: NFS client invokes this hook to initialize
3986  * the security context in its incore inode to the value provided by the server
3987  * for the file when the server returned the file's attributes to the client.
3988  * Must be called with inode->i_mutex locked.
3989  *
3990  * Return: Returns 0 on success, error on failure.
3991  */
security_inode_notifysecctx(struct inode * inode,void * ctx,u32 ctxlen)3992 int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
3993 {
3994 	return call_int_hook(inode_notifysecctx, 0, inode, ctx, ctxlen);
3995 }
3996 EXPORT_SYMBOL(security_inode_notifysecctx);
3997 
3998 /**
3999  * security_inode_setsecctx() - Change the security label of an inode
4000  * @dentry: inode
4001  * @ctx: secctx
4002  * @ctxlen: length of secctx
4003  *
4004  * Change the security context of an inode.  Updates the incore security
4005  * context managed by the security module and invokes the fs code as needed
4006  * (via __vfs_setxattr_noperm) to update any backing xattrs that represent the
4007  * context.  Example usage: NFS server invokes this hook to change the security
4008  * context in its incore inode and on the backing filesystem to a value
4009  * provided by the client on a SETATTR operation.  Must be called with
4010  * inode->i_mutex locked.
4011  *
4012  * Return: Returns 0 on success, error on failure.
4013  */
security_inode_setsecctx(struct dentry * dentry,void * ctx,u32 ctxlen)4014 int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
4015 {
4016 	return call_int_hook(inode_setsecctx, 0, dentry, ctx, ctxlen);
4017 }
4018 EXPORT_SYMBOL(security_inode_setsecctx);
4019 
4020 /**
4021  * security_inode_getsecctx() - Get the security label of an inode
4022  * @inode: inode
4023  * @ctx: secctx
4024  * @ctxlen: length of secctx
4025  *
4026  * On success, returns 0 and fills out @ctx and @ctxlen with the security
4027  * context for the given @inode.
4028  *
4029  * Return: Returns 0 on success, error on failure.
4030  */
security_inode_getsecctx(struct inode * inode,void ** ctx,u32 * ctxlen)4031 int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
4032 {
4033 	struct security_hook_list *hp;
4034 	int rc;
4035 
4036 	/*
4037 	 * Only one module will provide a security context.
4038 	 */
4039 	hlist_for_each_entry(hp, &security_hook_heads.inode_getsecctx, list) {
4040 		rc = hp->hook.inode_getsecctx(inode, ctx, ctxlen);
4041 		if (rc != LSM_RET_DEFAULT(inode_getsecctx))
4042 			return rc;
4043 	}
4044 
4045 	return LSM_RET_DEFAULT(inode_getsecctx);
4046 }
4047 EXPORT_SYMBOL(security_inode_getsecctx);
4048 
4049 #ifdef CONFIG_WATCH_QUEUE
4050 /**
4051  * security_post_notification() - Check if a watch notification can be posted
4052  * @w_cred: credentials of the task that set the watch
4053  * @cred: credentials of the task which triggered the watch
4054  * @n: the notification
4055  *
4056  * Check to see if a watch notification can be posted to a particular queue.
4057  *
4058  * Return: Returns 0 if permission is granted.
4059  */
security_post_notification(const struct cred * w_cred,const struct cred * cred,struct watch_notification * n)4060 int security_post_notification(const struct cred *w_cred,
4061 			       const struct cred *cred,
4062 			       struct watch_notification *n)
4063 {
4064 	return call_int_hook(post_notification, 0, w_cred, cred, n);
4065 }
4066 #endif /* CONFIG_WATCH_QUEUE */
4067 
4068 #ifdef CONFIG_KEY_NOTIFICATIONS
4069 /**
4070  * security_watch_key() - Check if a task is allowed to watch for key events
4071  * @key: the key to watch
4072  *
4073  * Check to see if a process is allowed to watch for event notifications from
4074  * a key or keyring.
4075  *
4076  * Return: Returns 0 if permission is granted.
4077  */
security_watch_key(struct key * key)4078 int security_watch_key(struct key *key)
4079 {
4080 	return call_int_hook(watch_key, 0, key);
4081 }
4082 #endif /* CONFIG_KEY_NOTIFICATIONS */
4083 
4084 #ifdef CONFIG_SECURITY_NETWORK
4085 /**
4086  * security_unix_stream_connect() - Check if a AF_UNIX stream is allowed
4087  * @sock: originating sock
4088  * @other: peer sock
4089  * @newsk: new sock
4090  *
4091  * Check permissions before establishing a Unix domain stream connection
4092  * between @sock and @other.
4093  *
4094  * The @unix_stream_connect and @unix_may_send hooks were necessary because
4095  * Linux provides an alternative to the conventional file name space for Unix
4096  * domain sockets.  Whereas binding and connecting to sockets in the file name
4097  * space is mediated by the typical file permissions (and caught by the mknod
4098  * and permission hooks in inode_security_ops), binding and connecting to
4099  * sockets in the abstract name space is completely unmediated.  Sufficient
4100  * control of Unix domain sockets in the abstract name space isn't possible
4101  * using only the socket layer hooks, since we need to know the actual target
4102  * socket, which is not looked up until we are inside the af_unix code.
4103  *
4104  * Return: Returns 0 if permission is granted.
4105  */
security_unix_stream_connect(struct sock * sock,struct sock * other,struct sock * newsk)4106 int security_unix_stream_connect(struct sock *sock, struct sock *other,
4107 				 struct sock *newsk)
4108 {
4109 	return call_int_hook(unix_stream_connect, 0, sock, other, newsk);
4110 }
4111 EXPORT_SYMBOL(security_unix_stream_connect);
4112 
4113 /**
4114  * security_unix_may_send() - Check if AF_UNIX socket can send datagrams
4115  * @sock: originating sock
4116  * @other: peer sock
4117  *
4118  * Check permissions before connecting or sending datagrams from @sock to
4119  * @other.
4120  *
4121  * The @unix_stream_connect and @unix_may_send hooks were necessary because
4122  * Linux provides an alternative to the conventional file name space for Unix
4123  * domain sockets.  Whereas binding and connecting to sockets in the file name
4124  * space is mediated by the typical file permissions (and caught by the mknod
4125  * and permission hooks in inode_security_ops), binding and connecting to
4126  * sockets in the abstract name space is completely unmediated.  Sufficient
4127  * control of Unix domain sockets in the abstract name space isn't possible
4128  * using only the socket layer hooks, since we need to know the actual target
4129  * socket, which is not looked up until we are inside the af_unix code.
4130  *
4131  * Return: Returns 0 if permission is granted.
4132  */
security_unix_may_send(struct socket * sock,struct socket * other)4133 int security_unix_may_send(struct socket *sock,  struct socket *other)
4134 {
4135 	return call_int_hook(unix_may_send, 0, sock, other);
4136 }
4137 EXPORT_SYMBOL(security_unix_may_send);
4138 
4139 /**
4140  * security_socket_create() - Check if creating a new socket is allowed
4141  * @family: protocol family
4142  * @type: communications type
4143  * @protocol: requested protocol
4144  * @kern: set to 1 if a kernel socket is requested
4145  *
4146  * Check permissions prior to creating a new socket.
4147  *
4148  * Return: Returns 0 if permission is granted.
4149  */
security_socket_create(int family,int type,int protocol,int kern)4150 int security_socket_create(int family, int type, int protocol, int kern)
4151 {
4152 	return call_int_hook(socket_create, 0, family, type, protocol, kern);
4153 }
4154 
4155 /**
4156  * security_socket_post_create() - Initialize a newly created socket
4157  * @sock: socket
4158  * @family: protocol family
4159  * @type: communications type
4160  * @protocol: requested protocol
4161  * @kern: set to 1 if a kernel socket is requested
4162  *
4163  * This hook allows a module to update or allocate a per-socket security
4164  * structure. Note that the security field was not added directly to the socket
4165  * structure, but rather, the socket security information is stored in the
4166  * associated inode.  Typically, the inode alloc_security hook will allocate
4167  * and attach security information to SOCK_INODE(sock)->i_security.  This hook
4168  * may be used to update the SOCK_INODE(sock)->i_security field with additional
4169  * information that wasn't available when the inode was allocated.
4170  *
4171  * Return: Returns 0 if permission is granted.
4172  */
security_socket_post_create(struct socket * sock,int family,int type,int protocol,int kern)4173 int security_socket_post_create(struct socket *sock, int family,
4174 				int type, int protocol, int kern)
4175 {
4176 	return call_int_hook(socket_post_create, 0, sock, family, type,
4177 			     protocol, kern);
4178 }
4179 
4180 /**
4181  * security_socket_socketpair() - Check if creating a socketpair is allowed
4182  * @socka: first socket
4183  * @sockb: second socket
4184  *
4185  * Check permissions before creating a fresh pair of sockets.
4186  *
4187  * Return: Returns 0 if permission is granted and the connection was
4188  *         established.
4189  */
security_socket_socketpair(struct socket * socka,struct socket * sockb)4190 int security_socket_socketpair(struct socket *socka, struct socket *sockb)
4191 {
4192 	return call_int_hook(socket_socketpair, 0, socka, sockb);
4193 }
4194 EXPORT_SYMBOL(security_socket_socketpair);
4195 
4196 /**
4197  * security_socket_bind() - Check if a socket bind operation is allowed
4198  * @sock: socket
4199  * @address: requested bind address
4200  * @addrlen: length of address
4201  *
4202  * Check permission before socket protocol layer bind operation is performed
4203  * and the socket @sock is bound to the address specified in the @address
4204  * parameter.
4205  *
4206  * Return: Returns 0 if permission is granted.
4207  */
security_socket_bind(struct socket * sock,struct sockaddr * address,int addrlen)4208 int security_socket_bind(struct socket *sock,
4209 			 struct sockaddr *address, int addrlen)
4210 {
4211 	return call_int_hook(socket_bind, 0, sock, address, addrlen);
4212 }
4213 
4214 /**
4215  * security_socket_connect() - Check if a socket connect operation is allowed
4216  * @sock: socket
4217  * @address: address of remote connection point
4218  * @addrlen: length of address
4219  *
4220  * Check permission before socket protocol layer connect operation attempts to
4221  * connect socket @sock to a remote address, @address.
4222  *
4223  * Return: Returns 0 if permission is granted.
4224  */
security_socket_connect(struct socket * sock,struct sockaddr * address,int addrlen)4225 int security_socket_connect(struct socket *sock,
4226 			    struct sockaddr *address, int addrlen)
4227 {
4228 	return call_int_hook(socket_connect, 0, sock, address, addrlen);
4229 }
4230 
4231 /**
4232  * security_socket_listen() - Check if a socket is allowed to listen
4233  * @sock: socket
4234  * @backlog: connection queue size
4235  *
4236  * Check permission before socket protocol layer listen operation.
4237  *
4238  * Return: Returns 0 if permission is granted.
4239  */
security_socket_listen(struct socket * sock,int backlog)4240 int security_socket_listen(struct socket *sock, int backlog)
4241 {
4242 	return call_int_hook(socket_listen, 0, sock, backlog);
4243 }
4244 
4245 /**
4246  * security_socket_accept() - Check if a socket is allowed to accept connections
4247  * @sock: listening socket
4248  * @newsock: newly creation connection socket
4249  *
4250  * Check permission before accepting a new connection.  Note that the new
4251  * socket, @newsock, has been created and some information copied to it, but
4252  * the accept operation has not actually been performed.
4253  *
4254  * Return: Returns 0 if permission is granted.
4255  */
security_socket_accept(struct socket * sock,struct socket * newsock)4256 int security_socket_accept(struct socket *sock, struct socket *newsock)
4257 {
4258 	return call_int_hook(socket_accept, 0, sock, newsock);
4259 }
4260 
4261 /**
4262  * security_socket_sendmsg() - Check is sending a message is allowed
4263  * @sock: sending socket
4264  * @msg: message to send
4265  * @size: size of message
4266  *
4267  * Check permission before transmitting a message to another socket.
4268  *
4269  * Return: Returns 0 if permission is granted.
4270  */
security_socket_sendmsg(struct socket * sock,struct msghdr * msg,int size)4271 int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size)
4272 {
4273 	return call_int_hook(socket_sendmsg, 0, sock, msg, size);
4274 }
4275 
4276 /**
4277  * security_socket_recvmsg() - Check if receiving a message is allowed
4278  * @sock: receiving socket
4279  * @msg: message to receive
4280  * @size: size of message
4281  * @flags: operational flags
4282  *
4283  * Check permission before receiving a message from a socket.
4284  *
4285  * Return: Returns 0 if permission is granted.
4286  */
security_socket_recvmsg(struct socket * sock,struct msghdr * msg,int size,int flags)4287 int security_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4288 			    int size, int flags)
4289 {
4290 	return call_int_hook(socket_recvmsg, 0, sock, msg, size, flags);
4291 }
4292 
4293 /**
4294  * security_socket_getsockname() - Check if reading the socket addr is allowed
4295  * @sock: socket
4296  *
4297  * Check permission before reading the local address (name) of the socket
4298  * object.
4299  *
4300  * Return: Returns 0 if permission is granted.
4301  */
security_socket_getsockname(struct socket * sock)4302 int security_socket_getsockname(struct socket *sock)
4303 {
4304 	return call_int_hook(socket_getsockname, 0, sock);
4305 }
4306 
4307 /**
4308  * security_socket_getpeername() - Check if reading the peer's addr is allowed
4309  * @sock: socket
4310  *
4311  * Check permission before the remote address (name) of a socket object.
4312  *
4313  * Return: Returns 0 if permission is granted.
4314  */
security_socket_getpeername(struct socket * sock)4315 int security_socket_getpeername(struct socket *sock)
4316 {
4317 	return call_int_hook(socket_getpeername, 0, sock);
4318 }
4319 
4320 /**
4321  * security_socket_getsockopt() - Check if reading a socket option is allowed
4322  * @sock: socket
4323  * @level: option's protocol level
4324  * @optname: option name
4325  *
4326  * Check permissions before retrieving the options associated with socket
4327  * @sock.
4328  *
4329  * Return: Returns 0 if permission is granted.
4330  */
security_socket_getsockopt(struct socket * sock,int level,int optname)4331 int security_socket_getsockopt(struct socket *sock, int level, int optname)
4332 {
4333 	return call_int_hook(socket_getsockopt, 0, sock, level, optname);
4334 }
4335 
4336 /**
4337  * security_socket_setsockopt() - Check if setting a socket option is allowed
4338  * @sock: socket
4339  * @level: option's protocol level
4340  * @optname: option name
4341  *
4342  * Check permissions before setting the options associated with socket @sock.
4343  *
4344  * Return: Returns 0 if permission is granted.
4345  */
security_socket_setsockopt(struct socket * sock,int level,int optname)4346 int security_socket_setsockopt(struct socket *sock, int level, int optname)
4347 {
4348 	return call_int_hook(socket_setsockopt, 0, sock, level, optname);
4349 }
4350 
4351 /**
4352  * security_socket_shutdown() - Checks if shutting down the socket is allowed
4353  * @sock: socket
4354  * @how: flag indicating how sends and receives are handled
4355  *
4356  * Checks permission before all or part of a connection on the socket @sock is
4357  * shut down.
4358  *
4359  * Return: Returns 0 if permission is granted.
4360  */
security_socket_shutdown(struct socket * sock,int how)4361 int security_socket_shutdown(struct socket *sock, int how)
4362 {
4363 	return call_int_hook(socket_shutdown, 0, sock, how);
4364 }
4365 
4366 /**
4367  * security_sock_rcv_skb() - Check if an incoming network packet is allowed
4368  * @sk: destination sock
4369  * @skb: incoming packet
4370  *
4371  * Check permissions on incoming network packets.  This hook is distinct from
4372  * Netfilter's IP input hooks since it is the first time that the incoming
4373  * sk_buff @skb has been associated with a particular socket, @sk.  Must not
4374  * sleep inside this hook because some callers hold spinlocks.
4375  *
4376  * Return: Returns 0 if permission is granted.
4377  */
security_sock_rcv_skb(struct sock * sk,struct sk_buff * skb)4378 int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4379 {
4380 	return call_int_hook(socket_sock_rcv_skb, 0, sk, skb);
4381 }
4382 EXPORT_SYMBOL(security_sock_rcv_skb);
4383 
4384 /**
4385  * security_socket_getpeersec_stream() - Get the remote peer label
4386  * @sock: socket
4387  * @optval: destination buffer
4388  * @optlen: size of peer label copied into the buffer
4389  * @len: maximum size of the destination buffer
4390  *
4391  * This hook allows the security module to provide peer socket security state
4392  * for unix or connected tcp sockets to userspace via getsockopt SO_GETPEERSEC.
4393  * For tcp sockets this can be meaningful if the socket is associated with an
4394  * ipsec SA.
4395  *
4396  * Return: Returns 0 if all is well, otherwise, typical getsockopt return
4397  *         values.
4398  */
security_socket_getpeersec_stream(struct socket * sock,sockptr_t optval,sockptr_t optlen,unsigned int len)4399 int security_socket_getpeersec_stream(struct socket *sock, sockptr_t optval,
4400 				      sockptr_t optlen, unsigned int len)
4401 {
4402 	struct security_hook_list *hp;
4403 	int rc;
4404 
4405 	/*
4406 	 * Only one module will provide a security context.
4407 	 */
4408 	hlist_for_each_entry(hp, &security_hook_heads.socket_getpeersec_stream,
4409 			     list) {
4410 		rc = hp->hook.socket_getpeersec_stream(sock, optval, optlen,
4411 						       len);
4412 		if (rc != LSM_RET_DEFAULT(socket_getpeersec_stream))
4413 			return rc;
4414 	}
4415 	return LSM_RET_DEFAULT(socket_getpeersec_stream);
4416 }
4417 
4418 /**
4419  * security_socket_getpeersec_dgram() - Get the remote peer label
4420  * @sock: socket
4421  * @skb: datagram packet
4422  * @secid: remote peer label secid
4423  *
4424  * This hook allows the security module to provide peer socket security state
4425  * for udp sockets on a per-packet basis to userspace via getsockopt
4426  * SO_GETPEERSEC. The application must first have indicated the IP_PASSSEC
4427  * option via getsockopt. It can then retrieve the security state returned by
4428  * this hook for a packet via the SCM_SECURITY ancillary message type.
4429  *
4430  * Return: Returns 0 on success, error on failure.
4431  */
security_socket_getpeersec_dgram(struct socket * sock,struct sk_buff * skb,u32 * secid)4432 int security_socket_getpeersec_dgram(struct socket *sock,
4433 				     struct sk_buff *skb, u32 *secid)
4434 {
4435 	struct security_hook_list *hp;
4436 	int rc;
4437 
4438 	/*
4439 	 * Only one module will provide a security context.
4440 	 */
4441 	hlist_for_each_entry(hp, &security_hook_heads.socket_getpeersec_dgram,
4442 			     list) {
4443 		rc = hp->hook.socket_getpeersec_dgram(sock, skb, secid);
4444 		if (rc != LSM_RET_DEFAULT(socket_getpeersec_dgram))
4445 			return rc;
4446 	}
4447 	return LSM_RET_DEFAULT(socket_getpeersec_dgram);
4448 }
4449 EXPORT_SYMBOL(security_socket_getpeersec_dgram);
4450 
4451 /**
4452  * security_sk_alloc() - Allocate and initialize a sock's LSM blob
4453  * @sk: sock
4454  * @family: protocol family
4455  * @priority: gfp flags
4456  *
4457  * Allocate and attach a security structure to the sk->sk_security field, which
4458  * is used to copy security attributes between local stream sockets.
4459  *
4460  * Return: Returns 0 on success, error on failure.
4461  */
security_sk_alloc(struct sock * sk,int family,gfp_t priority)4462 int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
4463 {
4464 	return call_int_hook(sk_alloc_security, 0, sk, family, priority);
4465 }
4466 
4467 /**
4468  * security_sk_free() - Free the sock's LSM blob
4469  * @sk: sock
4470  *
4471  * Deallocate security structure.
4472  */
security_sk_free(struct sock * sk)4473 void security_sk_free(struct sock *sk)
4474 {
4475 	call_void_hook(sk_free_security, sk);
4476 }
4477 
4478 /**
4479  * security_sk_clone() - Clone a sock's LSM state
4480  * @sk: original sock
4481  * @newsk: target sock
4482  *
4483  * Clone/copy security structure.
4484  */
security_sk_clone(const struct sock * sk,struct sock * newsk)4485 void security_sk_clone(const struct sock *sk, struct sock *newsk)
4486 {
4487 	call_void_hook(sk_clone_security, sk, newsk);
4488 }
4489 EXPORT_SYMBOL(security_sk_clone);
4490 
4491 /**
4492  * security_sk_classify_flow() - Set a flow's secid based on socket
4493  * @sk: original socket
4494  * @flic: target flow
4495  *
4496  * Set the target flow's secid to socket's secid.
4497  */
security_sk_classify_flow(const struct sock * sk,struct flowi_common * flic)4498 void security_sk_classify_flow(const struct sock *sk, struct flowi_common *flic)
4499 {
4500 	call_void_hook(sk_getsecid, sk, &flic->flowic_secid);
4501 }
4502 EXPORT_SYMBOL(security_sk_classify_flow);
4503 
4504 /**
4505  * security_req_classify_flow() - Set a flow's secid based on request_sock
4506  * @req: request_sock
4507  * @flic: target flow
4508  *
4509  * Sets @flic's secid to @req's secid.
4510  */
security_req_classify_flow(const struct request_sock * req,struct flowi_common * flic)4511 void security_req_classify_flow(const struct request_sock *req,
4512 				struct flowi_common *flic)
4513 {
4514 	call_void_hook(req_classify_flow, req, flic);
4515 }
4516 EXPORT_SYMBOL(security_req_classify_flow);
4517 
4518 /**
4519  * security_sock_graft() - Reconcile LSM state when grafting a sock on a socket
4520  * @sk: sock being grafted
4521  * @parent: target parent socket
4522  *
4523  * Sets @parent's inode secid to @sk's secid and update @sk with any necessary
4524  * LSM state from @parent.
4525  */
security_sock_graft(struct sock * sk,struct socket * parent)4526 void security_sock_graft(struct sock *sk, struct socket *parent)
4527 {
4528 	call_void_hook(sock_graft, sk, parent);
4529 }
4530 EXPORT_SYMBOL(security_sock_graft);
4531 
4532 /**
4533  * security_inet_conn_request() - Set request_sock state using incoming connect
4534  * @sk: parent listening sock
4535  * @skb: incoming connection
4536  * @req: new request_sock
4537  *
4538  * Initialize the @req LSM state based on @sk and the incoming connect in @skb.
4539  *
4540  * Return: Returns 0 if permission is granted.
4541  */
security_inet_conn_request(const struct sock * sk,struct sk_buff * skb,struct request_sock * req)4542 int security_inet_conn_request(const struct sock *sk,
4543 			       struct sk_buff *skb, struct request_sock *req)
4544 {
4545 	return call_int_hook(inet_conn_request, 0, sk, skb, req);
4546 }
4547 EXPORT_SYMBOL(security_inet_conn_request);
4548 
4549 /**
4550  * security_inet_csk_clone() - Set new sock LSM state based on request_sock
4551  * @newsk: new sock
4552  * @req: connection request_sock
4553  *
4554  * Set that LSM state of @sock using the LSM state from @req.
4555  */
security_inet_csk_clone(struct sock * newsk,const struct request_sock * req)4556 void security_inet_csk_clone(struct sock *newsk,
4557 			     const struct request_sock *req)
4558 {
4559 	call_void_hook(inet_csk_clone, newsk, req);
4560 }
4561 
4562 /**
4563  * security_inet_conn_established() - Update sock's LSM state with connection
4564  * @sk: sock
4565  * @skb: connection packet
4566  *
4567  * Update @sock's LSM state to represent a new connection from @skb.
4568  */
security_inet_conn_established(struct sock * sk,struct sk_buff * skb)4569 void security_inet_conn_established(struct sock *sk,
4570 				    struct sk_buff *skb)
4571 {
4572 	call_void_hook(inet_conn_established, sk, skb);
4573 }
4574 EXPORT_SYMBOL(security_inet_conn_established);
4575 
4576 /**
4577  * security_secmark_relabel_packet() - Check if setting a secmark is allowed
4578  * @secid: new secmark value
4579  *
4580  * Check if the process should be allowed to relabel packets to @secid.
4581  *
4582  * Return: Returns 0 if permission is granted.
4583  */
security_secmark_relabel_packet(u32 secid)4584 int security_secmark_relabel_packet(u32 secid)
4585 {
4586 	return call_int_hook(secmark_relabel_packet, 0, secid);
4587 }
4588 EXPORT_SYMBOL(security_secmark_relabel_packet);
4589 
4590 /**
4591  * security_secmark_refcount_inc() - Increment the secmark labeling rule count
4592  *
4593  * Tells the LSM to increment the number of secmark labeling rules loaded.
4594  */
security_secmark_refcount_inc(void)4595 void security_secmark_refcount_inc(void)
4596 {
4597 	call_void_hook(secmark_refcount_inc);
4598 }
4599 EXPORT_SYMBOL(security_secmark_refcount_inc);
4600 
4601 /**
4602  * security_secmark_refcount_dec() - Decrement the secmark labeling rule count
4603  *
4604  * Tells the LSM to decrement the number of secmark labeling rules loaded.
4605  */
security_secmark_refcount_dec(void)4606 void security_secmark_refcount_dec(void)
4607 {
4608 	call_void_hook(secmark_refcount_dec);
4609 }
4610 EXPORT_SYMBOL(security_secmark_refcount_dec);
4611 
4612 /**
4613  * security_tun_dev_alloc_security() - Allocate a LSM blob for a TUN device
4614  * @security: pointer to the LSM blob
4615  *
4616  * This hook allows a module to allocate a security structure for a TUN	device,
4617  * returning the pointer in @security.
4618  *
4619  * Return: Returns a zero on success, negative values on failure.
4620  */
security_tun_dev_alloc_security(void ** security)4621 int security_tun_dev_alloc_security(void **security)
4622 {
4623 	return call_int_hook(tun_dev_alloc_security, 0, security);
4624 }
4625 EXPORT_SYMBOL(security_tun_dev_alloc_security);
4626 
4627 /**
4628  * security_tun_dev_free_security() - Free a TUN device LSM blob
4629  * @security: LSM blob
4630  *
4631  * This hook allows a module to free the security structure for a TUN device.
4632  */
security_tun_dev_free_security(void * security)4633 void security_tun_dev_free_security(void *security)
4634 {
4635 	call_void_hook(tun_dev_free_security, security);
4636 }
4637 EXPORT_SYMBOL(security_tun_dev_free_security);
4638 
4639 /**
4640  * security_tun_dev_create() - Check if creating a TUN device is allowed
4641  *
4642  * Check permissions prior to creating a new TUN device.
4643  *
4644  * Return: Returns 0 if permission is granted.
4645  */
security_tun_dev_create(void)4646 int security_tun_dev_create(void)
4647 {
4648 	return call_int_hook(tun_dev_create, 0);
4649 }
4650 EXPORT_SYMBOL(security_tun_dev_create);
4651 
4652 /**
4653  * security_tun_dev_attach_queue() - Check if attaching a TUN queue is allowed
4654  * @security: TUN device LSM blob
4655  *
4656  * Check permissions prior to attaching to a TUN device queue.
4657  *
4658  * Return: Returns 0 if permission is granted.
4659  */
security_tun_dev_attach_queue(void * security)4660 int security_tun_dev_attach_queue(void *security)
4661 {
4662 	return call_int_hook(tun_dev_attach_queue, 0, security);
4663 }
4664 EXPORT_SYMBOL(security_tun_dev_attach_queue);
4665 
4666 /**
4667  * security_tun_dev_attach() - Update TUN device LSM state on attach
4668  * @sk: associated sock
4669  * @security: TUN device LSM blob
4670  *
4671  * This hook can be used by the module to update any security state associated
4672  * with the TUN device's sock structure.
4673  *
4674  * Return: Returns 0 if permission is granted.
4675  */
security_tun_dev_attach(struct sock * sk,void * security)4676 int security_tun_dev_attach(struct sock *sk, void *security)
4677 {
4678 	return call_int_hook(tun_dev_attach, 0, sk, security);
4679 }
4680 EXPORT_SYMBOL(security_tun_dev_attach);
4681 
4682 /**
4683  * security_tun_dev_open() - Update TUN device LSM state on open
4684  * @security: TUN device LSM blob
4685  *
4686  * This hook can be used by the module to update any security state associated
4687  * with the TUN device's security structure.
4688  *
4689  * Return: Returns 0 if permission is granted.
4690  */
security_tun_dev_open(void * security)4691 int security_tun_dev_open(void *security)
4692 {
4693 	return call_int_hook(tun_dev_open, 0, security);
4694 }
4695 EXPORT_SYMBOL(security_tun_dev_open);
4696 
4697 /**
4698  * security_sctp_assoc_request() - Update the LSM on a SCTP association req
4699  * @asoc: SCTP association
4700  * @skb: packet requesting the association
4701  *
4702  * Passes the @asoc and @chunk->skb of the association INIT packet to the LSM.
4703  *
4704  * Return: Returns 0 on success, error on failure.
4705  */
security_sctp_assoc_request(struct sctp_association * asoc,struct sk_buff * skb)4706 int security_sctp_assoc_request(struct sctp_association *asoc,
4707 				struct sk_buff *skb)
4708 {
4709 	return call_int_hook(sctp_assoc_request, 0, asoc, skb);
4710 }
4711 EXPORT_SYMBOL(security_sctp_assoc_request);
4712 
4713 /**
4714  * security_sctp_bind_connect() - Validate a list of addrs for a SCTP option
4715  * @sk: socket
4716  * @optname: SCTP option to validate
4717  * @address: list of IP addresses to validate
4718  * @addrlen: length of the address list
4719  *
4720  * Validiate permissions required for each address associated with sock	@sk.
4721  * Depending on @optname, the addresses will be treated as either a connect or
4722  * bind service. The @addrlen is calculated on each IPv4 and IPv6 address using
4723  * sizeof(struct sockaddr_in) or sizeof(struct sockaddr_in6).
4724  *
4725  * Return: Returns 0 on success, error on failure.
4726  */
security_sctp_bind_connect(struct sock * sk,int optname,struct sockaddr * address,int addrlen)4727 int security_sctp_bind_connect(struct sock *sk, int optname,
4728 			       struct sockaddr *address, int addrlen)
4729 {
4730 	return call_int_hook(sctp_bind_connect, 0, sk, optname,
4731 			     address, addrlen);
4732 }
4733 EXPORT_SYMBOL(security_sctp_bind_connect);
4734 
4735 /**
4736  * security_sctp_sk_clone() - Clone a SCTP sock's LSM state
4737  * @asoc: SCTP association
4738  * @sk: original sock
4739  * @newsk: target sock
4740  *
4741  * Called whenever a new socket is created by accept(2) (i.e. a TCP style
4742  * socket) or when a socket is 'peeled off' e.g userspace calls
4743  * sctp_peeloff(3).
4744  */
security_sctp_sk_clone(struct sctp_association * asoc,struct sock * sk,struct sock * newsk)4745 void security_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk,
4746 			    struct sock *newsk)
4747 {
4748 	call_void_hook(sctp_sk_clone, asoc, sk, newsk);
4749 }
4750 EXPORT_SYMBOL(security_sctp_sk_clone);
4751 
4752 /**
4753  * security_sctp_assoc_established() - Update LSM state when assoc established
4754  * @asoc: SCTP association
4755  * @skb: packet establishing the association
4756  *
4757  * Passes the @asoc and @chunk->skb of the association COOKIE_ACK packet to the
4758  * security module.
4759  *
4760  * Return: Returns 0 if permission is granted.
4761  */
security_sctp_assoc_established(struct sctp_association * asoc,struct sk_buff * skb)4762 int security_sctp_assoc_established(struct sctp_association *asoc,
4763 				    struct sk_buff *skb)
4764 {
4765 	return call_int_hook(sctp_assoc_established, 0, asoc, skb);
4766 }
4767 EXPORT_SYMBOL(security_sctp_assoc_established);
4768 
4769 /**
4770  * security_mptcp_add_subflow() - Inherit the LSM label from the MPTCP socket
4771  * @sk: the owning MPTCP socket
4772  * @ssk: the new subflow
4773  *
4774  * Update the labeling for the given MPTCP subflow, to match the one of the
4775  * owning MPTCP socket. This hook has to be called after the socket creation and
4776  * initialization via the security_socket_create() and
4777  * security_socket_post_create() LSM hooks.
4778  *
4779  * Return: Returns 0 on success or a negative error code on failure.
4780  */
security_mptcp_add_subflow(struct sock * sk,struct sock * ssk)4781 int security_mptcp_add_subflow(struct sock *sk, struct sock *ssk)
4782 {
4783 	return call_int_hook(mptcp_add_subflow, 0, sk, ssk);
4784 }
4785 
4786 #endif	/* CONFIG_SECURITY_NETWORK */
4787 
4788 #ifdef CONFIG_SECURITY_INFINIBAND
4789 /**
4790  * security_ib_pkey_access() - Check if access to an IB pkey is allowed
4791  * @sec: LSM blob
4792  * @subnet_prefix: subnet prefix of the port
4793  * @pkey: IB pkey
4794  *
4795  * Check permission to access a pkey when modifying a QP.
4796  *
4797  * Return: Returns 0 if permission is granted.
4798  */
security_ib_pkey_access(void * sec,u64 subnet_prefix,u16 pkey)4799 int security_ib_pkey_access(void *sec, u64 subnet_prefix, u16 pkey)
4800 {
4801 	return call_int_hook(ib_pkey_access, 0, sec, subnet_prefix, pkey);
4802 }
4803 EXPORT_SYMBOL(security_ib_pkey_access);
4804 
4805 /**
4806  * security_ib_endport_manage_subnet() - Check if SMPs traffic is allowed
4807  * @sec: LSM blob
4808  * @dev_name: IB device name
4809  * @port_num: port number
4810  *
4811  * Check permissions to send and receive SMPs on a end port.
4812  *
4813  * Return: Returns 0 if permission is granted.
4814  */
security_ib_endport_manage_subnet(void * sec,const char * dev_name,u8 port_num)4815 int security_ib_endport_manage_subnet(void *sec,
4816 				      const char *dev_name, u8 port_num)
4817 {
4818 	return call_int_hook(ib_endport_manage_subnet, 0, sec,
4819 			     dev_name, port_num);
4820 }
4821 EXPORT_SYMBOL(security_ib_endport_manage_subnet);
4822 
4823 /**
4824  * security_ib_alloc_security() - Allocate an Infiniband LSM blob
4825  * @sec: LSM blob
4826  *
4827  * Allocate a security structure for Infiniband objects.
4828  *
4829  * Return: Returns 0 on success, non-zero on failure.
4830  */
security_ib_alloc_security(void ** sec)4831 int security_ib_alloc_security(void **sec)
4832 {
4833 	return call_int_hook(ib_alloc_security, 0, sec);
4834 }
4835 EXPORT_SYMBOL(security_ib_alloc_security);
4836 
4837 /**
4838  * security_ib_free_security() - Free an Infiniband LSM blob
4839  * @sec: LSM blob
4840  *
4841  * Deallocate an Infiniband security structure.
4842  */
security_ib_free_security(void * sec)4843 void security_ib_free_security(void *sec)
4844 {
4845 	call_void_hook(ib_free_security, sec);
4846 }
4847 EXPORT_SYMBOL(security_ib_free_security);
4848 #endif	/* CONFIG_SECURITY_INFINIBAND */
4849 
4850 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4851 /**
4852  * security_xfrm_policy_alloc() - Allocate a xfrm policy LSM blob
4853  * @ctxp: xfrm security context being added to the SPD
4854  * @sec_ctx: security label provided by userspace
4855  * @gfp: gfp flags
4856  *
4857  * Allocate a security structure to the xp->security field; the security field
4858  * is initialized to NULL when the xfrm_policy is allocated.
4859  *
4860  * Return:  Return 0 if operation was successful.
4861  */
security_xfrm_policy_alloc(struct xfrm_sec_ctx ** ctxp,struct xfrm_user_sec_ctx * sec_ctx,gfp_t gfp)4862 int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
4863 			       struct xfrm_user_sec_ctx *sec_ctx,
4864 			       gfp_t gfp)
4865 {
4866 	return call_int_hook(xfrm_policy_alloc_security, 0, ctxp, sec_ctx, gfp);
4867 }
4868 EXPORT_SYMBOL(security_xfrm_policy_alloc);
4869 
4870 /**
4871  * security_xfrm_policy_clone() - Clone xfrm policy LSM state
4872  * @old_ctx: xfrm security context
4873  * @new_ctxp: target xfrm security context
4874  *
4875  * Allocate a security structure in new_ctxp that contains the information from
4876  * the old_ctx structure.
4877  *
4878  * Return: Return 0 if operation was successful.
4879  */
security_xfrm_policy_clone(struct xfrm_sec_ctx * old_ctx,struct xfrm_sec_ctx ** new_ctxp)4880 int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
4881 			       struct xfrm_sec_ctx **new_ctxp)
4882 {
4883 	return call_int_hook(xfrm_policy_clone_security, 0, old_ctx, new_ctxp);
4884 }
4885 
4886 /**
4887  * security_xfrm_policy_free() - Free a xfrm security context
4888  * @ctx: xfrm security context
4889  *
4890  * Free LSM resources associated with @ctx.
4891  */
security_xfrm_policy_free(struct xfrm_sec_ctx * ctx)4892 void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
4893 {
4894 	call_void_hook(xfrm_policy_free_security, ctx);
4895 }
4896 EXPORT_SYMBOL(security_xfrm_policy_free);
4897 
4898 /**
4899  * security_xfrm_policy_delete() - Check if deleting a xfrm policy is allowed
4900  * @ctx: xfrm security context
4901  *
4902  * Authorize deletion of a SPD entry.
4903  *
4904  * Return: Returns 0 if permission is granted.
4905  */
security_xfrm_policy_delete(struct xfrm_sec_ctx * ctx)4906 int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
4907 {
4908 	return call_int_hook(xfrm_policy_delete_security, 0, ctx);
4909 }
4910 
4911 /**
4912  * security_xfrm_state_alloc() - Allocate a xfrm state LSM blob
4913  * @x: xfrm state being added to the SAD
4914  * @sec_ctx: security label provided by userspace
4915  *
4916  * Allocate a security structure to the @x->security field; the security field
4917  * is initialized to NULL when the xfrm_state is allocated. Set the context to
4918  * correspond to @sec_ctx.
4919  *
4920  * Return: Return 0 if operation was successful.
4921  */
security_xfrm_state_alloc(struct xfrm_state * x,struct xfrm_user_sec_ctx * sec_ctx)4922 int security_xfrm_state_alloc(struct xfrm_state *x,
4923 			      struct xfrm_user_sec_ctx *sec_ctx)
4924 {
4925 	return call_int_hook(xfrm_state_alloc, 0, x, sec_ctx);
4926 }
4927 EXPORT_SYMBOL(security_xfrm_state_alloc);
4928 
4929 /**
4930  * security_xfrm_state_alloc_acquire() - Allocate a xfrm state LSM blob
4931  * @x: xfrm state being added to the SAD
4932  * @polsec: associated policy's security context
4933  * @secid: secid from the flow
4934  *
4935  * Allocate a security structure to the x->security field; the security field
4936  * is initialized to NULL when the xfrm_state is allocated.  Set the context to
4937  * correspond to secid.
4938  *
4939  * Return: Returns 0 if operation was successful.
4940  */
security_xfrm_state_alloc_acquire(struct xfrm_state * x,struct xfrm_sec_ctx * polsec,u32 secid)4941 int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
4942 				      struct xfrm_sec_ctx *polsec, u32 secid)
4943 {
4944 	return call_int_hook(xfrm_state_alloc_acquire, 0, x, polsec, secid);
4945 }
4946 
4947 /**
4948  * security_xfrm_state_delete() - Check if deleting a xfrm state is allowed
4949  * @x: xfrm state
4950  *
4951  * Authorize deletion of x->security.
4952  *
4953  * Return: Returns 0 if permission is granted.
4954  */
security_xfrm_state_delete(struct xfrm_state * x)4955 int security_xfrm_state_delete(struct xfrm_state *x)
4956 {
4957 	return call_int_hook(xfrm_state_delete_security, 0, x);
4958 }
4959 EXPORT_SYMBOL(security_xfrm_state_delete);
4960 
4961 /**
4962  * security_xfrm_state_free() - Free a xfrm state
4963  * @x: xfrm state
4964  *
4965  * Deallocate x->security.
4966  */
security_xfrm_state_free(struct xfrm_state * x)4967 void security_xfrm_state_free(struct xfrm_state *x)
4968 {
4969 	call_void_hook(xfrm_state_free_security, x);
4970 }
4971 
4972 /**
4973  * security_xfrm_policy_lookup() - Check if using a xfrm policy is allowed
4974  * @ctx: target xfrm security context
4975  * @fl_secid: flow secid used to authorize access
4976  *
4977  * Check permission when a flow selects a xfrm_policy for processing XFRMs on a
4978  * packet.  The hook is called when selecting either a per-socket policy or a
4979  * generic xfrm policy.
4980  *
4981  * Return: Return 0 if permission is granted, -ESRCH otherwise, or -errno on
4982  *         other errors.
4983  */
security_xfrm_policy_lookup(struct xfrm_sec_ctx * ctx,u32 fl_secid)4984 int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid)
4985 {
4986 	return call_int_hook(xfrm_policy_lookup, 0, ctx, fl_secid);
4987 }
4988 
4989 /**
4990  * security_xfrm_state_pol_flow_match() - Check for a xfrm match
4991  * @x: xfrm state to match
4992  * @xp: xfrm policy to check for a match
4993  * @flic: flow to check for a match.
4994  *
4995  * Check @xp and @flic for a match with @x.
4996  *
4997  * Return: Returns 1 if there is a match.
4998  */
security_xfrm_state_pol_flow_match(struct xfrm_state * x,struct xfrm_policy * xp,const struct flowi_common * flic)4999 int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
5000 				       struct xfrm_policy *xp,
5001 				       const struct flowi_common *flic)
5002 {
5003 	struct security_hook_list *hp;
5004 	int rc = LSM_RET_DEFAULT(xfrm_state_pol_flow_match);
5005 
5006 	/*
5007 	 * Since this function is expected to return 0 or 1, the judgment
5008 	 * becomes difficult if multiple LSMs supply this call. Fortunately,
5009 	 * we can use the first LSM's judgment because currently only SELinux
5010 	 * supplies this call.
5011 	 *
5012 	 * For speed optimization, we explicitly break the loop rather than
5013 	 * using the macro
5014 	 */
5015 	hlist_for_each_entry(hp, &security_hook_heads.xfrm_state_pol_flow_match,
5016 			     list) {
5017 		rc = hp->hook.xfrm_state_pol_flow_match(x, xp, flic);
5018 		break;
5019 	}
5020 	return rc;
5021 }
5022 
5023 /**
5024  * security_xfrm_decode_session() - Determine the xfrm secid for a packet
5025  * @skb: xfrm packet
5026  * @secid: secid
5027  *
5028  * Decode the packet in @skb and return the security label in @secid.
5029  *
5030  * Return: Return 0 if all xfrms used have the same secid.
5031  */
security_xfrm_decode_session(struct sk_buff * skb,u32 * secid)5032 int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
5033 {
5034 	return call_int_hook(xfrm_decode_session, 0, skb, secid, 1);
5035 }
5036 
security_skb_classify_flow(struct sk_buff * skb,struct flowi_common * flic)5037 void security_skb_classify_flow(struct sk_buff *skb, struct flowi_common *flic)
5038 {
5039 	int rc = call_int_hook(xfrm_decode_session, 0, skb, &flic->flowic_secid,
5040 			       0);
5041 
5042 	BUG_ON(rc);
5043 }
5044 EXPORT_SYMBOL(security_skb_classify_flow);
5045 #endif	/* CONFIG_SECURITY_NETWORK_XFRM */
5046 
5047 #ifdef CONFIG_KEYS
5048 /**
5049  * security_key_alloc() - Allocate and initialize a kernel key LSM blob
5050  * @key: key
5051  * @cred: credentials
5052  * @flags: allocation flags
5053  *
5054  * Permit allocation of a key and assign security data. Note that key does not
5055  * have a serial number assigned at this point.
5056  *
5057  * Return: Return 0 if permission is granted, -ve error otherwise.
5058  */
security_key_alloc(struct key * key,const struct cred * cred,unsigned long flags)5059 int security_key_alloc(struct key *key, const struct cred *cred,
5060 		       unsigned long flags)
5061 {
5062 	return call_int_hook(key_alloc, 0, key, cred, flags);
5063 }
5064 
5065 /**
5066  * security_key_free() - Free a kernel key LSM blob
5067  * @key: key
5068  *
5069  * Notification of destruction; free security data.
5070  */
security_key_free(struct key * key)5071 void security_key_free(struct key *key)
5072 {
5073 	call_void_hook(key_free, key);
5074 }
5075 
5076 /**
5077  * security_key_permission() - Check if a kernel key operation is allowed
5078  * @key_ref: key reference
5079  * @cred: credentials of actor requesting access
5080  * @need_perm: requested permissions
5081  *
5082  * See whether a specific operational right is granted to a process on a key.
5083  *
5084  * Return: Return 0 if permission is granted, -ve error otherwise.
5085  */
security_key_permission(key_ref_t key_ref,const struct cred * cred,enum key_need_perm need_perm)5086 int security_key_permission(key_ref_t key_ref, const struct cred *cred,
5087 			    enum key_need_perm need_perm)
5088 {
5089 	return call_int_hook(key_permission, 0, key_ref, cred, need_perm);
5090 }
5091 
5092 /**
5093  * security_key_getsecurity() - Get the key's security label
5094  * @key: key
5095  * @buffer: security label buffer
5096  *
5097  * Get a textual representation of the security context attached to a key for
5098  * the purposes of honouring KEYCTL_GETSECURITY.  This function allocates the
5099  * storage for the NUL-terminated string and the caller should free it.
5100  *
5101  * Return: Returns the length of @buffer (including terminating NUL) or -ve if
5102  *         an error occurs.  May also return 0 (and a NULL buffer pointer) if
5103  *         there is no security label assigned to the key.
5104  */
security_key_getsecurity(struct key * key,char ** buffer)5105 int security_key_getsecurity(struct key *key, char **buffer)
5106 {
5107 	*buffer = NULL;
5108 	return call_int_hook(key_getsecurity, 0, key, buffer);
5109 }
5110 #endif	/* CONFIG_KEYS */
5111 
5112 #ifdef CONFIG_AUDIT
5113 /**
5114  * security_audit_rule_init() - Allocate and init an LSM audit rule struct
5115  * @field: audit action
5116  * @op: rule operator
5117  * @rulestr: rule context
5118  * @lsmrule: receive buffer for audit rule struct
5119  *
5120  * Allocate and initialize an LSM audit rule structure.
5121  *
5122  * Return: Return 0 if @lsmrule has been successfully set, -EINVAL in case of
5123  *         an invalid rule.
5124  */
security_audit_rule_init(u32 field,u32 op,char * rulestr,void ** lsmrule)5125 int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule)
5126 {
5127 	return call_int_hook(audit_rule_init, 0, field, op, rulestr, lsmrule);
5128 }
5129 
5130 /**
5131  * security_audit_rule_known() - Check if an audit rule contains LSM fields
5132  * @krule: audit rule
5133  *
5134  * Specifies whether given @krule contains any fields related to the current
5135  * LSM.
5136  *
5137  * Return: Returns 1 in case of relation found, 0 otherwise.
5138  */
security_audit_rule_known(struct audit_krule * krule)5139 int security_audit_rule_known(struct audit_krule *krule)
5140 {
5141 	return call_int_hook(audit_rule_known, 0, krule);
5142 }
5143 
5144 /**
5145  * security_audit_rule_free() - Free an LSM audit rule struct
5146  * @lsmrule: audit rule struct
5147  *
5148  * Deallocate the LSM audit rule structure previously allocated by
5149  * audit_rule_init().
5150  */
security_audit_rule_free(void * lsmrule)5151 void security_audit_rule_free(void *lsmrule)
5152 {
5153 	call_void_hook(audit_rule_free, lsmrule);
5154 }
5155 
5156 /**
5157  * security_audit_rule_match() - Check if a label matches an audit rule
5158  * @secid: security label
5159  * @field: LSM audit field
5160  * @op: matching operator
5161  * @lsmrule: audit rule
5162  *
5163  * Determine if given @secid matches a rule previously approved by
5164  * security_audit_rule_known().
5165  *
5166  * Return: Returns 1 if secid matches the rule, 0 if it does not, -ERRNO on
5167  *         failure.
5168  */
security_audit_rule_match(u32 secid,u32 field,u32 op,void * lsmrule)5169 int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule)
5170 {
5171 	return call_int_hook(audit_rule_match, 0, secid, field, op, lsmrule);
5172 }
5173 #endif /* CONFIG_AUDIT */
5174 
5175 #ifdef CONFIG_BPF_SYSCALL
5176 /**
5177  * security_bpf() - Check if the bpf syscall operation is allowed
5178  * @cmd: command
5179  * @attr: bpf attribute
5180  * @size: size
5181  *
5182  * Do a initial check for all bpf syscalls after the attribute is copied into
5183  * the kernel. The actual security module can implement their own rules to
5184  * check the specific cmd they need.
5185  *
5186  * Return: Returns 0 if permission is granted.
5187  */
security_bpf(int cmd,union bpf_attr * attr,unsigned int size)5188 int security_bpf(int cmd, union bpf_attr *attr, unsigned int size)
5189 {
5190 	return call_int_hook(bpf, 0, cmd, attr, size);
5191 }
5192 
5193 /**
5194  * security_bpf_map() - Check if access to a bpf map is allowed
5195  * @map: bpf map
5196  * @fmode: mode
5197  *
5198  * Do a check when the kernel generates and returns a file descriptor for eBPF
5199  * maps.
5200  *
5201  * Return: Returns 0 if permission is granted.
5202  */
security_bpf_map(struct bpf_map * map,fmode_t fmode)5203 int security_bpf_map(struct bpf_map *map, fmode_t fmode)
5204 {
5205 	return call_int_hook(bpf_map, 0, map, fmode);
5206 }
5207 
5208 /**
5209  * security_bpf_prog() - Check if access to a bpf program is allowed
5210  * @prog: bpf program
5211  *
5212  * Do a check when the kernel generates and returns a file descriptor for eBPF
5213  * programs.
5214  *
5215  * Return: Returns 0 if permission is granted.
5216  */
security_bpf_prog(struct bpf_prog * prog)5217 int security_bpf_prog(struct bpf_prog *prog)
5218 {
5219 	return call_int_hook(bpf_prog, 0, prog);
5220 }
5221 
5222 /**
5223  * security_bpf_map_alloc() - Allocate a bpf map LSM blob
5224  * @map: bpf map
5225  *
5226  * Initialize the security field inside bpf map.
5227  *
5228  * Return: Returns 0 on success, error on failure.
5229  */
security_bpf_map_alloc(struct bpf_map * map)5230 int security_bpf_map_alloc(struct bpf_map *map)
5231 {
5232 	return call_int_hook(bpf_map_alloc_security, 0, map);
5233 }
5234 
5235 /**
5236  * security_bpf_prog_alloc() - Allocate a bpf program LSM blob
5237  * @aux: bpf program aux info struct
5238  *
5239  * Initialize the security field inside bpf program.
5240  *
5241  * Return: Returns 0 on success, error on failure.
5242  */
security_bpf_prog_alloc(struct bpf_prog_aux * aux)5243 int security_bpf_prog_alloc(struct bpf_prog_aux *aux)
5244 {
5245 	return call_int_hook(bpf_prog_alloc_security, 0, aux);
5246 }
5247 
5248 /**
5249  * security_bpf_map_free() - Free a bpf map's LSM blob
5250  * @map: bpf map
5251  *
5252  * Clean up the security information stored inside bpf map.
5253  */
security_bpf_map_free(struct bpf_map * map)5254 void security_bpf_map_free(struct bpf_map *map)
5255 {
5256 	call_void_hook(bpf_map_free_security, map);
5257 }
5258 
5259 /**
5260  * security_bpf_prog_free() - Free a bpf program's LSM blob
5261  * @aux: bpf program aux info struct
5262  *
5263  * Clean up the security information stored inside bpf prog.
5264  */
security_bpf_prog_free(struct bpf_prog_aux * aux)5265 void security_bpf_prog_free(struct bpf_prog_aux *aux)
5266 {
5267 	call_void_hook(bpf_prog_free_security, aux);
5268 }
5269 #endif /* CONFIG_BPF_SYSCALL */
5270 
5271 /**
5272  * security_locked_down() - Check if a kernel feature is allowed
5273  * @what: requested kernel feature
5274  *
5275  * Determine whether a kernel feature that potentially enables arbitrary code
5276  * execution in kernel space should be permitted.
5277  *
5278  * Return: Returns 0 if permission is granted.
5279  */
security_locked_down(enum lockdown_reason what)5280 int security_locked_down(enum lockdown_reason what)
5281 {
5282 	return call_int_hook(locked_down, 0, what);
5283 }
5284 EXPORT_SYMBOL(security_locked_down);
5285 
5286 #ifdef CONFIG_PERF_EVENTS
5287 /**
5288  * security_perf_event_open() - Check if a perf event open is allowed
5289  * @attr: perf event attribute
5290  * @type: type of event
5291  *
5292  * Check whether the @type of perf_event_open syscall is allowed.
5293  *
5294  * Return: Returns 0 if permission is granted.
5295  */
security_perf_event_open(struct perf_event_attr * attr,int type)5296 int security_perf_event_open(struct perf_event_attr *attr, int type)
5297 {
5298 	return call_int_hook(perf_event_open, 0, attr, type);
5299 }
5300 
5301 /**
5302  * security_perf_event_alloc() - Allocate a perf event LSM blob
5303  * @event: perf event
5304  *
5305  * Allocate and save perf_event security info.
5306  *
5307  * Return: Returns 0 on success, error on failure.
5308  */
security_perf_event_alloc(struct perf_event * event)5309 int security_perf_event_alloc(struct perf_event *event)
5310 {
5311 	return call_int_hook(perf_event_alloc, 0, event);
5312 }
5313 
5314 /**
5315  * security_perf_event_free() - Free a perf event LSM blob
5316  * @event: perf event
5317  *
5318  * Release (free) perf_event security info.
5319  */
security_perf_event_free(struct perf_event * event)5320 void security_perf_event_free(struct perf_event *event)
5321 {
5322 	call_void_hook(perf_event_free, event);
5323 }
5324 
5325 /**
5326  * security_perf_event_read() - Check if reading a perf event label is allowed
5327  * @event: perf event
5328  *
5329  * Read perf_event security info if allowed.
5330  *
5331  * Return: Returns 0 if permission is granted.
5332  */
security_perf_event_read(struct perf_event * event)5333 int security_perf_event_read(struct perf_event *event)
5334 {
5335 	return call_int_hook(perf_event_read, 0, event);
5336 }
5337 
5338 /**
5339  * security_perf_event_write() - Check if writing a perf event label is allowed
5340  * @event: perf event
5341  *
5342  * Write perf_event security info if allowed.
5343  *
5344  * Return: Returns 0 if permission is granted.
5345  */
security_perf_event_write(struct perf_event * event)5346 int security_perf_event_write(struct perf_event *event)
5347 {
5348 	return call_int_hook(perf_event_write, 0, event);
5349 }
5350 #endif /* CONFIG_PERF_EVENTS */
5351 
5352 #ifdef CONFIG_IO_URING
5353 /**
5354  * security_uring_override_creds() - Check if overriding creds is allowed
5355  * @new: new credentials
5356  *
5357  * Check if the current task, executing an io_uring operation, is allowed to
5358  * override it's credentials with @new.
5359  *
5360  * Return: Returns 0 if permission is granted.
5361  */
security_uring_override_creds(const struct cred * new)5362 int security_uring_override_creds(const struct cred *new)
5363 {
5364 	return call_int_hook(uring_override_creds, 0, new);
5365 }
5366 
5367 /**
5368  * security_uring_sqpoll() - Check if IORING_SETUP_SQPOLL is allowed
5369  *
5370  * Check whether the current task is allowed to spawn a io_uring polling thread
5371  * (IORING_SETUP_SQPOLL).
5372  *
5373  * Return: Returns 0 if permission is granted.
5374  */
security_uring_sqpoll(void)5375 int security_uring_sqpoll(void)
5376 {
5377 	return call_int_hook(uring_sqpoll, 0);
5378 }
5379 
5380 /**
5381  * security_uring_cmd() - Check if a io_uring passthrough command is allowed
5382  * @ioucmd: command
5383  *
5384  * Check whether the file_operations uring_cmd is allowed to run.
5385  *
5386  * Return: Returns 0 if permission is granted.
5387  */
security_uring_cmd(struct io_uring_cmd * ioucmd)5388 int security_uring_cmd(struct io_uring_cmd *ioucmd)
5389 {
5390 	return call_int_hook(uring_cmd, 0, ioucmd);
5391 }
5392 #endif /* CONFIG_IO_URING */
5393