linux - security/security.c

5717 lines · 166.7 KiB

1	// SPDX-License-Identifier: GPL-2.0-or-later
2	/*
3	* Security plug functions
4	*
5	* Copyright (C) 2001 WireX Communications, Inc <[email protected]>
6	* Copyright (C) 2001-2002 Greg Kroah-Hartman <[email protected]>
7	* Copyright (C) 2001 Networks Associates Technology, Inc <[email protected]>
8	* Copyright (C) 2016 Mellanox Technologies
9	* Copyright (C) 2023 Microsoft Corporation <[email protected]>
10	*/
11
12	#define pr_fmt(fmt) "LSM: " fmt
13
14	#include <linux/bpf.h>
15	#include <linux/capability.h>
16	#include <linux/dcache.h>
17	#include <linux/export.h>
18	#include <linux/init.h>
19	#include <linux/kernel.h>
20	#include <linux/kernel_read_file.h>
21	#include <linux/lsm_hooks.h>
22	#include <linux/mman.h>
23	#include <linux/mount.h>
24	#include <linux/personality.h>
25	#include <linux/backing-dev.h>
26	#include <linux/string.h>
27	#include <linux/xattr.h>
28	#include <linux/msg.h>
29	#include <linux/overflow.h>
30	#include <linux/perf_event.h>
31	#include <linux/fs.h>
32	#include <net/flow.h>
33	#include <net/sock.h>
34
35	#include "lsm.h"
36
37	/*
38	* These are descriptions of the reasons that can be passed to the
39	* security_locked_down() LSM hook. Placing this array here allows
40	* all security modules to use the same descriptions for auditing
41	* purposes.
42	*/
43	const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX + 1] = {
44	[LOCKDOWN_NONE] = "none",
45	[LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading",
46	[LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port",
47	[LOCKDOWN_EFI_TEST] = "/dev/efi_test access",
48	[LOCKDOWN_KEXEC] = "kexec of unsigned images",
49	[LOCKDOWN_HIBERNATION] = "hibernation",
50	[LOCKDOWN_PCI_ACCESS] = "direct PCI access",
51	[LOCKDOWN_IOPORT] = "raw io port access",
52	[LOCKDOWN_MSR] = "raw MSR access",
53	[LOCKDOWN_ACPI_TABLES] = "modifying ACPI tables",
54	[LOCKDOWN_DEVICE_TREE] = "modifying device tree contents",
55	[LOCKDOWN_PCMCIA_CIS] = "direct PCMCIA CIS storage",
56	[LOCKDOWN_TIOCSSERIAL] = "reconfiguration of serial port IO",
57	[LOCKDOWN_MODULE_PARAMETERS] = "unsafe module parameters",
58	[LOCKDOWN_MMIOTRACE] = "unsafe mmio",
59	[LOCKDOWN_DEBUGFS] = "debugfs access",
60	[LOCKDOWN_XMON_WR] = "xmon write access",
61	[LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM",
62	[LOCKDOWN_DBG_WRITE_KERNEL] = "use of kgdb/kdb to write kernel RAM",
63	[LOCKDOWN_RTAS_ERROR_INJECTION] = "RTAS error injection",
64	[LOCKDOWN_XEN_USER_ACTIONS] = "Xen guest user action",
65	[LOCKDOWN_INTEGRITY_MAX] = "integrity",
66	[LOCKDOWN_KCORE] = "/proc/kcore access",
67	[LOCKDOWN_KPROBES] = "use of kprobes",
68	[LOCKDOWN_BPF_READ_KERNEL] = "use of bpf to read kernel RAM",
69	[LOCKDOWN_DBG_READ_KERNEL] = "use of kgdb/kdb to read kernel RAM",
70	[LOCKDOWN_PERF] = "unsafe use of perf",
71	[LOCKDOWN_TRACEFS] = "use of tracefs",
72	[LOCKDOWN_XMON_RW] = "xmon read and write access",
73	[LOCKDOWN_XFRM_SECRET] = "xfrm SA secret",
74	[LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality",
75	};
76
77	bool lsm_debug __ro_after_init;
78
79	unsigned int lsm_active_cnt __ro_after_init;
80	const struct lsm_id *lsm_idlist[MAX_LSM_COUNT];
81
82	struct lsm_blob_sizes blob_sizes;
83
84	struct kmem_cache *lsm_file_cache;
85	struct kmem_cache *lsm_backing_file_cache;
86	struct kmem_cache *lsm_inode_cache;
87
88	#define SECURITY_HOOK_ACTIVE_KEY(HOOK, IDX) security_hook_active_##HOOK##_##IDX
89
90	/*
91	* Identifier for the LSM static calls.
92	* HOOK is an LSM hook as defined in linux/lsm_hookdefs.h
93	* IDX is the index of the static call. 0 <= NUM < MAX_LSM_COUNT
94	*/
95	#define LSM_STATIC_CALL(HOOK, IDX) lsm_static_call_##HOOK##_##IDX
96
97	/*
98	* Call the macro M for each LSM hook MAX_LSM_COUNT times.
99	*/
100	#define LSM_LOOP_UNROLL(M, ...) \
101	do { \
102	UNROLL(MAX_LSM_COUNT, M, __VA_ARGS__) \
103	} while (0)
104
105	#define LSM_DEFINE_UNROLL(M, ...) UNROLL(MAX_LSM_COUNT, M, __VA_ARGS__)
106
107	#ifdef CONFIG_HAVE_STATIC_CALL
108	#define LSM_HOOK_TRAMP(NAME, NUM) \
109	&STATIC_CALL_TRAMP(LSM_STATIC_CALL(NAME, NUM))
110	#else
111	#define LSM_HOOK_TRAMP(NAME, NUM) NULL
112	#endif
113
114	/*
115	* Define static calls and static keys for each LSM hook.
116	*/
117	#define DEFINE_LSM_STATIC_CALL(NUM, NAME, RET, ...) \
118	DEFINE_STATIC_CALL_NULL(LSM_STATIC_CALL(NAME, NUM), \
119	((RET()(__VA_ARGS__))NULL)); \
120	static DEFINE_STATIC_KEY_FALSE(SECURITY_HOOK_ACTIVE_KEY(NAME, NUM));
121
122	#define LSM_HOOK(RET, DEFAULT, NAME, ...) \
123	LSM_DEFINE_UNROLL(DEFINE_LSM_STATIC_CALL, NAME, RET, __VA_ARGS__)
124	#include <linux/lsm_hook_defs.h>
125	#undef LSM_HOOK
126	#undef DEFINE_LSM_STATIC_CALL
127
128	/*
129	* Initialise a table of static calls for each LSM hook.
130	* DEFINE_STATIC_CALL_NULL invocation above generates a key (STATIC_CALL_KEY)
131	* and a trampoline (STATIC_CALL_TRAMP) which are used to call
132	* __static_call_update when updating the static call.
133	*
134	* The static calls table is used by early LSMs, some architectures can fault on
135	* unaligned accesses and the fault handling code may not be ready by then.
136	* Thus, the static calls table should be aligned to avoid any unhandled faults
137	* in early init.
138	*/
139	struct lsm_static_calls_table
140	static_calls_table __ro_after_init __aligned(sizeof(u64)) = {
141	#define INIT_LSM_STATIC_CALL(NUM, NAME) \
142	(struct lsm_static_call) { \
143	.key = &STATIC_CALL_KEY(LSM_STATIC_CALL(NAME, NUM)), \
144	.trampoline = LSM_HOOK_TRAMP(NAME, NUM), \
145	.active = &SECURITY_HOOK_ACTIVE_KEY(NAME, NUM), \
146	},
147	#define LSM_HOOK(RET, DEFAULT, NAME, ...) \
148	.NAME = { \
149	LSM_DEFINE_UNROLL(INIT_LSM_STATIC_CALL, NAME) \
150	},
151	#include <linux/lsm_hook_defs.h>
152	#undef LSM_HOOK
153	#undef INIT_LSM_STATIC_CALL
154	};
155
156	/**
157	* lsm_file_alloc - allocate a composite file blob
158	* @file: the file that needs a blob
159	*
160	* Allocate the file blob for all the modules
161	*
162	* Returns 0, or -ENOMEM if memory can't be allocated.
163	*/
164	static int lsm_file_alloc(struct file *file)
165	{
166	if (!lsm_file_cache) {
167	file->f_security = NULL;
168	return 0;
169	}
170
171	file->f_security = kmem_cache_zalloc(lsm_file_cache, GFP_KERNEL);
172	if (file->f_security == NULL)
173	return -ENOMEM;
174	return 0;
175	}
176
177	/**
178	* lsm_backing_file_alloc - allocate a composite backing file blob
179	* @backing_file: the backing file
180	*
181	* Allocate the backing file blob for all the modules.
182	*
183	* Returns 0, or -ENOMEM if memory can't be allocated.
184	*/
185	static int lsm_backing_file_alloc(struct file *backing_file)
186	{
187	void *blob;
188
189	if (!lsm_backing_file_cache) {
190	backing_file_set_security(backing_file, NULL);
191	return 0;
192	}
193
194	blob = kmem_cache_zalloc(lsm_backing_file_cache, GFP_KERNEL);
195	backing_file_set_security(backing_file, blob);
196	if (!blob)
197	return -ENOMEM;
198	return 0;
199	}
200
201	/**
202	* lsm_blob_alloc - allocate a composite blob
203	* @dest: the destination for the blob
204	* @size: the size of the blob
205	* @gfp: allocation type
206	*
207	* Allocate a blob for all the modules
208	*
209	* Returns 0, or -ENOMEM if memory can't be allocated.
210	*/
211	static int lsm_blob_alloc(void **dest, size_t size, gfp_t gfp)
212	{
213	if (size == 0) {
214	*dest = NULL;
215	return 0;
216	}
217
218	*dest = kzalloc(size, gfp);
219	if (*dest == NULL)
220	return -ENOMEM;
221	return 0;
222	}
223
224	/**
225	* lsm_cred_alloc - allocate a composite cred blob
226	* @cred: the cred that needs a blob
227	* @gfp: allocation type
228	*
229	* Allocate the cred blob for all the modules
230	*
231	* Returns 0, or -ENOMEM if memory can't be allocated.
232	*/
233	int lsm_cred_alloc(struct cred *cred, gfp_t gfp)
234	{
235	return lsm_blob_alloc(&cred->security, blob_sizes.lbs_cred, gfp);
236	}
237
238	/**
239	* lsm_inode_alloc - allocate a composite inode blob
240	* @inode: the inode that needs a blob
241	* @gfp: allocation flags
242	*
243	* Allocate the inode blob for all the modules
244	*
245	* Returns 0, or -ENOMEM if memory can't be allocated.
246	*/
247	static int lsm_inode_alloc(struct inode *inode, gfp_t gfp)
248	{
249	if (!lsm_inode_cache) {
250	inode->i_security = NULL;
251	return 0;
252	}
253
254	inode->i_security = kmem_cache_zalloc(lsm_inode_cache, gfp);
255	if (inode->i_security == NULL)
256	return -ENOMEM;
257	return 0;
258	}
259
260	/**
261	* lsm_task_alloc - allocate a composite task blob
262	* @task: the task that needs a blob
263	*
264	* Allocate the task blob for all the modules
265	*
266	* Returns 0, or -ENOMEM if memory can't be allocated.
267	*/
268	int lsm_task_alloc(struct task_struct *task)
269	{
270	return lsm_blob_alloc(&task->security, blob_sizes.lbs_task, GFP_KERNEL);
271	}
272
273	/**
274	* lsm_ipc_alloc - allocate a composite ipc blob
275	* @kip: the ipc that needs a blob
276	*
277	* Allocate the ipc blob for all the modules
278	*
279	* Returns 0, or -ENOMEM if memory can't be allocated.
280	*/
281	static int lsm_ipc_alloc(struct kern_ipc_perm *kip)
282	{
283	return lsm_blob_alloc(&kip->security, blob_sizes.lbs_ipc, GFP_KERNEL);
284	}
285
286	#ifdef CONFIG_KEYS
287	/**
288	* lsm_key_alloc - allocate a composite key blob
289	* @key: the key that needs a blob
290	*
291	* Allocate the key blob for all the modules
292	*
293	* Returns 0, or -ENOMEM if memory can't be allocated.
294	*/
295	static int lsm_key_alloc(struct key *key)
296	{
297	return lsm_blob_alloc(&key->security, blob_sizes.lbs_key, GFP_KERNEL);
298	}
299	#endif /* CONFIG_KEYS */
300
301	/**
302	* lsm_msg_msg_alloc - allocate a composite msg_msg blob
303	* @mp: the msg_msg that needs a blob
304	*
305	* Allocate the ipc blob for all the modules
306	*
307	* Returns 0, or -ENOMEM if memory can't be allocated.
308	*/
309	static int lsm_msg_msg_alloc(struct msg_msg *mp)
310	{
311	return lsm_blob_alloc(&mp->security, blob_sizes.lbs_msg_msg,
312	GFP_KERNEL);
313	}
314
315	/**
316	* lsm_bdev_alloc - allocate a composite block_device blob
317	* @bdev: the block_device that needs a blob
318	*
319	* Allocate the block_device blob for all the modules
320	*
321	* Returns 0, or -ENOMEM if memory can't be allocated.
322	*/
323	static int lsm_bdev_alloc(struct block_device *bdev)
324	{
325	return lsm_blob_alloc(&bdev->bd_security, blob_sizes.lbs_bdev,
326	GFP_KERNEL);
327	}
328
329	#ifdef CONFIG_BPF_SYSCALL
330	/**
331	* lsm_bpf_map_alloc - allocate a composite bpf_map blob
332	* @map: the bpf_map that needs a blob
333	*
334	* Allocate the bpf_map blob for all the modules
335	*
336	* Returns 0, or -ENOMEM if memory can't be allocated.
337	*/
338	static int lsm_bpf_map_alloc(struct bpf_map *map)
339	{
340	return lsm_blob_alloc(&map->security, blob_sizes.lbs_bpf_map, GFP_KERNEL);
341	}
342
343	/**
344	* lsm_bpf_prog_alloc - allocate a composite bpf_prog blob
345	* @prog: the bpf_prog that needs a blob
346	*
347	* Allocate the bpf_prog blob for all the modules
348	*
349	* Returns 0, or -ENOMEM if memory can't be allocated.
350	*/
351	static int lsm_bpf_prog_alloc(struct bpf_prog *prog)
352	{
353	return lsm_blob_alloc(&prog->aux->security, blob_sizes.lbs_bpf_prog, GFP_KERNEL);
354	}
355
356	/**
357	* lsm_bpf_token_alloc - allocate a composite bpf_token blob
358	* @token: the bpf_token that needs a blob
359	*
360	* Allocate the bpf_token blob for all the modules
361	*
362	* Returns 0, or -ENOMEM if memory can't be allocated.
363	*/
364	static int lsm_bpf_token_alloc(struct bpf_token *token)
365	{
366	return lsm_blob_alloc(&token->security, blob_sizes.lbs_bpf_token, GFP_KERNEL);
367	}
368	#endif /* CONFIG_BPF_SYSCALL */
369
370	/**
371	* lsm_superblock_alloc - allocate a composite superblock blob
372	* @sb: the superblock that needs a blob
373	*
374	* Allocate the superblock blob for all the modules
375	*
376	* Returns 0, or -ENOMEM if memory can't be allocated.
377	*/
378	static int lsm_superblock_alloc(struct super_block *sb)
379	{
380	return lsm_blob_alloc(&sb->s_security, blob_sizes.lbs_superblock,
381	GFP_KERNEL);
382	}
383
384	/**
385	* lsm_fill_user_ctx - Fill a user space lsm_ctx structure
386	* @uctx: a userspace LSM context to be filled
387	* @uctx_len: available uctx size (input), used uctx size (output)
388	* @val: the new LSM context value
389	* @val_len: the size of the new LSM context value
390	* @id: LSM id
391	* @flags: LSM defined flags
392	*
393	* Fill all of the fields in a userspace lsm_ctx structure. If @uctx is NULL
394	* simply calculate the required size to output via @utc_len and return
395	* success.
396	*
397	* Returns 0 on success, -E2BIG if userspace buffer is not large enough,
398	* -EFAULT on a copyout error, -ENOMEM if memory can't be allocated.
399	*/
400	int lsm_fill_user_ctx(struct lsm_ctx __user uctx, u32 uctx_len,
401	void *val, size_t val_len,
402	u64 id, u64 flags)
403	{
404	struct lsm_ctx *nctx = NULL;
405	size_t nctx_len;
406	int rc = 0;
407
408	nctx_len = ALIGN(struct_size(nctx, ctx, val_len), sizeof(void *));
409	if (nctx_len > *uctx_len) {
410	rc = -E2BIG;
411	goto out;
412	}
413
414	/* no buffer - return success/0 and set @uctx_len to the req size */
415	if (!uctx)
416	goto out;
417
418	nctx = kzalloc(nctx_len, GFP_KERNEL);
419	if (nctx == NULL) {
420	rc = -ENOMEM;
421	goto out;
422	}
423	nctx->id = id;
424	nctx->flags = flags;
425	nctx->len = nctx_len;
426	nctx->ctx_len = val_len;
427	memcpy(nctx->ctx, val, val_len);
428
429	if (copy_to_user(uctx, nctx, nctx_len))
430	rc = -EFAULT;
431
432	out:
433	kfree(nctx);
434	*uctx_len = nctx_len;
435	return rc;
436	}
437
438	/*
439	* The default value of the LSM hook is defined in linux/lsm_hook_defs.h and
440	* can be accessed with:
441	*
442	* LSM_RET_DEFAULT(<hook_name>)
443	*
444	* The macros below define static constants for the default value of each
445	* LSM hook.
446	*/
447	#define LSM_RET_DEFAULT(NAME) (NAME##_default)
448	#define DECLARE_LSM_RET_DEFAULT_void(DEFAULT, NAME)
449	#define DECLARE_LSM_RET_DEFAULT_int(DEFAULT, NAME) \
450	static const int __maybe_unused LSM_RET_DEFAULT(NAME) = (DEFAULT);
451	#define LSM_HOOK(RET, DEFAULT, NAME, ...) \
452	DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME)
453
454	#include <linux/lsm_hook_defs.h>
455	#undef LSM_HOOK
456
457	/*
458	* Hook list operation macros.
459	*
460	* call_void_hook:
461	* This is a hook that does not return a value.
462	*
463	* call_int_hook:
464	* This is a hook that returns a value.
465	*/
466	#define __CALL_STATIC_VOID(NUM, HOOK, ...) \
467	do { \
468	if (static_branch_unlikely(&SECURITY_HOOK_ACTIVE_KEY(HOOK, NUM))) { \
469	static_call(LSM_STATIC_CALL(HOOK, NUM))(__VA_ARGS__); \
470	} \
471	} while (0);
472
473	#define call_void_hook(HOOK, ...) \
474	do { \
475	LSM_LOOP_UNROLL(__CALL_STATIC_VOID, HOOK, __VA_ARGS__); \
476	} while (0)
477
478
479	#define __CALL_STATIC_INT(NUM, R, HOOK, LABEL, ...) \
480	do { \
481	if (static_branch_unlikely(&SECURITY_HOOK_ACTIVE_KEY(HOOK, NUM))) { \
482	R = static_call(LSM_STATIC_CALL(HOOK, NUM))(__VA_ARGS__); \
483	if (R != LSM_RET_DEFAULT(HOOK)) \
484	goto LABEL; \
485	} \
486	} while (0);
487
488	#define call_int_hook(HOOK, ...) \
489	({ \
490	__label__ OUT; \
491	int RC = LSM_RET_DEFAULT(HOOK); \
492	\
493	LSM_LOOP_UNROLL(__CALL_STATIC_INT, RC, HOOK, OUT, __VA_ARGS__); \
494	OUT: \
495	RC; \
496	})
497
498	#define lsm_for_each_hook(scall, NAME) \
499	for (scall = static_calls_table.NAME; \
500	scall - static_calls_table.NAME < MAX_LSM_COUNT; scall++) \
501	if (static_key_enabled(&scall->active->key))
502
503	/* Security operations */
504
505	/**
506	* security_binder_set_context_mgr() - Check if becoming binder ctx mgr is ok
507	* @mgr: task credentials of current binder process
508	*
509	* Check whether @mgr is allowed to be the binder context manager.
510	*
511	* Return: Return 0 if permission is granted.
512	*/
513	int security_binder_set_context_mgr(const struct cred *mgr)
514	{
515	return call_int_hook(binder_set_context_mgr, mgr);
516	}
517
518	/**
519	* security_binder_transaction() - Check if a binder transaction is allowed
520	* @from: sending process
521	* @to: receiving process
522	*
523	* Check whether @from is allowed to invoke a binder transaction call to @to.
524	*
525	* Return: Returns 0 if permission is granted.
526	*/
527	int security_binder_transaction(const struct cred *from,
528	const struct cred *to)
529	{
530	return call_int_hook(binder_transaction, from, to);
531	}
532
533	/**
534	* security_binder_transfer_binder() - Check if a binder transfer is allowed
535	* @from: sending process
536	* @to: receiving process
537	*
538	* Check whether @from is allowed to transfer a binder reference to @to.
539	*
540	* Return: Returns 0 if permission is granted.
541	*/
542	int security_binder_transfer_binder(const struct cred *from,
543	const struct cred *to)
544	{
545	return call_int_hook(binder_transfer_binder, from, to);
546	}
547
548	/**
549	* security_binder_transfer_file() - Check if a binder file xfer is allowed
550	* @from: sending process
551	* @to: receiving process
552	* @file: file being transferred
553	*
554	* Check whether @from is allowed to transfer @file to @to.
555	*
556	* Return: Returns 0 if permission is granted.
557	*/
558	int security_binder_transfer_file(const struct cred *from,
559	const struct cred to, const struct file file)
560	{
561	return call_int_hook(binder_transfer_file, from, to, file);
562	}
563
564	/**
565	* security_ptrace_access_check() - Check if tracing is allowed
566	* @child: target process
567	* @mode: PTRACE_MODE flags
568	*
569	* Check permission before allowing the current process to trace the @child
570	* process. Security modules may also want to perform a process tracing check
571	* during an execve in the set_security or apply_creds hooks of tracing check
572	* during an execve in the bprm_set_creds hook of binprm_security_ops if the
573	* process is being traced and its security attributes would be changed by the
574	* execve.
575	*
576	* Return: Returns 0 if permission is granted.
577	*/
578	int security_ptrace_access_check(struct task_struct *child, unsigned int mode)
579	{
580	return call_int_hook(ptrace_access_check, child, mode);
581	}
582
583	/**
584	* security_ptrace_traceme() - Check if tracing is allowed
585	* @parent: tracing process
586	*
587	* Check that the @parent process has sufficient permission to trace the
588	* current process before allowing the current process to present itself to the
589	* @parent process for tracing.
590	*
591	* Return: Returns 0 if permission is granted.
592	*/
593	int security_ptrace_traceme(struct task_struct *parent)
594	{
595	return call_int_hook(ptrace_traceme, parent);
596	}
597
598	/**
599	* security_capget() - Get the capability sets for a process
600	* @target: target process
601	* @effective: effective capability set
602	* @inheritable: inheritable capability set
603	* @permitted: permitted capability set
604	*
605	* Get the @effective, @inheritable, and @permitted capability sets for the
606	* @target process. The hook may also perform permission checking to determine
607	* if the current process is allowed to see the capability sets of the @target
608	* process.
609	*
610	* Return: Returns 0 if the capability sets were successfully obtained.
611	*/
612	int security_capget(const struct task_struct *target,
613	kernel_cap_t *effective,
614	kernel_cap_t *inheritable,
615	kernel_cap_t *permitted)
616	{
617	return call_int_hook(capget, target, effective, inheritable, permitted);
618	}
619
620	/**
621	* security_capset() - Set the capability sets for a process
622	* @new: new credentials for the target process
623	* @old: current credentials of the target process
624	* @effective: effective capability set
625	* @inheritable: inheritable capability set
626	* @permitted: permitted capability set
627	*
628	* Set the @effective, @inheritable, and @permitted capability sets for the
629	* current process.
630	*
631	* Return: Returns 0 and update @new if permission is granted.
632	*/
633	int security_capset(struct cred new, const struct cred old,
634	const kernel_cap_t *effective,
635	const kernel_cap_t *inheritable,
636	const kernel_cap_t *permitted)
637	{
638	return call_int_hook(capset, new, old, effective, inheritable,
639	permitted);
640	}
641
642	/**
643	* security_capable() - Check if a process has the necessary capability
644	* @cred: credentials to examine
645	* @ns: user namespace
646	* @cap: capability requested
647	* @opts: capability check options
648	*
649	* Check whether the @tsk process has the @cap capability in the indicated
650	* credentials. @cap contains the capability <include/linux/capability.h>.
651	* @opts contains options for the capable check <include/linux/security.h>.
652	*
653	* Return: Returns 0 if the capability is granted.
654	*/
655	int security_capable(const struct cred *cred,
656	struct user_namespace *ns,
657	int cap,
658	unsigned int opts)
659	{
660	return call_int_hook(capable, cred, ns, cap, opts);
661	}
662
663	/**
664	* security_quotactl() - Check if a quotactl() syscall is allowed for this fs
665	* @cmds: commands
666	* @type: type
667	* @id: id
668	* @sb: filesystem
669	*
670	* Check whether the quotactl syscall is allowed for this @sb.
671	*
672	* Return: Returns 0 if permission is granted.
673	*/
674	int security_quotactl(int cmds, int type, int id, const struct super_block *sb)
675	{
676	return call_int_hook(quotactl, cmds, type, id, sb);
677	}
678
679	/**
680	* security_quota_on() - Check if QUOTAON is allowed for a dentry
681	* @dentry: dentry
682	*
683	* Check whether QUOTAON is allowed for @dentry.
684	*
685	* Return: Returns 0 if permission is granted.
686	*/
687	int security_quota_on(struct dentry *dentry)
688	{
689	return call_int_hook(quota_on, dentry);
690	}
691
692	/**
693	* security_syslog() - Check if accessing the kernel message ring is allowed
694	* @type: SYSLOG_ACTION_* type
695	*
696	* Check permission before accessing the kernel message ring or changing
697	* logging to the console. See the syslog(2) manual page for an explanation of
698	* the @type values.
699	*
700	* Return: Return 0 if permission is granted.
701	*/
702	int security_syslog(int type)
703	{
704	return call_int_hook(syslog, type);
705	}
706
707	/**
708	* security_settime64() - Check if changing the system time is allowed
709	* @ts: new time
710	* @tz: timezone
711	*
712	* Check permission to change the system time, struct timespec64 is defined in
713	* <include/linux/time64.h> and timezone is defined in <include/linux/time.h>.
714	*
715	* Return: Returns 0 if permission is granted.
716	*/
717	int security_settime64(const struct timespec64 ts, const struct timezone tz)
718	{
719	return call_int_hook(settime, ts, tz);
720	}
721
722	/**
723	* security_vm_enough_memory_mm() - Check if allocating a new mem map is allowed
724	* @mm: mm struct
725	* @pages: number of pages
726	*
727	* Check permissions for allocating a new virtual mapping. If all LSMs return
728	* a positive value, __vm_enough_memory() will be called with cap_sys_admin
729	* set. If at least one LSM returns 0 or negative, __vm_enough_memory() will be
730	* called with cap_sys_admin cleared.
731	*
732	* Return: Returns 0 if permission is granted by the LSM infrastructure to the
733	* caller.
734	*/
735	int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
736	{
737	struct lsm_static_call *scall;
738	int cap_sys_admin = 1;
739	int rc;
740
741	/*
742	* The module will respond with 0 if it thinks the __vm_enough_memory()
743	* call should be made with the cap_sys_admin set. If all of the modules
744	* agree that it should be set it will. If any module thinks it should
745	* not be set it won't.
746	*/
747	lsm_for_each_hook(scall, vm_enough_memory) {
748	rc = scall->hl->hook.vm_enough_memory(mm, pages);
749	if (rc < 0) {
750	cap_sys_admin = 0;
751	break;
752	}
753	}
754	return __vm_enough_memory(mm, pages, cap_sys_admin);
755	}
756
757	/**
758	* security_bprm_creds_for_exec() - Prepare the credentials for exec()
759	* @bprm: binary program information
760	*
761	* If the setup in prepare_exec_creds did not setup @bprm->cred->security
762	* properly for executing @bprm->file, update the LSM's portion of
763	* @bprm->cred->security to be what commit_creds needs to install for the new
764	* program. This hook may also optionally check permissions (e.g. for
765	* transitions between security domains). The hook must set @bprm->secureexec
766	* to 1 if AT_SECURE should be set to request libc enable secure mode. @bprm
767	* contains the linux_binprm structure.
768	*
769	* If execveat(2) is called with the AT_EXECVE_CHECK flag, bprm->is_check is
770	* set. The result must be the same as without this flag even if the execution
771	* will never really happen and @bprm will always be dropped.
772	*
773	* This hook must not change current->cred, only @bprm->cred.
774	*
775	* Return: Returns 0 if the hook is successful and permission is granted.
776	*/
777	int security_bprm_creds_for_exec(struct linux_binprm *bprm)
778	{
779	return call_int_hook(bprm_creds_for_exec, bprm);
780	}
781
782	/**
783	* security_bprm_creds_from_file() - Update linux_binprm creds based on file
784	* @bprm: binary program information
785	* @file: associated file
786	*
787	* If @file is setpcap, suid, sgid or otherwise marked to change privilege upon
788	* exec, update @bprm->cred to reflect that change. This is called after
789	* finding the binary that will be executed without an interpreter. This
790	* ensures that the credentials will not be derived from a script that the
791	* binary will need to reopen, which when reopend may end up being a completely
792	* different file. This hook may also optionally check permissions (e.g. for
793	* transitions between security domains). The hook must set @bprm->secureexec
794	* to 1 if AT_SECURE should be set to request libc enable secure mode. The
795	* hook must add to @bprm->per_clear any personality flags that should be
796	* cleared from current->personality. @bprm contains the linux_binprm
797	* structure.
798	*
799	* Return: Returns 0 if the hook is successful and permission is granted.
800	*/
801	int security_bprm_creds_from_file(struct linux_binprm bprm, const struct file file)
802	{
803	return call_int_hook(bprm_creds_from_file, bprm, file);
804	}
805
806	/**
807	* security_bprm_check() - Mediate binary handler search
808	* @bprm: binary program information
809	*
810	* This hook mediates the point when a search for a binary handler will begin.
811	* It allows a check against the @bprm->cred->security value which was set in
812	* the preceding creds_for_exec call. The argv list and envp list are reliably
813	* available in @bprm. This hook may be called multiple times during a single
814	* execve. @bprm contains the linux_binprm structure.
815	*
816	* Return: Returns 0 if the hook is successful and permission is granted.
817	*/
818	int security_bprm_check(struct linux_binprm *bprm)
819	{
820	return call_int_hook(bprm_check_security, bprm);
821	}
822
823	/**
824	* security_bprm_committing_creds() - Install creds for a process during exec()
825	* @bprm: binary program information
826	*
827	* Prepare to install the new security attributes of a process being
828	* transformed by an execve operation, based on the old credentials pointed to
829	* by @current->cred and the information set in @bprm->cred by the
830	* bprm_creds_for_exec hook. @bprm points to the linux_binprm structure. This
831	* hook is a good place to perform state changes on the process such as closing
832	* open file descriptors to which access will no longer be granted when the
833	* attributes are changed. This is called immediately before commit_creds().
834	*/
835	void security_bprm_committing_creds(const struct linux_binprm *bprm)
836	{
837	call_void_hook(bprm_committing_creds, bprm);
838	}
839
840	/**
841	* security_bprm_committed_creds() - Tidy up after cred install during exec()
842	* @bprm: binary program information
843	*
844	* Tidy up after the installation of the new security attributes of a process
845	* being transformed by an execve operation. The new credentials have, by this
846	* point, been set to @current->cred. @bprm points to the linux_binprm
847	* structure. This hook is a good place to perform state changes on the
848	* process such as clearing out non-inheritable signal state. This is called
849	* immediately after commit_creds().
850	*/
851	void security_bprm_committed_creds(const struct linux_binprm *bprm)
852	{
853	call_void_hook(bprm_committed_creds, bprm);
854	}
855
856	/**
857	* security_fs_context_submount() - Initialise fc->security
858	* @fc: new filesystem context
859	* @reference: dentry reference for submount/remount
860	*
861	* Fill out the ->security field for a new fs_context.
862	*
863	* Return: Returns 0 on success or negative error code on failure.
864	*/
865	int security_fs_context_submount(struct fs_context fc, struct super_block reference)
866	{
867	return call_int_hook(fs_context_submount, fc, reference);
868	}
869
870	/**
871	* security_fs_context_dup() - Duplicate a fs_context LSM blob
872	* @fc: destination filesystem context
873	* @src_fc: source filesystem context
874	*
875	* Allocate and attach a security structure to sc->security. This pointer is
876	* initialised to NULL by the caller. @fc indicates the new filesystem context.
877	* @src_fc indicates the original filesystem context.
878	*
879	* Return: Returns 0 on success or a negative error code on failure.
880	*/
881	int security_fs_context_dup(struct fs_context fc, struct fs_context src_fc)
882	{
883	return call_int_hook(fs_context_dup, fc, src_fc);
884	}
885
886	/**
887	* security_fs_context_parse_param() - Configure a filesystem context
888	* @fc: filesystem context
889	* @param: filesystem parameter
890	*
891	* Userspace provided a parameter to configure a superblock. The LSM can
892	* consume the parameter or return it to the caller for use elsewhere.
893	*
894	* Return: If the parameter is used by the LSM it should return 0, if it is
895	* returned to the caller -ENOPARAM is returned, otherwise a negative
896	* error code is returned.
897	*/
898	int security_fs_context_parse_param(struct fs_context *fc,
899	struct fs_parameter *param)
900	{
901	struct lsm_static_call *scall;
902	int trc;
903	int rc = -ENOPARAM;
904
905	lsm_for_each_hook(scall, fs_context_parse_param) {
906	trc = scall->hl->hook.fs_context_parse_param(fc, param);
907	if (trc == 0)
908	rc = 0;
909	else if (trc != -ENOPARAM)
910	return trc;
911	}
912	return rc;
913	}
914
915	/**
916	* security_sb_alloc() - Allocate a super_block LSM blob
917	* @sb: filesystem superblock
918	*
919	* Allocate and attach a security structure to the sb->s_security field. The
920	* s_security field is initialized to NULL when the structure is allocated.
921	* @sb contains the super_block structure to be modified.
922	*
923	* Return: Returns 0 if operation was successful.
924	*/
925	int security_sb_alloc(struct super_block *sb)
926	{
927	int rc = lsm_superblock_alloc(sb);
928
929	if (unlikely(rc))
930	return rc;
931	rc = call_int_hook(sb_alloc_security, sb);
932	if (unlikely(rc))
933	security_sb_free(sb);
934	return rc;
935	}
936
937	/**
938	* security_sb_delete() - Release super_block LSM associated objects
939	* @sb: filesystem superblock
940	*
941	* Release objects tied to a superblock (e.g. inodes). @sb contains the
942	* super_block structure being released.
943	*/
944	void security_sb_delete(struct super_block *sb)
945	{
946	call_void_hook(sb_delete, sb);
947	}
948
949	/**
950	* security_sb_free() - Free a super_block LSM blob
951	* @sb: filesystem superblock
952	*
953	* Deallocate and clear the sb->s_security field. @sb contains the super_block
954	* structure to be modified.
955	*/
956	void security_sb_free(struct super_block *sb)
957	{
958	call_void_hook(sb_free_security, sb);
959	kfree(sb->s_security);
960	sb->s_security = NULL;
961	}
962
963	/**
964	* security_free_mnt_opts() - Free memory associated with mount options
965	* @mnt_opts: LSM processed mount options
966	*
967	* Free memory associated with @mnt_ops.
968	*/
969	void security_free_mnt_opts(void **mnt_opts)
970	{
971	if (!*mnt_opts)
972	return;
973	call_void_hook(sb_free_mnt_opts, *mnt_opts);
974	*mnt_opts = NULL;
975	}
976	EXPORT_SYMBOL(security_free_mnt_opts);
977
978	/**
979	* security_sb_eat_lsm_opts() - Consume LSM mount options
980	* @options: mount options
981	* @mnt_opts: LSM processed mount options
982	*
983	* Eat (scan @options) and save them in @mnt_opts.
984	*
985	* Return: Returns 0 on success, negative values on failure.
986	*/
987	int security_sb_eat_lsm_opts(char options, void *mnt_opts)
988	{
989	return call_int_hook(sb_eat_lsm_opts, options, mnt_opts);
990	}
991	EXPORT_SYMBOL(security_sb_eat_lsm_opts);
992
993	/**
994	* security_sb_mnt_opts_compat() - Check if new mount options are allowed
995	* @sb: filesystem superblock
996	* @mnt_opts: new mount options
997	*
998	* Determine if the new mount options in @mnt_opts are allowed given the
999	* existing mounted filesystem at @sb. @sb superblock being compared.
1000	*
1001	* Return: Returns 0 if options are compatible.
1002	*/
1003	int security_sb_mnt_opts_compat(struct super_block *sb,
1004	void *mnt_opts)
1005	{
1006	return call_int_hook(sb_mnt_opts_compat, sb, mnt_opts);
1007	}
1008	EXPORT_SYMBOL(security_sb_mnt_opts_compat);
1009
1010	/**
1011	* security_sb_remount() - Verify no incompatible mount changes during remount
1012	* @sb: filesystem superblock
1013	* @mnt_opts: (re)mount options
1014	*
1015	* Extracts security system specific mount options and verifies no changes are
1016	* being made to those options.
1017	*
1018	* Return: Returns 0 if permission is granted.
1019	*/
1020	int security_sb_remount(struct super_block *sb,
1021	void *mnt_opts)
1022	{
1023	return call_int_hook(sb_remount, sb, mnt_opts);
1024	}
1025	EXPORT_SYMBOL(security_sb_remount);
1026
1027	/**
1028	* security_sb_kern_mount() - Check if a kernel mount is allowed
1029	* @sb: filesystem superblock
1030	*
1031	* Mount this @sb if allowed by permissions.
1032	*
1033	* Return: Returns 0 if permission is granted.
1034	*/
1035	int security_sb_kern_mount(const struct super_block *sb)
1036	{
1037	return call_int_hook(sb_kern_mount, sb);
1038	}
1039
1040	/**
1041	* security_sb_show_options() - Output the mount options for a superblock
1042	* @m: output file
1043	* @sb: filesystem superblock
1044	*
1045	* Show (print on @m) mount options for this @sb.
1046	*
1047	* Return: Returns 0 on success, negative values on failure.
1048	*/
1049	int security_sb_show_options(struct seq_file m, struct super_block sb)
1050	{
1051	return call_int_hook(sb_show_options, m, sb);
1052	}
1053
1054	/**
1055	* security_sb_statfs() - Check if accessing fs stats is allowed
1056	* @dentry: superblock handle
1057	*
1058	* Check permission before obtaining filesystem statistics for the @mnt
1059	* mountpoint. @dentry is a handle on the superblock for the filesystem.
1060	*
1061	* Return: Returns 0 if permission is granted.
1062	*/
1063	int security_sb_statfs(struct dentry *dentry)
1064	{
1065	return call_int_hook(sb_statfs, dentry);
1066	}
1067
1068	/**
1069	* security_sb_mount() - Check permission for mounting a filesystem
1070	* @dev_name: filesystem backing device
1071	* @path: mount point
1072	* @type: filesystem type
1073	* @flags: mount flags
1074	* @data: filesystem specific data
1075	*
1076	* Check permission before an object specified by @dev_name is mounted on the
1077	* mount point named by @nd. For an ordinary mount, @dev_name identifies a
1078	* device if the file system type requires a device. For a remount
1079	* (@flags & MS_REMOUNT), @dev_name is irrelevant. For a loopback/bind mount
1080	* (@flags & MS_BIND), @dev_name identifies the pathname of the object being
1081	* mounted.
1082	*
1083	* Return: Returns 0 if permission is granted.
1084	*/
1085	int security_sb_mount(const char dev_name, const struct path path,
1086	const char type, unsigned long flags, void data)
1087	{
1088	return call_int_hook(sb_mount, dev_name, path, type, flags, data);
1089	}
1090
1091	/**
1092	* security_sb_umount() - Check permission for unmounting a filesystem
1093	* @mnt: mounted filesystem
1094	* @flags: unmount flags
1095	*
1096	* Check permission before the @mnt file system is unmounted.
1097	*
1098	* Return: Returns 0 if permission is granted.
1099	*/
1100	int security_sb_umount(struct vfsmount *mnt, int flags)
1101	{
1102	return call_int_hook(sb_umount, mnt, flags);
1103	}
1104
1105	/**
1106	* security_sb_pivotroot() - Check permissions for pivoting the rootfs
1107	* @old_path: new location for current rootfs
1108	* @new_path: location of the new rootfs
1109	*
1110	* Check permission before pivoting the root filesystem.
1111	*
1112	* Return: Returns 0 if permission is granted.
1113	*/
1114	int security_sb_pivotroot(const struct path *old_path,
1115	const struct path *new_path)
1116	{
1117	return call_int_hook(sb_pivotroot, old_path, new_path);
1118	}
1119
1120	/**
1121	* security_sb_set_mnt_opts() - Set the mount options for a filesystem
1122	* @sb: filesystem superblock
1123	* @mnt_opts: binary mount options
1124	* @kern_flags: kernel flags (in)
1125	* @set_kern_flags: kernel flags (out)
1126	*
1127	* Set the security relevant mount options used for a superblock.
1128	*
1129	* Return: Returns 0 on success, error on failure.
1130	*/
1131	int security_sb_set_mnt_opts(struct super_block *sb,
1132	void *mnt_opts,
1133	unsigned long kern_flags,
1134	unsigned long *set_kern_flags)
1135	{
1136	struct lsm_static_call *scall;
1137	int rc = mnt_opts ? -EOPNOTSUPP : LSM_RET_DEFAULT(sb_set_mnt_opts);
1138
1139	lsm_for_each_hook(scall, sb_set_mnt_opts) {
1140	rc = scall->hl->hook.sb_set_mnt_opts(sb, mnt_opts, kern_flags,
1141	set_kern_flags);
1142	if (rc != LSM_RET_DEFAULT(sb_set_mnt_opts))
1143	break;
1144	}
1145	return rc;
1146	}
1147	EXPORT_SYMBOL(security_sb_set_mnt_opts);
1148
1149	/**
1150	* security_sb_clone_mnt_opts() - Duplicate superblock mount options
1151	* @oldsb: source superblock
1152	* @newsb: destination superblock
1153	* @kern_flags: kernel flags (in)
1154	* @set_kern_flags: kernel flags (out)
1155	*
1156	* Copy all security options from a given superblock to another.
1157	*
1158	* Return: Returns 0 on success, error on failure.
1159	*/
1160	int security_sb_clone_mnt_opts(const struct super_block *oldsb,
1161	struct super_block *newsb,
1162	unsigned long kern_flags,
1163	unsigned long *set_kern_flags)
1164	{
1165	return call_int_hook(sb_clone_mnt_opts, oldsb, newsb,
1166	kern_flags, set_kern_flags);
1167	}
1168	EXPORT_SYMBOL(security_sb_clone_mnt_opts);
1169
1170	/**
1171	* security_move_mount() - Check permissions for moving a mount
1172	* @from_path: source mount point
1173	* @to_path: destination mount point
1174	*
1175	* Check permission before a mount is moved.
1176	*
1177	* Return: Returns 0 if permission is granted.
1178	*/
1179	int security_move_mount(const struct path *from_path,
1180	const struct path *to_path)
1181	{
1182	return call_int_hook(move_mount, from_path, to_path);
1183	}
1184
1185	/**
1186	* security_path_notify() - Check if setting a watch is allowed
1187	* @path: file path
1188	* @mask: event mask
1189	* @obj_type: file path type
1190	*
1191	* Check permissions before setting a watch on events as defined by @mask, on
1192	* an object at @path, whose type is defined by @obj_type.
1193	*
1194	* Return: Returns 0 if permission is granted.
1195	*/
1196	int security_path_notify(const struct path *path, u64 mask,
1197	unsigned int obj_type)
1198	{
1199	return call_int_hook(path_notify, path, mask, obj_type);
1200	}
1201
1202	/**
1203	* security_inode_alloc() - Allocate an inode LSM blob
1204	* @inode: the inode
1205	* @gfp: allocation flags
1206	*
1207	* Allocate and attach a security structure to @inode->i_security. The
1208	* i_security field is initialized to NULL when the inode structure is
1209	* allocated.
1210	*
1211	* Return: Return 0 if operation was successful.
1212	*/
1213	int security_inode_alloc(struct inode *inode, gfp_t gfp)
1214	{
1215	int rc = lsm_inode_alloc(inode, gfp);
1216
1217	if (unlikely(rc))
1218	return rc;
1219	rc = call_int_hook(inode_alloc_security, inode);
1220	if (unlikely(rc))
1221	security_inode_free(inode);
1222	return rc;
1223	}
1224
1225	static void inode_free_by_rcu(struct rcu_head *head)
1226	{
1227	/* The rcu head is at the start of the inode blob */
1228	call_void_hook(inode_free_security_rcu, head);
1229	kmem_cache_free(lsm_inode_cache, head);
1230	}
1231
1232	/**
1233	* security_inode_free() - Free an inode's LSM blob
1234	* @inode: the inode
1235	*
1236	* Release any LSM resources associated with @inode, although due to the
1237	* inode's RCU protections it is possible that the resources will not be
1238	* fully released until after the current RCU grace period has elapsed.
1239	*
1240	* It is important for LSMs to note that despite being present in a call to
1241	* security_inode_free(), @inode may still be referenced in a VFS path walk
1242	* and calls to security_inode_permission() may be made during, or after,
1243	* a call to security_inode_free(). For this reason the inode->i_security
1244	* field is released via a call_rcu() callback and any LSMs which need to
1245	* retain inode state for use in security_inode_permission() should only
1246	* release that state in the inode_free_security_rcu() LSM hook callback.
1247	*/
1248	void security_inode_free(struct inode *inode)
1249	{
1250	call_void_hook(inode_free_security, inode);
1251	if (!inode->i_security)
1252	return;
1253	call_rcu((struct rcu_head *)inode->i_security, inode_free_by_rcu);
1254	}
1255
1256	/**
1257	* security_dentry_init_security() - Perform dentry initialization
1258	* @dentry: the dentry to initialize
1259	* @mode: mode used to determine resource type
1260	* @name: name of the last path component
1261	* @xattr_name: name of the security/LSM xattr
1262	* @lsmctx: pointer to the resulting LSM context
1263	*
1264	* Compute a context for a dentry as the inode is not yet available since NFSv4
1265	* has no label backed by an EA anyway. It is important to note that
1266	* @xattr_name does not need to be free'd by the caller, it is a static string.
1267	*
1268	* Return: Returns 0 on success, negative values on failure.
1269	*/
1270	int security_dentry_init_security(struct dentry *dentry, int mode,
1271	const struct qstr *name,
1272	const char **xattr_name,
1273	struct lsm_context *lsmctx)
1274	{
1275	return call_int_hook(dentry_init_security, dentry, mode, name,
1276	xattr_name, lsmctx);
1277	}
1278	EXPORT_SYMBOL(security_dentry_init_security);
1279
1280	/**
1281	* security_dentry_create_files_as() - Perform dentry initialization
1282	* @dentry: the dentry to initialize
1283	* @mode: mode used to determine resource type
1284	* @name: name of the last path component
1285	* @old: creds to use for LSM context calculations
1286	* @new: creds to modify
1287	*
1288	* Compute a context for a dentry as the inode is not yet available and set
1289	* that context in passed in creds so that new files are created using that
1290	* context. Context is calculated using the passed in creds and not the creds
1291	* of the caller.
1292	*
1293	* Return: Returns 0 on success, error on failure.
1294	*/
1295	int security_dentry_create_files_as(struct dentry *dentry, int mode,
1296	const struct qstr *name,
1297	const struct cred old, struct cred new)
1298	{
1299	return call_int_hook(dentry_create_files_as, dentry, mode,
1300	name, old, new);
1301	}
1302	EXPORT_SYMBOL(security_dentry_create_files_as);
1303
1304	/**
1305	* security_inode_init_security() - Initialize an inode's LSM context
1306	* @inode: the inode
1307	* @dir: parent directory
1308	* @qstr: last component of the pathname
1309	* @initxattrs: callback function to write xattrs
1310	* @fs_data: filesystem specific data
1311	*
1312	* Obtain the security attribute name suffix and value to set on a newly
1313	* created inode and set up the incore security field for the new inode. This
1314	* hook is called by the fs code as part of the inode creation transaction and
1315	* provides for atomic labeling of the inode, unlike the post_create/mkdir/...
1316	* hooks called by the VFS.
1317	*
1318	* The hook function is expected to populate the xattrs array, by calling
1319	* lsm_get_xattr_slot() to retrieve the slots reserved by the security module
1320	* with the lbs_xattr_count field of the lsm_blob_sizes structure. For each
1321	* slot, the hook function should set ->name to the attribute name suffix
1322	* (e.g. selinux), to allocate ->value (will be freed by the caller) and set it
1323	* to the attribute value, to set ->value_len to the length of the value. If
1324	* the security module does not use security attributes or does not wish to put
1325	* a security attribute on this particular inode, then it should return
1326	* -EOPNOTSUPP to skip this processing.
1327	*
1328	* Return: Returns 0 if the LSM successfully initialized all of the inode
1329	* security attributes that are required, negative values otherwise.
1330	*/
1331	int security_inode_init_security(struct inode inode, struct inode dir,
1332	const struct qstr *qstr,
1333	const initxattrs initxattrs, void *fs_data)
1334	{
1335	struct lsm_static_call *scall;
1336	struct xattr *new_xattrs = NULL;
1337	int ret = -EOPNOTSUPP, xattr_count = 0;
1338
1339	if (unlikely(IS_PRIVATE(inode)))
1340	return 0;
1341
1342	if (!blob_sizes.lbs_xattr_count)
1343	return 0;
1344
1345	if (initxattrs) {
1346	/* Allocate +1 as terminator. */
1347	new_xattrs = kcalloc(blob_sizes.lbs_xattr_count + 1,
1348	sizeof(*new_xattrs), GFP_NOFS);
1349	if (!new_xattrs)
1350	return -ENOMEM;
1351	}
1352
1353	lsm_for_each_hook(scall, inode_init_security) {
1354	ret = scall->hl->hook.inode_init_security(inode, dir, qstr, new_xattrs,
1355	&xattr_count);
1356	if (ret && ret != -EOPNOTSUPP)
1357	goto out;
1358	/*
1359	* As documented in lsm_hooks.h, -EOPNOTSUPP in this context
1360	* means that the LSM is not willing to provide an xattr, not
1361	* that it wants to signal an error. Thus, continue to invoke
1362	* the remaining LSMs.
1363	*/
1364	}
1365
1366	/* If initxattrs() is NULL, xattr_count is zero, skip the call. */
1367	if (!xattr_count)
1368	goto out;
1369
1370	ret = initxattrs(inode, new_xattrs, fs_data);
1371	out:
1372	for (; xattr_count > 0; xattr_count--)
1373	kfree(new_xattrs[xattr_count - 1].value);
1374	kfree(new_xattrs);
1375	return (ret == -EOPNOTSUPP) ? 0 : ret;
1376	}
1377	EXPORT_SYMBOL(security_inode_init_security);
1378
1379	/**
1380	* security_inode_init_security_anon() - Initialize an anonymous inode
1381	* @inode: the inode
1382	* @name: the anonymous inode class
1383	* @context_inode: an optional related inode
1384	*
1385	* Set up the incore security field for the new anonymous inode and return
1386	* whether the inode creation is permitted by the security module or not.
1387	*
1388	* Return: Returns 0 on success, -EACCES if the security module denies the
1389	* creation of this inode, or another -errno upon other errors.
1390	*/
1391	int security_inode_init_security_anon(struct inode *inode,
1392	const struct qstr *name,
1393	const struct inode *context_inode)
1394	{
1395	return call_int_hook(inode_init_security_anon, inode, name,
1396	context_inode);
1397	}
1398
1399	#ifdef CONFIG_SECURITY_PATH
1400	/**
1401	* security_path_mknod() - Check if creating a special file is allowed
1402	* @dir: parent directory
1403	* @dentry: new file
1404	* @mode: new file mode
1405	* @dev: device number
1406	*
1407	* Check permissions when creating a file. Note that this hook is called even
1408	* if mknod operation is being done for a regular file.
1409	*
1410	* Return: Returns 0 if permission is granted.
1411	*/
1412	int security_path_mknod(const struct path dir, struct dentry dentry,
1413	umode_t mode, unsigned int dev)
1414	{
1415	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
1416	return 0;
1417	return call_int_hook(path_mknod, dir, dentry, mode, dev);
1418	}
1419	EXPORT_SYMBOL(security_path_mknod);
1420
1421	/**
1422	* security_path_post_mknod() - Update inode security after reg file creation
1423	* @idmap: idmap of the mount
1424	* @dentry: new file
1425	*
1426	* Update inode security field after a regular file has been created.
1427	*/
1428	void security_path_post_mknod(const struct mnt_idmap idmap, struct dentry dentry)
1429	{
1430	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
1431	return;
1432	call_void_hook(path_post_mknod, idmap, dentry);
1433	}
1434
1435	/**
1436	* security_path_mkdir() - Check if creating a new directory is allowed
1437	* @dir: parent directory
1438	* @dentry: new directory
1439	* @mode: new directory mode
1440	*
1441	* Check permissions to create a new directory in the existing directory.
1442	*
1443	* Return: Returns 0 if permission is granted.
1444	*/
1445	int security_path_mkdir(const struct path dir, struct dentry dentry,
1446	umode_t mode)
1447	{
1448	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
1449	return 0;
1450	return call_int_hook(path_mkdir, dir, dentry, mode);
1451	}
1452	EXPORT_SYMBOL(security_path_mkdir);
1453
1454	/**
1455	* security_path_rmdir() - Check if removing a directory is allowed
1456	* @dir: parent directory
1457	* @dentry: directory to remove
1458	*
1459	* Check the permission to remove a directory.
1460	*
1461	* Return: Returns 0 if permission is granted.
1462	*/
1463	int security_path_rmdir(const struct path dir, struct dentry dentry)
1464	{
1465	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
1466	return 0;
1467	return call_int_hook(path_rmdir, dir, dentry);
1468	}
1469
1470	/**
1471	* security_path_unlink() - Check if removing a hard link is allowed
1472	* @dir: parent directory
1473	* @dentry: file
1474	*
1475	* Check the permission to remove a hard link to a file.
1476	*
1477	* Return: Returns 0 if permission is granted.
1478	*/
1479	int security_path_unlink(const struct path dir, struct dentry dentry)
1480	{
1481	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
1482	return 0;
1483	return call_int_hook(path_unlink, dir, dentry);
1484	}
1485	EXPORT_SYMBOL(security_path_unlink);
1486
1487	/**
1488	* security_path_symlink() - Check if creating a symbolic link is allowed
1489	* @dir: parent directory
1490	* @dentry: symbolic link
1491	* @old_name: file pathname
1492	*
1493	* Check the permission to create a symbolic link to a file.
1494	*
1495	* Return: Returns 0 if permission is granted.
1496	*/
1497	int security_path_symlink(const struct path dir, struct dentry dentry,
1498	const char *old_name)
1499	{
1500	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
1501	return 0;
1502	return call_int_hook(path_symlink, dir, dentry, old_name);
1503	}
1504
1505	/**
1506	* security_path_link - Check if creating a hard link is allowed
1507	* @old_dentry: existing file
1508	* @new_dir: new parent directory
1509	* @new_dentry: new link
1510	*
1511	* Check permission before creating a new hard link to a file.
1512	*
1513	* Return: Returns 0 if permission is granted.
1514	*/
1515	int security_path_link(struct dentry old_dentry, const struct path new_dir,
1516	struct dentry *new_dentry)
1517	{
1518	if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))
1519	return 0;
1520	return call_int_hook(path_link, old_dentry, new_dir, new_dentry);
1521	}
1522
1523	/**
1524	* security_path_rename() - Check if renaming a file is allowed
1525	* @old_dir: parent directory of the old file
1526	* @old_dentry: the old file
1527	* @new_dir: parent directory of the new file
1528	* @new_dentry: the new file
1529	* @flags: flags
1530	*
1531	* Check for permission to rename a file or directory.
1532	*
1533	* Return: Returns 0 if permission is granted.
1534	*/
1535	int security_path_rename(const struct path old_dir, struct dentry old_dentry,
1536	const struct path new_dir, struct dentry new_dentry,
1537	unsigned int flags)
1538	{
1539	if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry)) \|\|
1540	(d_is_positive(new_dentry) &&
1541	IS_PRIVATE(d_backing_inode(new_dentry)))))
1542	return 0;
1543
1544	return call_int_hook(path_rename, old_dir, old_dentry, new_dir,
1545	new_dentry, flags);
1546	}
1547	EXPORT_SYMBOL(security_path_rename);
1548
1549	/**
1550	* security_path_truncate() - Check if truncating a file is allowed
1551	* @path: file
1552	*
1553	* Check permission before truncating the file indicated by path. Note that
1554	* truncation permissions may also be checked based on already opened files,
1555	* using the security_file_truncate() hook.
1556	*
1557	* Return: Returns 0 if permission is granted.
1558	*/
1559	int security_path_truncate(const struct path *path)
1560	{
1561	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
1562	return 0;
1563	return call_int_hook(path_truncate, path);
1564	}
1565
1566	/**
1567	* security_path_chmod() - Check if changing the file's mode is allowed
1568	* @path: file
1569	* @mode: new mode
1570	*
1571	* Check for permission to change a mode of the file @path. The new mode is
1572	* specified in @mode which is a bitmask of constants from
1573	* <include/uapi/linux/stat.h>.
1574	*
1575	* Return: Returns 0 if permission is granted.
1576	*/
1577	int security_path_chmod(const struct path *path, umode_t mode)
1578	{
1579	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
1580	return 0;
1581	return call_int_hook(path_chmod, path, mode);
1582	}
1583
1584	/**
1585	* security_path_chown() - Check if changing the file's owner/group is allowed
1586	* @path: file
1587	* @uid: file owner
1588	* @gid: file group
1589	*
1590	* Check for permission to change owner/group of a file or directory.
1591	*
1592	* Return: Returns 0 if permission is granted.
1593	*/
1594	int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
1595	{
1596	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
1597	return 0;
1598	return call_int_hook(path_chown, path, uid, gid);
1599	}
1600
1601	/**
1602	* security_path_chroot() - Check if changing the root directory is allowed
1603	* @path: directory
1604	*
1605	* Check for permission to change root directory.
1606	*
1607	* Return: Returns 0 if permission is granted.
1608	*/
1609	int security_path_chroot(const struct path *path)
1610	{
1611	return call_int_hook(path_chroot, path);
1612	}
1613	#endif /* CONFIG_SECURITY_PATH */
1614
1615	/**
1616	* security_inode_create() - Check if creating a file is allowed
1617	* @dir: the parent directory
1618	* @dentry: the file being created
1619	* @mode: requested file mode
1620	*
1621	* Check permission to create a regular file.
1622	*
1623	* Return: Returns 0 if permission is granted.
1624	*/
1625	int security_inode_create(struct inode dir, struct dentry dentry,
1626	umode_t mode)
1627	{
1628	if (unlikely(IS_PRIVATE(dir)))
1629	return 0;
1630	return call_int_hook(inode_create, dir, dentry, mode);
1631	}
1632	EXPORT_SYMBOL_GPL(security_inode_create);
1633
1634	/**
1635	* security_inode_post_create_tmpfile() - Update inode security of new tmpfile
1636	* @idmap: idmap of the mount
1637	* @inode: inode of the new tmpfile
1638	*
1639	* Update inode security data after a tmpfile has been created.
1640	*/
1641	void security_inode_post_create_tmpfile(const struct mnt_idmap *idmap,
1642	struct inode *inode)
1643	{
1644	if (unlikely(IS_PRIVATE(inode)))
1645	return;
1646	call_void_hook(inode_post_create_tmpfile, idmap, inode);
1647	}
1648
1649	/**
1650	* security_inode_link() - Check if creating a hard link is allowed
1651	* @old_dentry: existing file
1652	* @dir: new parent directory
1653	* @new_dentry: new link
1654	*
1655	* Check permission before creating a new hard link to a file.
1656	*
1657	* Return: Returns 0 if permission is granted.
1658	*/
1659	int security_inode_link(struct dentry old_dentry, struct inode dir,
1660	struct dentry *new_dentry)
1661	{
1662	if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))
1663	return 0;
1664	return call_int_hook(inode_link, old_dentry, dir, new_dentry);
1665	}
1666
1667	/**
1668	* security_inode_unlink() - Check if removing a hard link is allowed
1669	* @dir: parent directory
1670	* @dentry: file
1671	*
1672	* Check the permission to remove a hard link to a file.
1673	*
1674	* Return: Returns 0 if permission is granted.
1675	*/
1676	int security_inode_unlink(struct inode dir, struct dentry dentry)
1677	{
1678	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
1679	return 0;
1680	return call_int_hook(inode_unlink, dir, dentry);
1681	}
1682
1683	/**
1684	* security_inode_symlink() - Check if creating a symbolic link is allowed
1685	* @dir: parent directory
1686	* @dentry: symbolic link
1687	* @old_name: existing filename
1688	*
1689	* Check the permission to create a symbolic link to a file.
1690	*
1691	* Return: Returns 0 if permission is granted.
1692	*/
1693	int security_inode_symlink(struct inode dir, struct dentry dentry,
1694	const char *old_name)
1695	{
1696	if (unlikely(IS_PRIVATE(dir)))
1697	return 0;
1698	return call_int_hook(inode_symlink, dir, dentry, old_name);
1699	}
1700
1701	/**
1702	* security_inode_mkdir() - Check if creating a new directory is allowed
1703	* @dir: parent directory
1704	* @dentry: new directory
1705	* @mode: new directory mode
1706	*
1707	* Check permissions to create a new directory in the existing directory
1708	* associated with inode structure @dir.
1709	*
1710	* Return: Returns 0 if permission is granted.
1711	*/
1712	int security_inode_mkdir(struct inode dir, struct dentry dentry, umode_t mode)
1713	{
1714	if (unlikely(IS_PRIVATE(dir)))
1715	return 0;
1716	return call_int_hook(inode_mkdir, dir, dentry, mode);
1717	}
1718	EXPORT_SYMBOL_GPL(security_inode_mkdir);
1719
1720	/**
1721	* security_inode_rmdir() - Check if removing a directory is allowed
1722	* @dir: parent directory
1723	* @dentry: directory to be removed
1724	*
1725	* Check the permission to remove a directory.
1726	*
1727	* Return: Returns 0 if permission is granted.
1728	*/
1729	int security_inode_rmdir(struct inode dir, struct dentry dentry)
1730	{
1731	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
1732	return 0;
1733	return call_int_hook(inode_rmdir, dir, dentry);
1734	}
1735
1736	/**
1737	* security_inode_mknod() - Check if creating a special file is allowed
1738	* @dir: parent directory
1739	* @dentry: new file
1740	* @mode: new file mode
1741	* @dev: device number
1742	*
1743	* Check permissions when creating a special file (or a socket or a fifo file
1744	* created via the mknod system call). Note that if mknod operation is being
1745	* done for a regular file, then the create hook will be called and not this
1746	* hook.
1747	*
1748	* Return: Returns 0 if permission is granted.
1749	*/
1750	int security_inode_mknod(struct inode dir, struct dentry dentry,
1751	umode_t mode, dev_t dev)
1752	{
1753	if (unlikely(IS_PRIVATE(dir)))
1754	return 0;
1755	return call_int_hook(inode_mknod, dir, dentry, mode, dev);
1756	}
1757
1758	/**
1759	* security_inode_rename() - Check if renaming a file is allowed
1760	* @old_dir: parent directory of the old file
1761	* @old_dentry: the old file
1762	* @new_dir: parent directory of the new file
1763	* @new_dentry: the new file
1764	* @flags: flags
1765	*
1766	* Check for permission to rename a file or directory.
1767	*
1768	* Return: Returns 0 if permission is granted.
1769	*/
1770	int security_inode_rename(struct inode old_dir, struct dentry old_dentry,
1771	struct inode new_dir, struct dentry new_dentry,
1772	unsigned int flags)
1773	{
1774	if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry)) \|\|
1775	(d_is_positive(new_dentry) &&
1776	IS_PRIVATE(d_backing_inode(new_dentry)))))
1777	return 0;
1778
1779	if (flags & RENAME_EXCHANGE) {
1780	int err = call_int_hook(inode_rename, new_dir, new_dentry,
1781	old_dir, old_dentry);
1782	if (err)
1783	return err;
1784	}
1785
1786	return call_int_hook(inode_rename, old_dir, old_dentry,
1787	new_dir, new_dentry);
1788	}
1789
1790	/**
1791	* security_inode_readlink() - Check if reading a symbolic link is allowed
1792	* @dentry: link
1793	*
1794	* Check the permission to read the symbolic link.
1795	*
1796	* Return: Returns 0 if permission is granted.
1797	*/
1798	int security_inode_readlink(struct dentry *dentry)
1799	{
1800	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
1801	return 0;
1802	return call_int_hook(inode_readlink, dentry);
1803	}
1804
1805	/**
1806	* security_inode_follow_link() - Check if following a symbolic link is allowed
1807	* @dentry: link dentry
1808	* @inode: link inode
1809	* @rcu: true if in RCU-walk mode
1810	*
1811	* Check permission to follow a symbolic link when looking up a pathname. If
1812	* @rcu is true, @inode is not stable.
1813	*
1814	* Return: Returns 0 if permission is granted.
1815	*/
1816	int security_inode_follow_link(struct dentry dentry, struct inode inode,
1817	bool rcu)
1818	{
1819	if (unlikely(IS_PRIVATE(inode)))
1820	return 0;
1821	return call_int_hook(inode_follow_link, dentry, inode, rcu);
1822	}
1823
1824	/**
1825	* security_inode_permission() - Check if accessing an inode is allowed
1826	* @inode: inode
1827	* @mask: access mask
1828	*
1829	* Check permission before accessing an inode. This hook is called by the
1830	* existing Linux permission function, so a security module can use it to
1831	* provide additional checking for existing Linux permission checks. Notice
1832	* that this hook is called when a file is opened (as well as many other
1833	* operations), whereas the file_security_ops permission hook is called when
1834	* the actual read/write operations are performed.
1835	*
1836	* Return: Returns 0 if permission is granted.
1837	*/
1838	int security_inode_permission(struct inode *inode, int mask)
1839	{
1840	if (unlikely(IS_PRIVATE(inode)))
1841	return 0;
1842	return call_int_hook(inode_permission, inode, mask);
1843	}
1844
1845	/**
1846	* security_inode_setattr() - Check if setting file attributes is allowed
1847	* @idmap: idmap of the mount
1848	* @dentry: file
1849	* @attr: new attributes
1850	*
1851	* Check permission before setting file attributes. Note that the kernel call
1852	* to notify_change is performed from several locations, whenever file
1853	* attributes change (such as when a file is truncated, chown/chmod operations,
1854	* transferring disk quotas, etc).
1855	*
1856	* Return: Returns 0 if permission is granted.
1857	*/
1858	int security_inode_setattr(const struct mnt_idmap *idmap,
1859	struct dentry dentry, struct iattr attr)
1860	{
1861	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
1862	return 0;
1863	return call_int_hook(inode_setattr, idmap, dentry, attr);
1864	}
1865	EXPORT_SYMBOL_GPL(security_inode_setattr);
1866
1867	/**
1868	* security_inode_post_setattr() - Update the inode after a setattr operation
1869	* @idmap: idmap of the mount
1870	* @dentry: file
1871	* @ia_valid: file attributes set
1872	*
1873	* Update inode security field after successful setting file attributes.
1874	*/
1875	void security_inode_post_setattr(const struct mnt_idmap idmap, struct dentry dentry,
1876	int ia_valid)
1877	{
1878	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
1879	return;
1880	call_void_hook(inode_post_setattr, idmap, dentry, ia_valid);
1881	}
1882
1883	/**
1884	* security_inode_getattr() - Check if getting file attributes is allowed
1885	* @path: file
1886	*
1887	* Check permission before obtaining file attributes.
1888	*
1889	* Return: Returns 0 if permission is granted.
1890	*/
1891	int security_inode_getattr(const struct path *path)
1892	{
1893	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
1894	return 0;
1895	return call_int_hook(inode_getattr, path);
1896	}
1897
1898	/**
1899	* security_inode_setxattr() - Check if setting file xattrs is allowed
1900	* @idmap: idmap of the mount
1901	* @dentry: file
1902	* @name: xattr name
1903	* @value: xattr value
1904	* @size: size of xattr value
1905	* @flags: flags
1906	*
1907	* This hook performs the desired permission checks before setting the extended
1908	* attributes (xattrs) on @dentry. It is important to note that we have some
1909	* additional logic before the main LSM implementation calls to detect if we
1910	* need to perform an additional capability check at the LSM layer.
1911	*
1912	* Normally we enforce a capability check prior to executing the various LSM
1913	* hook implementations, but if a LSM wants to avoid this capability check,
1914	* it can register a 'inode_xattr_skipcap' hook and return a value of 1 for
1915	* xattrs that it wants to avoid the capability check, leaving the LSM fully
1916	* responsible for enforcing the access control for the specific xattr. If all
1917	* of the enabled LSMs refrain from registering a 'inode_xattr_skipcap' hook,
1918	* or return a 0 (the default return value), the capability check is still
1919	* performed. If no 'inode_xattr_skipcap' hooks are registered the capability
1920	* check is performed.
1921	*
1922	* Return: Returns 0 if permission is granted.
1923	*/
1924	int security_inode_setxattr(const struct mnt_idmap *idmap,
1925	struct dentry dentry, const char name,
1926	const void *value, size_t size, int flags)
1927	{
1928	int rc;
1929
1930	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
1931	return 0;
1932
1933	/* enforce the capability checks at the lsm layer, if needed */
1934	if (!call_int_hook(inode_xattr_skipcap, name)) {
1935	rc = cap_inode_setxattr(dentry, name, value, size, flags);
1936	if (rc)
1937	return rc;
1938	}
1939
1940	return call_int_hook(inode_setxattr, idmap, dentry, name, value, size,
1941	flags);
1942	}
1943
1944	/**
1945	* security_inode_set_acl() - Check if setting posix acls is allowed
1946	* @idmap: idmap of the mount
1947	* @dentry: file
1948	* @acl_name: acl name
1949	* @kacl: acl struct
1950	*
1951	* Check permission before setting posix acls, the posix acls in @kacl are
1952	* identified by @acl_name.
1953	*
1954	* Return: Returns 0 if permission is granted.
1955	*/
1956	int security_inode_set_acl(const struct mnt_idmap *idmap,
1957	struct dentry dentry, const char acl_name,
1958	struct posix_acl *kacl)
1959	{
1960	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
1961	return 0;
1962	return call_int_hook(inode_set_acl, idmap, dentry, acl_name, kacl);
1963	}
1964
1965	/**
1966	* security_inode_post_set_acl() - Update inode security from posix acls set
1967	* @dentry: file
1968	* @acl_name: acl name
1969	* @kacl: acl struct
1970	*
1971	* Update inode security data after successfully setting posix acls on @dentry.
1972	* The posix acls in @kacl are identified by @acl_name.
1973	*/
1974	void security_inode_post_set_acl(struct dentry dentry, const char acl_name,
1975	struct posix_acl *kacl)
1976	{
1977	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
1978	return;
1979	call_void_hook(inode_post_set_acl, dentry, acl_name, kacl);
1980	}
1981
1982	/**
1983	* security_inode_get_acl() - Check if reading posix acls is allowed
1984	* @idmap: idmap of the mount
1985	* @dentry: file
1986	* @acl_name: acl name
1987	*
1988	* Check permission before getting osix acls, the posix acls are identified by
1989	* @acl_name.
1990	*
1991	* Return: Returns 0 if permission is granted.
1992	*/
1993	int security_inode_get_acl(const struct mnt_idmap *idmap,
1994	struct dentry dentry, const char acl_name)
1995	{
1996	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
1997	return 0;
1998	return call_int_hook(inode_get_acl, idmap, dentry, acl_name);
1999	}
2000
2001	/**
2002	* security_inode_remove_acl() - Check if removing a posix acl is allowed
2003	* @idmap: idmap of the mount
2004	* @dentry: file
2005	* @acl_name: acl name
2006	*
2007	* Check permission before removing posix acls, the posix acls are identified
2008	* by @acl_name.
2009	*
2010	* Return: Returns 0 if permission is granted.
2011	*/
2012	int security_inode_remove_acl(const struct mnt_idmap *idmap,
2013	struct dentry dentry, const char acl_name)
2014	{
2015	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2016	return 0;
2017	return call_int_hook(inode_remove_acl, idmap, dentry, acl_name);
2018	}
2019
2020	/**
2021	* security_inode_post_remove_acl() - Update inode security after rm posix acls
2022	* @idmap: idmap of the mount
2023	* @dentry: file
2024	* @acl_name: acl name
2025	*
2026	* Update inode security data after successfully removing posix acls on
2027	* @dentry in @idmap. The posix acls are identified by @acl_name.
2028	*/
2029	void security_inode_post_remove_acl(const struct mnt_idmap *idmap,
2030	struct dentry dentry, const char acl_name)
2031	{
2032	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2033	return;
2034	call_void_hook(inode_post_remove_acl, idmap, dentry, acl_name);
2035	}
2036
2037	/**
2038	* security_inode_post_setxattr() - Update the inode after a setxattr operation
2039	* @dentry: file
2040	* @name: xattr name
2041	* @value: xattr value
2042	* @size: xattr value size
2043	* @flags: flags
2044	*
2045	* Update inode security field after successful setxattr operation.
2046	*/
2047	void security_inode_post_setxattr(struct dentry dentry, const char name,
2048	const void *value, size_t size, int flags)
2049	{
2050	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2051	return;
2052	call_void_hook(inode_post_setxattr, dentry, name, value, size, flags);
2053	}
2054
2055	/**
2056	* security_inode_getxattr() - Check if xattr access is allowed
2057	* @dentry: file
2058	* @name: xattr name
2059	*
2060	* Check permission before obtaining the extended attributes identified by
2061	* @name for @dentry.
2062	*
2063	* Return: Returns 0 if permission is granted.
2064	*/
2065	int security_inode_getxattr(struct dentry dentry, const char name)
2066	{
2067	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2068	return 0;
2069	return call_int_hook(inode_getxattr, dentry, name);
2070	}
2071
2072	/**
2073	* security_inode_listxattr() - Check if listing xattrs is allowed
2074	* @dentry: file
2075	*
2076	* Check permission before obtaining the list of extended attribute names for
2077	* @dentry.
2078	*
2079	* Return: Returns 0 if permission is granted.
2080	*/
2081	int security_inode_listxattr(struct dentry *dentry)
2082	{
2083	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2084	return 0;
2085	return call_int_hook(inode_listxattr, dentry);
2086	}
2087
2088	/**
2089	* security_inode_removexattr() - Check if removing an xattr is allowed
2090	* @idmap: idmap of the mount
2091	* @dentry: file
2092	* @name: xattr name
2093	*
2094	* This hook performs the desired permission checks before setting the extended
2095	* attributes (xattrs) on @dentry. It is important to note that we have some
2096	* additional logic before the main LSM implementation calls to detect if we
2097	* need to perform an additional capability check at the LSM layer.
2098	*
2099	* Normally we enforce a capability check prior to executing the various LSM
2100	* hook implementations, but if a LSM wants to avoid this capability check,
2101	* it can register a 'inode_xattr_skipcap' hook and return a value of 1 for
2102	* xattrs that it wants to avoid the capability check, leaving the LSM fully
2103	* responsible for enforcing the access control for the specific xattr. If all
2104	* of the enabled LSMs refrain from registering a 'inode_xattr_skipcap' hook,
2105	* or return a 0 (the default return value), the capability check is still
2106	* performed. If no 'inode_xattr_skipcap' hooks are registered the capability
2107	* check is performed.
2108	*
2109	* Return: Returns 0 if permission is granted.
2110	*/
2111	int security_inode_removexattr(const struct mnt_idmap *idmap,
2112	struct dentry dentry, const char name)
2113	{
2114	int rc;
2115
2116	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2117	return 0;
2118
2119	/* enforce the capability checks at the lsm layer, if needed */
2120	if (!call_int_hook(inode_xattr_skipcap, name)) {
2121	rc = cap_inode_removexattr(idmap, dentry, name);
2122	if (rc)
2123	return rc;
2124	}
2125
2126	return call_int_hook(inode_removexattr, idmap, dentry, name);
2127	}
2128
2129	/**
2130	* security_inode_post_removexattr() - Update the inode after a removexattr op
2131	* @dentry: file
2132	* @name: xattr name
2133	*
2134	* Update the inode after a successful removexattr operation.
2135	*/
2136	void security_inode_post_removexattr(struct dentry dentry, const char name)
2137	{
2138	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2139	return;
2140	call_void_hook(inode_post_removexattr, dentry, name);
2141	}
2142
2143	/**
2144	* security_inode_file_setattr() - check if setting fsxattr is allowed
2145	* @dentry: file to set filesystem extended attributes on
2146	* @fa: extended attributes to set on the inode
2147	*
2148	* Called when file_setattr() syscall or FS_IOC_FSSETXATTR ioctl() is called on
2149	* inode
2150	*
2151	* Return: Returns 0 if permission is granted.
2152	*/
2153	int security_inode_file_setattr(struct dentry dentry, struct file_kattr fa)
2154	{
2155	return call_int_hook(inode_file_setattr, dentry, fa);
2156	}
2157
2158	/**
2159	* security_inode_file_getattr() - check if retrieving fsxattr is allowed
2160	* @dentry: file to retrieve filesystem extended attributes from
2161	* @fa: extended attributes to get
2162	*
2163	* Called when file_getattr() syscall or FS_IOC_FSGETXATTR ioctl() is called on
2164	* inode
2165	*
2166	* Return: Returns 0 if permission is granted.
2167	*/
2168	int security_inode_file_getattr(struct dentry dentry, struct file_kattr fa)
2169	{
2170	return call_int_hook(inode_file_getattr, dentry, fa);
2171	}
2172
2173	/**
2174	* security_inode_need_killpriv() - Check if security_inode_killpriv() required
2175	* @dentry: associated dentry
2176	*
2177	* Called when an inode has been changed to determine if
2178	* security_inode_killpriv() should be called.
2179	*
2180	* Return: Return <0 on error to abort the inode change operation, return 0 if
2181	* security_inode_killpriv() does not need to be called, return >0 if
2182	* security_inode_killpriv() does need to be called.
2183	*/
2184	int security_inode_need_killpriv(struct dentry *dentry)
2185	{
2186	return call_int_hook(inode_need_killpriv, dentry);
2187	}
2188
2189	/**
2190	* security_inode_killpriv() - The setuid bit is removed, update LSM state
2191	* @idmap: idmap of the mount
2192	* @dentry: associated dentry
2193	*
2194	* The @dentry's setuid bit is being removed. Remove similar security labels.
2195	* Called with the dentry->d_inode->i_mutex held.
2196	*
2197	* Return: Return 0 on success. If error is returned, then the operation
2198	* causing setuid bit removal is failed.
2199	*/
2200	int security_inode_killpriv(const struct mnt_idmap *idmap,
2201	struct dentry *dentry)
2202	{
2203	return call_int_hook(inode_killpriv, idmap, dentry);
2204	}
2205
2206	/**
2207	* security_inode_getsecurity() - Get the xattr security label of an inode
2208	* @idmap: idmap of the mount
2209	* @inode: inode
2210	* @name: xattr name
2211	* @buffer: security label buffer
2212	* @alloc: allocation flag
2213	*
2214	* Retrieve a copy of the extended attribute representation of the security
2215	* label associated with @name for @inode via @buffer. Note that @name is the
2216	* remainder of the attribute name after the security prefix has been removed.
2217	* @alloc is used to specify if the call should return a value via the buffer
2218	* or just the value length.
2219	*
2220	* Return: Returns size of buffer on success.
2221	*/
2222	int security_inode_getsecurity(const struct mnt_idmap *idmap,
2223	struct inode inode, const char name,
2224	void **buffer, bool alloc)
2225	{
2226	if (unlikely(IS_PRIVATE(inode)))
2227	return LSM_RET_DEFAULT(inode_getsecurity);
2228
2229	return call_int_hook(inode_getsecurity, idmap, inode, name, buffer,
2230	alloc);
2231	}
2232
2233	/**
2234	* security_inode_setsecurity() - Set the xattr security label of an inode
2235	* @inode: inode
2236	* @name: xattr name
2237	* @value: security label
2238	* @size: length of security label
2239	* @flags: flags
2240	*
2241	* Set the security label associated with @name for @inode from the extended
2242	* attribute value @value. @size indicates the size of the @value in bytes.
2243	* @flags may be XATTR_CREATE, XATTR_REPLACE, or 0. Note that @name is the
2244	* remainder of the attribute name after the security. prefix has been removed.
2245	*
2246	* Return: Returns 0 on success.
2247	*/
2248	int security_inode_setsecurity(struct inode inode, const char name,
2249	const void *value, size_t size, int flags)
2250	{
2251	if (unlikely(IS_PRIVATE(inode)))
2252	return LSM_RET_DEFAULT(inode_setsecurity);
2253
2254	return call_int_hook(inode_setsecurity, inode, name, value, size,
2255	flags);
2256	}
2257
2258	/**
2259	* security_inode_listsecurity() - List the xattr security label names
2260	* @inode: inode
2261	* @buffer: pointer to buffer
2262	* @remaining_size: pointer to remaining size of buffer
2263	*
2264	* Copy the extended attribute names for the security labels associated with
2265	* @inode into *(@buffer). The remaining size of @buffer is specified by
2266	* (@remaining_size). (@buffer) may be NULL to request the size of the
2267	* buffer required. Updates (@buffer) and (@remaining_size).
2268	*
2269	* Return: Returns 0 on success, or -errno on failure.
2270	*/
2271	int security_inode_listsecurity(struct inode *inode,
2272	char *buffer, ssize_t remaining_size)
2273	{
2274	if (unlikely(IS_PRIVATE(inode)))
2275	return 0;
2276	return call_int_hook(inode_listsecurity, inode, buffer, remaining_size);
2277	}
2278	EXPORT_SYMBOL(security_inode_listsecurity);
2279
2280	/**
2281	* security_inode_getlsmprop() - Get an inode's LSM data
2282	* @inode: inode
2283	* @prop: lsm specific information to return
2284	*
2285	* Get the lsm specific information associated with the node.
2286	*/
2287	void security_inode_getlsmprop(struct inode inode, struct lsm_prop prop)
2288	{
2289	call_void_hook(inode_getlsmprop, inode, prop);
2290	}
2291
2292	/**
2293	* security_inode_copy_up() - Create new creds for an overlayfs copy-up op
2294	* @src: union dentry of copy-up file
2295	* @new: newly created creds
2296	*
2297	* A file is about to be copied up from lower layer to upper layer of overlay
2298	* filesystem. Security module can prepare a set of new creds and modify as
2299	* need be and return new creds. Caller will switch to new creds temporarily to
2300	* create new file and release newly allocated creds.
2301	*
2302	* Return: Returns 0 on success or a negative error code on error.
2303	*/
2304	int security_inode_copy_up(struct dentry src, struct cred *new)
2305	{
2306	return call_int_hook(inode_copy_up, src, new);
2307	}
2308	EXPORT_SYMBOL(security_inode_copy_up);
2309
2310	/**
2311	* security_inode_copy_up_xattr() - Filter xattrs in an overlayfs copy-up op
2312	* @src: union dentry of copy-up file
2313	* @name: xattr name
2314	*
2315	* Filter the xattrs being copied up when a unioned file is copied up from a
2316	* lower layer to the union/overlay layer. The caller is responsible for
2317	* reading and writing the xattrs, this hook is merely a filter.
2318	*
2319	* Return: Returns 0 to accept the xattr, -ECANCELED to discard the xattr,
2320	* -EOPNOTSUPP if the security module does not know about attribute,
2321	* or a negative error code to abort the copy up.
2322	*/
2323	int security_inode_copy_up_xattr(struct dentry src, const char name)
2324	{
2325	int rc;
2326
2327	rc = call_int_hook(inode_copy_up_xattr, src, name);
2328	if (rc != LSM_RET_DEFAULT(inode_copy_up_xattr))
2329	return rc;
2330
2331	return LSM_RET_DEFAULT(inode_copy_up_xattr);
2332	}
2333	EXPORT_SYMBOL(security_inode_copy_up_xattr);
2334
2335	/**
2336	* security_inode_setintegrity() - Set the inode's integrity data
2337	* @inode: inode
2338	* @type: type of integrity, e.g. hash digest, signature, etc
2339	* @value: the integrity value
2340	* @size: size of the integrity value
2341	*
2342	* Register a verified integrity measurement of a inode with LSMs.
2343	* LSMs should free the previously saved data if @value is NULL.
2344	*
2345	* Return: Returns 0 on success, negative values on failure.
2346	*/
2347	int security_inode_setintegrity(const struct inode *inode,
2348	enum lsm_integrity_type type, const void *value,
2349	size_t size)
2350	{
2351	return call_int_hook(inode_setintegrity, inode, type, value, size);
2352	}
2353	EXPORT_SYMBOL(security_inode_setintegrity);
2354
2355	/**
2356	* security_kernfs_init_security() - Init LSM context for a kernfs node
2357	* @kn_dir: parent kernfs node
2358	* @kn: the kernfs node to initialize
2359	*
2360	* Initialize the security context of a newly created kernfs node based on its
2361	* own and its parent's attributes.
2362	*
2363	* Return: Returns 0 if permission is granted.
2364	*/
2365	int security_kernfs_init_security(struct kernfs_node *kn_dir,
2366	struct kernfs_node *kn)
2367	{
2368	return call_int_hook(kernfs_init_security, kn_dir, kn);
2369	}
2370
2371	/**
2372	* security_file_permission() - Check file permissions
2373	* @file: file
2374	* @mask: requested permissions
2375	*
2376	* Check file permissions before accessing an open file. This hook is called
2377	* by various operations that read or write files. A security module can use
2378	* this hook to perform additional checking on these operations, e.g. to
2379	* revalidate permissions on use to support privilege bracketing or policy
2380	* changes. Notice that this hook is used when the actual read/write
2381	* operations are performed, whereas the inode_security_ops hook is called when
2382	* a file is opened (as well as many other operations). Although this hook can
2383	* be used to revalidate permissions for various system call operations that
2384	* read or write files, it does not address the revalidation of permissions for
2385	* memory-mapped files. Security modules must handle this separately if they
2386	* need such revalidation.
2387	*
2388	* Return: Returns 0 if permission is granted.
2389	*/
2390	int security_file_permission(struct file *file, int mask)
2391	{
2392	return call_int_hook(file_permission, file, mask);
2393	}
2394
2395	/**
2396	* security_file_alloc() - Allocate and init a file's LSM blob
2397	* @file: the file
2398	*
2399	* Allocate and attach a security structure to the file->f_security field. The
2400	* security field is initialized to NULL when the structure is first created.
2401	*
2402	* Return: Return 0 if the hook is successful and permission is granted.
2403	*/
2404	int security_file_alloc(struct file *file)
2405	{
2406	int rc = lsm_file_alloc(file);
2407
2408	if (rc)
2409	return rc;
2410	rc = call_int_hook(file_alloc_security, file);
2411	if (unlikely(rc))
2412	security_file_free(file);
2413	return rc;
2414	}
2415
2416	/**
2417	* security_file_release() - Perform actions before releasing the file ref
2418	* @file: the file
2419	*
2420	* Perform actions before releasing the last reference to a file.
2421	*/
2422	void security_file_release(struct file *file)
2423	{
2424	call_void_hook(file_release, file);
2425	}
2426
2427	/**
2428	* security_file_free() - Free a file's LSM blob
2429	* @file: the file
2430	*
2431	* Deallocate and free any security structures stored in file->f_security.
2432	*/
2433	void security_file_free(struct file *file)
2434	{
2435	void *blob;
2436
2437	call_void_hook(file_free_security, file);
2438
2439	blob = file->f_security;
2440	if (blob) {
2441	file->f_security = NULL;
2442	kmem_cache_free(lsm_file_cache, blob);
2443	}
2444	}
2445
2446	/**
2447	* security_backing_file_alloc() - Allocate and setup a backing file blob
2448	* @backing_file: the backing file
2449	* @user_file: the associated user visible file
2450	*
2451	* Allocate a backing file LSM blob and perform any necessary initialization of
2452	* the LSM blob. There will be some operations where the LSM will not have
2453	* access to @user_file after this point, so any important state associated
2454	* with @user_file that is important to the LSM should be captured in the
2455	* backing file's LSM blob.
2456	*
2457	* LSM's should avoid taking a reference to @user_file in this hook as it will
2458	* result in problems later when the system attempts to drop/put the file
2459	* references due to a circular dependency.
2460	*
2461	* Return: Return 0 if the hook is successful, negative values otherwise.
2462	*/
2463	int security_backing_file_alloc(struct file *backing_file,
2464	const struct file *user_file)
2465	{
2466	int rc;
2467
2468	rc = lsm_backing_file_alloc(backing_file);
2469	if (rc)
2470	return rc;
2471	rc = call_int_hook(backing_file_alloc, backing_file, user_file);
2472	if (unlikely(rc))
2473	security_backing_file_free(backing_file);
2474
2475	return rc;
2476	}
2477
2478	/**
2479	* security_backing_file_free() - Free a backing file blob
2480	* @backing_file: the backing file
2481	*
2482	* Free any LSM state associate with a backing file's LSM blob, including the
2483	* blob itself.
2484	*/
2485	void security_backing_file_free(struct file *backing_file)
2486	{
2487	void *blob = backing_file_security(backing_file);
2488
2489	call_void_hook(backing_file_free, backing_file);
2490
2491	if (blob) {
2492	backing_file_set_security(backing_file, NULL);
2493	kmem_cache_free(lsm_backing_file_cache, blob);
2494	}
2495	}
2496
2497	/**
2498	* security_file_ioctl() - Check if an ioctl is allowed
2499	* @file: associated file
2500	* @cmd: ioctl cmd
2501	* @arg: ioctl arguments
2502	*
2503	* Check permission for an ioctl operation on @file. Note that @arg sometimes
2504	* represents a user space pointer; in other cases, it may be a simple integer
2505	* value. When @arg represents a user space pointer, it should never be used
2506	* by the security module.
2507	*
2508	* Return: Returns 0 if permission is granted.
2509	*/
2510	int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2511	{
2512	return call_int_hook(file_ioctl, file, cmd, arg);
2513	}
2514	EXPORT_SYMBOL_GPL(security_file_ioctl);
2515
2516	/**
2517	* security_file_ioctl_compat() - Check if an ioctl is allowed in compat mode
2518	* @file: associated file
2519	* @cmd: ioctl cmd
2520	* @arg: ioctl arguments
2521	*
2522	* Compat version of security_file_ioctl() that correctly handles 32-bit
2523	* processes running on 64-bit kernels.
2524	*
2525	* Return: Returns 0 if permission is granted.
2526	*/
2527	int security_file_ioctl_compat(struct file *file, unsigned int cmd,
2528	unsigned long arg)
2529	{
2530	return call_int_hook(file_ioctl_compat, file, cmd, arg);
2531	}
2532	EXPORT_SYMBOL_GPL(security_file_ioctl_compat);
2533
2534	static inline unsigned long mmap_prot(struct file *file, unsigned long prot)
2535	{
2536	/*
2537	* Does we have PROT_READ and does the application expect
2538	* it to imply PROT_EXEC? If not, nothing to talk about...
2539	*/
2540	if ((prot & (PROT_READ \| PROT_EXEC)) != PROT_READ)
2541	return prot;
2542	if (!(current->personality & READ_IMPLIES_EXEC))
2543	return prot;
2544	/*
2545	* if that's an anonymous mapping, let it.
2546	*/
2547	if (!file)
2548	return prot \| PROT_EXEC;
2549	/*
2550	* ditto if it's not on noexec mount, except that on !MMU we need
2551	* NOMMU_MAP_EXEC (== VM_MAYEXEC) in this case
2552	*/
2553	if (!path_noexec(&file->f_path)) {
2554	#ifndef CONFIG_MMU
2555	if (file->f_op->mmap_capabilities) {
2556	unsigned caps = file->f_op->mmap_capabilities(file);
2557	if (!(caps & NOMMU_MAP_EXEC))
2558	return prot;
2559	}
2560	#endif
2561	return prot \| PROT_EXEC;
2562	}
2563	/* anything on noexec mount won't get PROT_EXEC */
2564	return prot;
2565	}
2566
2567	/**
2568	* security_mmap_file() - Check if mmap'ing a file is allowed
2569	* @file: file
2570	* @prot: protection applied by the kernel
2571	* @flags: flags
2572	*
2573	* Check permissions for a mmap operation. The @file may be NULL, e.g. if
2574	* mapping anonymous memory.
2575	*
2576	* Return: Returns 0 if permission is granted.
2577	*/
2578	int security_mmap_file(struct file *file, unsigned long prot,
2579	unsigned long flags)
2580	{
2581	return call_int_hook(mmap_file, file, prot, mmap_prot(file, prot),
2582	flags);
2583	}
2584
2585	/**
2586	* security_mmap_backing_file - Check if mmap'ing a backing file is allowed
2587	* @vma: the vm_area_struct for the mmap'd region
2588	* @backing_file: the backing file being mmap'd
2589	* @user_file: the user file being mmap'd
2590	*
2591	* Check permissions for a mmap operation on a stacked filesystem. This hook
2592	* is called after the security_mmap_file() and is responsible for authorizing
2593	* the mmap on @backing_file. It is important to note that the mmap operation
2594	* on @user_file has already been authorized and the @vma->vm_file has been
2595	* set to @backing_file.
2596	*
2597	* Return: Returns 0 if permission is granted.
2598	*/
2599	int security_mmap_backing_file(struct vm_area_struct *vma,
2600	struct file *backing_file,
2601	struct file *user_file)
2602	{
2603	/* recommended by the stackable filesystem devs */
2604	if (WARN_ON_ONCE(!(backing_file->f_mode & FMODE_BACKING)))
2605	return -EIO;
2606
2607	return call_int_hook(mmap_backing_file, vma, backing_file, user_file);
2608	}
2609	EXPORT_SYMBOL_GPL(security_mmap_backing_file);
2610
2611	/**
2612	* security_mmap_addr() - Check if mmap'ing an address is allowed
2613	* @addr: address
2614	*
2615	* Check permissions for a mmap operation at @addr.
2616	*
2617	* Return: Returns 0 if permission is granted.
2618	*/
2619	int security_mmap_addr(unsigned long addr)
2620	{
2621	return call_int_hook(mmap_addr, addr);
2622	}
2623
2624	/**
2625	* security_file_mprotect() - Check if changing memory protections is allowed
2626	* @vma: memory region
2627	* @reqprot: application requested protection
2628	* @prot: protection applied by the kernel
2629	*
2630	* Check permissions before changing memory access permissions.
2631	*
2632	* Return: Returns 0 if permission is granted.
2633	*/
2634	int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
2635	unsigned long prot)
2636	{
2637	return call_int_hook(file_mprotect, vma, reqprot, prot);
2638	}
2639
2640	/**
2641	* security_file_lock() - Check if a file lock is allowed
2642	* @file: file
2643	* @cmd: lock operation (e.g. F_RDLCK, F_WRLCK)
2644	*
2645	* Check permission before performing file locking operations. Note the hook
2646	* mediates both flock and fcntl style locks.
2647	*
2648	* Return: Returns 0 if permission is granted.
2649	*/
2650	int security_file_lock(struct file *file, unsigned int cmd)
2651	{
2652	return call_int_hook(file_lock, file, cmd);
2653	}
2654
2655	/**
2656	* security_file_fcntl() - Check if fcntl() op is allowed
2657	* @file: file
2658	* @cmd: fcntl command
2659	* @arg: command argument
2660	*
2661	* Check permission before allowing the file operation specified by @cmd from
2662	* being performed on the file @file. Note that @arg sometimes represents a
2663	* user space pointer; in other cases, it may be a simple integer value. When
2664	* @arg represents a user space pointer, it should never be used by the
2665	* security module.
2666	*
2667	* Return: Returns 0 if permission is granted.
2668	*/
2669	int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
2670	{
2671	return call_int_hook(file_fcntl, file, cmd, arg);
2672	}
2673
2674	/**
2675	* security_file_set_fowner() - Set the file owner info in the LSM blob
2676	* @file: the file
2677	*
2678	* Save owner security information (typically from current->security) in
2679	* file->f_security for later use by the send_sigiotask hook.
2680	*
2681	* This hook is called with file->f_owner.lock held.
2682	*
2683	* Return: Returns 0 on success.
2684	*/
2685	void security_file_set_fowner(struct file *file)
2686	{
2687	call_void_hook(file_set_fowner, file);
2688	}
2689
2690	/**
2691	* security_file_send_sigiotask() - Check if sending SIGIO/SIGURG is allowed
2692	* @tsk: target task
2693	* @fown: signal sender
2694	* @sig: signal to be sent, SIGIO is sent if 0
2695	*
2696	* Check permission for the file owner @fown to send SIGIO or SIGURG to the
2697	* process @tsk. Note that this hook is sometimes called from interrupt. Note
2698	* that the fown_struct, @fown, is never outside the context of a struct file,
2699	* so the file structure (and associated security information) can always be
2700	* obtained: container_of(fown, struct file, f_owner).
2701	*
2702	* Return: Returns 0 if permission is granted.
2703	*/
2704	int security_file_send_sigiotask(struct task_struct *tsk,
2705	struct fown_struct *fown, int sig)
2706	{
2707	return call_int_hook(file_send_sigiotask, tsk, fown, sig);
2708	}
2709
2710	/**
2711	* security_file_receive() - Check if receiving a file via IPC is allowed
2712	* @file: file being received
2713	*
2714	* This hook allows security modules to control the ability of a process to
2715	* receive an open file descriptor via socket IPC.
2716	*
2717	* Return: Returns 0 if permission is granted.
2718	*/
2719	int security_file_receive(struct file *file)
2720	{
2721	return call_int_hook(file_receive, file);
2722	}
2723
2724	/**
2725	* security_file_open() - Save open() time state for late use by the LSM
2726	* @file:
2727	*
2728	* Save open-time permission checking state for later use upon file_permission,
2729	* and recheck access if anything has changed since inode_permission.
2730	*
2731	* We can check if a file is opened for execution (e.g. execve(2) call), either
2732	* directly or indirectly (e.g. ELF's ld.so) by checking file->f_flags &
2733	* __FMODE_EXEC .
2734	*
2735	* Return: Returns 0 if permission is granted.
2736	*/
2737	int security_file_open(struct file *file)
2738	{
2739	return call_int_hook(file_open, file);
2740	}
2741
2742	/**
2743	* security_file_post_open() - Evaluate a file after it has been opened
2744	* @file: the file
2745	* @mask: access mask
2746	*
2747	* Evaluate an opened file and the access mask requested with open(). The hook
2748	* is useful for LSMs that require the file content to be available in order to
2749	* make decisions.
2750	*
2751	* Return: Returns 0 if permission is granted.
2752	*/
2753	int security_file_post_open(struct file *file, int mask)
2754	{
2755	return call_int_hook(file_post_open, file, mask);
2756	}
2757	EXPORT_SYMBOL_GPL(security_file_post_open);
2758
2759	/**
2760	* security_file_truncate() - Check if truncating a file is allowed
2761	* @file: file
2762	*
2763	* Check permission before truncating a file, i.e. using ftruncate. Note that
2764	* truncation permission may also be checked based on the path, using the
2765	* @path_truncate hook.
2766	*
2767	* Return: Returns 0 if permission is granted.
2768	*/
2769	int security_file_truncate(struct file *file)
2770	{
2771	return call_int_hook(file_truncate, file);
2772	}
2773
2774	/**
2775	* security_task_alloc() - Allocate a task's LSM blob
2776	* @task: the task
2777	* @clone_flags: flags indicating what is being shared
2778	*
2779	* Handle allocation of task-related resources.
2780	*
2781	* Return: Returns a zero on success, negative values on failure.
2782	*/
2783	int security_task_alloc(struct task_struct *task, u64 clone_flags)
2784	{
2785	int rc = lsm_task_alloc(task);
2786
2787	if (rc)
2788	return rc;
2789	rc = call_int_hook(task_alloc, task, clone_flags);
2790	if (unlikely(rc))
2791	security_task_free(task);
2792	return rc;
2793	}
2794
2795	/**
2796	* security_task_free() - Free a task's LSM blob and related resources
2797	* @task: task
2798	*
2799	* Handle release of task-related resources. Note that this can be called from
2800	* interrupt context.
2801	*/
2802	void security_task_free(struct task_struct *task)
2803	{
2804	call_void_hook(task_free, task);
2805
2806	kfree(task->security);
2807	task->security = NULL;
2808	}
2809
2810	/**
2811	* security_cred_alloc_blank() - Allocate the min memory to allow cred_transfer
2812	* @cred: credentials
2813	* @gfp: gfp flags
2814	*
2815	* Only allocate sufficient memory and attach to @cred such that
2816	* cred_transfer() will not get ENOMEM.
2817	*
2818	* Return: Returns 0 on success, negative values on failure.
2819	*/
2820	int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)
2821	{
2822	int rc = lsm_cred_alloc(cred, gfp);
2823
2824	if (rc)
2825	return rc;
2826
2827	rc = call_int_hook(cred_alloc_blank, cred, gfp);
2828	if (unlikely(rc))
2829	security_cred_free(cred);
2830	return rc;
2831	}
2832
2833	/**
2834	* security_cred_free() - Free the cred's LSM blob and associated resources
2835	* @cred: credentials
2836	*
2837	* Deallocate and clear the cred->security field in a set of credentials.
2838	*/
2839	void security_cred_free(struct cred *cred)
2840	{
2841	/*
2842	* There is a failure case in prepare_creds() that
2843	* may result in a call here with ->security being NULL.
2844	*/
2845	if (unlikely(cred->security == NULL))
2846	return;
2847
2848	call_void_hook(cred_free, cred);
2849
2850	kfree(cred->security);
2851	cred->security = NULL;
2852	}
2853
2854	/**
2855	* security_prepare_creds() - Prepare a new set of credentials
2856	* @new: new credentials
2857	* @old: original credentials
2858	* @gfp: gfp flags
2859	*
2860	* Prepare a new set of credentials by copying the data from the old set.
2861	*
2862	* Return: Returns 0 on success, negative values on failure.
2863	*/
2864	int security_prepare_creds(struct cred new, const struct cred old, gfp_t gfp)
2865	{
2866	int rc = lsm_cred_alloc(new, gfp);
2867
2868	if (rc)
2869	return rc;
2870
2871	rc = call_int_hook(cred_prepare, new, old, gfp);
2872	if (unlikely(rc))
2873	security_cred_free(new);
2874	return rc;
2875	}
2876
2877	/**
2878	* security_transfer_creds() - Transfer creds
2879	* @new: target credentials
2880	* @old: original credentials
2881	*
2882	* Transfer data from original creds to new creds.
2883	*/
2884	void security_transfer_creds(struct cred new, const struct cred old)
2885	{
2886	call_void_hook(cred_transfer, new, old);
2887	}
2888
2889	/**
2890	* security_cred_getsecid() - Get the secid from a set of credentials
2891	* @c: credentials
2892	* @secid: secid value
2893	*
2894	* Retrieve the security identifier of the cred structure @c. In case of
2895	* failure, @secid will be set to zero.
2896	*/
2897	void security_cred_getsecid(const struct cred c, u32 secid)
2898	{
2899	*secid = 0;
2900	call_void_hook(cred_getsecid, c, secid);
2901	}
2902	EXPORT_SYMBOL(security_cred_getsecid);
2903
2904	/**
2905	* security_cred_getlsmprop() - Get the LSM data from a set of credentials
2906	* @c: credentials
2907	* @prop: destination for the LSM data
2908	*
2909	* Retrieve the security data of the cred structure @c. In case of
2910	* failure, @prop will be cleared.
2911	*/
2912	void security_cred_getlsmprop(const struct cred c, struct lsm_prop prop)
2913	{
2914	lsmprop_init(prop);
2915	call_void_hook(cred_getlsmprop, c, prop);
2916	}
2917	EXPORT_SYMBOL(security_cred_getlsmprop);
2918
2919	/**
2920	* security_kernel_act_as() - Set the kernel credentials to act as secid
2921	* @new: credentials
2922	* @secid: secid
2923	*
2924	* Set the credentials for a kernel service to act as (subjective context).
2925	* The current task must be the one that nominated @secid.
2926	*
2927	* Return: Returns 0 if successful.
2928	*/
2929	int security_kernel_act_as(struct cred *new, u32 secid)
2930	{
2931	return call_int_hook(kernel_act_as, new, secid);
2932	}
2933
2934	/**
2935	* security_kernel_create_files_as() - Set file creation context using an inode
2936	* @new: target credentials
2937	* @inode: reference inode
2938	*
2939	* Set the file creation context in a set of credentials to be the same as the
2940	* objective context of the specified inode. The current task must be the one
2941	* that nominated @inode.
2942	*
2943	* Return: Returns 0 if successful.
2944	*/
2945	int security_kernel_create_files_as(struct cred new, struct inode inode)
2946	{
2947	return call_int_hook(kernel_create_files_as, new, inode);
2948	}
2949
2950	/**
2951	* security_kernel_module_request() - Check if loading a module is allowed
2952	* @kmod_name: module name
2953	*
2954	* Ability to trigger the kernel to automatically upcall to userspace for
2955	* userspace to load a kernel module with the given name.
2956	*
2957	* Return: Returns 0 if successful.
2958	*/
2959	int security_kernel_module_request(char *kmod_name)
2960	{
2961	return call_int_hook(kernel_module_request, kmod_name);
2962	}
2963
2964	/**
2965	* security_kernel_read_file() - Read a file specified by userspace
2966	* @file: file
2967	* @id: file identifier
2968	* @contents: trust if security_kernel_post_read_file() will be called
2969	*
2970	* Read a file specified by userspace.
2971	*
2972	* Return: Returns 0 if permission is granted.
2973	*/
2974	int security_kernel_read_file(struct file *file, enum kernel_read_file_id id,
2975	bool contents)
2976	{
2977	return call_int_hook(kernel_read_file, file, id, contents);
2978	}
2979	EXPORT_SYMBOL_GPL(security_kernel_read_file);
2980
2981	/**
2982	* security_kernel_post_read_file() - Read a file specified by userspace
2983	* @file: file
2984	* @buf: file contents
2985	* @size: size of file contents
2986	* @id: file identifier
2987	*
2988	* Read a file specified by userspace. This must be paired with a prior call
2989	* to security_kernel_read_file() call that indicated this hook would also be
2990	* called, see security_kernel_read_file() for more information.
2991	*
2992	* Return: Returns 0 if permission is granted.
2993	*/
2994	int security_kernel_post_read_file(struct file file, char buf, loff_t size,
2995	enum kernel_read_file_id id)
2996	{
2997	return call_int_hook(kernel_post_read_file, file, buf, size, id);
2998	}
2999	EXPORT_SYMBOL_GPL(security_kernel_post_read_file);
3000
3001	/**
3002	* security_kernel_load_data() - Load data provided by userspace
3003	* @id: data identifier
3004	* @contents: true if security_kernel_post_load_data() will be called
3005	*
3006	* Load data provided by userspace.
3007	*
3008	* Return: Returns 0 if permission is granted.
3009	*/
3010	int security_kernel_load_data(enum kernel_load_data_id id, bool contents)
3011	{
3012	return call_int_hook(kernel_load_data, id, contents);
3013	}
3014	EXPORT_SYMBOL_GPL(security_kernel_load_data);
3015
3016	/**
3017	* security_kernel_post_load_data() - Load userspace data from a non-file source
3018	* @buf: data
3019	* @size: size of data
3020	* @id: data identifier
3021	* @description: text description of data, specific to the id value
3022	*
3023	* Load data provided by a non-file source (usually userspace buffer). This
3024	* must be paired with a prior security_kernel_load_data() call that indicated
3025	* this hook would also be called, see security_kernel_load_data() for more
3026	* information.
3027	*
3028	* Return: Returns 0 if permission is granted.
3029	*/
3030	int security_kernel_post_load_data(char *buf, loff_t size,
3031	enum kernel_load_data_id id,
3032	char *description)
3033	{
3034	return call_int_hook(kernel_post_load_data, buf, size, id, description);
3035	}
3036	EXPORT_SYMBOL_GPL(security_kernel_post_load_data);
3037
3038	/**
3039	* security_task_fix_setuid() - Update LSM with new user id attributes
3040	* @new: updated credentials
3041	* @old: credentials being replaced
3042	* @flags: LSM_SETID_* flag values
3043	*
3044	* Update the module's state after setting one or more of the user identity
3045	* attributes of the current process. The @flags parameter indicates which of
3046	* the set*uid system calls invoked this hook. If @new is the set of
3047	* credentials that will be installed. Modifications should be made to this
3048	* rather than to @current->cred.
3049	*
3050	* Return: Returns 0 on success.
3051	*/
3052	int security_task_fix_setuid(struct cred new, const struct cred old,
3053	int flags)
3054	{
3055	return call_int_hook(task_fix_setuid, new, old, flags);
3056	}
3057
3058	/**
3059	* security_task_fix_setgid() - Update LSM with new group id attributes
3060	* @new: updated credentials
3061	* @old: credentials being replaced
3062	* @flags: LSM_SETID_* flag value
3063	*
3064	* Update the module's state after setting one or more of the group identity
3065	* attributes of the current process. The @flags parameter indicates which of
3066	* the set*gid system calls invoked this hook. @new is the set of credentials
3067	* that will be installed. Modifications should be made to this rather than to
3068	* @current->cred.
3069	*
3070	* Return: Returns 0 on success.
3071	*/
3072	int security_task_fix_setgid(struct cred new, const struct cred old,
3073	int flags)
3074	{
3075	return call_int_hook(task_fix_setgid, new, old, flags);
3076	}
3077
3078	/**
3079	* security_task_fix_setgroups() - Update LSM with new supplementary groups
3080	* @new: updated credentials
3081	* @old: credentials being replaced
3082	*
3083	* Update the module's state after setting the supplementary group identity
3084	* attributes of the current process. @new is the set of credentials that will
3085	* be installed. Modifications should be made to this rather than to
3086	* @current->cred.
3087	*
3088	* Return: Returns 0 on success.
3089	*/
3090	int security_task_fix_setgroups(struct cred new, const struct cred old)
3091	{
3092	return call_int_hook(task_fix_setgroups, new, old);
3093	}
3094
3095	/**
3096	* security_task_setpgid() - Check if setting the pgid is allowed
3097	* @p: task being modified
3098	* @pgid: new pgid
3099	*
3100	* Check permission before setting the process group identifier of the process
3101	* @p to @pgid.
3102	*
3103	* Return: Returns 0 if permission is granted.
3104	*/
3105	int security_task_setpgid(struct task_struct *p, pid_t pgid)
3106	{
3107	return call_int_hook(task_setpgid, p, pgid);
3108	}
3109
3110	/**
3111	* security_task_getpgid() - Check if getting the pgid is allowed
3112	* @p: task
3113	*
3114	* Check permission before getting the process group identifier of the process
3115	* @p.
3116	*
3117	* Return: Returns 0 if permission is granted.
3118	*/
3119	int security_task_getpgid(struct task_struct *p)
3120	{
3121	return call_int_hook(task_getpgid, p);
3122	}
3123
3124	/**
3125	* security_task_getsid() - Check if getting the session id is allowed
3126	* @p: task
3127	*
3128	* Check permission before getting the session identifier of the process @p.
3129	*
3130	* Return: Returns 0 if permission is granted.
3131	*/
3132	int security_task_getsid(struct task_struct *p)
3133	{
3134	return call_int_hook(task_getsid, p);
3135	}
3136
3137	/**
3138	* security_current_getlsmprop_subj() - Current task's subjective LSM data
3139	* @prop: lsm specific information
3140	*
3141	* Retrieve the subjective security identifier of the current task and return
3142	* it in @prop.
3143	*/
3144	void security_current_getlsmprop_subj(struct lsm_prop *prop)
3145	{
3146	lsmprop_init(prop);
3147	call_void_hook(current_getlsmprop_subj, prop);
3148	}
3149	EXPORT_SYMBOL(security_current_getlsmprop_subj);
3150
3151	/**
3152	* security_task_getlsmprop_obj() - Get a task's objective LSM data
3153	* @p: target task
3154	* @prop: lsm specific information
3155	*
3156	* Retrieve the objective security identifier of the task_struct in @p and
3157	* return it in @prop.
3158	*/
3159	void security_task_getlsmprop_obj(struct task_struct p, struct lsm_prop prop)
3160	{
3161	lsmprop_init(prop);
3162	call_void_hook(task_getlsmprop_obj, p, prop);
3163	}
3164	EXPORT_SYMBOL(security_task_getlsmprop_obj);
3165
3166	/**
3167	* security_task_setnice() - Check if setting a task's nice value is allowed
3168	* @p: target task
3169	* @nice: nice value
3170	*
3171	* Check permission before setting the nice value of @p to @nice.
3172	*
3173	* Return: Returns 0 if permission is granted.
3174	*/
3175	int security_task_setnice(struct task_struct *p, int nice)
3176	{
3177	return call_int_hook(task_setnice, p, nice);
3178	}
3179
3180	/**
3181	* security_task_setioprio() - Check if setting a task's ioprio is allowed
3182	* @p: target task
3183	* @ioprio: ioprio value
3184	*
3185	* Check permission before setting the ioprio value of @p to @ioprio.
3186	*
3187	* Return: Returns 0 if permission is granted.
3188	*/
3189	int security_task_setioprio(struct task_struct *p, int ioprio)
3190	{
3191	return call_int_hook(task_setioprio, p, ioprio);
3192	}
3193
3194	/**
3195	* security_task_getioprio() - Check if getting a task's ioprio is allowed
3196	* @p: task
3197	*
3198	* Check permission before getting the ioprio value of @p.
3199	*
3200	* Return: Returns 0 if permission is granted.
3201	*/
3202	int security_task_getioprio(struct task_struct *p)
3203	{
3204	return call_int_hook(task_getioprio, p);
3205	}
3206
3207	/**
3208	* security_task_prlimit() - Check if get/setting resources limits is allowed
3209	* @cred: current task credentials
3210	* @tcred: target task credentials
3211	* @flags: LSM_PRLIMIT_* flag bits indicating a get/set/both
3212	*
3213	* Check permission before getting and/or setting the resource limits of
3214	* another task.
3215	*
3216	* Return: Returns 0 if permission is granted.
3217	*/
3218	int security_task_prlimit(const struct cred cred, const struct cred tcred,
3219	unsigned int flags)
3220	{
3221	return call_int_hook(task_prlimit, cred, tcred, flags);
3222	}
3223
3224	/**
3225	* security_task_setrlimit() - Check if setting a new rlimit value is allowed
3226	* @p: target task's group leader
3227	* @resource: resource whose limit is being set
3228	* @new_rlim: new resource limit
3229	*
3230	* Check permission before setting the resource limits of process @p for
3231	* @resource to @new_rlim. The old resource limit values can be examined by
3232	* dereferencing (p->signal->rlim + resource).
3233	*
3234	* Return: Returns 0 if permission is granted.
3235	*/
3236	int security_task_setrlimit(struct task_struct *p, unsigned int resource,
3237	struct rlimit *new_rlim)
3238	{
3239	return call_int_hook(task_setrlimit, p, resource, new_rlim);
3240	}
3241
3242	/**
3243	* security_task_setscheduler() - Check if setting sched policy/param is allowed
3244	* @p: target task
3245	*
3246	* Check permission before setting scheduling policy and/or parameters of
3247	* process @p.
3248	*
3249	* Return: Returns 0 if permission is granted.
3250	*/
3251	int security_task_setscheduler(struct task_struct *p)
3252	{
3253	return call_int_hook(task_setscheduler, p);
3254	}
3255
3256	/**
3257	* security_task_getscheduler() - Check if getting scheduling info is allowed
3258	* @p: target task
3259	*
3260	* Check permission before obtaining scheduling information for process @p.
3261	*
3262	* Return: Returns 0 if permission is granted.
3263	*/
3264	int security_task_getscheduler(struct task_struct *p)
3265	{
3266	return call_int_hook(task_getscheduler, p);
3267	}
3268
3269	/**
3270	* security_task_movememory() - Check if moving memory is allowed
3271	* @p: task
3272	*
3273	* Check permission before moving memory owned by process @p.
3274	*
3275	* Return: Returns 0 if permission is granted.
3276	*/
3277	int security_task_movememory(struct task_struct *p)
3278	{
3279	return call_int_hook(task_movememory, p);
3280	}
3281
3282	/**
3283	* security_task_kill() - Check if sending a signal is allowed
3284	* @p: target process
3285	* @info: signal information
3286	* @sig: signal value
3287	* @cred: credentials of the signal sender, NULL if @current
3288	*
3289	* Check permission before sending signal @sig to @p. @info can be NULL, the
3290	* constant 1, or a pointer to a kernel_siginfo structure. If @info is 1 or
3291	* SI_FROMKERNEL(info) is true, then the signal should be viewed as coming from
3292	* the kernel and should typically be permitted. SIGIO signals are handled
3293	* separately by the send_sigiotask hook in file_security_ops.
3294	*
3295	* Return: Returns 0 if permission is granted.
3296	*/
3297	int security_task_kill(struct task_struct p, struct kernel_siginfo info,
3298	int sig, const struct cred *cred)
3299	{
3300	return call_int_hook(task_kill, p, info, sig, cred);
3301	}
3302
3303	/**
3304	* security_task_prctl() - Handle an LSM specific prctl() call
3305	* @option: operation
3306	* @arg2: argument
3307	* @arg3: argument
3308	* @arg4: argument
3309	* @arg5: argument
3310	*
3311	* Handle lsm specific prctl() operations.
3312	*
3313	* Return: Return -ENOSYS if no-one wanted to handle this op, any other value
3314	* to cause prctl() to return immediately with that value.
3315	*/
3316	int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
3317	unsigned long arg4, unsigned long arg5)
3318	{
3319	int thisrc;
3320	int rc = LSM_RET_DEFAULT(task_prctl);
3321	struct lsm_static_call *scall;
3322
3323	lsm_for_each_hook(scall, task_prctl) {
3324	thisrc = scall->hl->hook.task_prctl(option, arg2, arg3, arg4, arg5);
3325	if (thisrc != LSM_RET_DEFAULT(task_prctl)) {
3326	rc = thisrc;
3327	if (thisrc != 0)
3328	break;
3329	}
3330	}
3331	return rc;
3332	}
3333
3334	/**
3335	* security_task_to_inode() - Set the security attributes of a task's inode
3336	* @p: task
3337	* @inode: inode
3338	*
3339	* Set the security attributes for an inode based on an associated task's
3340	* security attributes, e.g. for /proc/pid inodes.
3341	*/
3342	void security_task_to_inode(struct task_struct p, struct inode inode)
3343	{
3344	call_void_hook(task_to_inode, p, inode);
3345	}
3346
3347	/**
3348	* security_create_user_ns() - Check if creating a new userns is allowed
3349	* @cred: prepared creds
3350	*
3351	* Check permission prior to creating a new user namespace.
3352	*
3353	* Return: Returns 0 if successful, otherwise < 0 error code.
3354	*/
3355	int security_create_user_ns(const struct cred *cred)
3356	{
3357	return call_int_hook(userns_create, cred);
3358	}
3359
3360	/**
3361	* security_ipc_permission() - Check if sysv ipc access is allowed
3362	* @ipcp: ipc permission structure
3363	* @flag: requested permissions
3364	*
3365	* Check permissions for access to IPC.
3366	*
3367	* Return: Returns 0 if permission is granted.
3368	*/
3369	int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
3370	{
3371	return call_int_hook(ipc_permission, ipcp, flag);
3372	}
3373
3374	/**
3375	* security_ipc_getlsmprop() - Get the sysv ipc object LSM data
3376	* @ipcp: ipc permission structure
3377	* @prop: pointer to lsm information
3378	*
3379	* Get the lsm information associated with the ipc object.
3380	*/
3381
3382	void security_ipc_getlsmprop(struct kern_ipc_perm ipcp, struct lsm_prop prop)
3383	{
3384	lsmprop_init(prop);
3385	call_void_hook(ipc_getlsmprop, ipcp, prop);
3386	}
3387
3388	/**
3389	* security_msg_msg_alloc() - Allocate a sysv ipc message LSM blob
3390	* @msg: message structure
3391	*
3392	* Allocate and attach a security structure to the msg->security field. The
3393	* security field is initialized to NULL when the structure is first created.
3394	*
3395	* Return: Return 0 if operation was successful and permission is granted.
3396	*/
3397	int security_msg_msg_alloc(struct msg_msg *msg)
3398	{
3399	int rc = lsm_msg_msg_alloc(msg);
3400
3401	if (unlikely(rc))
3402	return rc;
3403	rc = call_int_hook(msg_msg_alloc_security, msg);
3404	if (unlikely(rc))
3405	security_msg_msg_free(msg);
3406	return rc;
3407	}
3408
3409	/**
3410	* security_msg_msg_free() - Free a sysv ipc message LSM blob
3411	* @msg: message structure
3412	*
3413	* Deallocate the security structure for this message.
3414	*/
3415	void security_msg_msg_free(struct msg_msg *msg)
3416	{
3417	call_void_hook(msg_msg_free_security, msg);
3418	kfree(msg->security);
3419	msg->security = NULL;
3420	}
3421
3422	/**
3423	* security_msg_queue_alloc() - Allocate a sysv ipc msg queue LSM blob
3424	* @msq: sysv ipc permission structure
3425	*
3426	* Allocate and attach a security structure to @msg. The security field is
3427	* initialized to NULL when the structure is first created.
3428	*
3429	* Return: Returns 0 if operation was successful and permission is granted.
3430	*/
3431	int security_msg_queue_alloc(struct kern_ipc_perm *msq)
3432	{
3433	int rc = lsm_ipc_alloc(msq);
3434
3435	if (unlikely(rc))
3436	return rc;
3437	rc = call_int_hook(msg_queue_alloc_security, msq);
3438	if (unlikely(rc))
3439	security_msg_queue_free(msq);
3440	return rc;
3441	}
3442
3443	/**
3444	* security_msg_queue_free() - Free a sysv ipc msg queue LSM blob
3445	* @msq: sysv ipc permission structure
3446	*
3447	* Deallocate security field @perm->security for the message queue.
3448	*/
3449	void security_msg_queue_free(struct kern_ipc_perm *msq)
3450	{
3451	call_void_hook(msg_queue_free_security, msq);
3452	kfree(msq->security);
3453	msq->security = NULL;
3454	}
3455
3456	/**
3457	* security_msg_queue_associate() - Check if a msg queue operation is allowed
3458	* @msq: sysv ipc permission structure
3459	* @msqflg: operation flags
3460	*
3461	* Check permission when a message queue is requested through the msgget system
3462	* call. This hook is only called when returning the message queue identifier
3463	* for an existing message queue, not when a new message queue is created.
3464	*
3465	* Return: Return 0 if permission is granted.
3466	*/
3467	int security_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
3468	{
3469	return call_int_hook(msg_queue_associate, msq, msqflg);
3470	}
3471
3472	/**
3473	* security_msg_queue_msgctl() - Check if a msg queue operation is allowed
3474	* @msq: sysv ipc permission structure
3475	* @cmd: operation
3476	*
3477	* Check permission when a message control operation specified by @cmd is to be
3478	* performed on the message queue with permissions.
3479	*
3480	* Return: Returns 0 if permission is granted.
3481	*/
3482	int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
3483	{
3484	return call_int_hook(msg_queue_msgctl, msq, cmd);
3485	}
3486
3487	/**
3488	* security_msg_queue_msgsnd() - Check if sending a sysv ipc message is allowed
3489	* @msq: sysv ipc permission structure
3490	* @msg: message
3491	* @msqflg: operation flags
3492	*
3493	* Check permission before a message, @msg, is enqueued on the message queue
3494	* with permissions specified in @msq.
3495	*
3496	* Return: Returns 0 if permission is granted.
3497	*/
3498	int security_msg_queue_msgsnd(struct kern_ipc_perm *msq,
3499	struct msg_msg *msg, int msqflg)
3500	{
3501	return call_int_hook(msg_queue_msgsnd, msq, msg, msqflg);
3502	}
3503
3504	/**
3505	* security_msg_queue_msgrcv() - Check if receiving a sysv ipc msg is allowed
3506	* @msq: sysv ipc permission structure
3507	* @msg: message
3508	* @target: target task
3509	* @type: type of message requested
3510	* @mode: operation flags
3511	*
3512	* Check permission before a message, @msg, is removed from the message queue.
3513	* The @target task structure contains a pointer to the process that will be
3514	* receiving the message (not equal to the current process when inline receives
3515	* are being performed).
3516	*
3517	* Return: Returns 0 if permission is granted.
3518	*/
3519	int security_msg_queue_msgrcv(struct kern_ipc_perm msq, struct msg_msg msg,
3520	struct task_struct *target, long type, int mode)
3521	{
3522	return call_int_hook(msg_queue_msgrcv, msq, msg, target, type, mode);
3523	}
3524
3525	/**
3526	* security_shm_alloc() - Allocate a sysv shm LSM blob
3527	* @shp: sysv ipc permission structure
3528	*
3529	* Allocate and attach a security structure to the @shp security field. The
3530	* security field is initialized to NULL when the structure is first created.
3531	*
3532	* Return: Returns 0 if operation was successful and permission is granted.
3533	*/
3534	int security_shm_alloc(struct kern_ipc_perm *shp)
3535	{
3536	int rc = lsm_ipc_alloc(shp);
3537
3538	if (unlikely(rc))
3539	return rc;
3540	rc = call_int_hook(shm_alloc_security, shp);
3541	if (unlikely(rc))
3542	security_shm_free(shp);
3543	return rc;
3544	}
3545
3546	/**
3547	* security_shm_free() - Free a sysv shm LSM blob
3548	* @shp: sysv ipc permission structure
3549	*
3550	* Deallocate the security structure @perm->security for the memory segment.
3551	*/
3552	void security_shm_free(struct kern_ipc_perm *shp)
3553	{
3554	call_void_hook(shm_free_security, shp);
3555	kfree(shp->security);
3556	shp->security = NULL;
3557	}
3558
3559	/**
3560	* security_shm_associate() - Check if a sysv shm operation is allowed
3561	* @shp: sysv ipc permission structure
3562	* @shmflg: operation flags
3563	*
3564	* Check permission when a shared memory region is requested through the shmget
3565	* system call. This hook is only called when returning the shared memory
3566	* region identifier for an existing region, not when a new shared memory
3567	* region is created.
3568	*
3569	* Return: Returns 0 if permission is granted.
3570	*/
3571	int security_shm_associate(struct kern_ipc_perm *shp, int shmflg)
3572	{
3573	return call_int_hook(shm_associate, shp, shmflg);
3574	}
3575
3576	/**
3577	* security_shm_shmctl() - Check if a sysv shm operation is allowed
3578	* @shp: sysv ipc permission structure
3579	* @cmd: operation
3580	*
3581	* Check permission when a shared memory control operation specified by @cmd is
3582	* to be performed on the shared memory region with permissions in @shp.
3583	*
3584	* Return: Return 0 if permission is granted.
3585	*/
3586	int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
3587	{
3588	return call_int_hook(shm_shmctl, shp, cmd);
3589	}
3590
3591	/**
3592	* security_shm_shmat() - Check if a sysv shm attach operation is allowed
3593	* @shp: sysv ipc permission structure
3594	* @shmaddr: address of memory region to attach
3595	* @shmflg: operation flags
3596	*
3597	* Check permissions prior to allowing the shmat system call to attach the
3598	* shared memory segment with permissions @shp to the data segment of the
3599	* calling process. The attaching address is specified by @shmaddr.
3600	*
3601	* Return: Returns 0 if permission is granted.
3602	*/
3603	int security_shm_shmat(struct kern_ipc_perm *shp,
3604	char __user *shmaddr, int shmflg)
3605	{
3606	return call_int_hook(shm_shmat, shp, shmaddr, shmflg);
3607	}
3608
3609	/**
3610	* security_sem_alloc() - Allocate a sysv semaphore LSM blob
3611	* @sma: sysv ipc permission structure
3612	*
3613	* Allocate and attach a security structure to the @sma security field. The
3614	* security field is initialized to NULL when the structure is first created.
3615	*
3616	* Return: Returns 0 if operation was successful and permission is granted.
3617	*/
3618	int security_sem_alloc(struct kern_ipc_perm *sma)
3619	{
3620	int rc = lsm_ipc_alloc(sma);
3621
3622	if (unlikely(rc))
3623	return rc;
3624	rc = call_int_hook(sem_alloc_security, sma);
3625	if (unlikely(rc))
3626	security_sem_free(sma);
3627	return rc;
3628	}
3629
3630	/**
3631	* security_sem_free() - Free a sysv semaphore LSM blob
3632	* @sma: sysv ipc permission structure
3633	*
3634	* Deallocate security structure @sma->security for the semaphore.
3635	*/
3636	void security_sem_free(struct kern_ipc_perm *sma)
3637	{
3638	call_void_hook(sem_free_security, sma);
3639	kfree(sma->security);
3640	sma->security = NULL;
3641	}
3642
3643	/**
3644	* security_sem_associate() - Check if a sysv semaphore operation is allowed
3645	* @sma: sysv ipc permission structure
3646	* @semflg: operation flags
3647	*
3648	* Check permission when a semaphore is requested through the semget system
3649	* call. This hook is only called when returning the semaphore identifier for
3650	* an existing semaphore, not when a new one must be created.
3651	*
3652	* Return: Returns 0 if permission is granted.
3653	*/
3654	int security_sem_associate(struct kern_ipc_perm *sma, int semflg)
3655	{
3656	return call_int_hook(sem_associate, sma, semflg);
3657	}
3658
3659	/**
3660	* security_sem_semctl() - Check if a sysv semaphore operation is allowed
3661	* @sma: sysv ipc permission structure
3662	* @cmd: operation
3663	*
3664	* Check permission when a semaphore operation specified by @cmd is to be
3665	* performed on the semaphore.
3666	*
3667	* Return: Returns 0 if permission is granted.
3668	*/
3669	int security_sem_semctl(struct kern_ipc_perm *sma, int cmd)
3670	{
3671	return call_int_hook(sem_semctl, sma, cmd);
3672	}
3673
3674	/**
3675	* security_sem_semop() - Check if a sysv semaphore operation is allowed
3676	* @sma: sysv ipc permission structure
3677	* @sops: operations to perform
3678	* @nsops: number of operations
3679	* @alter: flag indicating changes will be made
3680	*
3681	* Check permissions before performing operations on members of the semaphore
3682	* set. If the @alter flag is nonzero, the semaphore set may be modified.
3683	*
3684	* Return: Returns 0 if permission is granted.
3685	*/
3686	int security_sem_semop(struct kern_ipc_perm sma, struct sembuf sops,
3687	unsigned nsops, int alter)
3688	{
3689	return call_int_hook(sem_semop, sma, sops, nsops, alter);
3690	}
3691
3692	/**
3693	* security_d_instantiate() - Populate an inode's LSM state based on a dentry
3694	* @dentry: dentry
3695	* @inode: inode
3696	*
3697	* Fill in @inode security information for a @dentry if allowed.
3698	*/
3699	void security_d_instantiate(struct dentry dentry, struct inode inode)
3700	{
3701	if (unlikely(inode && IS_PRIVATE(inode)))
3702	return;
3703	call_void_hook(d_instantiate, dentry, inode);
3704	}
3705	EXPORT_SYMBOL(security_d_instantiate);
3706
3707	/*
3708	* Please keep this in sync with it's counterpart in security/lsm_syscalls.c
3709	*/
3710
3711	/**
3712	* security_getselfattr - Read an LSM attribute of the current process.
3713	* @attr: which attribute to return
3714	* @uctx: the user-space destination for the information, or NULL
3715	* @size: pointer to the size of space available to receive the data
3716	* @flags: special handling options. LSM_FLAG_SINGLE indicates that only
3717	* attributes associated with the LSM identified in the passed @ctx be
3718	* reported.
3719	*
3720	* A NULL value for @uctx can be used to get both the number of attributes
3721	* and the size of the data.
3722	*
3723	* Returns the number of attributes found on success, negative value
3724	* on error. @size is reset to the total size of the data.
3725	* If @size is insufficient to contain the data -E2BIG is returned.
3726	*/
3727	int security_getselfattr(unsigned int attr, struct lsm_ctx __user *uctx,
3728	u32 __user *size, u32 flags)
3729	{
3730	struct lsm_static_call *scall;
3731	struct lsm_ctx lctx = { .id = LSM_ID_UNDEF, };
3732	u8 __user base = (u8 __user )uctx;
3733	u32 entrysize;
3734	u32 total = 0;
3735	u32 left;
3736	bool toobig = false;
3737	bool single = false;
3738	int count = 0;
3739	int rc;
3740
3741	if (attr == LSM_ATTR_UNDEF)
3742	return -EINVAL;
3743	if (size == NULL)
3744	return -EINVAL;
3745	if (get_user(left, size))
3746	return -EFAULT;
3747
3748	if (flags) {
3749	/*
3750	* Only flag supported is LSM_FLAG_SINGLE
3751	*/
3752	if (flags != LSM_FLAG_SINGLE \|\| !uctx)
3753	return -EINVAL;
3754	if (copy_from_user(&lctx, uctx, sizeof(lctx)))
3755	return -EFAULT;
3756	/*
3757	* If the LSM ID isn't specified it is an error.
3758	*/
3759	if (lctx.id == LSM_ID_UNDEF)
3760	return -EINVAL;
3761	single = true;
3762	}
3763
3764	/*
3765	* In the usual case gather all the data from the LSMs.
3766	* In the single case only get the data from the LSM specified.
3767	*/
3768	lsm_for_each_hook(scall, getselfattr) {
3769	if (single && lctx.id != scall->hl->lsmid->id)
3770	continue;
3771	entrysize = left;
3772	if (base)
3773	uctx = (struct lsm_ctx __user *)(base + total);
3774	rc = scall->hl->hook.getselfattr(attr, uctx, &entrysize, flags);
3775	if (rc == -EOPNOTSUPP)
3776	continue;
3777	if (rc == -E2BIG) {
3778	rc = 0;
3779	left = 0;
3780	toobig = true;
3781	} else if (rc < 0)
3782	return rc;
3783	else
3784	left -= entrysize;
3785
3786	total += entrysize;
3787	count += rc;
3788	if (single)
3789	break;
3790	}
3791	if (put_user(total, size))
3792	return -EFAULT;
3793	if (toobig)
3794	return -E2BIG;
3795	if (count == 0)
3796	return LSM_RET_DEFAULT(getselfattr);
3797	return count;
3798	}
3799
3800	/*
3801	* Please keep this in sync with it's counterpart in security/lsm_syscalls.c
3802	*/
3803
3804	/**
3805	* security_setselfattr - Set an LSM attribute on the current process.
3806	* @attr: which attribute to set
3807	* @uctx: the user-space source for the information
3808	* @size: the size of the data
3809	* @flags: reserved for future use, must be 0
3810	*
3811	* Set an LSM attribute for the current process. The LSM, attribute
3812	* and new value are included in @uctx.
3813	*
3814	* Returns 0 on success, -EINVAL if the input is inconsistent, -EFAULT
3815	* if the user buffer is inaccessible, E2BIG if size is too big, or an
3816	* LSM specific failure.
3817	*/
3818	int security_setselfattr(unsigned int attr, struct lsm_ctx __user *uctx,
3819	u32 size, u32 flags)
3820	{
3821	struct lsm_static_call *scall;
3822	struct lsm_ctx *lctx;
3823	int rc = LSM_RET_DEFAULT(setselfattr);
3824	u64 required_len;
3825
3826	if (flags)
3827	return -EINVAL;
3828	if (size < sizeof(*lctx))
3829	return -EINVAL;
3830	if (size > PAGE_SIZE)
3831	return -E2BIG;
3832
3833	lctx = memdup_user(uctx, size);
3834	if (IS_ERR(lctx))
3835	return PTR_ERR(lctx);
3836
3837	if (size < lctx->len \|\|
3838	check_add_overflow(sizeof(*lctx), lctx->ctx_len, &required_len) \|\|
3839	lctx->len < required_len) {
3840	rc = -EINVAL;
3841	goto free_out;
3842	}
3843
3844	lsm_for_each_hook(scall, setselfattr)
3845	if ((scall->hl->lsmid->id) == lctx->id) {
3846	rc = scall->hl->hook.setselfattr(attr, lctx, size, flags);
3847	break;
3848	}
3849
3850	free_out:
3851	kfree(lctx);
3852	return rc;
3853	}
3854
3855	/**
3856	* security_getprocattr() - Read an attribute for a task
3857	* @p: the task
3858	* @lsmid: LSM identification
3859	* @name: attribute name
3860	* @value: attribute value
3861	*
3862	* Read attribute @name for task @p and store it into @value if allowed.
3863	*
3864	* Return: Returns the length of @value on success, a negative value otherwise.
3865	*/
3866	int security_getprocattr(struct task_struct p, int lsmid, const char name,
3867	char **value)
3868	{
3869	struct lsm_static_call *scall;
3870
3871	lsm_for_each_hook(scall, getprocattr) {
3872	if (lsmid != 0 && lsmid != scall->hl->lsmid->id)
3873	continue;
3874	return scall->hl->hook.getprocattr(p, name, value);
3875	}
3876	return LSM_RET_DEFAULT(getprocattr);
3877	}
3878
3879	/**
3880	* security_setprocattr() - Set an attribute for a task
3881	* @lsmid: LSM identification
3882	* @name: attribute name
3883	* @value: attribute value
3884	* @size: attribute value size
3885	*
3886	* Write (set) the current task's attribute @name to @value, size @size if
3887	* allowed.
3888	*
3889	* Return: Returns bytes written on success, a negative value otherwise.
3890	*/
3891	int security_setprocattr(int lsmid, const char name, void value, size_t size)
3892	{
3893	struct lsm_static_call *scall;
3894
3895	lsm_for_each_hook(scall, setprocattr) {
3896	if (lsmid != 0 && lsmid != scall->hl->lsmid->id)
3897	continue;
3898	return scall->hl->hook.setprocattr(name, value, size);
3899	}
3900	return LSM_RET_DEFAULT(setprocattr);
3901	}
3902
3903	/**
3904	* security_ismaclabel() - Check if the named attribute is a MAC label
3905	* @name: full extended attribute name
3906	*
3907	* Check if the extended attribute specified by @name represents a MAC label.
3908	*
3909	* Return: Returns 1 if name is a MAC attribute otherwise returns 0.
3910	*/
3911	int security_ismaclabel(const char *name)
3912	{
3913	return call_int_hook(ismaclabel, name);
3914	}
3915	EXPORT_SYMBOL(security_ismaclabel);
3916
3917	/**
3918	* security_secid_to_secctx() - Convert a secid to a secctx
3919	* @secid: secid
3920	* @cp: the LSM context
3921	*
3922	* Convert secid to security context. If @cp is NULL the length of the
3923	* result will be returned, but no data will be returned. This
3924	* does mean that the length could change between calls to check the length and
3925	* the next call which actually allocates and returns the data.
3926	*
3927	* Return: Return length of data on success, error on failure.
3928	*/
3929	int security_secid_to_secctx(u32 secid, struct lsm_context *cp)
3930	{
3931	return call_int_hook(secid_to_secctx, secid, cp);
3932	}
3933	EXPORT_SYMBOL(security_secid_to_secctx);
3934
3935	/**
3936	* security_lsmprop_to_secctx() - Convert a lsm_prop to a secctx
3937	* @prop: lsm specific information
3938	* @cp: the LSM context
3939	* @lsmid: which security module to report
3940	*
3941	* Convert a @prop entry to security context. If @cp is NULL the
3942	* length of the result will be returned. This does mean that the
3943	* length could change between calls to check the length and the
3944	* next call which actually allocates and returns the @cp.
3945	*
3946	* @lsmid identifies which LSM should supply the context.
3947	* A value of LSM_ID_UNDEF indicates that the first LSM suppling
3948	* the hook should be used. This is used in cases where the
3949	* ID of the supplying LSM is unambiguous.
3950	*
3951	* Return: Return length of data on success, error on failure.
3952	*/
3953	int security_lsmprop_to_secctx(struct lsm_prop prop, struct lsm_context cp,
3954	int lsmid)
3955	{
3956	struct lsm_static_call *scall;
3957
3958	lsm_for_each_hook(scall, lsmprop_to_secctx) {
3959	if (lsmid != LSM_ID_UNDEF && lsmid != scall->hl->lsmid->id)
3960	continue;
3961	return scall->hl->hook.lsmprop_to_secctx(prop, cp);
3962	}
3963	return LSM_RET_DEFAULT(lsmprop_to_secctx);
3964	}
3965	EXPORT_SYMBOL(security_lsmprop_to_secctx);
3966
3967	/**
3968	* security_secctx_to_secid() - Convert a secctx to a secid
3969	* @secdata: secctx
3970	* @seclen: length of secctx
3971	* @secid: secid
3972	*
3973	* Convert security context to secid.
3974	*
3975	* Return: Returns 0 on success, error on failure.
3976	*/
3977	int security_secctx_to_secid(const char secdata, u32 seclen, u32 secid)
3978	{
3979	*secid = 0;
3980	return call_int_hook(secctx_to_secid, secdata, seclen, secid);
3981	}
3982	EXPORT_SYMBOL(security_secctx_to_secid);
3983
3984	/**
3985	* security_release_secctx() - Free a secctx buffer
3986	* @cp: the security context
3987	*
3988	* Release the security context.
3989	*/
3990	void security_release_secctx(struct lsm_context *cp)
3991	{
3992	call_void_hook(release_secctx, cp);
3993	memset(cp, 0, sizeof(*cp));
3994	}
3995	EXPORT_SYMBOL(security_release_secctx);
3996
3997	/**
3998	* security_inode_invalidate_secctx() - Invalidate an inode's security label
3999	* @inode: inode
4000	*
4001	* Notify the security module that it must revalidate the security context of
4002	* an inode.
4003	*/
4004	void security_inode_invalidate_secctx(struct inode *inode)
4005	{
4006	call_void_hook(inode_invalidate_secctx, inode);
4007	}
4008	EXPORT_SYMBOL(security_inode_invalidate_secctx);
4009
4010	/**
4011	* security_inode_notifysecctx() - Notify the LSM of an inode's security label
4012	* @inode: inode
4013	* @ctx: secctx
4014	* @ctxlen: length of secctx
4015	*
4016	* Notify the security module of what the security context of an inode should
4017	* be. Initializes the incore security context managed by the security module
4018	* for this inode. Example usage: NFS client invokes this hook to initialize
4019	* the security context in its incore inode to the value provided by the server
4020	* for the file when the server returned the file's attributes to the client.
4021	* Must be called with inode->i_mutex locked.
4022	*
4023	* Return: Returns 0 on success, error on failure.
4024	*/
4025	int security_inode_notifysecctx(struct inode inode, void ctx, u32 ctxlen)
4026	{
4027	return call_int_hook(inode_notifysecctx, inode, ctx, ctxlen);
4028	}
4029	EXPORT_SYMBOL(security_inode_notifysecctx);
4030
4031	/**
4032	* security_inode_setsecctx() - Change the security label of an inode
4033	* @dentry: inode
4034	* @ctx: secctx
4035	* @ctxlen: length of secctx
4036	*
4037	* Change the security context of an inode. Updates the incore security
4038	* context managed by the security module and invokes the fs code as needed
4039	* (via __vfs_setxattr_noperm) to update any backing xattrs that represent the
4040	* context. Example usage: NFS server invokes this hook to change the security
4041	* context in its incore inode and on the backing filesystem to a value
4042	* provided by the client on a SETATTR operation. Must be called with
4043	* inode->i_mutex locked.
4044	*
4045	* Return: Returns 0 on success, error on failure.
4046	*/
4047	int security_inode_setsecctx(struct dentry dentry, void ctx, u32 ctxlen)
4048	{
4049	return call_int_hook(inode_setsecctx, dentry, ctx, ctxlen);
4050	}
4051	EXPORT_SYMBOL(security_inode_setsecctx);
4052
4053	/**
4054	* security_inode_getsecctx() - Get the security label of an inode
4055	* @inode: inode
4056	* @cp: security context
4057	*
4058	* On success, returns 0 and fills out @cp with the security context
4059	* for the given @inode.
4060	*
4061	* Return: Returns 0 on success, error on failure.
4062	*/
4063	int security_inode_getsecctx(struct inode inode, struct lsm_context cp)
4064	{
4065	memset(cp, 0, sizeof(*cp));
4066	return call_int_hook(inode_getsecctx, inode, cp);
4067	}
4068	EXPORT_SYMBOL(security_inode_getsecctx);
4069
4070	#ifdef CONFIG_WATCH_QUEUE
4071	/**
4072	* security_post_notification() - Check if a watch notification can be posted
4073	* @w_cred: credentials of the task that set the watch
4074	* @cred: credentials of the task which triggered the watch
4075	* @n: the notification
4076	*
4077	* Check to see if a watch notification can be posted to a particular queue.
4078	*
4079	* Return: Returns 0 if permission is granted.
4080	*/
4081	int security_post_notification(const struct cred *w_cred,
4082	const struct cred *cred,
4083	struct watch_notification *n)
4084	{
4085	return call_int_hook(post_notification, w_cred, cred, n);
4086	}
4087	#endif /* CONFIG_WATCH_QUEUE */
4088
4089	#ifdef CONFIG_KEY_NOTIFICATIONS
4090	/**
4091	* security_watch_key() - Check if a task is allowed to watch for key events
4092	* @key: the key to watch
4093	*
4094	* Check to see if a process is allowed to watch for event notifications from
4095	* a key or keyring.
4096	*
4097	* Return: Returns 0 if permission is granted.
4098	*/
4099	int security_watch_key(struct key *key)
4100	{
4101	return call_int_hook(watch_key, key);
4102	}
4103	#endif /* CONFIG_KEY_NOTIFICATIONS */
4104
4105	#ifdef CONFIG_SECURITY_NETWORK
4106	/**
4107	* security_netlink_send() - Save info and check if netlink sending is allowed
4108	* @sk: sending socket
4109	* @skb: netlink message
4110	*
4111	* Save security information for a netlink message so that permission checking
4112	* can be performed when the message is processed. The security information
4113	* can be saved using the eff_cap field of the netlink_skb_parms structure.
4114	* Also may be used to provide fine grained control over message transmission.
4115	*
4116	* Return: Returns 0 if the information was successfully saved and message is
4117	* allowed to be transmitted.
4118	*/
4119	int security_netlink_send(struct sock sk, struct sk_buff skb)
4120	{
4121	return call_int_hook(netlink_send, sk, skb);
4122	}
4123
4124	/**
4125	* security_unix_stream_connect() - Check if a AF_UNIX stream is allowed
4126	* @sock: originating sock
4127	* @other: peer sock
4128	* @newsk: new sock
4129	*
4130	* Check permissions before establishing a Unix domain stream connection
4131	* between @sock and @other.
4132	*
4133	* The @unix_stream_connect and @unix_may_send hooks were necessary because
4134	* Linux provides an alternative to the conventional file name space for Unix
4135	* domain sockets. Whereas binding and connecting to sockets in the file name
4136	* space is mediated by the typical file permissions (and caught by the mknod
4137	* and permission hooks in inode_security_ops), binding and connecting to
4138	* sockets in the abstract name space is completely unmediated. Sufficient
4139	* control of Unix domain sockets in the abstract name space isn't possible
4140	* using only the socket layer hooks, since we need to know the actual target
4141	* socket, which is not looked up until we are inside the af_unix code.
4142	*
4143	* Return: Returns 0 if permission is granted.
4144	*/
4145	int security_unix_stream_connect(struct sock sock, struct sock other,
4146	struct sock *newsk)
4147	{
4148	return call_int_hook(unix_stream_connect, sock, other, newsk);
4149	}
4150	EXPORT_SYMBOL(security_unix_stream_connect);
4151
4152	/**
4153	* security_unix_may_send() - Check if AF_UNIX socket can send datagrams
4154	* @sock: originating sock
4155	* @other: peer sock
4156	*
4157	* Check permissions before connecting or sending datagrams from @sock to
4158	* @other.
4159	*
4160	* The @unix_stream_connect and @unix_may_send hooks were necessary because
4161	* Linux provides an alternative to the conventional file name space for Unix
4162	* domain sockets. Whereas binding and connecting to sockets in the file name
4163	* space is mediated by the typical file permissions (and caught by the mknod
4164	* and permission hooks in inode_security_ops), binding and connecting to
4165	* sockets in the abstract name space is completely unmediated. Sufficient
4166	* control of Unix domain sockets in the abstract name space isn't possible
4167	* using only the socket layer hooks, since we need to know the actual target
4168	* socket, which is not looked up until we are inside the af_unix code.
4169	*
4170	* Return: Returns 0 if permission is granted.
4171	*/
4172	int security_unix_may_send(struct socket sock, struct socket other)
4173	{
4174	return call_int_hook(unix_may_send, sock, other);
4175	}
4176	EXPORT_SYMBOL(security_unix_may_send);
4177
4178	/**
4179	* security_socket_create() - Check if creating a new socket is allowed
4180	* @family: protocol family
4181	* @type: communications type
4182	* @protocol: requested protocol
4183	* @kern: set to 1 if a kernel socket is requested
4184	*
4185	* Check permissions prior to creating a new socket.
4186	*
4187	* Return: Returns 0 if permission is granted.
4188	*/
4189	int security_socket_create(int family, int type, int protocol, int kern)
4190	{
4191	return call_int_hook(socket_create, family, type, protocol, kern);
4192	}
4193
4194	/**
4195	* security_socket_post_create() - Initialize a newly created socket
4196	* @sock: socket
4197	* @family: protocol family
4198	* @type: communications type
4199	* @protocol: requested protocol
4200	* @kern: set to 1 if a kernel socket is requested
4201	*
4202	* This hook allows a module to update or allocate a per-socket security
4203	* structure. Note that the security field was not added directly to the socket
4204	* structure, but rather, the socket security information is stored in the
4205	* associated inode. Typically, the inode alloc_security hook will allocate
4206	* and attach security information to SOCK_INODE(sock)->i_security. This hook
4207	* may be used to update the SOCK_INODE(sock)->i_security field with additional
4208	* information that wasn't available when the inode was allocated.
4209	*
4210	* Return: Returns 0 if permission is granted.
4211	*/
4212	int security_socket_post_create(struct socket *sock, int family,
4213	int type, int protocol, int kern)
4214	{
4215	return call_int_hook(socket_post_create, sock, family, type,
4216	protocol, kern);
4217	}
4218
4219	/**
4220	* security_socket_socketpair() - Check if creating a socketpair is allowed
4221	* @socka: first socket
4222	* @sockb: second socket
4223	*
4224	* Check permissions before creating a fresh pair of sockets.
4225	*
4226	* Return: Returns 0 if permission is granted and the connection was
4227	* established.
4228	*/
4229	int security_socket_socketpair(struct socket socka, struct socket sockb)
4230	{
4231	return call_int_hook(socket_socketpair, socka, sockb);
4232	}
4233	EXPORT_SYMBOL(security_socket_socketpair);
4234
4235	/**
4236	* security_socket_bind() - Check if a socket bind operation is allowed
4237	* @sock: socket
4238	* @address: requested bind address
4239	* @addrlen: length of address
4240	*
4241	* Check permission before socket protocol layer bind operation is performed
4242	* and the socket @sock is bound to the address specified in the @address
4243	* parameter.
4244	*
4245	* Return: Returns 0 if permission is granted.
4246	*/
4247	int security_socket_bind(struct socket *sock,
4248	struct sockaddr *address, int addrlen)
4249	{
4250	return call_int_hook(socket_bind, sock, address, addrlen);
4251	}
4252
4253	/**
4254	* security_socket_connect() - Check if a socket connect operation is allowed
4255	* @sock: socket
4256	* @address: address of remote connection point
4257	* @addrlen: length of address
4258	*
4259	* Check permission before socket protocol layer connect operation attempts to
4260	* connect socket @sock to a remote address, @address.
4261	*
4262	* Return: Returns 0 if permission is granted.
4263	*/
4264	int security_socket_connect(struct socket *sock,
4265	struct sockaddr *address, int addrlen)
4266	{
4267	return call_int_hook(socket_connect, sock, address, addrlen);
4268	}
4269
4270	/**
4271	* security_socket_listen() - Check if a socket is allowed to listen
4272	* @sock: socket
4273	* @backlog: connection queue size
4274	*
4275	* Check permission before socket protocol layer listen operation.
4276	*
4277	* Return: Returns 0 if permission is granted.
4278	*/
4279	int security_socket_listen(struct socket *sock, int backlog)
4280	{
4281	return call_int_hook(socket_listen, sock, backlog);
4282	}
4283
4284	/**
4285	* security_socket_accept() - Check if a socket is allowed to accept connections
4286	* @sock: listening socket
4287	* @newsock: newly creation connection socket
4288	*
4289	* Check permission before accepting a new connection. Note that the new
4290	* socket, @newsock, has been created and some information copied to it, but
4291	* the accept operation has not actually been performed.
4292	*
4293	* Return: Returns 0 if permission is granted.
4294	*/
4295	int security_socket_accept(struct socket sock, struct socket newsock)
4296	{
4297	return call_int_hook(socket_accept, sock, newsock);
4298	}
4299
4300	/**
4301	* security_socket_sendmsg() - Check if sending a message is allowed
4302	* @sock: sending socket
4303	* @msg: message to send
4304	* @size: size of message
4305	*
4306	* Check permission before transmitting a message to another socket.
4307	*
4308	* Return: Returns 0 if permission is granted.
4309	*/
4310	int security_socket_sendmsg(struct socket sock, struct msghdr msg, int size)
4311	{
4312	return call_int_hook(socket_sendmsg, sock, msg, size);
4313	}
4314
4315	/**
4316	* security_socket_recvmsg() - Check if receiving a message is allowed
4317	* @sock: receiving socket
4318	* @msg: message to receive
4319	* @size: size of message
4320	* @flags: operational flags
4321	*
4322	* Check permission before receiving a message from a socket.
4323	*
4324	* Return: Returns 0 if permission is granted.
4325	*/
4326	int security_socket_recvmsg(struct socket sock, struct msghdr msg,
4327	int size, int flags)
4328	{
4329	return call_int_hook(socket_recvmsg, sock, msg, size, flags);
4330	}
4331
4332	/**
4333	* security_socket_getsockname() - Check if reading the socket addr is allowed
4334	* @sock: socket
4335	*
4336	* Check permission before reading the local address (name) of the socket
4337	* object.
4338	*
4339	* Return: Returns 0 if permission is granted.
4340	*/
4341	int security_socket_getsockname(struct socket *sock)
4342	{
4343	return call_int_hook(socket_getsockname, sock);
4344	}
4345
4346	/**
4347	* security_socket_getpeername() - Check if reading the peer's addr is allowed
4348	* @sock: socket
4349	*
4350	* Check permission before the remote address (name) of a socket object.
4351	*
4352	* Return: Returns 0 if permission is granted.
4353	*/
4354	int security_socket_getpeername(struct socket *sock)
4355	{
4356	return call_int_hook(socket_getpeername, sock);
4357	}
4358
4359	/**
4360	* security_socket_getsockopt() - Check if reading a socket option is allowed
4361	* @sock: socket
4362	* @level: option's protocol level
4363	* @optname: option name
4364	*
4365	* Check permissions before retrieving the options associated with socket
4366	* @sock.
4367	*
4368	* Return: Returns 0 if permission is granted.
4369	*/
4370	int security_socket_getsockopt(struct socket *sock, int level, int optname)
4371	{
4372	return call_int_hook(socket_getsockopt, sock, level, optname);
4373	}
4374
4375	/**
4376	* security_socket_setsockopt() - Check if setting a socket option is allowed
4377	* @sock: socket
4378	* @level: option's protocol level
4379	* @optname: option name
4380	*
4381	* Check permissions before setting the options associated with socket @sock.
4382	*
4383	* Return: Returns 0 if permission is granted.
4384	*/
4385	int security_socket_setsockopt(struct socket *sock, int level, int optname)
4386	{
4387	return call_int_hook(socket_setsockopt, sock, level, optname);
4388	}
4389
4390	/**
4391	* security_socket_shutdown() - Checks if shutting down the socket is allowed
4392	* @sock: socket
4393	* @how: flag indicating how sends and receives are handled
4394	*
4395	* Checks permission before all or part of a connection on the socket @sock is
4396	* shut down.
4397	*
4398	* Return: Returns 0 if permission is granted.
4399	*/
4400	int security_socket_shutdown(struct socket *sock, int how)
4401	{
4402	return call_int_hook(socket_shutdown, sock, how);
4403	}
4404
4405	/**
4406	* security_sock_rcv_skb() - Check if an incoming network packet is allowed
4407	* @sk: destination sock
4408	* @skb: incoming packet
4409	*
4410	* Check permissions on incoming network packets. This hook is distinct from
4411	* Netfilter's IP input hooks since it is the first time that the incoming
4412	* sk_buff @skb has been associated with a particular socket, @sk. Must not
4413	* sleep inside this hook because some callers hold spinlocks.
4414	*
4415	* Return: Returns 0 if permission is granted.
4416	*/
4417	int security_sock_rcv_skb(struct sock sk, struct sk_buff skb)
4418	{
4419	return call_int_hook(socket_sock_rcv_skb, sk, skb);
4420	}
4421	EXPORT_SYMBOL(security_sock_rcv_skb);
4422
4423	/**
4424	* security_socket_getpeersec_stream() - Get the remote peer label
4425	* @sock: socket
4426	* @optval: destination buffer
4427	* @optlen: size of peer label copied into the buffer
4428	* @len: maximum size of the destination buffer
4429	*
4430	* This hook allows the security module to provide peer socket security state
4431	* for unix or connected tcp sockets to userspace via getsockopt SO_GETPEERSEC.
4432	* For tcp sockets this can be meaningful if the socket is associated with an
4433	* ipsec SA.
4434	*
4435	* Return: Returns 0 if all is well, otherwise, typical getsockopt return
4436	* values.
4437	*/
4438	int security_socket_getpeersec_stream(struct socket *sock, sockptr_t optval,
4439	sockptr_t optlen, unsigned int len)
4440	{
4441	return call_int_hook(socket_getpeersec_stream, sock, optval, optlen,
4442	len);
4443	}
4444
4445	/**
4446	* security_socket_getpeersec_dgram() - Get the remote peer label
4447	* @sock: socket
4448	* @skb: datagram packet
4449	* @secid: remote peer label secid
4450	*
4451	* This hook allows the security module to provide peer socket security state
4452	* for udp sockets on a per-packet basis to userspace via getsockopt
4453	* SO_GETPEERSEC. The application must first have indicated the IP_PASSSEC
4454	* option via getsockopt. It can then retrieve the security state returned by
4455	* this hook for a packet via the SCM_SECURITY ancillary message type.
4456	*
4457	* Return: Returns 0 on success, error on failure.
4458	*/
4459	int security_socket_getpeersec_dgram(struct socket *sock,
4460	struct sk_buff skb, u32 secid)
4461	{
4462	return call_int_hook(socket_getpeersec_dgram, sock, skb, secid);
4463	}
4464	EXPORT_SYMBOL(security_socket_getpeersec_dgram);
4465
4466	/**
4467	* lsm_sock_alloc - allocate a composite sock blob
4468	* @sock: the sock that needs a blob
4469	* @gfp: allocation mode
4470	*
4471	* Allocate the sock blob for all the modules
4472	*
4473	* Returns 0, or -ENOMEM if memory can't be allocated.
4474	*/
4475	static int lsm_sock_alloc(struct sock *sock, gfp_t gfp)
4476	{
4477	return lsm_blob_alloc(&sock->sk_security, blob_sizes.lbs_sock, gfp);
4478	}
4479
4480	/**
4481	* security_sk_alloc() - Allocate and initialize a sock's LSM blob
4482	* @sk: sock
4483	* @family: protocol family
4484	* @priority: gfp flags
4485	*
4486	* Allocate and attach a security structure to the sk->sk_security field, which
4487	* is used to copy security attributes between local stream sockets.
4488	*
4489	* Return: Returns 0 on success, error on failure.
4490	*/
4491	int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
4492	{
4493	int rc = lsm_sock_alloc(sk, priority);
4494
4495	if (unlikely(rc))
4496	return rc;
4497	rc = call_int_hook(sk_alloc_security, sk, family, priority);
4498	if (unlikely(rc))
4499	security_sk_free(sk);
4500	return rc;
4501	}
4502
4503	/**
4504	* security_sk_free() - Free the sock's LSM blob
4505	* @sk: sock
4506	*
4507	* Deallocate security structure.
4508	*/
4509	void security_sk_free(struct sock *sk)
4510	{
4511	call_void_hook(sk_free_security, sk);
4512	kfree(sk->sk_security);
4513	sk->sk_security = NULL;
4514	}
4515
4516	/**
4517	* security_sk_clone() - Clone a sock's LSM state
4518	* @sk: original sock
4519	* @newsk: target sock
4520	*
4521	* Clone/copy security structure.
4522	*/
4523	void security_sk_clone(const struct sock sk, struct sock newsk)
4524	{
4525	call_void_hook(sk_clone_security, sk, newsk);
4526	}
4527	EXPORT_SYMBOL(security_sk_clone);
4528
4529	/**
4530	* security_sk_classify_flow() - Set a flow's secid based on socket
4531	* @sk: original socket
4532	* @flic: target flow
4533	*
4534	* Set the target flow's secid to socket's secid.
4535	*/
4536	void security_sk_classify_flow(const struct sock sk, struct flowi_common flic)
4537	{
4538	call_void_hook(sk_getsecid, sk, &flic->flowic_secid);
4539	}
4540	EXPORT_SYMBOL(security_sk_classify_flow);
4541
4542	/**
4543	* security_req_classify_flow() - Set a flow's secid based on request_sock
4544	* @req: request_sock
4545	* @flic: target flow
4546	*
4547	* Sets @flic's secid to @req's secid.
4548	*/
4549	void security_req_classify_flow(const struct request_sock *req,
4550	struct flowi_common *flic)
4551	{
4552	call_void_hook(req_classify_flow, req, flic);
4553	}
4554	EXPORT_SYMBOL(security_req_classify_flow);
4555
4556	/**
4557	* security_sock_graft() - Reconcile LSM state when grafting a sock on a socket
4558	* @sk: sock being grafted
4559	* @parent: target parent socket
4560	*
4561	* Sets @parent's inode secid to @sk's secid and update @sk with any necessary
4562	* LSM state from @parent.
4563	*/
4564	void security_sock_graft(struct sock sk, struct socket parent)
4565	{
4566	call_void_hook(sock_graft, sk, parent);
4567	}
4568	EXPORT_SYMBOL(security_sock_graft);
4569
4570	/**
4571	* security_inet_conn_request() - Set request_sock state using incoming connect
4572	* @sk: parent listening sock
4573	* @skb: incoming connection
4574	* @req: new request_sock
4575	*
4576	* Initialize the @req LSM state based on @sk and the incoming connect in @skb.
4577	*
4578	* Return: Returns 0 if permission is granted.
4579	*/
4580	int security_inet_conn_request(const struct sock *sk,
4581	struct sk_buff skb, struct request_sock req)
4582	{
4583	return call_int_hook(inet_conn_request, sk, skb, req);
4584	}
4585	EXPORT_SYMBOL(security_inet_conn_request);
4586
4587	/**
4588	* security_inet_csk_clone() - Set new sock LSM state based on request_sock
4589	* @newsk: new sock
4590	* @req: connection request_sock
4591	*
4592	* Set that LSM state of @sock using the LSM state from @req.
4593	*/
4594	void security_inet_csk_clone(struct sock *newsk,
4595	const struct request_sock *req)
4596	{
4597	call_void_hook(inet_csk_clone, newsk, req);
4598	}
4599
4600	/**
4601	* security_inet_conn_established() - Update sock's LSM state with connection
4602	* @sk: sock
4603	* @skb: connection packet
4604	*
4605	* Update @sock's LSM state to represent a new connection from @skb.
4606	*/
4607	void security_inet_conn_established(struct sock *sk,
4608	struct sk_buff *skb)
4609	{
4610	call_void_hook(inet_conn_established, sk, skb);
4611	}
4612	EXPORT_SYMBOL(security_inet_conn_established);
4613
4614	/**
4615	* security_secmark_relabel_packet() - Check if setting a secmark is allowed
4616	* @secid: new secmark value
4617	*
4618	* Check if the process should be allowed to relabel packets to @secid.
4619	*
4620	* Return: Returns 0 if permission is granted.
4621	*/
4622	int security_secmark_relabel_packet(u32 secid)
4623	{
4624	return call_int_hook(secmark_relabel_packet, secid);
4625	}
4626	EXPORT_SYMBOL(security_secmark_relabel_packet);
4627
4628	/**
4629	* security_secmark_refcount_inc() - Increment the secmark labeling rule count
4630	*
4631	* Tells the LSM to increment the number of secmark labeling rules loaded.
4632	*/
4633	void security_secmark_refcount_inc(void)
4634	{
4635	call_void_hook(secmark_refcount_inc);
4636	}
4637	EXPORT_SYMBOL(security_secmark_refcount_inc);
4638
4639	/**
4640	* security_secmark_refcount_dec() - Decrement the secmark labeling rule count
4641	*
4642	* Tells the LSM to decrement the number of secmark labeling rules loaded.
4643	*/
4644	void security_secmark_refcount_dec(void)
4645	{
4646	call_void_hook(secmark_refcount_dec);
4647	}
4648	EXPORT_SYMBOL(security_secmark_refcount_dec);
4649
4650	/**
4651	* security_tun_dev_alloc_security() - Allocate a LSM blob for a TUN device
4652	* @security: pointer to the LSM blob
4653	*
4654	* This hook allows a module to allocate a security structure for a TUN device,
4655	* returning the pointer in @security.
4656	*
4657	* Return: Returns a zero on success, negative values on failure.
4658	*/
4659	int security_tun_dev_alloc_security(void **security)
4660	{
4661	int rc;
4662
4663	rc = lsm_blob_alloc(security, blob_sizes.lbs_tun_dev, GFP_KERNEL);
4664	if (rc)
4665	return rc;
4666
4667	rc = call_int_hook(tun_dev_alloc_security, *security);
4668	if (rc) {
4669	kfree(*security);
4670	*security = NULL;
4671	}
4672	return rc;
4673	}
4674	EXPORT_SYMBOL(security_tun_dev_alloc_security);
4675
4676	/**
4677	* security_tun_dev_free_security() - Free a TUN device LSM blob
4678	* @security: LSM blob
4679	*
4680	* This hook allows a module to free the security structure for a TUN device.
4681	*/
4682	void security_tun_dev_free_security(void *security)
4683	{
4684	kfree(security);
4685	}
4686	EXPORT_SYMBOL(security_tun_dev_free_security);
4687
4688	/**
4689	* security_tun_dev_create() - Check if creating a TUN device is allowed
4690	*
4691	* Check permissions prior to creating a new TUN device.
4692	*
4693	* Return: Returns 0 if permission is granted.
4694	*/
4695	int security_tun_dev_create(void)
4696	{
4697	return call_int_hook(tun_dev_create);
4698	}
4699	EXPORT_SYMBOL(security_tun_dev_create);
4700
4701	/**
4702	* security_tun_dev_attach_queue() - Check if attaching a TUN queue is allowed
4703	* @security: TUN device LSM blob
4704	*
4705	* Check permissions prior to attaching to a TUN device queue.
4706	*
4707	* Return: Returns 0 if permission is granted.
4708	*/
4709	int security_tun_dev_attach_queue(void *security)
4710	{
4711	return call_int_hook(tun_dev_attach_queue, security);
4712	}
4713	EXPORT_SYMBOL(security_tun_dev_attach_queue);
4714
4715	/**
4716	* security_tun_dev_attach() - Update TUN device LSM state on attach
4717	* @sk: associated sock
4718	* @security: TUN device LSM blob
4719	*
4720	* This hook can be used by the module to update any security state associated
4721	* with the TUN device's sock structure.
4722	*
4723	* Return: Returns 0 if permission is granted.
4724	*/
4725	int security_tun_dev_attach(struct sock sk, void security)
4726	{
4727	return call_int_hook(tun_dev_attach, sk, security);
4728	}
4729	EXPORT_SYMBOL(security_tun_dev_attach);
4730
4731	/**
4732	* security_tun_dev_open() - Update TUN device LSM state on open
4733	* @security: TUN device LSM blob
4734	*
4735	* This hook can be used by the module to update any security state associated
4736	* with the TUN device's security structure.
4737	*
4738	* Return: Returns 0 if permission is granted.
4739	*/
4740	int security_tun_dev_open(void *security)
4741	{
4742	return call_int_hook(tun_dev_open, security);
4743	}
4744	EXPORT_SYMBOL(security_tun_dev_open);
4745
4746	/**
4747	* security_sctp_assoc_request() - Update the LSM on a SCTP association req
4748	* @asoc: SCTP association
4749	* @skb: packet requesting the association
4750	*
4751	* Passes the @asoc and @chunk->skb of the association INIT packet to the LSM.
4752	*
4753	* Return: Returns 0 on success, error on failure.
4754	*/
4755	int security_sctp_assoc_request(struct sctp_association *asoc,
4756	struct sk_buff *skb)
4757	{
4758	return call_int_hook(sctp_assoc_request, asoc, skb);
4759	}
4760	EXPORT_SYMBOL(security_sctp_assoc_request);
4761
4762	/**
4763	* security_sctp_bind_connect() - Validate a list of addrs for a SCTP option
4764	* @sk: socket
4765	* @optname: SCTP option to validate
4766	* @address: list of IP addresses to validate
4767	* @addrlen: length of the address list
4768	*
4769	* Validiate permissions required for each address associated with sock @sk.
4770	* Depending on @optname, the addresses will be treated as either a connect or
4771	* bind service. The @addrlen is calculated on each IPv4 and IPv6 address using
4772	* sizeof(struct sockaddr_in) or sizeof(struct sockaddr_in6).
4773	*
4774	* Return: Returns 0 on success, error on failure.
4775	*/
4776	int security_sctp_bind_connect(struct sock *sk, int optname,
4777	struct sockaddr *address, int addrlen)
4778	{
4779	return call_int_hook(sctp_bind_connect, sk, optname, address, addrlen);
4780	}
4781	EXPORT_SYMBOL(security_sctp_bind_connect);
4782
4783	/**
4784	* security_sctp_sk_clone() - Clone a SCTP sock's LSM state
4785	* @asoc: SCTP association
4786	* @sk: original sock
4787	* @newsk: target sock
4788	*
4789	* Called whenever a new socket is created by accept(2) (i.e. a TCP style
4790	* socket) or when a socket is 'peeled off' e.g userspace calls
4791	* sctp_peeloff(3).
4792	*/
4793	void security_sctp_sk_clone(struct sctp_association asoc, struct sock sk,
4794	struct sock *newsk)
4795	{
4796	call_void_hook(sctp_sk_clone, asoc, sk, newsk);
4797	}
4798	EXPORT_SYMBOL(security_sctp_sk_clone);
4799
4800	/**
4801	* security_sctp_assoc_established() - Update LSM state when assoc established
4802	* @asoc: SCTP association
4803	* @skb: packet establishing the association
4804	*
4805	* Passes the @asoc and @chunk->skb of the association COOKIE_ACK packet to the
4806	* security module.
4807	*
4808	* Return: Returns 0 if permission is granted.
4809	*/
4810	int security_sctp_assoc_established(struct sctp_association *asoc,
4811	struct sk_buff *skb)
4812	{
4813	return call_int_hook(sctp_assoc_established, asoc, skb);
4814	}
4815	EXPORT_SYMBOL(security_sctp_assoc_established);
4816
4817	/**
4818	* security_mptcp_add_subflow() - Inherit the LSM label from the MPTCP socket
4819	* @sk: the owning MPTCP socket
4820	* @ssk: the new subflow
4821	*
4822	* Update the labeling for the given MPTCP subflow, to match the one of the
4823	* owning MPTCP socket. This hook has to be called after the socket creation and
4824	* initialization via the security_socket_create() and
4825	* security_socket_post_create() LSM hooks.
4826	*
4827	* Return: Returns 0 on success or a negative error code on failure.
4828	*/
4829	int security_mptcp_add_subflow(struct sock sk, struct sock ssk)
4830	{
4831	return call_int_hook(mptcp_add_subflow, sk, ssk);
4832	}
4833
4834	#endif /* CONFIG_SECURITY_NETWORK */
4835
4836	#if defined(CONFIG_SECURITY_NETWORK) && defined(CONFIG_SECURITY_PATH)
4837	/**
4838	* security_unix_find() - Check if a named AF_UNIX socket can connect
4839	* @path: path of the socket being connected to
4840	* @other: peer sock
4841	* @flags: flags associated with the socket
4842	*
4843	* This hook is called to check permissions before connecting to a named
4844	* AF_UNIX socket. The caller does not hold any locks on @other.
4845	*
4846	* Return: Returns 0 if permission is granted.
4847	*/
4848	int security_unix_find(const struct path path, struct sock other, int flags)
4849	{
4850	return call_int_hook(unix_find, path, other, flags);
4851	}
4852	EXPORT_SYMBOL(security_unix_find);
4853
4854	#endif /* CONFIG_SECURITY_NETWORK && CONFIG_SECURITY_PATH */
4855
4856	#ifdef CONFIG_SECURITY_INFINIBAND
4857	/**
4858	* security_ib_pkey_access() - Check if access to an IB pkey is allowed
4859	* @sec: LSM blob
4860	* @subnet_prefix: subnet prefix of the port
4861	* @pkey: IB pkey
4862	*
4863	* Check permission to access a pkey when modifying a QP.
4864	*
4865	* Return: Returns 0 if permission is granted.
4866	*/
4867	int security_ib_pkey_access(void *sec, u64 subnet_prefix, u16 pkey)
4868	{
4869	return call_int_hook(ib_pkey_access, sec, subnet_prefix, pkey);
4870	}
4871	EXPORT_SYMBOL(security_ib_pkey_access);
4872
4873	/**
4874	* security_ib_endport_manage_subnet() - Check if SMPs traffic is allowed
4875	* @sec: LSM blob
4876	* @dev_name: IB device name
4877	* @port_num: port number
4878	*
4879	* Check permissions to send and receive SMPs on a end port.
4880	*
4881	* Return: Returns 0 if permission is granted.
4882	*/
4883	int security_ib_endport_manage_subnet(void *sec,
4884	const char *dev_name, u8 port_num)
4885	{
4886	return call_int_hook(ib_endport_manage_subnet, sec, dev_name, port_num);
4887	}
4888	EXPORT_SYMBOL(security_ib_endport_manage_subnet);
4889
4890	/**
4891	* security_ib_alloc_security() - Allocate an Infiniband LSM blob
4892	* @sec: LSM blob
4893	*
4894	* Allocate a security structure for Infiniband objects.
4895	*
4896	* Return: Returns 0 on success, non-zero on failure.
4897	*/
4898	int security_ib_alloc_security(void **sec)
4899	{
4900	int rc;
4901
4902	rc = lsm_blob_alloc(sec, blob_sizes.lbs_ib, GFP_KERNEL);
4903	if (rc)
4904	return rc;
4905
4906	rc = call_int_hook(ib_alloc_security, *sec);
4907	if (rc) {
4908	kfree(*sec);
4909	*sec = NULL;
4910	}
4911	return rc;
4912	}
4913	EXPORT_SYMBOL(security_ib_alloc_security);
4914
4915	/**
4916	* security_ib_free_security() - Free an Infiniband LSM blob
4917	* @sec: LSM blob
4918	*
4919	* Deallocate an Infiniband security structure.
4920	*/
4921	void security_ib_free_security(void *sec)
4922	{
4923	kfree(sec);
4924	}
4925	EXPORT_SYMBOL(security_ib_free_security);
4926	#endif /* CONFIG_SECURITY_INFINIBAND */
4927
4928	#ifdef CONFIG_SECURITY_NETWORK_XFRM
4929	/**
4930	* security_xfrm_policy_alloc() - Allocate a xfrm policy LSM blob
4931	* @ctxp: xfrm security context being added to the SPD
4932	* @sec_ctx: security label provided by userspace
4933	* @gfp: gfp flags
4934	*
4935	* Allocate a security structure to the xp->security field; the security field
4936	* is initialized to NULL when the xfrm_policy is allocated.
4937	*
4938	* Return: Return 0 if operation was successful.
4939	*/
4940	int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
4941	struct xfrm_user_sec_ctx *sec_ctx,
4942	gfp_t gfp)
4943	{
4944	return call_int_hook(xfrm_policy_alloc_security, ctxp, sec_ctx, gfp);
4945	}
4946	EXPORT_SYMBOL(security_xfrm_policy_alloc);
4947
4948	/**
4949	* security_xfrm_policy_clone() - Clone xfrm policy LSM state
4950	* @old_ctx: xfrm security context
4951	* @new_ctxp: target xfrm security context
4952	*
4953	* Allocate a security structure in new_ctxp that contains the information from
4954	* the old_ctx structure.
4955	*
4956	* Return: Return 0 if operation was successful.
4957	*/
4958	int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
4959	struct xfrm_sec_ctx **new_ctxp)
4960	{
4961	return call_int_hook(xfrm_policy_clone_security, old_ctx, new_ctxp);
4962	}
4963
4964	/**
4965	* security_xfrm_policy_free() - Free a xfrm security context
4966	* @ctx: xfrm security context
4967	*
4968	* Free LSM resources associated with @ctx.
4969	*/
4970	void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
4971	{
4972	call_void_hook(xfrm_policy_free_security, ctx);
4973	}
4974	EXPORT_SYMBOL(security_xfrm_policy_free);
4975
4976	/**
4977	* security_xfrm_policy_delete() - Check if deleting a xfrm policy is allowed
4978	* @ctx: xfrm security context
4979	*
4980	* Authorize deletion of a SPD entry.
4981	*
4982	* Return: Returns 0 if permission is granted.
4983	*/
4984	int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
4985	{
4986	return call_int_hook(xfrm_policy_delete_security, ctx);
4987	}
4988
4989	/**
4990	* security_xfrm_state_alloc() - Allocate a xfrm state LSM blob
4991	* @x: xfrm state being added to the SAD
4992	* @sec_ctx: security label provided by userspace
4993	*
4994	* Allocate a security structure to the @x->security field; the security field
4995	* is initialized to NULL when the xfrm_state is allocated. Set the context to
4996	* correspond to @sec_ctx.
4997	*
4998	* Return: Return 0 if operation was successful.
4999	*/
5000	int security_xfrm_state_alloc(struct xfrm_state *x,
5001	struct xfrm_user_sec_ctx *sec_ctx)
5002	{
5003	return call_int_hook(xfrm_state_alloc, x, sec_ctx);
5004	}
5005	EXPORT_SYMBOL(security_xfrm_state_alloc);
5006
5007	/**
5008	* security_xfrm_state_alloc_acquire() - Allocate a xfrm state LSM blob
5009	* @x: xfrm state being added to the SAD
5010	* @polsec: associated policy's security context
5011	* @secid: secid from the flow
5012	*
5013	* Allocate a security structure to the x->security field; the security field
5014	* is initialized to NULL when the xfrm_state is allocated. Set the context to
5015	* correspond to secid.
5016	*
5017	* Return: Returns 0 if operation was successful.
5018	*/
5019	int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
5020	struct xfrm_sec_ctx *polsec, u32 secid)
5021	{
5022	return call_int_hook(xfrm_state_alloc_acquire, x, polsec, secid);
5023	}
5024
5025	/**
5026	* security_xfrm_state_delete() - Check if deleting a xfrm state is allowed
5027	* @x: xfrm state
5028	*
5029	* Authorize deletion of x->security.
5030	*
5031	* Return: Returns 0 if permission is granted.
5032	*/
5033	int security_xfrm_state_delete(struct xfrm_state *x)
5034	{
5035	return call_int_hook(xfrm_state_delete_security, x);
5036	}
5037	EXPORT_SYMBOL(security_xfrm_state_delete);
5038
5039	/**
5040	* security_xfrm_state_free() - Free a xfrm state
5041	* @x: xfrm state
5042	*
5043	* Deallocate x->security.
5044	*/
5045	void security_xfrm_state_free(struct xfrm_state *x)
5046	{
5047	call_void_hook(xfrm_state_free_security, x);
5048	}
5049
5050	/**
5051	* security_xfrm_policy_lookup() - Check if using a xfrm policy is allowed
5052	* @ctx: target xfrm security context
5053	* @fl_secid: flow secid used to authorize access
5054	*
5055	* Check permission when a flow selects a xfrm_policy for processing XFRMs on a
5056	* packet. The hook is called when selecting either a per-socket policy or a
5057	* generic xfrm policy.
5058	*
5059	* Return: Return 0 if permission is granted, -ESRCH otherwise, or -errno on
5060	* other errors.
5061	*/
5062	int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid)
5063	{
5064	return call_int_hook(xfrm_policy_lookup, ctx, fl_secid);
5065	}
5066
5067	/**
5068	* security_xfrm_state_pol_flow_match() - Check for a xfrm match
5069	* @x: xfrm state to match
5070	* @xp: xfrm policy to check for a match
5071	* @flic: flow to check for a match.
5072	*
5073	* Check @xp and @flic for a match with @x.
5074	*
5075	* Return: Returns 1 if there is a match.
5076	*/
5077	int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
5078	struct xfrm_policy *xp,
5079	const struct flowi_common *flic)
5080	{
5081	struct lsm_static_call *scall;
5082	int rc = LSM_RET_DEFAULT(xfrm_state_pol_flow_match);
5083
5084	/*
5085	* Since this function is expected to return 0 or 1, the judgment
5086	* becomes difficult if multiple LSMs supply this call. Fortunately,
5087	* we can use the first LSM's judgment because currently only SELinux
5088	* supplies this call.
5089	*
5090	* For speed optimization, we explicitly break the loop rather than
5091	* using the macro
5092	*/
5093	lsm_for_each_hook(scall, xfrm_state_pol_flow_match) {
5094	rc = scall->hl->hook.xfrm_state_pol_flow_match(x, xp, flic);
5095	break;
5096	}
5097	return rc;
5098	}
5099
5100	/**
5101	* security_xfrm_decode_session() - Determine the xfrm secid for a packet
5102	* @skb: xfrm packet
5103	* @secid: secid
5104	*
5105	* Decode the packet in @skb and return the security label in @secid.
5106	*
5107	* Return: Return 0 if all xfrms used have the same secid.
5108	*/
5109	int security_xfrm_decode_session(struct sk_buff skb, u32 secid)
5110	{
5111	return call_int_hook(xfrm_decode_session, skb, secid, 1);
5112	}
5113
5114	void security_skb_classify_flow(struct sk_buff skb, struct flowi_common flic)
5115	{
5116	int rc = call_int_hook(xfrm_decode_session, skb, &flic->flowic_secid,
5117	0);
5118
5119	BUG_ON(rc);
5120	}
5121	EXPORT_SYMBOL(security_skb_classify_flow);
5122	#endif /* CONFIG_SECURITY_NETWORK_XFRM */
5123
5124	#ifdef CONFIG_KEYS
5125	/**
5126	* security_key_alloc() - Allocate and initialize a kernel key LSM blob
5127	* @key: key
5128	* @cred: credentials
5129	* @flags: allocation flags
5130	*
5131	* Permit allocation of a key and assign security data. Note that key does not
5132	* have a serial number assigned at this point.
5133	*
5134	* Return: Return 0 if permission is granted, -ve error otherwise.
5135	*/
5136	int security_key_alloc(struct key key, const struct cred cred,
5137	unsigned long flags)
5138	{
5139	int rc = lsm_key_alloc(key);
5140
5141	if (unlikely(rc))
5142	return rc;
5143	rc = call_int_hook(key_alloc, key, cred, flags);
5144	if (unlikely(rc))
5145	security_key_free(key);
5146	return rc;
5147	}
5148
5149	/**
5150	* security_key_free() - Free a kernel key LSM blob
5151	* @key: key
5152	*
5153	* Notification of destruction; free security data.
5154	*/
5155	void security_key_free(struct key *key)
5156	{
5157	kfree(key->security);
5158	key->security = NULL;
5159	}
5160
5161	/**
5162	* security_key_permission() - Check if a kernel key operation is allowed
5163	* @key_ref: key reference
5164	* @cred: credentials of actor requesting access
5165	* @need_perm: requested permissions
5166	*
5167	* See whether a specific operational right is granted to a process on a key.
5168	*
5169	* Return: Return 0 if permission is granted, -ve error otherwise.
5170	*/
5171	int security_key_permission(key_ref_t key_ref, const struct cred *cred,
5172	enum key_need_perm need_perm)
5173	{
5174	return call_int_hook(key_permission, key_ref, cred, need_perm);
5175	}
5176
5177	/**
5178	* security_key_getsecurity() - Get the key's security label
5179	* @key: key
5180	* @buffer: security label buffer
5181	*
5182	* Get a textual representation of the security context attached to a key for
5183	* the purposes of honouring KEYCTL_GETSECURITY. This function allocates the
5184	* storage for the NUL-terminated string and the caller should free it.
5185	*
5186	* Return: Returns the length of @buffer (including terminating NUL) or -ve if
5187	* an error occurs. May also return 0 (and a NULL buffer pointer) if
5188	* there is no security label assigned to the key.
5189	*/
5190	int security_key_getsecurity(struct key key, char *buffer)
5191	{
5192	*buffer = NULL;
5193	return call_int_hook(key_getsecurity, key, buffer);
5194	}
5195
5196	/**
5197	* security_key_post_create_or_update() - Notification of key create or update
5198	* @keyring: keyring to which the key is linked to
5199	* @key: created or updated key
5200	* @payload: data used to instantiate or update the key
5201	* @payload_len: length of payload
5202	* @flags: key flags
5203	* @create: flag indicating whether the key was created or updated
5204	*
5205	* Notify the caller of a key creation or update.
5206	*/
5207	void security_key_post_create_or_update(struct key keyring, struct key key,
5208	const void *payload, size_t payload_len,
5209	unsigned long flags, bool create)
5210	{
5211	call_void_hook(key_post_create_or_update, keyring, key, payload,
5212	payload_len, flags, create);
5213	}
5214	#endif /* CONFIG_KEYS */
5215
5216	#ifdef CONFIG_AUDIT
5217	/**
5218	* security_audit_rule_init() - Allocate and init an LSM audit rule struct
5219	* @field: audit action
5220	* @op: rule operator
5221	* @rulestr: rule context
5222	* @lsmrule: receive buffer for audit rule struct
5223	* @gfp: GFP flag used for kmalloc
5224	*
5225	* Allocate and initialize an LSM audit rule structure.
5226	*
5227	* Return: Return 0 if @lsmrule has been successfully set, -EINVAL in case of
5228	* an invalid rule.
5229	*/
5230	int security_audit_rule_init(u32 field, u32 op, char rulestr, void *lsmrule,
5231	gfp_t gfp)
5232	{
5233	return call_int_hook(audit_rule_init, field, op, rulestr, lsmrule, gfp);
5234	}
5235
5236	/**
5237	* security_audit_rule_known() - Check if an audit rule contains LSM fields
5238	* @krule: audit rule
5239	*
5240	* Specifies whether given @krule contains any fields related to the current
5241	* LSM.
5242	*
5243	* Return: Returns 1 in case of relation found, 0 otherwise.
5244	*/
5245	int security_audit_rule_known(struct audit_krule *krule)
5246	{
5247	return call_int_hook(audit_rule_known, krule);
5248	}
5249
5250	/**
5251	* security_audit_rule_free() - Free an LSM audit rule struct
5252	* @lsmrule: audit rule struct
5253	*
5254	* Deallocate the LSM audit rule structure previously allocated by
5255	* audit_rule_init().
5256	*/
5257	void security_audit_rule_free(void *lsmrule)
5258	{
5259	call_void_hook(audit_rule_free, lsmrule);
5260	}
5261
5262	/**
5263	* security_audit_rule_match() - Check if a label matches an audit rule
5264	* @prop: security label
5265	* @field: LSM audit field
5266	* @op: matching operator
5267	* @lsmrule: audit rule
5268	*
5269	* Determine if given @secid matches a rule previously approved by
5270	* security_audit_rule_known().
5271	*
5272	* Return: Returns 1 if secid matches the rule, 0 if it does not, -ERRNO on
5273	* failure.
5274	*/
5275	int security_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op,
5276	void *lsmrule)
5277	{
5278	return call_int_hook(audit_rule_match, prop, field, op, lsmrule);
5279	}
5280	#endif /* CONFIG_AUDIT */
5281
5282	#ifdef CONFIG_BPF_SYSCALL
5283	/**
5284	* security_bpf() - Check if the bpf syscall operation is allowed
5285	* @cmd: command
5286	* @attr: bpf attribute
5287	* @size: size
5288	* @kernel: whether or not call originated from kernel
5289	*
5290	* Do a initial check for all bpf syscalls after the attribute is copied into
5291	* the kernel. The actual security module can implement their own rules to
5292	* check the specific cmd they need.
5293	*
5294	* Return: Returns 0 if permission is granted.
5295	*/
5296	int security_bpf(int cmd, union bpf_attr *attr, unsigned int size, bool kernel)
5297	{
5298	return call_int_hook(bpf, cmd, attr, size, kernel);
5299	}
5300
5301	/**
5302	* security_bpf_map() - Check if access to a bpf map is allowed
5303	* @map: bpf map
5304	* @fmode: mode
5305	*
5306	* Do a check when the kernel generates and returns a file descriptor for eBPF
5307	* maps.
5308	*
5309	* Return: Returns 0 if permission is granted.
5310	*/
5311	int security_bpf_map(struct bpf_map *map, fmode_t fmode)
5312	{
5313	return call_int_hook(bpf_map, map, fmode);
5314	}
5315
5316	/**
5317	* security_bpf_prog() - Check if access to a bpf program is allowed
5318	* @prog: bpf program
5319	*
5320	* Do a check when the kernel generates and returns a file descriptor for eBPF
5321	* programs.
5322	*
5323	* Return: Returns 0 if permission is granted.
5324	*/
5325	int security_bpf_prog(struct bpf_prog *prog)
5326	{
5327	return call_int_hook(bpf_prog, prog);
5328	}
5329
5330	/**
5331	* security_bpf_map_create() - Check if BPF map creation is allowed
5332	* @map: BPF map object
5333	* @attr: BPF syscall attributes used to create BPF map
5334	* @token: BPF token used to grant user access
5335	* @kernel: whether or not call originated from kernel
5336	*
5337	* Do a check when the kernel creates a new BPF map. This is also the
5338	* point where LSM blob is allocated for LSMs that need them.
5339	*
5340	* Return: Returns 0 on success, error on failure.
5341	*/
5342	int security_bpf_map_create(struct bpf_map map, union bpf_attr attr,
5343	struct bpf_token *token, bool kernel)
5344	{
5345	int rc;
5346
5347	rc = lsm_bpf_map_alloc(map);
5348	if (unlikely(rc))
5349	return rc;
5350
5351	rc = call_int_hook(bpf_map_create, map, attr, token, kernel);
5352	if (unlikely(rc))
5353	security_bpf_map_free(map);
5354	return rc;
5355	}
5356
5357	/**
5358	* security_bpf_prog_load() - Check if loading of BPF program is allowed
5359	* @prog: BPF program object
5360	* @attr: BPF syscall attributes used to create BPF program
5361	* @token: BPF token used to grant user access to BPF subsystem
5362	* @kernel: whether or not call originated from kernel
5363	*
5364	* Perform an access control check when the kernel loads a BPF program and
5365	* allocates associated BPF program object. This hook is also responsible for
5366	* allocating any required LSM state for the BPF program.
5367	*
5368	* Return: Returns 0 on success, error on failure.
5369	*/
5370	int security_bpf_prog_load(struct bpf_prog prog, union bpf_attr attr,
5371	struct bpf_token *token, bool kernel)
5372	{
5373	int rc;
5374
5375	rc = lsm_bpf_prog_alloc(prog);
5376	if (unlikely(rc))
5377	return rc;
5378
5379	rc = call_int_hook(bpf_prog_load, prog, attr, token, kernel);
5380	if (unlikely(rc))
5381	security_bpf_prog_free(prog);
5382	return rc;
5383	}
5384
5385	/**
5386	* security_bpf_token_create() - Check if creating of BPF token is allowed
5387	* @token: BPF token object
5388	* @attr: BPF syscall attributes used to create BPF token
5389	* @path: path pointing to BPF FS mount point from which BPF token is created
5390	*
5391	* Do a check when the kernel instantiates a new BPF token object from BPF FS
5392	* instance. This is also the point where LSM blob can be allocated for LSMs.
5393	*
5394	* Return: Returns 0 on success, error on failure.
5395	*/
5396	int security_bpf_token_create(struct bpf_token token, union bpf_attr attr,
5397	const struct path *path)
5398	{
5399	int rc;
5400
5401	rc = lsm_bpf_token_alloc(token);
5402	if (unlikely(rc))
5403	return rc;
5404
5405	rc = call_int_hook(bpf_token_create, token, attr, path);
5406	if (unlikely(rc))
5407	security_bpf_token_free(token);
5408	return rc;
5409	}
5410
5411	/**
5412	* security_bpf_token_cmd() - Check if BPF token is allowed to delegate
5413	* requested BPF syscall command
5414	* @token: BPF token object
5415	* @cmd: BPF syscall command requested to be delegated by BPF token
5416	*
5417	* Do a check when the kernel decides whether provided BPF token should allow
5418	* delegation of requested BPF syscall command.
5419	*
5420	* Return: Returns 0 on success, error on failure.
5421	*/
5422	int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cmd)
5423	{
5424	return call_int_hook(bpf_token_cmd, token, cmd);
5425	}
5426
5427	/**
5428	* security_bpf_token_capable() - Check if BPF token is allowed to delegate
5429	* requested BPF-related capability
5430	* @token: BPF token object
5431	* @cap: capabilities requested to be delegated by BPF token
5432	*
5433	* Do a check when the kernel decides whether provided BPF token should allow
5434	* delegation of requested BPF-related capabilities.
5435	*
5436	* Return: Returns 0 on success, error on failure.
5437	*/
5438	int security_bpf_token_capable(const struct bpf_token *token, int cap)
5439	{
5440	return call_int_hook(bpf_token_capable, token, cap);
5441	}
5442
5443	/**
5444	* security_bpf_map_free() - Free a bpf map's LSM blob
5445	* @map: bpf map
5446	*
5447	* Clean up the security information stored inside bpf map.
5448	*/
5449	void security_bpf_map_free(struct bpf_map *map)
5450	{
5451	call_void_hook(bpf_map_free, map);
5452	kfree(map->security);
5453	map->security = NULL;
5454	}
5455
5456	/**
5457	* security_bpf_prog_free() - Free a BPF program's LSM blob
5458	* @prog: BPF program struct
5459	*
5460	* Clean up the security information stored inside BPF program.
5461	*/
5462	void security_bpf_prog_free(struct bpf_prog *prog)
5463	{
5464	call_void_hook(bpf_prog_free, prog);
5465	kfree(prog->aux->security);
5466	prog->aux->security = NULL;
5467	}
5468
5469	/**
5470	* security_bpf_token_free() - Free a BPF token's LSM blob
5471	* @token: BPF token struct
5472	*
5473	* Clean up the security information stored inside BPF token.
5474	*/
5475	void security_bpf_token_free(struct bpf_token *token)
5476	{
5477	call_void_hook(bpf_token_free, token);
5478	kfree(token->security);
5479	token->security = NULL;
5480	}
5481	#endif /* CONFIG_BPF_SYSCALL */
5482
5483	/**
5484	* security_locked_down() - Check if a kernel feature is allowed
5485	* @what: requested kernel feature
5486	*
5487	* Determine whether a kernel feature that potentially enables arbitrary code
5488	* execution in kernel space should be permitted.
5489	*
5490	* Return: Returns 0 if permission is granted.
5491	*/
5492	int security_locked_down(enum lockdown_reason what)
5493	{
5494	return call_int_hook(locked_down, what);
5495	}
5496	EXPORT_SYMBOL(security_locked_down);
5497
5498	/**
5499	* security_bdev_alloc() - Allocate a block device LSM blob
5500	* @bdev: block device
5501	*
5502	* Allocate and attach a security structure to @bdev->bd_security. The
5503	* security field is initialized to NULL when the bdev structure is
5504	* allocated.
5505	*
5506	* Return: Return 0 if operation was successful.
5507	*/
5508	int security_bdev_alloc(struct block_device *bdev)
5509	{
5510	int rc = 0;
5511
5512	rc = lsm_bdev_alloc(bdev);
5513	if (unlikely(rc))
5514	return rc;
5515
5516	rc = call_int_hook(bdev_alloc_security, bdev);
5517	if (unlikely(rc))
5518	security_bdev_free(bdev);
5519
5520	return rc;
5521	}
5522	EXPORT_SYMBOL(security_bdev_alloc);
5523
5524	/**
5525	* security_bdev_free() - Free a block device's LSM blob
5526	* @bdev: block device
5527	*
5528	* Deallocate the bdev security structure and set @bdev->bd_security to NULL.
5529	*/
5530	void security_bdev_free(struct block_device *bdev)
5531	{
5532	if (!bdev->bd_security)
5533	return;
5534
5535	call_void_hook(bdev_free_security, bdev);
5536
5537	kfree(bdev->bd_security);
5538	bdev->bd_security = NULL;
5539	}
5540	EXPORT_SYMBOL(security_bdev_free);
5541
5542	/**
5543	* security_bdev_setintegrity() - Set the device's integrity data
5544	* @bdev: block device
5545	* @type: type of integrity, e.g. hash digest, signature, etc
5546	* @value: the integrity value
5547	* @size: size of the integrity value
5548	*
5549	* Register a verified integrity measurement of a bdev with LSMs.
5550	* LSMs should free the previously saved data if @value is NULL.
5551	* Please note that the new hook should be invoked every time the security
5552	* information is updated to keep these data current. For example, in dm-verity,
5553	* if the mapping table is reloaded and configured to use a different dm-verity
5554	* target with a new roothash and signing information, the previously stored
5555	* data in the LSM blob will become obsolete. It is crucial to re-invoke the
5556	* hook to refresh these data and ensure they are up to date. This necessity
5557	* arises from the design of device-mapper, where a device-mapper device is
5558	* first created, and then targets are subsequently loaded into it. These
5559	* targets can be modified multiple times during the device's lifetime.
5560	* Therefore, while the LSM blob is allocated during the creation of the block
5561	* device, its actual contents are not initialized at this stage and can change
5562	* substantially over time. This includes alterations from data that the LSMs
5563	* 'trusts' to those they do not, making it essential to handle these changes
5564	* correctly. Failure to address this dynamic aspect could potentially allow
5565	* for bypassing LSM checks.
5566	*
5567	* Return: Returns 0 on success, negative values on failure.
5568	*/
5569	int security_bdev_setintegrity(struct block_device *bdev,
5570	enum lsm_integrity_type type, const void *value,
5571	size_t size)
5572	{
5573	return call_int_hook(bdev_setintegrity, bdev, type, value, size);
5574	}
5575	EXPORT_SYMBOL(security_bdev_setintegrity);
5576
5577	#ifdef CONFIG_PERF_EVENTS
5578	/**
5579	* security_perf_event_open() - Check if a perf event open is allowed
5580	* @type: type of event
5581	*
5582	* Check whether the @type of perf_event_open syscall is allowed.
5583	*
5584	* Return: Returns 0 if permission is granted.
5585	*/
5586	int security_perf_event_open(int type)
5587	{
5588	return call_int_hook(perf_event_open, type);
5589	}
5590
5591	/**
5592	* security_perf_event_alloc() - Allocate a perf event LSM blob
5593	* @event: perf event
5594	*
5595	* Allocate and save perf_event security info.
5596	*
5597	* Return: Returns 0 on success, error on failure.
5598	*/
5599	int security_perf_event_alloc(struct perf_event *event)
5600	{
5601	int rc;
5602
5603	rc = lsm_blob_alloc(&event->security, blob_sizes.lbs_perf_event,
5604	GFP_KERNEL);
5605	if (rc)
5606	return rc;
5607
5608	rc = call_int_hook(perf_event_alloc, event);
5609	if (rc) {
5610	kfree(event->security);
5611	event->security = NULL;
5612	}
5613	return rc;
5614	}
5615
5616	/**
5617	* security_perf_event_free() - Free a perf event LSM blob
5618	* @event: perf event
5619	*
5620	* Release (free) perf_event security info.
5621	*/
5622	void security_perf_event_free(struct perf_event *event)
5623	{
5624	kfree(event->security);
5625	event->security = NULL;
5626	}
5627
5628	/**
5629	* security_perf_event_read() - Check if reading a perf event label is allowed
5630	* @event: perf event
5631	*
5632	* Read perf_event security info if allowed.
5633	*
5634	* Return: Returns 0 if permission is granted.
5635	*/
5636	int security_perf_event_read(struct perf_event *event)
5637	{
5638	return call_int_hook(perf_event_read, event);
5639	}
5640
5641	/**
5642	* security_perf_event_write() - Check if writing a perf event label is allowed
5643	* @event: perf event
5644	*
5645	* Write perf_event security info if allowed.
5646	*
5647	* Return: Returns 0 if permission is granted.
5648	*/
5649	int security_perf_event_write(struct perf_event *event)
5650	{
5651	return call_int_hook(perf_event_write, event);
5652	}
5653	#endif /* CONFIG_PERF_EVENTS */
5654
5655	#ifdef CONFIG_IO_URING
5656	/**
5657	* security_uring_override_creds() - Check if overriding creds is allowed
5658	* @new: new credentials
5659	*
5660	* Check if the current task, executing an io_uring operation, is allowed to
5661	* override it's credentials with @new.
5662	*
5663	* Return: Returns 0 if permission is granted.
5664	*/
5665	int security_uring_override_creds(const struct cred *new)
5666	{
5667	return call_int_hook(uring_override_creds, new);
5668	}
5669
5670	/**
5671	* security_uring_sqpoll() - Check if IORING_SETUP_SQPOLL is allowed
5672	*
5673	* Check whether the current task is allowed to spawn a io_uring polling thread
5674	* (IORING_SETUP_SQPOLL).
5675	*
5676	* Return: Returns 0 if permission is granted.
5677	*/
5678	int security_uring_sqpoll(void)
5679	{
5680	return call_int_hook(uring_sqpoll);
5681	}
5682
5683	/**
5684	* security_uring_cmd() - Check if a io_uring passthrough command is allowed
5685	* @ioucmd: command
5686	*
5687	* Check whether the file_operations uring_cmd is allowed to run.
5688	*
5689	* Return: Returns 0 if permission is granted.
5690	*/
5691	int security_uring_cmd(struct io_uring_cmd *ioucmd)
5692	{
5693	return call_int_hook(uring_cmd, ioucmd);
5694	}
5695
5696	/**
5697	* security_uring_allowed() - Check if io_uring_setup() is allowed
5698	*
5699	* Check whether the current task is allowed to call io_uring_setup().
5700	*
5701	* Return: Returns 0 if permission is granted.
5702	*/
5703	int security_uring_allowed(void)
5704	{
5705	return call_int_hook(uring_allowed);
5706	}
5707	#endif /* CONFIG_IO_URING */
5708
5709	/**
5710	* security_initramfs_populated() - Notify LSMs that initramfs has been loaded
5711	*
5712	* Tells the LSMs the initramfs has been unpacked into the rootfs.
5713	*/
5714	void security_initramfs_populated(void)
5715	{
5716	call_void_hook(initramfs_populated);
5717	}