linux/security/security.c
<<
>>
Prefs
   1/*
   2 * Security plug functions
   3 *
   4 * Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com>
   5 * Copyright (C) 2001-2002 Greg Kroah-Hartman <greg@kroah.com>
   6 * Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com>
   7 *
   8 *      This program is free software; you can redistribute it and/or modify
   9 *      it under the terms of the GNU General Public License as published by
  10 *      the Free Software Foundation; either version 2 of the License, or
  11 *      (at your option) any later version.
  12 */
  13
  14#include <linux/capability.h>
  15#include <linux/module.h>
  16#include <linux/init.h>
  17#include <linux/kernel.h>
  18#include <linux/security.h>
  19
  20/* Boot-time LSM user choice */
  21static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1];
  22
  23/* things that live in capability.c */
  24extern struct security_operations default_security_ops;
  25extern void security_fixup_ops(struct security_operations *ops);
  26
  27struct security_operations *security_ops;       /* Initialized to NULL */
  28
  29/* amount of vm to protect from userspace access */
  30unsigned long mmap_min_addr = CONFIG_SECURITY_DEFAULT_MMAP_MIN_ADDR;
  31
  32static inline int verify(struct security_operations *ops)
  33{
  34        /* verify the security_operations structure exists */
  35        if (!ops)
  36                return -EINVAL;
  37        security_fixup_ops(ops);
  38        return 0;
  39}
  40
  41static void __init do_security_initcalls(void)
  42{
  43        initcall_t *call;
  44        call = __security_initcall_start;
  45        while (call < __security_initcall_end) {
  46                (*call) ();
  47                call++;
  48        }
  49}
  50
  51/**
  52 * security_init - initializes the security framework
  53 *
  54 * This should be called early in the kernel initialization sequence.
  55 */
  56int __init security_init(void)
  57{
  58        printk(KERN_INFO "Security Framework initialized\n");
  59
  60        security_fixup_ops(&default_security_ops);
  61        security_ops = &default_security_ops;
  62        do_security_initcalls();
  63
  64        return 0;
  65}
  66
  67/* Save user chosen LSM */
  68static int __init choose_lsm(char *str)
  69{
  70        strncpy(chosen_lsm, str, SECURITY_NAME_MAX);
  71        return 1;
  72}
  73__setup("security=", choose_lsm);
  74
  75/**
  76 * security_module_enable - Load given security module on boot ?
  77 * @ops: a pointer to the struct security_operations that is to be checked.
  78 *
  79 * Each LSM must pass this method before registering its own operations
  80 * to avoid security registration races. This method may also be used
  81 * to check if your LSM is currently loaded during kernel initialization.
  82 *
  83 * Return true if:
  84 *      -The passed LSM is the one chosen by user at boot time,
  85 *      -or user didn't specify a specific LSM and we're the first to ask
  86 *       for registration permission,
  87 *      -or the passed LSM is currently loaded.
  88 * Otherwise, return false.
  89 */
  90int __init security_module_enable(struct security_operations *ops)
  91{
  92        if (!*chosen_lsm)
  93                strncpy(chosen_lsm, ops->name, SECURITY_NAME_MAX);
  94        else if (strncmp(ops->name, chosen_lsm, SECURITY_NAME_MAX))
  95                return 0;
  96
  97        return 1;
  98}
  99
 100/**
 101 * register_security - registers a security framework with the kernel
 102 * @ops: a pointer to the struct security_options that is to be registered
 103 *
 104 * This function allows a security module to register itself with the
 105 * kernel security subsystem.  Some rudimentary checking is done on the @ops
 106 * value passed to this function. You'll need to check first if your LSM
 107 * is allowed to register its @ops by calling security_module_enable(@ops).
 108 *
 109 * If there is already a security module registered with the kernel,
 110 * an error will be returned.  Otherwise %0 is returned on success.
 111 */
 112int register_security(struct security_operations *ops)
 113{
 114        if (verify(ops)) {
 115                printk(KERN_DEBUG "%s could not verify "
 116                       "security_operations structure.\n", __func__);
 117                return -EINVAL;
 118        }
 119
 120        if (security_ops != &default_security_ops)
 121                return -EAGAIN;
 122
 123        security_ops = ops;
 124
 125        return 0;
 126}
 127
 128/* Security operations */
 129
 130int security_ptrace_may_access(struct task_struct *child, unsigned int mode)
 131{
 132        return security_ops->ptrace_may_access(child, mode);
 133}
 134
 135int security_ptrace_traceme(struct task_struct *parent)
 136{
 137        return security_ops->ptrace_traceme(parent);
 138}
 139
 140int security_capget(struct task_struct *target,
 141                     kernel_cap_t *effective,
 142                     kernel_cap_t *inheritable,
 143                     kernel_cap_t *permitted)
 144{
 145        return security_ops->capget(target, effective, inheritable, permitted);
 146}
 147
 148int security_capset_check(struct task_struct *target,
 149                           kernel_cap_t *effective,
 150                           kernel_cap_t *inheritable,
 151                           kernel_cap_t *permitted)
 152{
 153        return security_ops->capset_check(target, effective, inheritable, permitted);
 154}
 155
 156void security_capset_set(struct task_struct *target,
 157                          kernel_cap_t *effective,
 158                          kernel_cap_t *inheritable,
 159                          kernel_cap_t *permitted)
 160{
 161        security_ops->capset_set(target, effective, inheritable, permitted);
 162}
 163
 164int security_capable(struct task_struct *tsk, int cap)
 165{
 166        return security_ops->capable(tsk, cap);
 167}
 168
 169int security_acct(struct file *file)
 170{
 171        return security_ops->acct(file);
 172}
 173
 174int security_sysctl(struct ctl_table *table, int op)
 175{
 176        return security_ops->sysctl(table, op);
 177}
 178
 179int security_quotactl(int cmds, int type, int id, struct super_block *sb)
 180{
 181        return security_ops->quotactl(cmds, type, id, sb);
 182}
 183
 184int security_quota_on(struct dentry *dentry)
 185{
 186        return security_ops->quota_on(dentry);
 187}
 188
 189int security_syslog(int type)
 190{
 191        return security_ops->syslog(type);
 192}
 193
 194int security_settime(struct timespec *ts, struct timezone *tz)
 195{
 196        return security_ops->settime(ts, tz);
 197}
 198
 199int security_vm_enough_memory(long pages)
 200{
 201        WARN_ON(current->mm == NULL);
 202        return security_ops->vm_enough_memory(current->mm, pages);
 203}
 204
 205int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
 206{
 207        WARN_ON(mm == NULL);
 208        return security_ops->vm_enough_memory(mm, pages);
 209}
 210
 211int security_vm_enough_memory_kern(long pages)
 212{
 213        /* If current->mm is a kernel thread then we will pass NULL,
 214           for this specific case that is fine */
 215        return security_ops->vm_enough_memory(current->mm, pages);
 216}
 217
 218int security_bprm_alloc(struct linux_binprm *bprm)
 219{
 220        return security_ops->bprm_alloc_security(bprm);
 221}
 222
 223void security_bprm_free(struct linux_binprm *bprm)
 224{
 225        security_ops->bprm_free_security(bprm);
 226}
 227
 228void security_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
 229{
 230        security_ops->bprm_apply_creds(bprm, unsafe);
 231}
 232
 233void security_bprm_post_apply_creds(struct linux_binprm *bprm)
 234{
 235        security_ops->bprm_post_apply_creds(bprm);
 236}
 237
 238int security_bprm_set(struct linux_binprm *bprm)
 239{
 240        return security_ops->bprm_set_security(bprm);
 241}
 242
 243int security_bprm_check(struct linux_binprm *bprm)
 244{
 245        return security_ops->bprm_check_security(bprm);
 246}
 247
 248int security_bprm_secureexec(struct linux_binprm *bprm)
 249{
 250        return security_ops->bprm_secureexec(bprm);
 251}
 252
 253int security_sb_alloc(struct super_block *sb)
 254{
 255        return security_ops->sb_alloc_security(sb);
 256}
 257
 258void security_sb_free(struct super_block *sb)
 259{
 260        security_ops->sb_free_security(sb);
 261}
 262
 263int security_sb_copy_data(char *orig, char *copy)
 264{
 265        return security_ops->sb_copy_data(orig, copy);
 266}
 267EXPORT_SYMBOL(security_sb_copy_data);
 268
 269int security_sb_kern_mount(struct super_block *sb, void *data)
 270{
 271        return security_ops->sb_kern_mount(sb, data);
 272}
 273
 274int security_sb_show_options(struct seq_file *m, struct super_block *sb)
 275{
 276        return security_ops->sb_show_options(m, sb);
 277}
 278
 279int security_sb_statfs(struct dentry *dentry)
 280{
 281        return security_ops->sb_statfs(dentry);
 282}
 283
 284int security_sb_mount(char *dev_name, struct path *path,
 285                       char *type, unsigned long flags, void *data)
 286{
 287        return security_ops->sb_mount(dev_name, path, type, flags, data);
 288}
 289
 290int security_sb_check_sb(struct vfsmount *mnt, struct path *path)
 291{
 292        return security_ops->sb_check_sb(mnt, path);
 293}
 294
 295int security_sb_umount(struct vfsmount *mnt, int flags)
 296{
 297        return security_ops->sb_umount(mnt, flags);
 298}
 299
 300void security_sb_umount_close(struct vfsmount *mnt)
 301{
 302        security_ops->sb_umount_close(mnt);
 303}
 304
 305void security_sb_umount_busy(struct vfsmount *mnt)
 306{
 307        security_ops->sb_umount_busy(mnt);
 308}
 309
 310void security_sb_post_remount(struct vfsmount *mnt, unsigned long flags, void *data)
 311{
 312        security_ops->sb_post_remount(mnt, flags, data);
 313}
 314
 315void security_sb_post_addmount(struct vfsmount *mnt, struct path *mountpoint)
 316{
 317        security_ops->sb_post_addmount(mnt, mountpoint);
 318}
 319
 320int security_sb_pivotroot(struct path *old_path, struct path *new_path)
 321{
 322        return security_ops->sb_pivotroot(old_path, new_path);
 323}
 324
 325void security_sb_post_pivotroot(struct path *old_path, struct path *new_path)
 326{
 327        security_ops->sb_post_pivotroot(old_path, new_path);
 328}
 329
 330int security_sb_set_mnt_opts(struct super_block *sb,
 331                                struct security_mnt_opts *opts)
 332{
 333        return security_ops->sb_set_mnt_opts(sb, opts);
 334}
 335EXPORT_SYMBOL(security_sb_set_mnt_opts);
 336
 337void security_sb_clone_mnt_opts(const struct super_block *oldsb,
 338                                struct super_block *newsb)
 339{
 340        security_ops->sb_clone_mnt_opts(oldsb, newsb);
 341}
 342EXPORT_SYMBOL(security_sb_clone_mnt_opts);
 343
 344int security_sb_parse_opts_str(char *options, struct security_mnt_opts *opts)
 345{
 346        return security_ops->sb_parse_opts_str(options, opts);
 347}
 348EXPORT_SYMBOL(security_sb_parse_opts_str);
 349
 350int security_inode_alloc(struct inode *inode)
 351{
 352        inode->i_security = NULL;
 353        return security_ops->inode_alloc_security(inode);
 354}
 355
 356void security_inode_free(struct inode *inode)
 357{
 358        security_ops->inode_free_security(inode);
 359}
 360
 361int security_inode_init_security(struct inode *inode, struct inode *dir,
 362                                  char **name, void **value, size_t *len)
 363{
 364        if (unlikely(IS_PRIVATE(inode)))
 365                return -EOPNOTSUPP;
 366        return security_ops->inode_init_security(inode, dir, name, value, len);
 367}
 368EXPORT_SYMBOL(security_inode_init_security);
 369
 370int security_inode_create(struct inode *dir, struct dentry *dentry, int mode)
 371{
 372        if (unlikely(IS_PRIVATE(dir)))
 373                return 0;
 374        return security_ops->inode_create(dir, dentry, mode);
 375}
 376
 377int security_inode_link(struct dentry *old_dentry, struct inode *dir,
 378                         struct dentry *new_dentry)
 379{
 380        if (unlikely(IS_PRIVATE(old_dentry->d_inode)))
 381                return 0;
 382        return security_ops->inode_link(old_dentry, dir, new_dentry);
 383}
 384
 385int security_inode_unlink(struct inode *dir, struct dentry *dentry)
 386{
 387        if (unlikely(IS_PRIVATE(dentry->d_inode)))
 388                return 0;
 389        return security_ops->inode_unlink(dir, dentry);
 390}
 391
 392int security_inode_symlink(struct inode *dir, struct dentry *dentry,
 393                            const char *old_name)
 394{
 395        if (unlikely(IS_PRIVATE(dir)))
 396                return 0;
 397        return security_ops->inode_symlink(dir, dentry, old_name);
 398}
 399
 400int security_inode_mkdir(struct inode *dir, struct dentry *dentry, int mode)
 401{
 402        if (unlikely(IS_PRIVATE(dir)))
 403                return 0;
 404        return security_ops->inode_mkdir(dir, dentry, mode);
 405}
 406
 407int security_inode_rmdir(struct inode *dir, struct dentry *dentry)
 408{
 409        if (unlikely(IS_PRIVATE(dentry->d_inode)))
 410                return 0;
 411        return security_ops->inode_rmdir(dir, dentry);
 412}
 413
 414int security_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
 415{
 416        if (unlikely(IS_PRIVATE(dir)))
 417                return 0;
 418        return security_ops->inode_mknod(dir, dentry, mode, dev);
 419}
 420
 421int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
 422                           struct inode *new_dir, struct dentry *new_dentry)
 423{
 424        if (unlikely(IS_PRIVATE(old_dentry->d_inode) ||
 425            (new_dentry->d_inode && IS_PRIVATE(new_dentry->d_inode))))
 426                return 0;
 427        return security_ops->inode_rename(old_dir, old_dentry,
 428                                           new_dir, new_dentry);
 429}
 430
 431int security_inode_readlink(struct dentry *dentry)
 432{
 433        if (unlikely(IS_PRIVATE(dentry->d_inode)))
 434                return 0;
 435        return security_ops->inode_readlink(dentry);
 436}
 437
 438int security_inode_follow_link(struct dentry *dentry, struct nameidata *nd)
 439{
 440        if (unlikely(IS_PRIVATE(dentry->d_inode)))
 441                return 0;
 442        return security_ops->inode_follow_link(dentry, nd);
 443}
 444
 445int security_inode_permission(struct inode *inode, int mask)
 446{
 447        if (unlikely(IS_PRIVATE(inode)))
 448                return 0;
 449        return security_ops->inode_permission(inode, mask);
 450}
 451
 452int security_inode_setattr(struct dentry *dentry, struct iattr *attr)
 453{
 454        if (unlikely(IS_PRIVATE(dentry->d_inode)))
 455                return 0;
 456        return security_ops->inode_setattr(dentry, attr);
 457}
 458EXPORT_SYMBOL_GPL(security_inode_setattr);
 459
 460int security_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
 461{
 462        if (unlikely(IS_PRIVATE(dentry->d_inode)))
 463                return 0;
 464        return security_ops->inode_getattr(mnt, dentry);
 465}
 466
 467void security_inode_delete(struct inode *inode)
 468{
 469        if (unlikely(IS_PRIVATE(inode)))
 470                return;
 471        security_ops->inode_delete(inode);
 472}
 473
 474int security_inode_setxattr(struct dentry *dentry, const char *name,
 475                            const void *value, size_t size, int flags)
 476{
 477        if (unlikely(IS_PRIVATE(dentry->d_inode)))
 478                return 0;
 479        return security_ops->inode_setxattr(dentry, name, value, size, flags);
 480}
 481
 482void security_inode_post_setxattr(struct dentry *dentry, const char *name,
 483                                  const void *value, size_t size, int flags)
 484{
 485        if (unlikely(IS_PRIVATE(dentry->d_inode)))
 486                return;
 487        security_ops->inode_post_setxattr(dentry, name, value, size, flags);
 488}
 489
 490int security_inode_getxattr(struct dentry *dentry, const char *name)
 491{
 492        if (unlikely(IS_PRIVATE(dentry->d_inode)))
 493                return 0;
 494        return security_ops->inode_getxattr(dentry, name);
 495}
 496
 497int security_inode_listxattr(struct dentry *dentry)
 498{
 499        if (unlikely(IS_PRIVATE(dentry->d_inode)))
 500                return 0;
 501        return security_ops->inode_listxattr(dentry);
 502}
 503
 504int security_inode_removexattr(struct dentry *dentry, const char *name)
 505{
 506        if (unlikely(IS_PRIVATE(dentry->d_inode)))
 507                return 0;
 508        return security_ops->inode_removexattr(dentry, name);
 509}
 510
 511int security_inode_need_killpriv(struct dentry *dentry)
 512{
 513        return security_ops->inode_need_killpriv(dentry);
 514}
 515
 516int security_inode_killpriv(struct dentry *dentry)
 517{
 518        return security_ops->inode_killpriv(dentry);
 519}
 520
 521int security_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
 522{
 523        if (unlikely(IS_PRIVATE(inode)))
 524                return 0;
 525        return security_ops->inode_getsecurity(inode, name, buffer, alloc);
 526}
 527
 528int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
 529{
 530        if (unlikely(IS_PRIVATE(inode)))
 531                return 0;
 532        return security_ops->inode_setsecurity(inode, name, value, size, flags);
 533}
 534
 535int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
 536{
 537        if (unlikely(IS_PRIVATE(inode)))
 538                return 0;
 539        return security_ops->inode_listsecurity(inode, buffer, buffer_size);
 540}
 541
 542void security_inode_getsecid(const struct inode *inode, u32 *secid)
 543{
 544        security_ops->inode_getsecid(inode, secid);
 545}
 546
 547int security_file_permission(struct file *file, int mask)
 548{
 549        return security_ops->file_permission(file, mask);
 550}
 551
 552int security_file_alloc(struct file *file)
 553{
 554        return security_ops->file_alloc_security(file);
 555}
 556
 557void security_file_free(struct file *file)
 558{
 559        security_ops->file_free_security(file);
 560}
 561
 562int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 563{
 564        return security_ops->file_ioctl(file, cmd, arg);
 565}
 566
 567int security_file_mmap(struct file *file, unsigned long reqprot,
 568                        unsigned long prot, unsigned long flags,
 569                        unsigned long addr, unsigned long addr_only)
 570{
 571        return security_ops->file_mmap(file, reqprot, prot, flags, addr, addr_only);
 572}
 573
 574int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
 575                            unsigned long prot)
 576{
 577        return security_ops->file_mprotect(vma, reqprot, prot);
 578}
 579
 580int security_file_lock(struct file *file, unsigned int cmd)
 581{
 582        return security_ops->file_lock(file, cmd);
 583}
 584
 585int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
 586{
 587        return security_ops->file_fcntl(file, cmd, arg);
 588}
 589
 590int security_file_set_fowner(struct file *file)
 591{
 592        return security_ops->file_set_fowner(file);
 593}
 594
 595int security_file_send_sigiotask(struct task_struct *tsk,
 596                                  struct fown_struct *fown, int sig)
 597{
 598        return security_ops->file_send_sigiotask(tsk, fown, sig);
 599}
 600
 601int security_file_receive(struct file *file)
 602{
 603        return security_ops->file_receive(file);
 604}
 605
 606int security_dentry_open(struct file *file)
 607{
 608        return security_ops->dentry_open(file);
 609}
 610
 611int security_task_create(unsigned long clone_flags)
 612{
 613        return security_ops->task_create(clone_flags);
 614}
 615
 616int security_task_alloc(struct task_struct *p)
 617{
 618        return security_ops->task_alloc_security(p);
 619}
 620
 621void security_task_free(struct task_struct *p)
 622{
 623        security_ops->task_free_security(p);
 624}
 625
 626int security_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
 627{
 628        return security_ops->task_setuid(id0, id1, id2, flags);
 629}
 630
 631int security_task_post_setuid(uid_t old_ruid, uid_t old_euid,
 632                               uid_t old_suid, int flags)
 633{
 634        return security_ops->task_post_setuid(old_ruid, old_euid, old_suid, flags);
 635}
 636
 637int security_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
 638{
 639        return security_ops->task_setgid(id0, id1, id2, flags);
 640}
 641
 642int security_task_setpgid(struct task_struct *p, pid_t pgid)
 643{
 644        return security_ops->task_setpgid(p, pgid);
 645}
 646
 647int security_task_getpgid(struct task_struct *p)
 648{
 649        return security_ops->task_getpgid(p);
 650}
 651
 652int security_task_getsid(struct task_struct *p)
 653{
 654        return security_ops->task_getsid(p);
 655}
 656
 657void security_task_getsecid(struct task_struct *p, u32 *secid)
 658{
 659        security_ops->task_getsecid(p, secid);
 660}
 661EXPORT_SYMBOL(security_task_getsecid);
 662
 663int security_task_setgroups(struct group_info *group_info)
 664{
 665        return security_ops->task_setgroups(group_info);
 666}
 667
 668int security_task_setnice(struct task_struct *p, int nice)
 669{
 670        return security_ops->task_setnice(p, nice);
 671}
 672
 673int security_task_setioprio(struct task_struct *p, int ioprio)
 674{
 675        return security_ops->task_setioprio(p, ioprio);
 676}
 677
 678int security_task_getioprio(struct task_struct *p)
 679{
 680        return security_ops->task_getioprio(p);
 681}
 682
 683int security_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
 684{
 685        return security_ops->task_setrlimit(resource, new_rlim);
 686}
 687
 688int security_task_setscheduler(struct task_struct *p,
 689                                int policy, struct sched_param *lp)
 690{
 691        return security_ops->task_setscheduler(p, policy, lp);
 692}
 693
 694int security_task_getscheduler(struct task_struct *p)
 695{
 696        return security_ops->task_getscheduler(p);
 697}
 698
 699int security_task_movememory(struct task_struct *p)
 700{
 701        return security_ops->task_movememory(p);
 702}
 703
 704int security_task_kill(struct task_struct *p, struct siginfo *info,
 705                        int sig, u32 secid)
 706{
 707        return security_ops->task_kill(p, info, sig, secid);
 708}
 709
 710int security_task_wait(struct task_struct *p)
 711{
 712        return security_ops->task_wait(p);
 713}
 714
 715int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
 716                         unsigned long arg4, unsigned long arg5, long *rc_p)
 717{
 718        return security_ops->task_prctl(option, arg2, arg3, arg4, arg5, rc_p);
 719}
 720
 721void security_task_reparent_to_init(struct task_struct *p)
 722{
 723        security_ops->task_reparent_to_init(p);
 724}
 725
 726void security_task_to_inode(struct task_struct *p, struct inode *inode)
 727{
 728        security_ops->task_to_inode(p, inode);
 729}
 730
 731int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
 732{
 733        return security_ops->ipc_permission(ipcp, flag);
 734}
 735
 736void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
 737{
 738        security_ops->ipc_getsecid(ipcp, secid);
 739}
 740
 741int security_msg_msg_alloc(struct msg_msg *msg)
 742{
 743        return security_ops->msg_msg_alloc_security(msg);
 744}
 745
 746void security_msg_msg_free(struct msg_msg *msg)
 747{
 748        security_ops->msg_msg_free_security(msg);
 749}
 750
 751int security_msg_queue_alloc(struct msg_queue *msq)
 752{
 753        return security_ops->msg_queue_alloc_security(msq);
 754}
 755
 756void security_msg_queue_free(struct msg_queue *msq)
 757{
 758        security_ops->msg_queue_free_security(msq);
 759}
 760
 761int security_msg_queue_associate(struct msg_queue *msq, int msqflg)
 762{
 763        return security_ops->msg_queue_associate(msq, msqflg);
 764}
 765
 766int security_msg_queue_msgctl(struct msg_queue *msq, int cmd)
 767{
 768        return security_ops->msg_queue_msgctl(msq, cmd);
 769}
 770
 771int security_msg_queue_msgsnd(struct msg_queue *msq,
 772                               struct msg_msg *msg, int msqflg)
 773{
 774        return security_ops->msg_queue_msgsnd(msq, msg, msqflg);
 775}
 776
 777int security_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
 778                               struct task_struct *target, long type, int mode)
 779{
 780        return security_ops->msg_queue_msgrcv(msq, msg, target, type, mode);
 781}
 782
 783int security_shm_alloc(struct shmid_kernel *shp)
 784{
 785        return security_ops->shm_alloc_security(shp);
 786}
 787
 788void security_shm_free(struct shmid_kernel *shp)
 789{
 790        security_ops->shm_free_security(shp);
 791}
 792
 793int security_shm_associate(struct shmid_kernel *shp, int shmflg)
 794{
 795        return security_ops->shm_associate(shp, shmflg);
 796}
 797
 798int security_shm_shmctl(struct shmid_kernel *shp, int cmd)
 799{
 800        return security_ops->shm_shmctl(shp, cmd);
 801}
 802
 803int security_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr, int shmflg)
 804{
 805        return security_ops->shm_shmat(shp, shmaddr, shmflg);
 806}
 807
 808int security_sem_alloc(struct sem_array *sma)
 809{
 810        return security_ops->sem_alloc_security(sma);
 811}
 812
 813void security_sem_free(struct sem_array *sma)
 814{
 815        security_ops->sem_free_security(sma);
 816}
 817
 818int security_sem_associate(struct sem_array *sma, int semflg)
 819{
 820        return security_ops->sem_associate(sma, semflg);
 821}
 822
 823int security_sem_semctl(struct sem_array *sma, int cmd)
 824{
 825        return security_ops->sem_semctl(sma, cmd);
 826}
 827
 828int security_sem_semop(struct sem_array *sma, struct sembuf *sops,
 829                        unsigned nsops, int alter)
 830{
 831        return security_ops->sem_semop(sma, sops, nsops, alter);
 832}
 833
 834void security_d_instantiate(struct dentry *dentry, struct inode *inode)
 835{
 836        if (unlikely(inode && IS_PRIVATE(inode)))
 837                return;
 838        security_ops->d_instantiate(dentry, inode);
 839}
 840EXPORT_SYMBOL(security_d_instantiate);
 841
 842int security_getprocattr(struct task_struct *p, char *name, char **value)
 843{
 844        return security_ops->getprocattr(p, name, value);
 845}
 846
 847int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size)
 848{
 849        return security_ops->setprocattr(p, name, value, size);
 850}
 851
 852int security_netlink_send(struct sock *sk, struct sk_buff *skb)
 853{
 854        return security_ops->netlink_send(sk, skb);
 855}
 856
 857int security_netlink_recv(struct sk_buff *skb, int cap)
 858{
 859        return security_ops->netlink_recv(skb, cap);
 860}
 861EXPORT_SYMBOL(security_netlink_recv);
 862
 863int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
 864{
 865        return security_ops->secid_to_secctx(secid, secdata, seclen);
 866}
 867EXPORT_SYMBOL(security_secid_to_secctx);
 868
 869int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
 870{
 871        return security_ops->secctx_to_secid(secdata, seclen, secid);
 872}
 873EXPORT_SYMBOL(security_secctx_to_secid);
 874
 875void security_release_secctx(char *secdata, u32 seclen)
 876{
 877        security_ops->release_secctx(secdata, seclen);
 878}
 879EXPORT_SYMBOL(security_release_secctx);
 880
 881#ifdef CONFIG_SECURITY_NETWORK
 882
 883int security_unix_stream_connect(struct socket *sock, struct socket *other,
 884                                 struct sock *newsk)
 885{
 886        return security_ops->unix_stream_connect(sock, other, newsk);
 887}
 888EXPORT_SYMBOL(security_unix_stream_connect);
 889
 890int security_unix_may_send(struct socket *sock,  struct socket *other)
 891{
 892        return security_ops->unix_may_send(sock, other);
 893}
 894EXPORT_SYMBOL(security_unix_may_send);
 895
 896int security_socket_create(int family, int type, int protocol, int kern)
 897{
 898        return security_ops->socket_create(family, type, protocol, kern);
 899}
 900
 901int security_socket_post_create(struct socket *sock, int family,
 902                                int type, int protocol, int kern)
 903{
 904        return security_ops->socket_post_create(sock, family, type,
 905                                                protocol, kern);
 906}
 907
 908int security_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
 909{
 910        return security_ops->socket_bind(sock, address, addrlen);
 911}
 912
 913int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
 914{
 915        return security_ops->socket_connect(sock, address, addrlen);
 916}
 917
 918int security_socket_listen(struct socket *sock, int backlog)
 919{
 920        return security_ops->socket_listen(sock, backlog);
 921}
 922
 923int security_socket_accept(struct socket *sock, struct socket *newsock)
 924{
 925        return security_ops->socket_accept(sock, newsock);
 926}
 927
 928void security_socket_post_accept(struct socket *sock, struct socket *newsock)
 929{
 930        security_ops->socket_post_accept(sock, newsock);
 931}
 932
 933int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size)
 934{
 935        return security_ops->socket_sendmsg(sock, msg, size);
 936}
 937
 938int security_socket_recvmsg(struct socket *sock, struct msghdr *msg,
 939                            int size, int flags)
 940{
 941        return security_ops->socket_recvmsg(sock, msg, size, flags);
 942}
 943
 944int security_socket_getsockname(struct socket *sock)
 945{
 946        return security_ops->socket_getsockname(sock);
 947}
 948
 949int security_socket_getpeername(struct socket *sock)
 950{
 951        return security_ops->socket_getpeername(sock);
 952}
 953
 954int security_socket_getsockopt(struct socket *sock, int level, int optname)
 955{
 956        return security_ops->socket_getsockopt(sock, level, optname);
 957}
 958
 959int security_socket_setsockopt(struct socket *sock, int level, int optname)
 960{
 961        return security_ops->socket_setsockopt(sock, level, optname);
 962}
 963
 964int security_socket_shutdown(struct socket *sock, int how)
 965{
 966        return security_ops->socket_shutdown(sock, how);
 967}
 968
 969int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
 970{
 971        return security_ops->socket_sock_rcv_skb(sk, skb);
 972}
 973EXPORT_SYMBOL(security_sock_rcv_skb);
 974
 975int security_socket_getpeersec_stream(struct socket *sock, char __user *optval,
 976                                      int __user *optlen, unsigned len)
 977{
 978        return security_ops->socket_getpeersec_stream(sock, optval, optlen, len);
 979}
 980
 981int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
 982{
 983        return security_ops->socket_getpeersec_dgram(sock, skb, secid);
 984}
 985EXPORT_SYMBOL(security_socket_getpeersec_dgram);
 986
 987int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
 988{
 989        return security_ops->sk_alloc_security(sk, family, priority);
 990}
 991
 992void security_sk_free(struct sock *sk)
 993{
 994        security_ops->sk_free_security(sk);
 995}
 996
 997void security_sk_clone(const struct sock *sk, struct sock *newsk)
 998{
 999        security_ops->sk_clone_security(sk, newsk);
1000}
1001
1002void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
1003{
1004        security_ops->sk_getsecid(sk, &fl->secid);
1005}
1006EXPORT_SYMBOL(security_sk_classify_flow);
1007
1008void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
1009{
1010        security_ops->req_classify_flow(req, fl);
1011}
1012EXPORT_SYMBOL(security_req_classify_flow);
1013
1014void security_sock_graft(struct sock *sk, struct socket *parent)
1015{
1016        security_ops->sock_graft(sk, parent);
1017}
1018EXPORT_SYMBOL(security_sock_graft);
1019
1020int security_inet_conn_request(struct sock *sk,
1021                        struct sk_buff *skb, struct request_sock *req)
1022{
1023        return security_ops->inet_conn_request(sk, skb, req);
1024}
1025EXPORT_SYMBOL(security_inet_conn_request);
1026
1027void security_inet_csk_clone(struct sock *newsk,
1028                        const struct request_sock *req)
1029{
1030        security_ops->inet_csk_clone(newsk, req);
1031}
1032
1033void security_inet_conn_established(struct sock *sk,
1034                        struct sk_buff *skb)
1035{
1036        security_ops->inet_conn_established(sk, skb);
1037}
1038
1039#endif  /* CONFIG_SECURITY_NETWORK */
1040
1041#ifdef CONFIG_SECURITY_NETWORK_XFRM
1042
1043int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *sec_ctx)
1044{
1045        return security_ops->xfrm_policy_alloc_security(ctxp, sec_ctx);
1046}
1047EXPORT_SYMBOL(security_xfrm_policy_alloc);
1048
1049int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
1050                              struct xfrm_sec_ctx **new_ctxp)
1051{
1052        return security_ops->xfrm_policy_clone_security(old_ctx, new_ctxp);
1053}
1054
1055void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
1056{
1057        security_ops->xfrm_policy_free_security(ctx);
1058}
1059EXPORT_SYMBOL(security_xfrm_policy_free);
1060
1061int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
1062{
1063        return security_ops->xfrm_policy_delete_security(ctx);
1064}
1065
1066int security_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx)
1067{
1068        return security_ops->xfrm_state_alloc_security(x, sec_ctx, 0);
1069}
1070EXPORT_SYMBOL(security_xfrm_state_alloc);
1071
1072int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
1073                                      struct xfrm_sec_ctx *polsec, u32 secid)
1074{
1075        if (!polsec)
1076                return 0;
1077        /*
1078         * We want the context to be taken from secid which is usually
1079         * from the sock.
1080         */
1081        return security_ops->xfrm_state_alloc_security(x, NULL, secid);
1082}
1083
1084int security_xfrm_state_delete(struct xfrm_state *x)
1085{
1086        return security_ops->xfrm_state_delete_security(x);
1087}
1088EXPORT_SYMBOL(security_xfrm_state_delete);
1089
1090void security_xfrm_state_free(struct xfrm_state *x)
1091{
1092        security_ops->xfrm_state_free_security(x);
1093}
1094
1095int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
1096{
1097        return security_ops->xfrm_policy_lookup(ctx, fl_secid, dir);
1098}
1099
1100int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
1101                                       struct xfrm_policy *xp, struct flowi *fl)
1102{
1103        return security_ops->xfrm_state_pol_flow_match(x, xp, fl);
1104}
1105
1106int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
1107{
1108        return security_ops->xfrm_decode_session(skb, secid, 1);
1109}
1110
1111void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl)
1112{
1113        int rc = security_ops->xfrm_decode_session(skb, &fl->secid, 0);
1114
1115        BUG_ON(rc);
1116}
1117EXPORT_SYMBOL(security_skb_classify_flow);
1118
1119#endif  /* CONFIG_SECURITY_NETWORK_XFRM */
1120
1121#ifdef CONFIG_KEYS
1122
1123int security_key_alloc(struct key *key, struct task_struct *tsk, unsigned long flags)
1124{
1125        return security_ops->key_alloc(key, tsk, flags);
1126}
1127
1128void security_key_free(struct key *key)
1129{
1130        security_ops->key_free(key);
1131}
1132
1133int security_key_permission(key_ref_t key_ref,
1134                            struct task_struct *context, key_perm_t perm)
1135{
1136        return security_ops->key_permission(key_ref, context, perm);
1137}
1138
1139int security_key_getsecurity(struct key *key, char **_buffer)
1140{
1141        return security_ops->key_getsecurity(key, _buffer);
1142}
1143
1144#endif  /* CONFIG_KEYS */
1145
1146#ifdef CONFIG_AUDIT
1147
1148int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule)
1149{
1150        return security_ops->audit_rule_init(field, op, rulestr, lsmrule);
1151}
1152
1153int security_audit_rule_known(struct audit_krule *krule)
1154{
1155        return security_ops->audit_rule_known(krule);
1156}
1157
1158void security_audit_rule_free(void *lsmrule)
1159{
1160        security_ops->audit_rule_free(lsmrule);
1161}
1162
1163int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule,
1164                              struct audit_context *actx)
1165{
1166        return security_ops->audit_rule_match(secid, field, op, lsmrule, actx);
1167}
1168
1169#endif /* CONFIG_AUDIT */
1170