projects/linux·blob master · refs

2442 lines · 65.9 KiB

1/*
2 * Linux Security plug
3 *
4 * Copyright (C) 2001 WireX Communications, Inc <[email protected]>
5 * Copyright (C) 2001 Greg Kroah-Hartman <[email protected]>
6 * Copyright (C) 2001 Networks Associates Technology, Inc <[email protected]>
7 * Copyright (C) 2001 James Morris <[email protected]>
8 * Copyright (C) 2001 Silicon Graphics, Inc. (Trust Technology Group)
9 * Copyright (C) 2016 Mellanox Techonologies
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
15 *
16 * Due to this file being licensed under the GPL there is controversy over
17 * whether this permits you to write a module that #includes this file
18 * without placing your module under the GPL. Please consult a lawyer for
19 * advice before doing this.
20 *
21 */
22
23#ifndef __LINUX_SECURITY_H
24#define __LINUX_SECURITY_H
25
26#include <linux/kernel_read_file.h>
27#include <linux/key.h>
28#include <linux/capability.h>
29#include <linux/fs.h>
30#include <linux/slab.h>
31#include <linux/err.h>
32#include <linux/string.h>
33#include <linux/mm.h>
34#include <linux/sockptr.h>
35#include <linux/bpf.h>
36#include <uapi/linux/lsm.h>
37#include <linux/lsm/selinux.h>
38#include <linux/lsm/smack.h>
39#include <linux/lsm/apparmor.h>
40#include <linux/lsm/bpf.h>
41
42struct linux_binprm;
43struct cred;
44struct rlimit;
45struct kernel_siginfo;
46struct sembuf;
47struct kern_ipc_perm;
48struct audit_context;
49struct super_block;
50struct inode;
51struct dentry;
52struct file;
53struct vfsmount;
54struct path;
55struct qstr;
56struct iattr;
57struct fown_struct;
58struct file_operations;
59struct msg_msg;
60struct xattr;
61struct kernfs_node;
62struct xfrm_sec_ctx;
63struct mm_struct;
64struct fs_context;
65struct fs_parameter;
66enum fs_value_type;
67struct watch;
68struct watch_notification;
69struct lsm_ctx;
70
71/* Default (no) options for the capable function */
72#define CAP_OPT_NONE 0x0
73/* If capable should audit the security request */
74#define CAP_OPT_NOAUDIT BIT(1)
75/* If capable is being called by a setid function */
76#define CAP_OPT_INSETID BIT(2)
77
78/* LSM Agnostic defines for security_sb_set_mnt_opts() flags */
79#define SECURITY_LSM_NATIVE_LABELS 1
80
81struct ctl_table;
82struct audit_krule;
83struct user_namespace;
84struct timezone;
85
86enum lsm_event {
87 LSM_POLICY_CHANGE,
88 LSM_STARTED_ALL,
89};
90
91struct dm_verity_digest {
92 const char *alg;
93 const u8 *digest;
94 size_t digest_len;
95};
96
97enum lsm_integrity_type {
98 LSM_INT_DMVERITY_SIG_VALID,
99 LSM_INT_DMVERITY_ROOTHASH,
100 LSM_INT_FSVERITY_BUILTINSIG_VALID,
101};
102
103/*
104 * These are reasons that can be passed to the security_locked_down()
105 * LSM hook. Lockdown reasons that protect kernel integrity (ie, the
106 * ability for userland to modify kernel code) are placed before
107 * LOCKDOWN_INTEGRITY_MAX. Lockdown reasons that protect kernel
108 * confidentiality (ie, the ability for userland to extract
109 * information from the running kernel that would otherwise be
110 * restricted) are placed before LOCKDOWN_CONFIDENTIALITY_MAX.
111 *
112 * LSM authors should note that the semantics of any given lockdown
113 * reason are not guaranteed to be stable - the same reason may block
114 * one set of features in one kernel release, and a slightly different
115 * set of features in a later kernel release. LSMs that seek to expose
116 * lockdown policy at any level of granularity other than "none",
117 * "integrity" or "confidentiality" are responsible for either
118 * ensuring that they expose a consistent level of functionality to
119 * userland, or ensuring that userland is aware that this is
120 * potentially a moving target. It is easy to misuse this information
121 * in a way that could break userspace. Please be careful not to do
122 * so.
123 *
124 * If you add to this, remember to extend lockdown_reasons in
125 * security/lockdown/lockdown.c.
126 */
127enum lockdown_reason {
128 LOCKDOWN_NONE,
129 LOCKDOWN_MODULE_SIGNATURE,
130 LOCKDOWN_DEV_MEM,
131 LOCKDOWN_EFI_TEST,
132 LOCKDOWN_KEXEC,
133 LOCKDOWN_HIBERNATION,
134 LOCKDOWN_PCI_ACCESS,
135 LOCKDOWN_IOPORT,
136 LOCKDOWN_MSR,
137 LOCKDOWN_ACPI_TABLES,
138 LOCKDOWN_DEVICE_TREE,
139 LOCKDOWN_PCMCIA_CIS,
140 LOCKDOWN_TIOCSSERIAL,
141 LOCKDOWN_MODULE_PARAMETERS,
142 LOCKDOWN_MMIOTRACE,
143 LOCKDOWN_DEBUGFS,
144 LOCKDOWN_XMON_WR,
145 LOCKDOWN_BPF_WRITE_USER,
146 LOCKDOWN_DBG_WRITE_KERNEL,
147 LOCKDOWN_RTAS_ERROR_INJECTION,
148 LOCKDOWN_XEN_USER_ACTIONS,
149 LOCKDOWN_INTEGRITY_MAX,
150 LOCKDOWN_KCORE,
151 LOCKDOWN_KPROBES,
152 LOCKDOWN_BPF_READ_KERNEL,
153 LOCKDOWN_DBG_READ_KERNEL,
154 LOCKDOWN_PERF,
155 LOCKDOWN_TRACEFS,
156 LOCKDOWN_XMON_RW,
157 LOCKDOWN_XFRM_SECRET,
158 LOCKDOWN_CONFIDENTIALITY_MAX,
159};
160
161/*
162 * Data exported by the security modules
163 */
164struct lsm_prop {
165 struct lsm_prop_selinux selinux;
166 struct lsm_prop_smack smack;
167 struct lsm_prop_apparmor apparmor;
168 struct lsm_prop_bpf bpf;
169};
170
171extern const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1];
172
173/* These functions are in security/commoncap.c */
174extern int cap_capable(const struct cred *cred, struct user_namespace *ns,
175 int cap, unsigned int opts);
176extern int cap_settime(const struct timespec64 *ts, const struct timezone *tz);
177extern int cap_ptrace_access_check(struct task_struct *child, unsigned int mode);
178extern int cap_ptrace_traceme(struct task_struct *parent);
179extern int cap_capget(const struct task_struct *target, kernel_cap_t *effective,
180 kernel_cap_t *inheritable, kernel_cap_t *permitted);
181extern int cap_capset(struct cred *new, const struct cred *old,
182 const kernel_cap_t *effective,
183 const kernel_cap_t *inheritable,
184 const kernel_cap_t *permitted);
185extern int cap_bprm_creds_from_file(struct linux_binprm *bprm, const struct file *file);
186int cap_inode_setxattr(struct dentry *dentry, const char *name,
187 const void *value, size_t size, int flags);
188int cap_inode_removexattr(const struct mnt_idmap *idmap,
189 struct dentry *dentry, const char *name);
190int cap_inode_need_killpriv(struct dentry *dentry);
191int cap_inode_killpriv(const struct mnt_idmap *idmap, struct dentry *dentry);
192int cap_inode_getsecurity(const struct mnt_idmap *idmap,
193 struct inode *inode, const char *name, void **buffer,
194 bool alloc);
195extern int cap_mmap_addr(unsigned long addr);
196extern int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags);
197extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
198 unsigned long arg4, unsigned long arg5);
199extern int cap_task_setscheduler(struct task_struct *p);
200extern int cap_task_setioprio(struct task_struct *p, int ioprio);
201extern int cap_task_setnice(struct task_struct *p, int nice);
202extern int cap_vm_enough_memory(struct mm_struct *mm, long pages);
203
204struct msghdr;
205struct sk_buff;
206struct sock;
207struct sockaddr;
208struct socket;
209struct flowi_common;
210struct dst_entry;
211struct xfrm_selector;
212struct xfrm_policy;
213struct xfrm_state;
214struct xfrm_user_sec_ctx;
215struct seq_file;
216struct sctp_association;
217
218#ifdef CONFIG_MMU
219extern unsigned long mmap_min_addr;
220extern unsigned long dac_mmap_min_addr;
221#else
222#define mmap_min_addr 0UL
223#define dac_mmap_min_addr 0UL
224#endif
225
226/*
227 * A "security context" is the text representation of
228 * the information used by LSMs.
229 * This structure contains the string, its length, and which LSM
230 * it is useful for.
231 */
232struct lsm_context {
233 char *context; /* Provided by the module */
234 u32 len;
235 int id; /* Identifies the module */
236};
237
238/*
239 * Values used in the task_security_ops calls
240 */
241/* setuid or setgid, id0 == uid or gid */
242#define LSM_SETID_ID 1
243
244/* setreuid or setregid, id0 == real, id1 == eff */
245#define LSM_SETID_RE 2
246
247/* setresuid or setresgid, id0 == real, id1 == eff, uid2 == saved */
248#define LSM_SETID_RES 4
249
250/* setfsuid or setfsgid, id0 == fsuid or fsgid */
251#define LSM_SETID_FS 8
252
253/* Flags for security_task_prlimit(). */
254#define LSM_PRLIMIT_READ 1
255#define LSM_PRLIMIT_WRITE 2
256
257/* forward declares to avoid warnings */
258struct sched_param;
259struct request_sock;
260
261/* bprm->unsafe reasons */
262#define LSM_UNSAFE_SHARE 1
263#define LSM_UNSAFE_PTRACE 2
264#define LSM_UNSAFE_NO_NEW_PRIVS 4
265
266#ifdef CONFIG_MMU
267extern int mmap_min_addr_handler(const struct ctl_table *table, int write,
268 void *buffer, size_t *lenp, loff_t *ppos);
269#endif
270
271/* security_inode_init_security callback function to write xattrs */
272typedef int (*initxattrs) (struct inode *inode,
273 const struct xattr *xattr_array, void *fs_data);
274
275
276/* Keep the kernel_load_data_id enum in sync with kernel_read_file_id */
277#define __data_id_enumify(ENUM, dummy) LOADING_ ## ENUM,
278#define __data_id_stringify(dummy, str) #str,
279
280enum kernel_load_data_id {
281 __kernel_read_file_id(__data_id_enumify)
282};
283
284static const char * const kernel_load_data_str[] = {
285 __kernel_read_file_id(__data_id_stringify)
286};
287
288static inline const char *kernel_load_data_id_str(enum kernel_load_data_id id)
289{
290 if ((unsigned)id >= LOADING_MAX_ID)
291 return kernel_load_data_str[LOADING_UNKNOWN];
292
293 return kernel_load_data_str[id];
294}
295
296/**
297 * lsmprop_init - initialize a lsm_prop structure
298 * @prop: Pointer to the data to initialize
299 *
300 * Set all secid for all modules to the specified value.
301 */
302static inline void lsmprop_init(struct lsm_prop *prop)
303{
304 memset(prop, 0, sizeof(*prop));
305}
306
307#ifdef CONFIG_SECURITY
308
309/**
310 * lsmprop_is_set - report if there is a value in the lsm_prop
311 * @prop: Pointer to the exported LSM data
312 *
313 * Returns true if there is a value set, false otherwise
314 */
315static inline bool lsmprop_is_set(struct lsm_prop *prop)
316{
317 const struct lsm_prop empty = {};
318
319 return !!memcmp(prop, &empty, sizeof(*prop));
320}
321
322int call_blocking_lsm_notifier(enum lsm_event event, void *data);
323int register_blocking_lsm_notifier(struct notifier_block *nb);
324int unregister_blocking_lsm_notifier(struct notifier_block *nb);
325
326/* prototypes */
327extern int security_init(void);
328extern int early_security_init(void);
329extern u64 lsm_name_to_attr(const char *name);
330
331/* Security operations */
332int security_binder_set_context_mgr(const struct cred *mgr);
333int security_binder_transaction(const struct cred *from,
334 const struct cred *to);
335int security_binder_transfer_binder(const struct cred *from,
336 const struct cred *to);
337int security_binder_transfer_file(const struct cred *from,
338 const struct cred *to, const struct file *file);
339int security_ptrace_access_check(struct task_struct *child, unsigned int mode);
340int security_ptrace_traceme(struct task_struct *parent);
341int security_capget(const struct task_struct *target,
342 kernel_cap_t *effective,
343 kernel_cap_t *inheritable,
344 kernel_cap_t *permitted);
345int security_capset(struct cred *new, const struct cred *old,
346 const kernel_cap_t *effective,
347 const kernel_cap_t *inheritable,
348 const kernel_cap_t *permitted);
349int security_capable(const struct cred *cred,
350 struct user_namespace *ns,
351 int cap,
352 unsigned int opts);
353int security_quotactl(int cmds, int type, int id, const struct super_block *sb);
354int security_quota_on(struct dentry *dentry);
355int security_syslog(int type);
356int security_settime64(const struct timespec64 *ts, const struct timezone *tz);
357int security_vm_enough_memory_mm(struct mm_struct *mm, long pages);
358int security_bprm_creds_for_exec(struct linux_binprm *bprm);
359int security_bprm_creds_from_file(struct linux_binprm *bprm, const struct file *file);
360int security_bprm_check(struct linux_binprm *bprm);
361void security_bprm_committing_creds(const struct linux_binprm *bprm);
362void security_bprm_committed_creds(const struct linux_binprm *bprm);
363int security_fs_context_submount(struct fs_context *fc, struct super_block *reference);
364int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc);
365int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param);
366int security_sb_alloc(struct super_block *sb);
367void security_sb_delete(struct super_block *sb);
368void security_sb_free(struct super_block *sb);
369void security_free_mnt_opts(void **mnt_opts);
370int security_sb_eat_lsm_opts(char *options, void **mnt_opts);
371int security_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts);
372int security_sb_remount(struct super_block *sb, void *mnt_opts);
373int security_sb_kern_mount(const struct super_block *sb);
374int security_sb_show_options(struct seq_file *m, struct super_block *sb);
375int security_sb_statfs(struct dentry *dentry);
376int security_sb_mount(const char *dev_name, const struct path *path,
377 const char *type, unsigned long flags, void *data);
378int security_sb_umount(struct vfsmount *mnt, int flags);
379int security_sb_pivotroot(const struct path *old_path, const struct path *new_path);
380int security_sb_set_mnt_opts(struct super_block *sb,
381 void *mnt_opts,
382 unsigned long kern_flags,
383 unsigned long *set_kern_flags);
384int security_sb_clone_mnt_opts(const struct super_block *oldsb,
385 struct super_block *newsb,
386 unsigned long kern_flags,
387 unsigned long *set_kern_flags);
388int security_move_mount(const struct path *from_path, const struct path *to_path);
389int security_dentry_init_security(struct dentry *dentry, int mode,
390 const struct qstr *name,
391 const char **xattr_name,
392 struct lsm_context *lsmcxt);
393int security_dentry_create_files_as(struct dentry *dentry, int mode,
394 const struct qstr *name,
395 const struct cred *old,
396 struct cred *new);
397int security_path_notify(const struct path *path, u64 mask,
398 unsigned int obj_type);
399int security_inode_alloc(struct inode *inode, gfp_t gfp);
400void security_inode_free(struct inode *inode);
401int security_inode_init_security(struct inode *inode, struct inode *dir,
402 const struct qstr *qstr,
403 initxattrs initxattrs, void *fs_data);
404int security_inode_init_security_anon(struct inode *inode,
405 const struct qstr *name,
406 const struct inode *context_inode);
407int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode);
408void security_inode_post_create_tmpfile(const struct mnt_idmap *idmap,
409 struct inode *inode);
410int security_inode_link(struct dentry *old_dentry, struct inode *dir,
411 struct dentry *new_dentry);
412int security_inode_unlink(struct inode *dir, struct dentry *dentry);
413int security_inode_symlink(struct inode *dir, struct dentry *dentry,
414 const char *old_name);
415int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode);
416int security_inode_rmdir(struct inode *dir, struct dentry *dentry);
417int security_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev);
418int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
419 struct inode *new_dir, struct dentry *new_dentry,
420 unsigned int flags);
421int security_inode_readlink(struct dentry *dentry);
422int security_inode_follow_link(struct dentry *dentry, struct inode *inode,
423 bool rcu);
424int security_inode_permission(struct inode *inode, int mask);
425int security_inode_setattr(const struct mnt_idmap *idmap,
426 struct dentry *dentry, struct iattr *attr);
427void security_inode_post_setattr(const struct mnt_idmap *idmap, struct dentry *dentry,
428 int ia_valid);
429int security_inode_getattr(const struct path *path);
430int security_inode_setxattr(const struct mnt_idmap *idmap,
431 struct dentry *dentry, const char *name,
432 const void *value, size_t size, int flags);
433int security_inode_set_acl(const struct mnt_idmap *idmap,
434 struct dentry *dentry, const char *acl_name,
435 struct posix_acl *kacl);
436void security_inode_post_set_acl(struct dentry *dentry, const char *acl_name,
437 struct posix_acl *kacl);
438int security_inode_get_acl(const struct mnt_idmap *idmap,
439 struct dentry *dentry, const char *acl_name);
440int security_inode_remove_acl(const struct mnt_idmap *idmap,
441 struct dentry *dentry, const char *acl_name);
442void security_inode_post_remove_acl(const struct mnt_idmap *idmap,
443 struct dentry *dentry,
444 const char *acl_name);
445void security_inode_post_setxattr(struct dentry *dentry, const char *name,
446 const void *value, size_t size, int flags);
447int security_inode_getxattr(struct dentry *dentry, const char *name);
448int security_inode_listxattr(struct dentry *dentry);
449int security_inode_removexattr(const struct mnt_idmap *idmap,
450 struct dentry *dentry, const char *name);
451void security_inode_post_removexattr(struct dentry *dentry, const char *name);
452int security_inode_file_setattr(struct dentry *dentry,
453 struct file_kattr *fa);
454int security_inode_file_getattr(struct dentry *dentry,
455 struct file_kattr *fa);
456int security_inode_need_killpriv(struct dentry *dentry);
457int security_inode_killpriv(const struct mnt_idmap *idmap, struct dentry *dentry);
458int security_inode_getsecurity(const struct mnt_idmap *idmap,
459 struct inode *inode, const char *name,
460 void **buffer, bool alloc);
461int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags);
462int security_inode_listsecurity(struct inode *inode, char **buffer, ssize_t *remaining_size);
463void security_inode_getlsmprop(struct inode *inode, struct lsm_prop *prop);
464int security_inode_copy_up(struct dentry *src, struct cred **new);
465int security_inode_copy_up_xattr(struct dentry *src, const char *name);
466int security_inode_setintegrity(const struct inode *inode,
467 enum lsm_integrity_type type, const void *value,
468 size_t size);
469int security_kernfs_init_security(struct kernfs_node *kn_dir,
470 struct kernfs_node *kn);
471int security_file_permission(struct file *file, int mask);
472int security_file_alloc(struct file *file);
473void security_file_release(struct file *file);
474void security_file_free(struct file *file);
475int security_backing_file_alloc(struct file *backing_file,
476 const struct file *user_file);
477void security_backing_file_free(struct file *backing_file);
478int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
479int security_file_ioctl_compat(struct file *file, unsigned int cmd,
480 unsigned long arg);
481int security_mmap_file(struct file *file, unsigned long prot,
482 unsigned long flags);
483int security_mmap_backing_file(struct vm_area_struct *vma,
484 struct file *backing_file,
485 struct file *user_file);
486int security_mmap_addr(unsigned long addr);
487int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
488 unsigned long prot);
489int security_file_lock(struct file *file, unsigned int cmd);
490int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg);
491void security_file_set_fowner(struct file *file);
492int security_file_send_sigiotask(struct task_struct *tsk,
493 struct fown_struct *fown, int sig);
494int security_file_receive(struct file *file);
495int security_file_open(struct file *file);
496int security_file_post_open(struct file *file, int mask);
497int security_file_truncate(struct file *file);
498int security_task_alloc(struct task_struct *task, u64 clone_flags);
499void security_task_free(struct task_struct *task);
500int security_cred_alloc_blank(struct cred *cred, gfp_t gfp);
501void security_cred_free(struct cred *cred);
502int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp);
503void security_transfer_creds(struct cred *new, const struct cred *old);
504void security_cred_getsecid(const struct cred *c, u32 *secid);
505void security_cred_getlsmprop(const struct cred *c, struct lsm_prop *prop);
506int security_kernel_act_as(struct cred *new, u32 secid);
507int security_kernel_create_files_as(struct cred *new, struct inode *inode);
508int security_kernel_module_request(char *kmod_name);
509int security_kernel_load_data(enum kernel_load_data_id id, bool contents);
510int security_kernel_post_load_data(char *buf, loff_t size,
511 enum kernel_load_data_id id,
512 char *description);
513int security_kernel_read_file(struct file *file, enum kernel_read_file_id id,
514 bool contents);
515int security_kernel_post_read_file(struct file *file, char *buf, loff_t size,
516 enum kernel_read_file_id id);
517int security_task_fix_setuid(struct cred *new, const struct cred *old,
518 int flags);
519int security_task_fix_setgid(struct cred *new, const struct cred *old,
520 int flags);
521int security_task_fix_setgroups(struct cred *new, const struct cred *old);
522int security_task_setpgid(struct task_struct *p, pid_t pgid);
523int security_task_getpgid(struct task_struct *p);
524int security_task_getsid(struct task_struct *p);
525void security_current_getlsmprop_subj(struct lsm_prop *prop);
526void security_task_getlsmprop_obj(struct task_struct *p, struct lsm_prop *prop);
527int security_task_setnice(struct task_struct *p, int nice);
528int security_task_setioprio(struct task_struct *p, int ioprio);
529int security_task_getioprio(struct task_struct *p);
530int security_task_prlimit(const struct cred *cred, const struct cred *tcred,
531 unsigned int flags);
532int security_task_setrlimit(struct task_struct *p, unsigned int resource,
533 struct rlimit *new_rlim);
534int security_task_setscheduler(struct task_struct *p);
535int security_task_getscheduler(struct task_struct *p);
536int security_task_movememory(struct task_struct *p);
537int security_task_kill(struct task_struct *p, struct kernel_siginfo *info,
538 int sig, const struct cred *cred);
539int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
540 unsigned long arg4, unsigned long arg5);
541void security_task_to_inode(struct task_struct *p, struct inode *inode);
542int security_create_user_ns(const struct cred *cred);
543int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag);
544void security_ipc_getlsmprop(struct kern_ipc_perm *ipcp, struct lsm_prop *prop);
545int security_msg_msg_alloc(struct msg_msg *msg);
546void security_msg_msg_free(struct msg_msg *msg);
547int security_msg_queue_alloc(struct kern_ipc_perm *msq);
548void security_msg_queue_free(struct kern_ipc_perm *msq);
549int security_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg);
550int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd);
551int security_msg_queue_msgsnd(struct kern_ipc_perm *msq,
552 struct msg_msg *msg, int msqflg);
553int security_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
554 struct task_struct *target, long type, int mode);
555int security_shm_alloc(struct kern_ipc_perm *shp);
556void security_shm_free(struct kern_ipc_perm *shp);
557int security_shm_associate(struct kern_ipc_perm *shp, int shmflg);
558int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd);
559int security_shm_shmat(struct kern_ipc_perm *shp, char __user *shmaddr, int shmflg);
560int security_sem_alloc(struct kern_ipc_perm *sma);
561void security_sem_free(struct kern_ipc_perm *sma);
562int security_sem_associate(struct kern_ipc_perm *sma, int semflg);
563int security_sem_semctl(struct kern_ipc_perm *sma, int cmd);
564int security_sem_semop(struct kern_ipc_perm *sma, struct sembuf *sops,
565 unsigned nsops, int alter);
566void security_d_instantiate(struct dentry *dentry, struct inode *inode);
567int security_getselfattr(unsigned int attr, struct lsm_ctx __user *ctx,
568 u32 __user *size, u32 flags);
569int security_setselfattr(unsigned int attr, struct lsm_ctx __user *ctx,
570 u32 size, u32 flags);
571int security_getprocattr(struct task_struct *p, int lsmid, const char *name,
572 char **value);
573int security_setprocattr(int lsmid, const char *name, void *value, size_t size);
574int security_ismaclabel(const char *name);
575int security_secid_to_secctx(u32 secid, struct lsm_context *cp);
576int security_lsmprop_to_secctx(struct lsm_prop *prop, struct lsm_context *cp,
577 int lsmid);
578int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
579void security_release_secctx(struct lsm_context *cp);
580void security_inode_invalidate_secctx(struct inode *inode);
581int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen);
582int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
583int security_inode_getsecctx(struct inode *inode, struct lsm_context *cp);
584int security_locked_down(enum lockdown_reason what);
585int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 *uctx_len,
586 void *val, size_t val_len, u64 id, u64 flags);
587int security_bdev_alloc(struct block_device *bdev);
588void security_bdev_free(struct block_device *bdev);
589int security_bdev_setintegrity(struct block_device *bdev,
590 enum lsm_integrity_type type, const void *value,
591 size_t size);
592#else /* CONFIG_SECURITY */
593
594/**
595 * lsmprop_is_set - report if there is a value in the lsm_prop
596 * @prop: Pointer to the exported LSM data
597 *
598 * Returns true if there is a value set, false otherwise
599 */
600static inline bool lsmprop_is_set(struct lsm_prop *prop)
601{
602 return false;
603}
604
605static inline int call_blocking_lsm_notifier(enum lsm_event event, void *data)
606{
607 return 0;
608}
609
610static inline int register_blocking_lsm_notifier(struct notifier_block *nb)
611{
612 return 0;
613}
614
615static inline int unregister_blocking_lsm_notifier(struct notifier_block *nb)
616{
617 return 0;
618}
619
620static inline u64 lsm_name_to_attr(const char *name)
621{
622 return LSM_ATTR_UNDEF;
623}
624
625static inline void security_free_mnt_opts(void **mnt_opts)
626{
627}
628
629/*
630 * This is the default capabilities functionality. Most of these functions
631 * are just stubbed out, but a few must call the proper capable code.
632 */
633
634static inline int security_init(void)
635{
636 return 0;
637}
638
639static inline int early_security_init(void)
640{
641 return 0;
642}
643
644static inline int security_binder_set_context_mgr(const struct cred *mgr)
645{
646 return 0;
647}
648
649static inline int security_binder_transaction(const struct cred *from,
650 const struct cred *to)
651{
652 return 0;
653}
654
655static inline int security_binder_transfer_binder(const struct cred *from,
656 const struct cred *to)
657{
658 return 0;
659}
660
661static inline int security_binder_transfer_file(const struct cred *from,
662 const struct cred *to,
663 const struct file *file)
664{
665 return 0;
666}
667
668static inline int security_ptrace_access_check(struct task_struct *child,
669 unsigned int mode)
670{
671 return cap_ptrace_access_check(child, mode);
672}
673
674static inline int security_ptrace_traceme(struct task_struct *parent)
675{
676 return cap_ptrace_traceme(parent);
677}
678
679static inline int security_capget(const struct task_struct *target,
680 kernel_cap_t *effective,
681 kernel_cap_t *inheritable,
682 kernel_cap_t *permitted)
683{
684 return cap_capget(target, effective, inheritable, permitted);
685}
686
687static inline int security_capset(struct cred *new,
688 const struct cred *old,
689 const kernel_cap_t *effective,
690 const kernel_cap_t *inheritable,
691 const kernel_cap_t *permitted)
692{
693 return cap_capset(new, old, effective, inheritable, permitted);
694}
695
696static inline int security_capable(const struct cred *cred,
697 struct user_namespace *ns,
698 int cap,
699 unsigned int opts)
700{
701 return cap_capable(cred, ns, cap, opts);
702}
703
704static inline int security_quotactl(int cmds, int type, int id,
705 const struct super_block *sb)
706{
707 return 0;
708}
709
710static inline int security_quota_on(struct dentry *dentry)
711{
712 return 0;
713}
714
715static inline int security_syslog(int type)
716{
717 return 0;
718}
719
720static inline int security_settime64(const struct timespec64 *ts,
721 const struct timezone *tz)
722{
723 return cap_settime(ts, tz);
724}
725
726static inline int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
727{
728 return __vm_enough_memory(mm, pages, !cap_vm_enough_memory(mm, pages));
729}
730
731static inline int security_bprm_creds_for_exec(struct linux_binprm *bprm)
732{
733 return 0;
734}
735
736static inline int security_bprm_creds_from_file(struct linux_binprm *bprm,
737 const struct file *file)
738{
739 return cap_bprm_creds_from_file(bprm, file);
740}
741
742static inline int security_bprm_check(struct linux_binprm *bprm)
743{
744 return 0;
745}
746
747static inline void security_bprm_committing_creds(const struct linux_binprm *bprm)
748{
749}
750
751static inline void security_bprm_committed_creds(const struct linux_binprm *bprm)
752{
753}
754
755static inline int security_fs_context_submount(struct fs_context *fc,
756 struct super_block *reference)
757{
758 return 0;
759}
760static inline int security_fs_context_dup(struct fs_context *fc,
761 struct fs_context *src_fc)
762{
763 return 0;
764}
765static inline int security_fs_context_parse_param(struct fs_context *fc,
766 struct fs_parameter *param)
767{
768 return -ENOPARAM;
769}
770
771static inline int security_sb_alloc(struct super_block *sb)
772{
773 return 0;
774}
775
776static inline void security_sb_delete(struct super_block *sb)
777{ }
778
779static inline void security_sb_free(struct super_block *sb)
780{ }
781
782static inline int security_sb_eat_lsm_opts(char *options,
783 void **mnt_opts)
784{
785 return 0;
786}
787
788static inline int security_sb_remount(struct super_block *sb,
789 void *mnt_opts)
790{
791 return 0;
792}
793
794static inline int security_sb_mnt_opts_compat(struct super_block *sb,
795 void *mnt_opts)
796{
797 return 0;
798}
799
800
801static inline int security_sb_kern_mount(struct super_block *sb)
802{
803 return 0;
804}
805
806static inline int security_sb_show_options(struct seq_file *m,
807 struct super_block *sb)
808{
809 return 0;
810}
811
812static inline int security_sb_statfs(struct dentry *dentry)
813{
814 return 0;
815}
816
817static inline int security_sb_mount(const char *dev_name, const struct path *path,
818 const char *type, unsigned long flags,
819 void *data)
820{
821 return 0;
822}
823
824static inline int security_sb_umount(struct vfsmount *mnt, int flags)
825{
826 return 0;
827}
828
829static inline int security_sb_pivotroot(const struct path *old_path,
830 const struct path *new_path)
831{
832 return 0;
833}
834
835static inline int security_sb_set_mnt_opts(struct super_block *sb,
836 void *mnt_opts,
837 unsigned long kern_flags,
838 unsigned long *set_kern_flags)
839{
840 return 0;
841}
842
843static inline int security_sb_clone_mnt_opts(const struct super_block *oldsb,
844 struct super_block *newsb,
845 unsigned long kern_flags,
846 unsigned long *set_kern_flags)
847{
848 return 0;
849}
850
851static inline int security_move_mount(const struct path *from_path,
852 const struct path *to_path)
853{
854 return 0;
855}
856
857static inline int security_path_notify(const struct path *path, u64 mask,
858 unsigned int obj_type)
859{
860 return 0;
861}
862
863static inline int security_inode_alloc(struct inode *inode, gfp_t gfp)
864{
865 return 0;
866}
867
868static inline void security_inode_free(struct inode *inode)
869{ }
870
871static inline int security_dentry_init_security(struct dentry *dentry,
872 int mode,
873 const struct qstr *name,
874 const char **xattr_name,
875 struct lsm_context *lsmcxt)
876{
877 return -EOPNOTSUPP;
878}
879
880static inline int security_dentry_create_files_as(struct dentry *dentry,
881 int mode, const struct qstr *name,
882 const struct cred *old,
883 struct cred *new)
884{
885 return 0;
886}
887
888
889static inline int security_inode_init_security(struct inode *inode,
890 struct inode *dir,
891 const struct qstr *qstr,
892 const initxattrs xattrs,
893 void *fs_data)
894{
895 return 0;
896}
897
898static inline int security_inode_init_security_anon(struct inode *inode,
899 const struct qstr *name,
900 const struct inode *context_inode)
901{
902 return 0;
903}
904
905static inline int security_inode_create(struct inode *dir,
906 struct dentry *dentry,
907 umode_t mode)
908{
909 return 0;
910}
911
912static inline void
913security_inode_post_create_tmpfile(const struct mnt_idmap *idmap, struct inode *inode)
914{ }
915
916static inline int security_inode_link(struct dentry *old_dentry,
917 struct inode *dir,
918 struct dentry *new_dentry)
919{
920 return 0;
921}
922
923static inline int security_inode_unlink(struct inode *dir,
924 struct dentry *dentry)
925{
926 return 0;
927}
928
929static inline int security_inode_symlink(struct inode *dir,
930 struct dentry *dentry,
931 const char *old_name)
932{
933 return 0;
934}
935
936static inline int security_inode_mkdir(struct inode *dir,
937 struct dentry *dentry,
938 int mode)
939{
940 return 0;
941}
942
943static inline int security_inode_rmdir(struct inode *dir,
944 struct dentry *dentry)
945{
946 return 0;
947}
948
949static inline int security_inode_mknod(struct inode *dir,
950 struct dentry *dentry,
951 int mode, dev_t dev)
952{
953 return 0;
954}
955
956static inline int security_inode_rename(struct inode *old_dir,
957 struct dentry *old_dentry,
958 struct inode *new_dir,
959 struct dentry *new_dentry,
960 unsigned int flags)
961{
962 return 0;
963}
964
965static inline int security_inode_readlink(struct dentry *dentry)
966{
967 return 0;
968}
969
970static inline int security_inode_follow_link(struct dentry *dentry,
971 struct inode *inode,
972 bool rcu)
973{
974 return 0;
975}
976
977static inline int security_inode_permission(struct inode *inode, int mask)
978{
979 return 0;
980}
981
982static inline int security_inode_setattr(const struct mnt_idmap *idmap,
983 struct dentry *dentry,
984 struct iattr *attr)
985{
986 return 0;
987}
988
989static inline void
990security_inode_post_setattr(const struct mnt_idmap *idmap, struct dentry *dentry,
991 int ia_valid)
992{ }
993
994static inline int security_inode_getattr(const struct path *path)
995{
996 return 0;
997}
998
999static inline int security_inode_setxattr(const struct mnt_idmap *idmap,
1000 struct dentry *dentry, const char *name, const void *value,
1001 size_t size, int flags)
1002{
1003 return cap_inode_setxattr(dentry, name, value, size, flags);
1004}
1005
1006static inline int security_inode_set_acl(const struct mnt_idmap *idmap,
1007 struct dentry *dentry,
1008 const char *acl_name,
1009 struct posix_acl *kacl)
1010{
1011 return 0;
1012}
1013
1014static inline void security_inode_post_set_acl(struct dentry *dentry,
1015 const char *acl_name,
1016 struct posix_acl *kacl)
1017{ }
1018
1019static inline int security_inode_get_acl(const struct mnt_idmap *idmap,
1020 struct dentry *dentry,
1021 const char *acl_name)
1022{
1023 return 0;
1024}
1025
1026static inline int security_inode_remove_acl(const struct mnt_idmap *idmap,
1027 struct dentry *dentry,
1028 const char *acl_name)
1029{
1030 return 0;
1031}
1032
1033static inline void security_inode_post_remove_acl(const struct mnt_idmap *idmap,
1034 struct dentry *dentry,
1035 const char *acl_name)
1036{ }
1037
1038static inline void security_inode_post_setxattr(struct dentry *dentry,
1039 const char *name, const void *value, size_t size, int flags)
1040{ }
1041
1042static inline int security_inode_getxattr(struct dentry *dentry,
1043 const char *name)
1044{
1045 return 0;
1046}
1047
1048static inline int security_inode_listxattr(struct dentry *dentry)
1049{
1050 return 0;
1051}
1052
1053static inline int security_inode_removexattr(const struct mnt_idmap *idmap,
1054 struct dentry *dentry,
1055 const char *name)
1056{
1057 return cap_inode_removexattr(idmap, dentry, name);
1058}
1059
1060static inline void security_inode_post_removexattr(struct dentry *dentry,
1061 const char *name)
1062{ }
1063
1064static inline int security_inode_file_setattr(struct dentry *dentry,
1065 struct file_kattr *fa)
1066{
1067 return 0;
1068}
1069
1070static inline int security_inode_file_getattr(struct dentry *dentry,
1071 struct file_kattr *fa)
1072{
1073 return 0;
1074}
1075
1076static inline int security_inode_need_killpriv(struct dentry *dentry)
1077{
1078 return cap_inode_need_killpriv(dentry);
1079}
1080
1081static inline int security_inode_killpriv(const struct mnt_idmap *idmap,
1082 struct dentry *dentry)
1083{
1084 return cap_inode_killpriv(idmap, dentry);
1085}
1086
1087static inline int security_inode_getsecurity(const struct mnt_idmap *idmap,
1088 struct inode *inode,
1089 const char *name, void **buffer,
1090 bool alloc)
1091{
1092 return cap_inode_getsecurity(idmap, inode, name, buffer, alloc);
1093}
1094
1095static inline int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
1096{
1097 return -EOPNOTSUPP;
1098}
1099
1100static inline int security_inode_listsecurity(struct inode *inode,
1101 char **buffer, ssize_t *remaining_size)
1102{
1103 return 0;
1104}
1105
1106static inline void security_inode_getlsmprop(struct inode *inode,
1107 struct lsm_prop *prop)
1108{
1109 lsmprop_init(prop);
1110}
1111
1112static inline int security_inode_copy_up(struct dentry *src, struct cred **new)
1113{
1114 return 0;
1115}
1116
1117static inline int security_inode_setintegrity(const struct inode *inode,
1118 enum lsm_integrity_type type,
1119 const void *value, size_t size)
1120{
1121 return 0;
1122}
1123
1124static inline int security_kernfs_init_security(struct kernfs_node *kn_dir,
1125 struct kernfs_node *kn)
1126{
1127 return 0;
1128}
1129
1130static inline int security_inode_copy_up_xattr(struct dentry *src, const char *name)
1131{
1132 return -EOPNOTSUPP;
1133}
1134
1135static inline int security_file_permission(struct file *file, int mask)
1136{
1137 return 0;
1138}
1139
1140static inline int security_file_alloc(struct file *file)
1141{
1142 return 0;
1143}
1144
1145static inline void security_file_release(struct file *file)
1146{ }
1147
1148static inline void security_file_free(struct file *file)
1149{ }
1150
1151static inline int security_backing_file_alloc(struct file *backing_file,
1152 const struct file *user_file)
1153{
1154 return 0;
1155}
1156
1157static inline void security_backing_file_free(struct file *backing_file)
1158{ }
1159
1160static inline int security_file_ioctl(struct file *file, unsigned int cmd,
1161 unsigned long arg)
1162{
1163 return 0;
1164}
1165
1166static inline int security_file_ioctl_compat(struct file *file,
1167 unsigned int cmd,
1168 unsigned long arg)
1169{
1170 return 0;
1171}
1172
1173static inline int security_mmap_file(struct file *file, unsigned long prot,
1174 unsigned long flags)
1175{
1176 return 0;
1177}
1178
1179static inline int security_mmap_backing_file(struct vm_area_struct *vma,
1180 struct file *backing_file,
1181 struct file *user_file)
1182{
1183 return 0;
1184}
1185
1186static inline int security_mmap_addr(unsigned long addr)
1187{
1188 return cap_mmap_addr(addr);
1189}
1190
1191static inline int security_file_mprotect(struct vm_area_struct *vma,
1192 unsigned long reqprot,
1193 unsigned long prot)
1194{
1195 return 0;
1196}
1197
1198static inline int security_file_lock(struct file *file, unsigned int cmd)
1199{
1200 return 0;
1201}
1202
1203static inline int security_file_fcntl(struct file *file, unsigned int cmd,
1204 unsigned long arg)
1205{
1206 return 0;
1207}
1208
1209static inline void security_file_set_fowner(struct file *file)
1210{
1211 return;
1212}
1213
1214static inline int security_file_send_sigiotask(struct task_struct *tsk,
1215 struct fown_struct *fown,
1216 int sig)
1217{
1218 return 0;
1219}
1220
1221static inline int security_file_receive(struct file *file)
1222{
1223 return 0;
1224}
1225
1226static inline int security_file_open(struct file *file)
1227{
1228 return 0;
1229}
1230
1231static inline int security_file_post_open(struct file *file, int mask)
1232{
1233 return 0;
1234}
1235
1236static inline int security_file_truncate(struct file *file)
1237{
1238 return 0;
1239}
1240
1241static inline int security_task_alloc(struct task_struct *task,
1242 u64 clone_flags)
1243{
1244 return 0;
1245}
1246
1247static inline void security_task_free(struct task_struct *task)
1248{ }
1249
1250static inline int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)
1251{
1252 return 0;
1253}
1254
1255static inline void security_cred_free(struct cred *cred)
1256{ }
1257
1258static inline int security_prepare_creds(struct cred *new,
1259 const struct cred *old,
1260 gfp_t gfp)
1261{
1262 return 0;
1263}
1264
1265static inline void security_transfer_creds(struct cred *new,
1266 const struct cred *old)
1267{
1268}
1269
1270static inline void security_cred_getsecid(const struct cred *c, u32 *secid)
1271{
1272 *secid = 0;
1273}
1274
1275static inline void security_cred_getlsmprop(const struct cred *c,
1276 struct lsm_prop *prop)
1277{ }
1278
1279static inline int security_kernel_act_as(struct cred *cred, u32 secid)
1280{
1281 return 0;
1282}
1283
1284static inline int security_kernel_create_files_as(struct cred *cred,
1285 struct inode *inode)
1286{
1287 return 0;
1288}
1289
1290static inline int security_kernel_module_request(char *kmod_name)
1291{
1292 return 0;
1293}
1294
1295static inline int security_kernel_load_data(enum kernel_load_data_id id, bool contents)
1296{
1297 return 0;
1298}
1299
1300static inline int security_kernel_post_load_data(char *buf, loff_t size,
1301 enum kernel_load_data_id id,
1302 char *description)
1303{
1304 return 0;
1305}
1306
1307static inline int security_kernel_read_file(struct file *file,
1308 enum kernel_read_file_id id,
1309 bool contents)
1310{
1311 return 0;
1312}
1313
1314static inline int security_kernel_post_read_file(struct file *file,
1315 char *buf, loff_t size,
1316 enum kernel_read_file_id id)
1317{
1318 return 0;
1319}
1320
1321static inline int security_task_fix_setuid(struct cred *new,
1322 const struct cred *old,
1323 int flags)
1324{
1325 return cap_task_fix_setuid(new, old, flags);
1326}
1327
1328static inline int security_task_fix_setgid(struct cred *new,
1329 const struct cred *old,
1330 int flags)
1331{
1332 return 0;
1333}
1334
1335static inline int security_task_fix_setgroups(struct cred *new,
1336 const struct cred *old)
1337{
1338 return 0;
1339}
1340
1341static inline int security_task_setpgid(struct task_struct *p, pid_t pgid)
1342{
1343 return 0;
1344}
1345
1346static inline int security_task_getpgid(struct task_struct *p)
1347{
1348 return 0;
1349}
1350
1351static inline int security_task_getsid(struct task_struct *p)
1352{
1353 return 0;
1354}
1355
1356static inline void security_current_getlsmprop_subj(struct lsm_prop *prop)
1357{
1358 lsmprop_init(prop);
1359}
1360
1361static inline void security_task_getlsmprop_obj(struct task_struct *p,
1362 struct lsm_prop *prop)
1363{
1364 lsmprop_init(prop);
1365}
1366
1367static inline int security_task_setnice(struct task_struct *p, int nice)
1368{
1369 return cap_task_setnice(p, nice);
1370}
1371
1372static inline int security_task_setioprio(struct task_struct *p, int ioprio)
1373{
1374 return cap_task_setioprio(p, ioprio);
1375}
1376
1377static inline int security_task_getioprio(struct task_struct *p)
1378{
1379 return 0;
1380}
1381
1382static inline int security_task_prlimit(const struct cred *cred,
1383 const struct cred *tcred,
1384 unsigned int flags)
1385{
1386 return 0;
1387}
1388
1389static inline int security_task_setrlimit(struct task_struct *p,
1390 unsigned int resource,
1391 struct rlimit *new_rlim)
1392{
1393 return 0;
1394}
1395
1396static inline int security_task_setscheduler(struct task_struct *p)
1397{
1398 return cap_task_setscheduler(p);
1399}
1400
1401static inline int security_task_getscheduler(struct task_struct *p)
1402{
1403 return 0;
1404}
1405
1406static inline int security_task_movememory(struct task_struct *p)
1407{
1408 return 0;
1409}
1410
1411static inline int security_task_kill(struct task_struct *p,
1412 struct kernel_siginfo *info, int sig,
1413 const struct cred *cred)
1414{
1415 return 0;
1416}
1417
1418static inline int security_task_prctl(int option, unsigned long arg2,
1419 unsigned long arg3,
1420 unsigned long arg4,
1421 unsigned long arg5)
1422{
1423 return cap_task_prctl(option, arg2, arg3, arg4, arg5);
1424}
1425
1426static inline void security_task_to_inode(struct task_struct *p, struct inode *inode)
1427{ }
1428
1429static inline int security_create_user_ns(const struct cred *cred)
1430{
1431 return 0;
1432}
1433
1434static inline int security_ipc_permission(struct kern_ipc_perm *ipcp,
1435 short flag)
1436{
1437 return 0;
1438}
1439
1440static inline void security_ipc_getlsmprop(struct kern_ipc_perm *ipcp,
1441 struct lsm_prop *prop)
1442{
1443 lsmprop_init(prop);
1444}
1445
1446static inline int security_msg_msg_alloc(struct msg_msg *msg)
1447{
1448 return 0;
1449}
1450
1451static inline void security_msg_msg_free(struct msg_msg *msg)
1452{ }
1453
1454static inline int security_msg_queue_alloc(struct kern_ipc_perm *msq)
1455{
1456 return 0;
1457}
1458
1459static inline void security_msg_queue_free(struct kern_ipc_perm *msq)
1460{ }
1461
1462static inline int security_msg_queue_associate(struct kern_ipc_perm *msq,
1463 int msqflg)
1464{
1465 return 0;
1466}
1467
1468static inline int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
1469{
1470 return 0;
1471}
1472
1473static inline int security_msg_queue_msgsnd(struct kern_ipc_perm *msq,
1474 struct msg_msg *msg, int msqflg)
1475{
1476 return 0;
1477}
1478
1479static inline int security_msg_queue_msgrcv(struct kern_ipc_perm *msq,
1480 struct msg_msg *msg,
1481 struct task_struct *target,
1482 long type, int mode)
1483{
1484 return 0;
1485}
1486
1487static inline int security_shm_alloc(struct kern_ipc_perm *shp)
1488{
1489 return 0;
1490}
1491
1492static inline void security_shm_free(struct kern_ipc_perm *shp)
1493{ }
1494
1495static inline int security_shm_associate(struct kern_ipc_perm *shp,
1496 int shmflg)
1497{
1498 return 0;
1499}
1500
1501static inline int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
1502{
1503 return 0;
1504}
1505
1506static inline int security_shm_shmat(struct kern_ipc_perm *shp,
1507 char __user *shmaddr, int shmflg)
1508{
1509 return 0;
1510}
1511
1512static inline int security_sem_alloc(struct kern_ipc_perm *sma)
1513{
1514 return 0;
1515}
1516
1517static inline void security_sem_free(struct kern_ipc_perm *sma)
1518{ }
1519
1520static inline int security_sem_associate(struct kern_ipc_perm *sma, int semflg)
1521{
1522 return 0;
1523}
1524
1525static inline int security_sem_semctl(struct kern_ipc_perm *sma, int cmd)
1526{
1527 return 0;
1528}
1529
1530static inline int security_sem_semop(struct kern_ipc_perm *sma,
1531 struct sembuf *sops, unsigned nsops,
1532 int alter)
1533{
1534 return 0;
1535}
1536
1537static inline void security_d_instantiate(struct dentry *dentry,
1538 struct inode *inode)
1539{ }
1540
1541static inline int security_getselfattr(unsigned int attr,
1542 struct lsm_ctx __user *ctx,
1543 size_t __user *size, u32 flags)
1544{
1545 return -EOPNOTSUPP;
1546}
1547
1548static inline int security_setselfattr(unsigned int attr,
1549 struct lsm_ctx __user *ctx,
1550 size_t size, u32 flags)
1551{
1552 return -EOPNOTSUPP;
1553}
1554
1555static inline int security_getprocattr(struct task_struct *p, int lsmid,
1556 const char *name, char **value)
1557{
1558 return -EINVAL;
1559}
1560
1561static inline int security_setprocattr(int lsmid, char *name, void *value,
1562 size_t size)
1563{
1564 return -EINVAL;
1565}
1566
1567static inline int security_ismaclabel(const char *name)
1568{
1569 return 0;
1570}
1571
1572static inline int security_secid_to_secctx(u32 secid, struct lsm_context *cp)
1573{
1574 return -EOPNOTSUPP;
1575}
1576
1577static inline int security_lsmprop_to_secctx(struct lsm_prop *prop,
1578 struct lsm_context *cp,
1579 int lsmid)
1580{
1581 return -EOPNOTSUPP;
1582}
1583
1584static inline int security_secctx_to_secid(const char *secdata,
1585 u32 seclen,
1586 u32 *secid)
1587{
1588 return -EOPNOTSUPP;
1589}
1590
1591static inline void security_release_secctx(struct lsm_context *cp)
1592{
1593}
1594
1595static inline void security_inode_invalidate_secctx(struct inode *inode)
1596{
1597}
1598
1599static inline int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
1600{
1601 return -EOPNOTSUPP;
1602}
1603static inline int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
1604{
1605 return -EOPNOTSUPP;
1606}
1607static inline int security_inode_getsecctx(struct inode *inode,
1608 struct lsm_context *cp)
1609{
1610 return -EOPNOTSUPP;
1611}
1612static inline int security_locked_down(enum lockdown_reason what)
1613{
1614 return 0;
1615}
1616static inline int lsm_fill_user_ctx(struct lsm_ctx __user *uctx,
1617 u32 *uctx_len, void *val, size_t val_len,
1618 u64 id, u64 flags)
1619{
1620 return -EOPNOTSUPP;
1621}
1622
1623static inline int security_bdev_alloc(struct block_device *bdev)
1624{
1625 return 0;
1626}
1627
1628static inline void security_bdev_free(struct block_device *bdev)
1629{
1630}
1631
1632static inline int security_bdev_setintegrity(struct block_device *bdev,
1633 enum lsm_integrity_type type,
1634 const void *value, size_t size)
1635{
1636 return 0;
1637}
1638
1639#endif /* CONFIG_SECURITY */
1640
1641#if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE)
1642int security_post_notification(const struct cred *w_cred,
1643 const struct cred *cred,
1644 struct watch_notification *n);
1645#else
1646static inline int security_post_notification(const struct cred *w_cred,
1647 const struct cred *cred,
1648 struct watch_notification *n)
1649{
1650 return 0;
1651}
1652#endif
1653
1654#if defined(CONFIG_SECURITY) && defined(CONFIG_KEY_NOTIFICATIONS)
1655int security_watch_key(struct key *key);
1656#else
1657static inline int security_watch_key(struct key *key)
1658{
1659 return 0;
1660}
1661#endif
1662
1663#ifdef CONFIG_SECURITY_NETWORK
1664
1665int security_netlink_send(struct sock *sk, struct sk_buff *skb);
1666int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk);
1667int security_unix_may_send(struct socket *sock, struct socket *other);
1668int security_socket_create(int family, int type, int protocol, int kern);
1669int security_socket_post_create(struct socket *sock, int family,
1670 int type, int protocol, int kern);
1671int security_socket_socketpair(struct socket *socka, struct socket *sockb);
1672int security_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen);
1673int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen);
1674int security_socket_listen(struct socket *sock, int backlog);
1675int security_socket_accept(struct socket *sock, struct socket *newsock);
1676int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size);
1677int security_socket_recvmsg(struct socket *sock, struct msghdr *msg,
1678 int size, int flags);
1679int security_socket_getsockname(struct socket *sock);
1680int security_socket_getpeername(struct socket *sock);
1681int security_socket_getsockopt(struct socket *sock, int level, int optname);
1682int security_socket_setsockopt(struct socket *sock, int level, int optname);
1683int security_socket_shutdown(struct socket *sock, int how);
1684int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb);
1685int security_socket_getpeersec_stream(struct socket *sock, sockptr_t optval,
1686 sockptr_t optlen, unsigned int len);
1687int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid);
1688int security_sk_alloc(struct sock *sk, int family, gfp_t priority);
1689void security_sk_free(struct sock *sk);
1690void security_sk_clone(const struct sock *sk, struct sock *newsk);
1691void security_sk_classify_flow(const struct sock *sk,
1692 struct flowi_common *flic);
1693void security_req_classify_flow(const struct request_sock *req,
1694 struct flowi_common *flic);
1695void security_sock_graft(struct sock*sk, struct socket *parent);
1696int security_inet_conn_request(const struct sock *sk,
1697 struct sk_buff *skb, struct request_sock *req);
1698void security_inet_csk_clone(struct sock *newsk,
1699 const struct request_sock *req);
1700void security_inet_conn_established(struct sock *sk,
1701 struct sk_buff *skb);
1702int security_secmark_relabel_packet(u32 secid);
1703void security_secmark_refcount_inc(void);
1704void security_secmark_refcount_dec(void);
1705int security_tun_dev_alloc_security(void **security);
1706void security_tun_dev_free_security(void *security);
1707int security_tun_dev_create(void);
1708int security_tun_dev_attach_queue(void *security);
1709int security_tun_dev_attach(struct sock *sk, void *security);
1710int security_tun_dev_open(void *security);
1711int security_sctp_assoc_request(struct sctp_association *asoc, struct sk_buff *skb);
1712int security_sctp_bind_connect(struct sock *sk, int optname,
1713 struct sockaddr *address, int addrlen);
1714void security_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk,
1715 struct sock *newsk);
1716int security_sctp_assoc_established(struct sctp_association *asoc,
1717 struct sk_buff *skb);
1718int security_mptcp_add_subflow(struct sock *sk, struct sock *ssk);
1719
1720#else /* CONFIG_SECURITY_NETWORK */
1721static inline int security_netlink_send(struct sock *sk, struct sk_buff *skb)
1722{
1723 return 0;
1724}
1725
1726static inline int security_unix_stream_connect(struct sock *sock,
1727 struct sock *other,
1728 struct sock *newsk)
1729{
1730 return 0;
1731}
1732
1733static inline int security_unix_may_send(struct socket *sock,
1734 struct socket *other)
1735{
1736 return 0;
1737}
1738
1739static inline int security_socket_create(int family, int type,
1740 int protocol, int kern)
1741{
1742 return 0;
1743}
1744
1745static inline int security_socket_post_create(struct socket *sock,
1746 int family,
1747 int type,
1748 int protocol, int kern)
1749{
1750 return 0;
1751}
1752
1753static inline int security_socket_socketpair(struct socket *socka,
1754 struct socket *sockb)
1755{
1756 return 0;
1757}
1758
1759static inline int security_socket_bind(struct socket *sock,
1760 struct sockaddr *address,
1761 int addrlen)
1762{
1763 return 0;
1764}
1765
1766static inline int security_socket_connect(struct socket *sock,
1767 struct sockaddr *address,
1768 int addrlen)
1769{
1770 return 0;
1771}
1772
1773static inline int security_socket_listen(struct socket *sock, int backlog)
1774{
1775 return 0;
1776}
1777
1778static inline int security_socket_accept(struct socket *sock,
1779 struct socket *newsock)
1780{
1781 return 0;
1782}
1783
1784static inline int security_socket_sendmsg(struct socket *sock,
1785 struct msghdr *msg, int size)
1786{
1787 return 0;
1788}
1789
1790static inline int security_socket_recvmsg(struct socket *sock,
1791 struct msghdr *msg, int size,
1792 int flags)
1793{
1794 return 0;
1795}
1796
1797static inline int security_socket_getsockname(struct socket *sock)
1798{
1799 return 0;
1800}
1801
1802static inline int security_socket_getpeername(struct socket *sock)
1803{
1804 return 0;
1805}
1806
1807static inline int security_socket_getsockopt(struct socket *sock,
1808 int level, int optname)
1809{
1810 return 0;
1811}
1812
1813static inline int security_socket_setsockopt(struct socket *sock,
1814 int level, int optname)
1815{
1816 return 0;
1817}
1818
1819static inline int security_socket_shutdown(struct socket *sock, int how)
1820{
1821 return 0;
1822}
1823static inline int security_sock_rcv_skb(struct sock *sk,
1824 struct sk_buff *skb)
1825{
1826 return 0;
1827}
1828
1829static inline int security_socket_getpeersec_stream(struct socket *sock,
1830 sockptr_t optval,
1831 sockptr_t optlen,
1832 unsigned int len)
1833{
1834 return -ENOPROTOOPT;
1835}
1836
1837static inline int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
1838{
1839 return -ENOPROTOOPT;
1840}
1841
1842static inline int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
1843{
1844 return 0;
1845}
1846
1847static inline void security_sk_free(struct sock *sk)
1848{
1849}
1850
1851static inline void security_sk_clone(const struct sock *sk, struct sock *newsk)
1852{
1853}
1854
1855static inline void security_sk_classify_flow(const struct sock *sk,
1856 struct flowi_common *flic)
1857{
1858}
1859
1860static inline void security_req_classify_flow(const struct request_sock *req,
1861 struct flowi_common *flic)
1862{
1863}
1864
1865static inline void security_sock_graft(struct sock *sk, struct socket *parent)
1866{
1867}
1868
1869static inline int security_inet_conn_request(const struct sock *sk,
1870 struct sk_buff *skb, struct request_sock *req)
1871{
1872 return 0;
1873}
1874
1875static inline void security_inet_csk_clone(struct sock *newsk,
1876 const struct request_sock *req)
1877{
1878}
1879
1880static inline void security_inet_conn_established(struct sock *sk,
1881 struct sk_buff *skb)
1882{
1883}
1884
1885static inline int security_secmark_relabel_packet(u32 secid)
1886{
1887 return 0;
1888}
1889
1890static inline void security_secmark_refcount_inc(void)
1891{
1892}
1893
1894static inline void security_secmark_refcount_dec(void)
1895{
1896}
1897
1898static inline int security_tun_dev_alloc_security(void **security)
1899{
1900 return 0;
1901}
1902
1903static inline void security_tun_dev_free_security(void *security)
1904{
1905}
1906
1907static inline int security_tun_dev_create(void)
1908{
1909 return 0;
1910}
1911
1912static inline int security_tun_dev_attach_queue(void *security)
1913{
1914 return 0;
1915}
1916
1917static inline int security_tun_dev_attach(struct sock *sk, void *security)
1918{
1919 return 0;
1920}
1921
1922static inline int security_tun_dev_open(void *security)
1923{
1924 return 0;
1925}
1926
1927static inline int security_sctp_assoc_request(struct sctp_association *asoc,
1928 struct sk_buff *skb)
1929{
1930 return 0;
1931}
1932
1933static inline int security_sctp_bind_connect(struct sock *sk, int optname,
1934 struct sockaddr *address,
1935 int addrlen)
1936{
1937 return 0;
1938}
1939
1940static inline void security_sctp_sk_clone(struct sctp_association *asoc,
1941 struct sock *sk,
1942 struct sock *newsk)
1943{
1944}
1945
1946static inline int security_sctp_assoc_established(struct sctp_association *asoc,
1947 struct sk_buff *skb)
1948{
1949 return 0;
1950}
1951
1952static inline int security_mptcp_add_subflow(struct sock *sk, struct sock *ssk)
1953{
1954 return 0;
1955}
1956#endif /* CONFIG_SECURITY_NETWORK */
1957
1958#if defined(CONFIG_SECURITY_NETWORK) && defined(CONFIG_SECURITY_PATH)
1959
1960int security_unix_find(const struct path *path, struct sock *other, int flags);
1961
1962#else /* CONFIG_SECURITY_NETWORK && CONFIG_SECURITY_PATH */
1963static inline int security_unix_find(const struct path *path, struct sock *other, int flags)
1964{
1965 return 0;
1966}
1967#endif /* CONFIG_SECURITY_NETWORK && CONFIG_SECURITY_PATH */
1968
1969#ifdef CONFIG_SECURITY_INFINIBAND
1970int security_ib_pkey_access(void *sec, u64 subnet_prefix, u16 pkey);
1971int security_ib_endport_manage_subnet(void *sec, const char *name, u8 port_num);
1972int security_ib_alloc_security(void **sec);
1973void security_ib_free_security(void *sec);
1974#else /* CONFIG_SECURITY_INFINIBAND */
1975static inline int security_ib_pkey_access(void *sec, u64 subnet_prefix, u16 pkey)
1976{
1977 return 0;
1978}
1979
1980static inline int security_ib_endport_manage_subnet(void *sec, const char *dev_name, u8 port_num)
1981{
1982 return 0;
1983}
1984
1985static inline int security_ib_alloc_security(void **sec)
1986{
1987 return 0;
1988}
1989
1990static inline void security_ib_free_security(void *sec)
1991{
1992}
1993#endif /* CONFIG_SECURITY_INFINIBAND */
1994
1995#ifdef CONFIG_SECURITY_NETWORK_XFRM
1996
1997int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
1998 struct xfrm_user_sec_ctx *sec_ctx, gfp_t gfp);
1999int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctxp);
2000void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
2001int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx);
2002int security_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx);
2003int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
2004 struct xfrm_sec_ctx *polsec, u32 secid);
2005int security_xfrm_state_delete(struct xfrm_state *x);
2006void security_xfrm_state_free(struct xfrm_state *x);
2007int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid);
2008int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
2009 struct xfrm_policy *xp,
2010 const struct flowi_common *flic);
2011int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid);
2012void security_skb_classify_flow(struct sk_buff *skb, struct flowi_common *flic);
2013
2014#else /* CONFIG_SECURITY_NETWORK_XFRM */
2015
2016static inline int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
2017 struct xfrm_user_sec_ctx *sec_ctx,
2018 gfp_t gfp)
2019{
2020 return 0;
2021}
2022
2023static inline int security_xfrm_policy_clone(struct xfrm_sec_ctx *old, struct xfrm_sec_ctx **new_ctxp)
2024{
2025 return 0;
2026}
2027
2028static inline void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
2029{
2030}
2031
2032static inline int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
2033{
2034 return 0;
2035}
2036
2037static inline int security_xfrm_state_alloc(struct xfrm_state *x,
2038 struct xfrm_user_sec_ctx *sec_ctx)
2039{
2040 return 0;
2041}
2042
2043static inline int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
2044 struct xfrm_sec_ctx *polsec, u32 secid)
2045{
2046 return 0;
2047}
2048
2049static inline void security_xfrm_state_free(struct xfrm_state *x)
2050{
2051}
2052
2053static inline int security_xfrm_state_delete(struct xfrm_state *x)
2054{
2055 return 0;
2056}
2057
2058static inline int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid)
2059{
2060 return 0;
2061}
2062
2063static inline int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
2064 struct xfrm_policy *xp,
2065 const struct flowi_common *flic)
2066{
2067 return 1;
2068}
2069
2070static inline int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
2071{
2072 return 0;
2073}
2074
2075static inline void security_skb_classify_flow(struct sk_buff *skb,
2076 struct flowi_common *flic)
2077{
2078}
2079
2080#endif /* CONFIG_SECURITY_NETWORK_XFRM */
2081
2082#ifdef CONFIG_SECURITY_PATH
2083int security_path_unlink(const struct path *dir, struct dentry *dentry);
2084int security_path_mkdir(const struct path *dir, struct dentry *dentry, umode_t mode);
2085int security_path_rmdir(const struct path *dir, struct dentry *dentry);
2086int security_path_mknod(const struct path *dir, struct dentry *dentry, umode_t mode,
2087 unsigned int dev);
2088void security_path_post_mknod(const struct mnt_idmap *idmap, struct dentry *dentry);
2089int security_path_truncate(const struct path *path);
2090int security_path_symlink(const struct path *dir, struct dentry *dentry,
2091 const char *old_name);
2092int security_path_link(struct dentry *old_dentry, const struct path *new_dir,
2093 struct dentry *new_dentry);
2094int security_path_rename(const struct path *old_dir, struct dentry *old_dentry,
2095 const struct path *new_dir, struct dentry *new_dentry,
2096 unsigned int flags);
2097int security_path_chmod(const struct path *path, umode_t mode);
2098int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid);
2099int security_path_chroot(const struct path *path);
2100#else /* CONFIG_SECURITY_PATH */
2101static inline int security_path_unlink(const struct path *dir, struct dentry *dentry)
2102{
2103 return 0;
2104}
2105
2106static inline int security_path_mkdir(const struct path *dir, struct dentry *dentry,
2107 umode_t mode)
2108{
2109 return 0;
2110}
2111
2112static inline int security_path_rmdir(const struct path *dir, struct dentry *dentry)
2113{
2114 return 0;
2115}
2116
2117static inline int security_path_mknod(const struct path *dir, struct dentry *dentry,
2118 umode_t mode, unsigned int dev)
2119{
2120 return 0;
2121}
2122
2123static inline void security_path_post_mknod(const struct mnt_idmap *idmap,
2124 struct dentry *dentry)
2125{ }
2126
2127static inline int security_path_truncate(const struct path *path)
2128{
2129 return 0;
2130}
2131
2132static inline int security_path_symlink(const struct path *dir, struct dentry *dentry,
2133 const char *old_name)
2134{
2135 return 0;
2136}
2137
2138static inline int security_path_link(struct dentry *old_dentry,
2139 const struct path *new_dir,
2140 struct dentry *new_dentry)
2141{
2142 return 0;
2143}
2144
2145static inline int security_path_rename(const struct path *old_dir,
2146 struct dentry *old_dentry,
2147 const struct path *new_dir,
2148 struct dentry *new_dentry,
2149 unsigned int flags)
2150{
2151 return 0;
2152}
2153
2154static inline int security_path_chmod(const struct path *path, umode_t mode)
2155{
2156 return 0;
2157}
2158
2159static inline int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
2160{
2161 return 0;
2162}
2163
2164static inline int security_path_chroot(const struct path *path)
2165{
2166 return 0;
2167}
2168#endif /* CONFIG_SECURITY_PATH */
2169
2170#ifdef CONFIG_KEYS
2171#ifdef CONFIG_SECURITY
2172
2173int security_key_alloc(struct key *key, const struct cred *cred, unsigned long flags);
2174void security_key_free(struct key *key);
2175int security_key_permission(key_ref_t key_ref, const struct cred *cred,
2176 enum key_need_perm need_perm);
2177int security_key_getsecurity(struct key *key, char **_buffer);
2178void security_key_post_create_or_update(struct key *keyring, struct key *key,
2179 const void *payload, size_t payload_len,
2180 unsigned long flags, bool create);
2181
2182#else
2183
2184static inline int security_key_alloc(struct key *key,
2185 const struct cred *cred,
2186 unsigned long flags)
2187{
2188 return 0;
2189}
2190
2191static inline void security_key_free(struct key *key)
2192{
2193}
2194
2195static inline int security_key_permission(key_ref_t key_ref,
2196 const struct cred *cred,
2197 enum key_need_perm need_perm)
2198{
2199 return 0;
2200}
2201
2202static inline int security_key_getsecurity(struct key *key, char **_buffer)
2203{
2204 *_buffer = NULL;
2205 return 0;
2206}
2207
2208static inline void security_key_post_create_or_update(struct key *keyring,
2209 struct key *key,
2210 const void *payload,
2211 size_t payload_len,
2212 unsigned long flags,
2213 bool create)
2214{ }
2215
2216#endif
2217#endif /* CONFIG_KEYS */
2218
2219#ifdef CONFIG_AUDIT
2220#ifdef CONFIG_SECURITY
2221int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule,
2222 gfp_t gfp);
2223int security_audit_rule_known(struct audit_krule *krule);
2224int security_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op,
2225 void *lsmrule);
2226void security_audit_rule_free(void *lsmrule);
2227
2228#else
2229
2230static inline int security_audit_rule_init(u32 field, u32 op, char *rulestr,
2231 void **lsmrule, gfp_t gfp)
2232{
2233 return 0;
2234}
2235
2236static inline int security_audit_rule_known(struct audit_krule *krule)
2237{
2238 return 0;
2239}
2240
2241static inline int security_audit_rule_match(struct lsm_prop *prop, u32 field,
2242 u32 op, void *lsmrule)
2243{
2244 return 0;
2245}
2246
2247static inline void security_audit_rule_free(void *lsmrule)
2248{ }
2249
2250#endif /* CONFIG_SECURITY */
2251#endif /* CONFIG_AUDIT */
2252
2253#ifdef CONFIG_SECURITYFS
2254
2255extern struct dentry *securityfs_create_file(const char *name, umode_t mode,
2256 struct dentry *parent, void *data,
2257 const struct file_operations *fops);
2258extern struct dentry *securityfs_create_dir(const char *name, struct dentry *parent);
2259struct dentry *securityfs_create_symlink(const char *name,
2260 struct dentry *parent,
2261 const char *target,
2262 const struct inode_operations *iops);
2263extern void securityfs_remove(struct dentry *dentry);
2264
2265#else /* CONFIG_SECURITYFS */
2266
2267static inline struct dentry *securityfs_create_dir(const char *name,
2268 struct dentry *parent)
2269{
2270 return ERR_PTR(-ENODEV);
2271}
2272
2273static inline struct dentry *securityfs_create_file(const char *name,
2274 umode_t mode,
2275 struct dentry *parent,
2276 void *data,
2277 const struct file_operations *fops)
2278{
2279 return ERR_PTR(-ENODEV);
2280}
2281
2282static inline struct dentry *securityfs_create_symlink(const char *name,
2283 struct dentry *parent,
2284 const char *target,
2285 const struct inode_operations *iops)
2286{
2287 return ERR_PTR(-ENODEV);
2288}
2289
2290static inline void securityfs_remove(struct dentry *dentry)
2291{}
2292
2293#endif
2294
2295#ifdef CONFIG_BPF_SYSCALL
2296union bpf_attr;
2297struct bpf_map;
2298struct bpf_prog;
2299struct bpf_token;
2300#ifdef CONFIG_SECURITY
2301extern int security_bpf(int cmd, union bpf_attr *attr, unsigned int size, bool kernel);
2302extern int security_bpf_map(struct bpf_map *map, fmode_t fmode);
2303extern int security_bpf_prog(struct bpf_prog *prog);
2304extern int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
2305 struct bpf_token *token, bool kernel);
2306extern void security_bpf_map_free(struct bpf_map *map);
2307extern int security_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,
2308 struct bpf_token *token, bool kernel);
2309extern void security_bpf_prog_free(struct bpf_prog *prog);
2310extern int security_bpf_token_create(struct bpf_token *token, union bpf_attr *attr,
2311 const struct path *path);
2312extern void security_bpf_token_free(struct bpf_token *token);
2313extern int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cmd);
2314extern int security_bpf_token_capable(const struct bpf_token *token, int cap);
2315#else
2316static inline int security_bpf(int cmd, union bpf_attr *attr,
2317 unsigned int size, bool kernel)
2318{
2319 return 0;
2320}
2321
2322static inline int security_bpf_map(struct bpf_map *map, fmode_t fmode)
2323{
2324 return 0;
2325}
2326
2327static inline int security_bpf_prog(struct bpf_prog *prog)
2328{
2329 return 0;
2330}
2331
2332static inline int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
2333 struct bpf_token *token, bool kernel)
2334{
2335 return 0;
2336}
2337
2338static inline void security_bpf_map_free(struct bpf_map *map)
2339{ }
2340
2341static inline int security_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,
2342 struct bpf_token *token, bool kernel)
2343{
2344 return 0;
2345}
2346
2347static inline void security_bpf_prog_free(struct bpf_prog *prog)
2348{ }
2349
2350static inline int security_bpf_token_create(struct bpf_token *token, union bpf_attr *attr,
2351 const struct path *path)
2352{
2353 return 0;
2354}
2355
2356static inline void security_bpf_token_free(struct bpf_token *token)
2357{ }
2358
2359static inline int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cmd)
2360{
2361 return 0;
2362}
2363
2364static inline int security_bpf_token_capable(const struct bpf_token *token, int cap)
2365{
2366 return 0;
2367}
2368#endif /* CONFIG_SECURITY */
2369#endif /* CONFIG_BPF_SYSCALL */
2370
2371#ifdef CONFIG_PERF_EVENTS
2372struct perf_event_attr;
2373struct perf_event;
2374
2375#ifdef CONFIG_SECURITY
2376extern int security_perf_event_open(int type);
2377extern int security_perf_event_alloc(struct perf_event *event);
2378extern void security_perf_event_free(struct perf_event *event);
2379extern int security_perf_event_read(struct perf_event *event);
2380extern int security_perf_event_write(struct perf_event *event);
2381#else
2382static inline int security_perf_event_open(int type)
2383{
2384 return 0;
2385}
2386
2387static inline int security_perf_event_alloc(struct perf_event *event)
2388{
2389 return 0;
2390}
2391
2392static inline void security_perf_event_free(struct perf_event *event)
2393{
2394}
2395
2396static inline int security_perf_event_read(struct perf_event *event)
2397{
2398 return 0;
2399}
2400
2401static inline int security_perf_event_write(struct perf_event *event)
2402{
2403 return 0;
2404}
2405#endif /* CONFIG_SECURITY */
2406#endif /* CONFIG_PERF_EVENTS */
2407
2408#ifdef CONFIG_IO_URING
2409#ifdef CONFIG_SECURITY
2410extern int security_uring_override_creds(const struct cred *new);
2411extern int security_uring_sqpoll(void);
2412extern int security_uring_cmd(struct io_uring_cmd *ioucmd);
2413extern int security_uring_allowed(void);
2414#else
2415static inline int security_uring_override_creds(const struct cred *new)
2416{
2417 return 0;
2418}
2419static inline int security_uring_sqpoll(void)
2420{
2421 return 0;
2422}
2423static inline int security_uring_cmd(struct io_uring_cmd *ioucmd)
2424{
2425 return 0;
2426}
2427static inline int security_uring_allowed(void)
2428{
2429 return 0;
2430}
2431#endif /* CONFIG_SECURITY */
2432#endif /* CONFIG_IO_URING */
2433
2434#ifdef CONFIG_SECURITY
2435extern void security_initramfs_populated(void);
2436#else
2437static inline void security_initramfs_populated(void)
2438{
2439}
2440#endif /* CONFIG_SECURITY */
2441
2442#endif /* ! __LINUX_SECURITY_H */