security.h 114 KB
Newer Older
Linus Torvalds's avatar
Linus Torvalds committed
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
/*
 * Linux Security plug
 *
 * Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com>
 * Copyright (C) 2001 Greg Kroah-Hartman <greg@kroah.com>
 * Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com>
 * Copyright (C) 2001 James Morris <jmorris@intercode.com.au>
 * Copyright (C) 2001 Silicon Graphics, Inc. (Trust Technology Group)
 *
 *	This program is free software; you can redistribute it and/or modify
 *	it under the terms of the GNU General Public License as published by
 *	the Free Software Foundation; either version 2 of the License, or
 *	(at your option) any later version.
 *
 *	Due to this file being licensed under the GPL there is controversy over
 *	whether this permits you to write a module that #includes this file
 *	without placing your module under the GPL.  Please consult a lawyer for
 *	advice before doing this.
 *
 */

#ifndef __LINUX_SECURITY_H
#define __LINUX_SECURITY_H

25
#include <linux/key.h>
Al Viro's avatar
Al Viro committed
26
#include <linux/capability.h>
27
#include <linux/slab.h>
Al Viro's avatar
Al Viro committed
28
#include <linux/err.h>
29
#include <linux/string.h>
Al Viro's avatar
Al Viro committed
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

struct linux_binprm;
struct cred;
struct rlimit;
struct siginfo;
struct sem_array;
struct sembuf;
struct kern_ipc_perm;
struct audit_context;
struct super_block;
struct inode;
struct dentry;
struct file;
struct vfsmount;
struct path;
struct qstr;
struct nameidata;
struct iattr;
struct fown_struct;
struct file_operations;
struct shmid_kernel;
struct msg_msg;
struct msg_queue;
struct xattr;
struct xfrm_sec_ctx;
struct mm_struct;
Linus Torvalds's avatar
Linus Torvalds committed
56

57
58
59
/* Maximum number of letters for an LSM name string */
#define SECURITY_NAME_MAX	10

60
61
62
63
/* If capable should audit the security request */
#define SECURITY_CAP_NOAUDIT 0
#define SECURITY_CAP_AUDIT 1

64
65
66
/* LSM Agnostic defines for sb_set_mnt_opts */
#define SECURITY_LSM_NATIVE_LABELS	1

Linus Torvalds's avatar
Linus Torvalds committed
67
struct ctl_table;
68
struct audit_krule;
69
struct user_namespace;
Al Viro's avatar
Al Viro committed
70
struct timezone;
Linus Torvalds's avatar
Linus Torvalds committed
71
72
73
74
75

/*
 * These functions are in security/capability.c and are used
 * as the default capabilities functions
 */
76
77
extern int cap_capable(const struct cred *cred, struct user_namespace *ns,
		       int cap, int audit);
78
extern int cap_settime(const struct timespec *ts, const struct timezone *tz);
79
extern int cap_ptrace_access_check(struct task_struct *child, unsigned int mode);
80
extern int cap_ptrace_traceme(struct task_struct *parent);
81
extern int cap_capget(struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);
82
83
84
85
extern int cap_capset(struct cred *new, const struct cred *old,
		      const kernel_cap_t *effective,
		      const kernel_cap_t *inheritable,
		      const kernel_cap_t *permitted);
86
extern int cap_bprm_set_creds(struct linux_binprm *bprm);
Linus Torvalds's avatar
Linus Torvalds committed
87
extern int cap_bprm_secureexec(struct linux_binprm *bprm);
88
89
90
extern int cap_inode_setxattr(struct dentry *dentry, const char *name,
			      const void *value, size_t size, int flags);
extern int cap_inode_removexattr(struct dentry *dentry, const char *name);
91
92
extern int cap_inode_need_killpriv(struct dentry *dentry);
extern int cap_inode_killpriv(struct dentry *dentry);
93
extern int cap_mmap_addr(unsigned long addr);
94
95
extern int cap_mmap_file(struct file *file, unsigned long reqprot,
			 unsigned long prot, unsigned long flags);
96
extern int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags);
97
extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
98
			  unsigned long arg4, unsigned long arg5);
99
extern int cap_task_setscheduler(struct task_struct *p);
100
101
extern int cap_task_setioprio(struct task_struct *p, int ioprio);
extern int cap_task_setnice(struct task_struct *p, int nice);
102
extern int cap_vm_enough_memory(struct mm_struct *mm, long pages);
Linus Torvalds's avatar
Linus Torvalds committed
103
104
105
106
107
108

struct msghdr;
struct sk_buff;
struct sock;
struct sockaddr;
struct socket;
109
110
111
112
113
114
struct flowi;
struct dst_entry;
struct xfrm_selector;
struct xfrm_policy;
struct xfrm_state;
struct xfrm_user_sec_ctx;
115
struct seq_file;
Linus Torvalds's avatar
Linus Torvalds committed
116
117
118

extern int cap_netlink_send(struct sock *sk, struct sk_buff *skb);

119
120
void reset_security_ops(void);

121
#ifdef CONFIG_MMU
122
extern unsigned long mmap_min_addr;
123
extern unsigned long dac_mmap_min_addr;
124
#else
125
#define mmap_min_addr		0UL
126
127
128
#define dac_mmap_min_addr	0UL
#endif

Linus Torvalds's avatar
Linus Torvalds committed
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
/*
 * Values used in the task_security_ops calls
 */
/* setuid or setgid, id0 == uid or gid */
#define LSM_SETID_ID	1

/* setreuid or setregid, id0 == real, id1 == eff */
#define LSM_SETID_RE	2

/* setresuid or setresgid, id0 == real, id1 == eff, uid2 == saved */
#define LSM_SETID_RES	4

/* setfsuid or setfsgid, id0 == fsuid or fsgid */
#define LSM_SETID_FS	8

/* forward declares to avoid warnings */
struct sched_param;
146
struct request_sock;
Linus Torvalds's avatar
Linus Torvalds committed
147

148
/* bprm->unsafe reasons */
Linus Torvalds's avatar
Linus Torvalds committed
149
150
151
#define LSM_UNSAFE_SHARE	1
#define LSM_UNSAFE_PTRACE	2
#define LSM_UNSAFE_PTRACE_CAP	4
152
#define LSM_UNSAFE_NO_NEW_PRIVS	8
Linus Torvalds's avatar
Linus Torvalds committed
153

154
#ifdef CONFIG_MMU
155
extern int mmap_min_addr_handler(struct ctl_table *table, int write,
156
				 void __user *buffer, size_t *lenp, loff_t *ppos);
157
#endif
158

159
160
161
162
/* security_inode_init_security callback function to write xattrs */
typedef int (*initxattrs) (struct inode *inode,
			   const struct xattr *xattr_array, void *fs_data);

Linus Torvalds's avatar
Linus Torvalds committed
163
164
#ifdef CONFIG_SECURITY

165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
struct security_mnt_opts {
	char **mnt_opts;
	int *mnt_opts_flags;
	int num_mnt_opts;
};

static inline void security_init_mnt_opts(struct security_mnt_opts *opts)
{
	opts->mnt_opts = NULL;
	opts->mnt_opts_flags = NULL;
	opts->num_mnt_opts = 0;
}

static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
{
	int i;
	if (opts->mnt_opts)
182
		for (i = 0; i < opts->num_mnt_opts; i++)
183
184
185
186
187
188
189
190
			kfree(opts->mnt_opts[i]);
	kfree(opts->mnt_opts);
	opts->mnt_opts = NULL;
	kfree(opts->mnt_opts_flags);
	opts->mnt_opts_flags = NULL;
	opts->num_mnt_opts = 0;
}

Linus Torvalds's avatar
Linus Torvalds committed
191
192
193
/**
 * struct security_operations - main security structure
 *
194
195
196
 * Security module identifier.
 *
 * @name:
197
 *	A string that acts as a unique identifier for the LSM with max number
198
199
 *	of characters = SECURITY_NAME_MAX.
 *
Linus Torvalds's avatar
Linus Torvalds committed
200
201
 * Security hooks for program execution operations.
 *
202
 * @bprm_set_creds:
Linus Torvalds's avatar
Linus Torvalds committed
203
204
205
206
207
208
209
210
211
212
213
214
 *	Save security information in the bprm->security field, typically based
 *	on information about the bprm->file, for later use by the apply_creds
 *	hook.  This hook may also optionally check permissions (e.g. for
 *	transitions between security domains).
 *	This hook may be called multiple times during a single execve, e.g. for
 *	interpreters.  The hook can tell whether it has already been called by
 *	checking to see if @bprm->security is non-NULL.  If so, then the hook
 *	may decide either to retain the security information saved earlier or
 *	to replace it.
 *	@bprm contains the linux_binprm structure.
 *	Return 0 if the hook is successful and permission is granted.
 * @bprm_check_security:
215
216
217
218
219
220
 *	This hook mediates the point when a search for a binary handler will
 *	begin.  It allows a check the @bprm->security value which is set in the
 *	preceding set_creds call.  The primary difference from set_creds is
 *	that the argv list and envp list are reliably available in @bprm.  This
 *	hook may be called multiple times during a single execve; and in each
 *	pass set_creds is called first.
221
 *	@bprm contains the linux_binprm structure.
Linus Torvalds's avatar
Linus Torvalds committed
222
 *	Return 0 if the hook is successful and permission is granted.
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
 * @bprm_committing_creds:
 *	Prepare to install the new security attributes of a process being
 *	transformed by an execve operation, based on the old credentials
 *	pointed to by @current->cred and the information set in @bprm->cred by
 *	the bprm_set_creds hook.  @bprm points to the linux_binprm structure.
 *	This hook is a good place to perform state changes on the process such
 *	as closing open file descriptors to which access will no longer be
 *	granted when the attributes are changed.  This is called immediately
 *	before commit_creds().
 * @bprm_committed_creds:
 *	Tidy up after the installation of the new security attributes of a
 *	process being transformed by an execve operation.  The new credentials
 *	have, by this point, been set to @current->cred.  @bprm points to the
 *	linux_binprm structure.  This hook is a good place to perform state
 *	changes on the process such as clearing out non-inheritable signal
 *	state.  This is called immediately after commit_creds().
Linus Torvalds's avatar
Linus Torvalds committed
239
 * @bprm_secureexec:
240
241
242
243
244
 *	Return a boolean value (0 or 1) indicating whether a "secure exec"
 *	is required.  The flag is passed in the auxiliary table
 *	on the initial stack to the ELF interpreter to indicate whether libc
 *	should enable secure mode.
 *	@bprm contains the linux_binprm structure.
Linus Torvalds's avatar
Linus Torvalds committed
245
246
247
248
249
250
251
252
253
254
255
256
257
 *
 * Security hooks for filesystem operations.
 *
 * @sb_alloc_security:
 *	Allocate and attach a security structure to the sb->s_security field.
 *	The s_security field is initialized to NULL when the structure is
 *	allocated.
 *	@sb contains the super_block structure to be modified.
 *	Return 0 if operation was successful.
 * @sb_free_security:
 *	Deallocate and clear the sb->s_security field.
 *	@sb contains the super_block structure to be modified.
 * @sb_statfs:
258
259
260
 *	Check permission before obtaining filesystem statistics for the @mnt
 *	mountpoint.
 *	@dentry is a handle on the superblock for the filesystem.
261
 *	Return 0 if permission is granted.
Linus Torvalds's avatar
Linus Torvalds committed
262
263
264
265
266
267
268
269
 * @sb_mount:
 *	Check permission before an object specified by @dev_name is mounted on
 *	the mount point named by @nd.  For an ordinary mount, @dev_name
 *	identifies a device if the file system type requires a device.  For a
 *	remount (@flags & MS_REMOUNT), @dev_name is irrelevant.  For a
 *	loopback/bind mount (@flags & MS_BIND), @dev_name identifies the
 *	pathname of the object being mounted.
 *	@dev_name contains the name for object being mounted.
270
 *	@path contains the path for mount point object.
Linus Torvalds's avatar
Linus Torvalds committed
271
272
273
274
275
276
277
278
279
280
281
282
283
284
 *	@type contains the filesystem type.
 *	@flags contains the mount flags.
 *	@data contains the filesystem-specific data.
 *	Return 0 if permission is granted.
 * @sb_copy_data:
 *	Allow mount option data to be copied prior to parsing by the filesystem,
 *	so that the security module can extract security-specific mount
 *	options cleanly (a filesystem may modify the data e.g. with strsep()).
 *	This also allows the original mount data to be stripped of security-
 *	specific options to avoid having to make filesystems aware of them.
 *	@type the type of filesystem being mounted.
 *	@orig the original mount data copied from userspace.
 *	@copy copied data which will be passed to the security module.
 *	Returns 0 if the copy was successful.
285
 * @sb_remount:
286
 *	Extracts security system specific mount options and verifies no changes
287
288
289
290
 *	are being made to those options.
 *	@sb superblock being remounted
 *	@data contains the filesystem-specific data.
 *	Return 0 if permission is granted.
Linus Torvalds's avatar
Linus Torvalds committed
291
292
293
294
295
296
297
 * @sb_umount:
 *	Check permission before the @mnt file system is unmounted.
 *	@mnt contains the mounted file system.
 *	@flags contains the unmount flags, e.g. MNT_FORCE.
 *	Return 0 if permission is granted.
 * @sb_pivotroot:
 *	Check permission before pivoting the root filesystem.
298
 *	@old_path contains the path for the new location of the current root (put_old).
299
 *	@new_path contains the path for the new root (new_root).
Linus Torvalds's avatar
Linus Torvalds committed
300
 *	Return 0 if permission is granted.
301
302
303
 * @sb_set_mnt_opts:
 *	Set the security relevant mount options used for a superblock
 *	@sb the superblock to set security mount options for
304
 *	@opts binary data structure containing all lsm mount data
305
306
307
308
 * @sb_clone_mnt_opts:
 *	Copy all security options from a given superblock to another
 *	@oldsb old superblock which contain information to clone
 *	@newsb new superblock which needs filled in
309
310
311
312
 * @sb_parse_opts_str:
 *	Parse a string of security data filling in the opts structure
 *	@options string containing all mount options known by the LSM
 *	@opts binary data structure usable by the LSM
313
314
315
316
317
318
319
320
321
 * @dentry_init_security:
 *	Compute a context for a dentry as the inode is not yet available
 *	since NFSv4 has no label backed by an EA anyway.
 *	@dentry dentry to use in calculating the context.
 *	@mode mode used to determine resource type.
 *	@name name of the last path component used to create file
 *	@ctx pointer to place the pointer to the resulting context in.
 *	@ctxlen point to place the length of the resulting context.
 *
Linus Torvalds's avatar
Linus Torvalds committed
322
323
324
325
326
327
328
329
330
331
332
333
 *
 * Security hooks for inode operations.
 *
 * @inode_alloc_security:
 *	Allocate and attach a security structure to @inode->i_security.  The
 *	i_security field is initialized to NULL when the inode structure is
 *	allocated.
 *	@inode contains the inode structure.
 *	Return 0 if operation was successful.
 * @inode_free_security:
 *	@inode contains the inode structure.
 *	Deallocate the inode security structure and set @inode->i_security to
334
 *	NULL.
335
 * @inode_init_security:
336
 *	Obtain the security attribute name suffix and value to set on a newly
337
338
339
340
341
342
343
344
345
346
347
 *	created inode and set up the incore security field for the new inode.
 *	This hook is called by the fs code as part of the inode creation
 *	transaction and provides for atomic labeling of the inode, unlike
 *	the post_create/mkdir/... hooks called by the VFS.  The hook function
 *	is expected to allocate the name and value via kmalloc, with the caller
 *	being responsible for calling kfree after using them.
 *	If the security module does not use security attributes or does
 *	not wish to put a security attribute on this particular inode,
 *	then it should return -EOPNOTSUPP to skip this processing.
 *	@inode contains the inode structure of the newly created inode.
 *	@dir contains the inode structure of the parent directory.
348
 *	@qstr contains the last path component of the new object
349
350
351
352
353
354
 *	@name will be set to the allocated name suffix (e.g. selinux).
 *	@value will be set to the allocated attribute value.
 *	@len will be set to the length of the value.
 *	Returns 0 if @name and @value have been successfully set,
 *		-EOPNOTSUPP if no security attribute is needed, or
 *		-ENOMEM on memory allocation failure.
Linus Torvalds's avatar
Linus Torvalds committed
355
356
357
358
359
360
361
362
363
364
365
366
 * @inode_create:
 *	Check permission to create a regular file.
 *	@dir contains inode structure of the parent of the new file.
 *	@dentry contains the dentry structure for the file to be created.
 *	@mode contains the file mode of the file to be created.
 *	Return 0 if permission is granted.
 * @inode_link:
 *	Check permission before creating a new hard link to a file.
 *	@old_dentry contains the dentry structure for an existing link to the file.
 *	@dir contains the inode structure of the parent directory of the new link.
 *	@new_dentry contains the dentry structure for the new link.
 *	Return 0 if permission is granted.
367
368
369
370
371
372
373
374
 * @path_link:
 *	Check permission before creating a new hard link to a file.
 *	@old_dentry contains the dentry structure for an existing link
 *	to the file.
 *	@new_dir contains the path structure of the parent directory of
 *	the new link.
 *	@new_dentry contains the dentry structure for the new link.
 *	Return 0 if permission is granted.
Linus Torvalds's avatar
Linus Torvalds committed
375
 * @inode_unlink:
376
 *	Check the permission to remove a hard link to a file.
Linus Torvalds's avatar
Linus Torvalds committed
377
378
379
 *	@dir contains the inode structure of parent directory of the file.
 *	@dentry contains the dentry structure for file to be unlinked.
 *	Return 0 if permission is granted.
380
381
382
383
384
 * @path_unlink:
 *	Check the permission to remove a hard link to a file.
 *	@dir contains the path structure of parent directory of the file.
 *	@dentry contains the dentry structure for file to be unlinked.
 *	Return 0 if permission is granted.
Linus Torvalds's avatar
Linus Torvalds committed
385
386
387
388
389
390
 * @inode_symlink:
 *	Check the permission to create a symbolic link to a file.
 *	@dir contains the inode structure of parent directory of the symbolic link.
 *	@dentry contains the dentry structure of the symbolic link.
 *	@old_name contains the pathname of file.
 *	Return 0 if permission is granted.
391
392
393
394
395
396
397
 * @path_symlink:
 *	Check the permission to create a symbolic link to a file.
 *	@dir contains the path structure of parent directory of
 *	the symbolic link.
 *	@dentry contains the dentry structure of the symbolic link.
 *	@old_name contains the pathname of file.
 *	Return 0 if permission is granted.
Linus Torvalds's avatar
Linus Torvalds committed
398
399
 * @inode_mkdir:
 *	Check permissions to create a new directory in the existing directory
400
401
 *	associated with inode structure @dir.
 *	@dir contains the inode structure of parent of the directory to be created.
Linus Torvalds's avatar
Linus Torvalds committed
402
403
404
 *	@dentry contains the dentry structure of new directory.
 *	@mode contains the mode of new directory.
 *	Return 0 if permission is granted.
405
406
 * @path_mkdir:
 *	Check permissions to create a new directory in the existing directory
407
408
 *	associated with path structure @path.
 *	@dir contains the path structure of parent of the directory
409
410
411
412
 *	to be created.
 *	@dentry contains the dentry structure of new directory.
 *	@mode contains the mode of new directory.
 *	Return 0 if permission is granted.
Linus Torvalds's avatar
Linus Torvalds committed
413
414
415
416
417
 * @inode_rmdir:
 *	Check the permission to remove a directory.
 *	@dir contains the inode structure of parent of the directory to be removed.
 *	@dentry contains the dentry structure of directory to be removed.
 *	Return 0 if permission is granted.
418
419
420
421
422
423
 * @path_rmdir:
 *	Check the permission to remove a directory.
 *	@dir contains the path structure of parent of the directory to be
 *	removed.
 *	@dentry contains the dentry structure of directory to be removed.
 *	Return 0 if permission is granted.
Linus Torvalds's avatar
Linus Torvalds committed
424
425
426
427
428
429
430
431
 * @inode_mknod:
 *	Check permissions when creating a special file (or a socket or a fifo
 *	file created via the mknod system call).  Note that if mknod operation
 *	is being done for a regular file, then the create hook will be called
 *	and not this hook.
 *	@dir contains the inode structure of parent of the new file.
 *	@dentry contains the dentry structure of the new file.
 *	@mode contains the mode of the new file.
432
 *	@dev contains the device number.
Linus Torvalds's avatar
Linus Torvalds committed
433
 *	Return 0 if permission is granted.
434
435
436
437
438
439
440
441
442
 * @path_mknod:
 *	Check permissions when creating a file. Note that this hook is called
 *	even if mknod operation is being done for a regular file.
 *	@dir contains the path structure of parent of the new file.
 *	@dentry contains the dentry structure of the new file.
 *	@mode contains the mode of the new file.
 *	@dev contains the undecoded device number. Use new_decode_dev() to get
 *	the decoded device number.
 *	Return 0 if permission is granted.
Linus Torvalds's avatar
Linus Torvalds committed
443
444
445
446
447
448
449
 * @inode_rename:
 *	Check for permission to rename a file or directory.
 *	@old_dir contains the inode structure for parent of the old link.
 *	@old_dentry contains the dentry structure of the old link.
 *	@new_dir contains the inode structure for parent of the new link.
 *	@new_dentry contains the dentry structure of the new link.
 *	Return 0 if permission is granted.
450
451
452
453
454
455
456
 * @path_rename:
 *	Check for permission to rename a file or directory.
 *	@old_dir contains the path structure for parent of the old link.
 *	@old_dentry contains the dentry structure of the old link.
 *	@new_dir contains the path structure for parent of the new link.
 *	@new_dentry contains the dentry structure of the new link.
 *	Return 0 if permission is granted.
457
458
459
460
461
462
463
464
465
466
467
468
 * @path_chmod:
 *	Check for permission to change DAC's permission of a file or directory.
 *	@dentry contains the dentry structure.
 *	@mnt contains the vfsmnt structure.
 *	@mode contains DAC's mode.
 *	Return 0 if permission is granted.
 * @path_chown:
 *	Check for permission to change owner/group of a file or directory.
 *	@path contains the path structure.
 *	@uid contains new owner's ID.
 *	@gid contains new group's ID.
 *	Return 0 if permission is granted.
469
470
471
472
 * @path_chroot:
 *	Check for permission to change root directory.
 *	@path contains the path structure.
 *	Return 0 if permission is granted.
Linus Torvalds's avatar
Linus Torvalds committed
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
 * @inode_readlink:
 *	Check the permission to read the symbolic link.
 *	@dentry contains the dentry structure for the file link.
 *	Return 0 if permission is granted.
 * @inode_follow_link:
 *	Check permission to follow a symbolic link when looking up a pathname.
 *	@dentry contains the dentry structure for the link.
 *	@nd contains the nameidata structure for the parent directory.
 *	Return 0 if permission is granted.
 * @inode_permission:
 *	Check permission before accessing an inode.  This hook is called by the
 *	existing Linux permission function, so a security module can use it to
 *	provide additional checking for existing Linux permission checks.
 *	Notice that this hook is called when a file is opened (as well as many
 *	other operations), whereas the file_security_ops permission hook is
 *	called when the actual read/write operations are performed.
 *	@inode contains the inode structure to check.
 *	@mask contains the permission mask.
 *	Return 0 if permission is granted.
 * @inode_setattr:
 *	Check permission before setting file attributes.  Note that the kernel
 *	call to notify_change is performed from several locations, whenever
 *	file attributes change (such as when a file is truncated, chown/chmod
 *	operations, transferring disk quotas, etc).
 *	@dentry contains the dentry structure for the file.
 *	@attr is the iattr structure containing the new file attributes.
 *	Return 0 if permission is granted.
500
501
502
503
 * @path_truncate:
 *	Check permission before truncating a file.
 *	@path contains the path structure for the file.
 *	Return 0 if permission is granted.
Linus Torvalds's avatar
Linus Torvalds committed
504
505
506
507
508
509
 * @inode_getattr:
 *	Check permission before obtaining file attributes.
 *	@mnt is the vfsmount where the dentry was looked up
 *	@dentry contains the dentry structure for the file.
 *	Return 0 if permission is granted.
 * @inode_setxattr:
510
511
512
 *	Check permission before setting the extended attributes
 *	@value identified by @name for @dentry.
 *	Return 0 if permission is granted.
Linus Torvalds's avatar
Linus Torvalds committed
513
 * @inode_post_setxattr:
514
515
 *	Update inode security field after successful setxattr operation.
 *	@value identified by @name for @dentry.
Linus Torvalds's avatar
Linus Torvalds committed
516
 * @inode_getxattr:
517
518
519
 *	Check permission before obtaining the extended attributes
 *	identified by @name for @dentry.
 *	Return 0 if permission is granted.
Linus Torvalds's avatar
Linus Torvalds committed
520
 * @inode_listxattr:
521
522
523
 *	Check permission before obtaining the list of extended attribute
 *	names for @dentry.
 *	Return 0 if permission is granted.
Linus Torvalds's avatar
Linus Torvalds committed
524
 * @inode_removexattr:
525
526
527
 *	Check permission before removing the extended attribute
 *	identified by @name for @dentry.
 *	Return 0 if permission is granted.
Linus Torvalds's avatar
Linus Torvalds committed
528
 * @inode_getsecurity:
529
530
531
532
533
534
 *	Retrieve a copy of the extended attribute representation of the
 *	security label associated with @name for @inode via @buffer.  Note that
 *	@name is the remainder of the attribute name after the security prefix
 *	has been removed. @alloc is used to specify of the call should return a
 *	value via the buffer or just the value length Return size of buffer on
 *	success.
Linus Torvalds's avatar
Linus Torvalds committed
535
536
537
538
 * @inode_setsecurity:
 *	Set the security label associated with @name for @inode from the
 *	extended attribute value @value.  @size indicates the size of the
 *	@value in bytes.  @flags may be XATTR_CREATE, XATTR_REPLACE, or 0.
539
 *	Note that @name is the remainder of the attribute name after the
Linus Torvalds's avatar
Linus Torvalds committed
540
541
542
543
544
545
546
547
 *	security. prefix has been removed.
 *	Return 0 on success.
 * @inode_listsecurity:
 *	Copy the extended attribute names for the security labels
 *	associated with @inode into @buffer.  The maximum size of @buffer
 *	is specified by @buffer_size.  @buffer may be NULL to request
 *	the size of the buffer required.
 *	Returns number of bytes used/required on success.
548
549
550
551
552
553
554
555
556
557
558
559
 * @inode_need_killpriv:
 *	Called when an inode has been changed.
 *	@dentry is the dentry being changed.
 *	Return <0 on error to abort the inode change operation.
 *	Return 0 if inode_killpriv does not need to be called.
 *	Return >0 if inode_killpriv does need to be called.
 * @inode_killpriv:
 *	The setuid bit is being removed.  Remove similar security labels.
 *	Called with the dentry->d_inode->i_mutex held.
 *	@dentry is the dentry being changed.
 *	Return 0 on success.  If error is returned, then the operation
 *	causing setuid bit removal is failed.
560
561
562
563
564
 * @inode_getsecid:
 *	Get the secid associated with the node.
 *	@inode contains a pointer to the inode.
 *	@secid contains a pointer to the location where result will be saved.
 *	In case of failure, @secid will be set to zero.
Linus Torvalds's avatar
Linus Torvalds committed
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
 *
 * Security hooks for file operations
 *
 * @file_permission:
 *	Check file permissions before accessing an open file.  This hook is
 *	called by various operations that read or write files.  A security
 *	module can use this hook to perform additional checking on these
 *	operations, e.g.  to revalidate permissions on use to support privilege
 *	bracketing or policy changes.  Notice that this hook is used when the
 *	actual read/write operations are performed, whereas the
 *	inode_security_ops hook is called when a file is opened (as well as
 *	many other operations).
 *	Caveat:  Although this hook can be used to revalidate permissions for
 *	various system call operations that read or write files, it does not
 *	address the revalidation of permissions for memory-mapped files.
 *	Security modules must handle this separately if they need such
 *	revalidation.
 *	@file contains the file structure being accessed.
 *	@mask contains the requested permissions.
 *	Return 0 if permission is granted.
 * @file_alloc_security:
 *	Allocate and attach a security structure to the file->f_security field.
 *	The security field is initialized to NULL when the structure is first
 *	created.
 *	@file contains the file structure to secure.
 *	Return 0 if the hook is successful and permission is granted.
 * @file_free_security:
 *	Deallocate and free any security structures stored in file->f_security.
 *	@file contains the file structure being modified.
 * @file_ioctl:
 *	@file contains the file structure.
 *	@cmd contains the operation to perform.
 *	@arg contains the operational arguments.
598
 *	Check permission for an ioctl operation on @file.  Note that @arg
Linus Torvalds's avatar
Linus Torvalds committed
599
600
601
602
 *	sometimes represents a user space pointer; in other cases, it may be a
 *	simple integer value.  When @arg represents a user space pointer, it
 *	should never be used by the security module.
 *	Return 0 if permission is granted.
603
604
605
606
607
 * @mmap_addr :
 *	Check permissions for a mmap operation at @addr.
 *	@addr contains virtual address that will be used for the operation.
 *	Return 0 if permission is granted.
 * @mmap_file :
Linus Torvalds's avatar
Linus Torvalds committed
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
 *	Check permissions for a mmap operation.  The @file may be NULL, e.g.
 *	if mapping anonymous memory.
 *	@file contains the file structure for file to map (may be NULL).
 *	@reqprot contains the protection requested by the application.
 *	@prot contains the protection that will be applied by the kernel.
 *	@flags contains the operational flags.
 *	Return 0 if permission is granted.
 * @file_mprotect:
 *	Check permissions before changing memory access permissions.
 *	@vma contains the memory region to modify.
 *	@reqprot contains the protection requested by the application.
 *	@prot contains the protection that will be applied by the kernel.
 *	Return 0 if permission is granted.
 * @file_lock:
 *	Check permission before performing file locking operations.
 *	Note: this hook mediates both flock and fcntl style locks.
 *	@file contains the file structure.
 *	@cmd contains the posix-translated lock operation to perform
 *	(e.g. F_RDLCK, F_WRLCK).
 *	Return 0 if permission is granted.
 * @file_fcntl:
 *	Check permission before allowing the file operation specified by @cmd
630
 *	from being performed on the file @file.  Note that @arg sometimes
Linus Torvalds's avatar
Linus Torvalds committed
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
 *	represents a user space pointer; in other cases, it may be a simple
 *	integer value.  When @arg represents a user space pointer, it should
 *	never be used by the security module.
 *	@file contains the file structure.
 *	@cmd contains the operation to be performed.
 *	@arg contains the operational arguments.
 *	Return 0 if permission is granted.
 * @file_set_fowner:
 *	Save owner security information (typically from current->security) in
 *	file->f_security for later use by the send_sigiotask hook.
 *	@file contains the file structure to update.
 *	Return 0 on success.
 * @file_send_sigiotask:
 *	Check permission for the file owner @fown to send SIGIO or SIGURG to the
 *	process @tsk.  Note that this hook is sometimes called from interrupt.
 *	Note that the fown_struct, @fown, is never outside the context of a
 *	struct file, so the file structure (and associated security information)
 *	can always be obtained:
649
 *		container_of(fown, struct file, f_owner)
650
 *	@tsk contains the structure of task receiving signal.
Linus Torvalds's avatar
Linus Torvalds committed
651
652
653
654
655
656
657
658
 *	@fown contains the file owner information.
 *	@sig is the signal that will be sent.  When 0, kernel sends SIGIO.
 *	Return 0 if permission is granted.
 * @file_receive:
 *	This hook allows security modules to control the ability of a process
 *	to receive an open file descriptor via socket IPC.
 *	@file contains the file structure being received.
 *	Return 0 if permission is granted.
659
 * @file_open
660
661
662
663
 *	Save open-time permission checking state for later use upon
 *	file_permission, and recheck access if anything has changed
 *	since inode_permission.
 *
Linus Torvalds's avatar
Linus Torvalds committed
664
665
666
667
668
669
670
 * Security hooks for task operations.
 *
 * @task_create:
 *	Check permission before creating a child process.  See the clone(2)
 *	manual page for definitions of the @clone_flags.
 *	@clone_flags contains the flags indicating what should be shared.
 *	Return 0 if permission is granted.
671
672
673
674
 * @task_free:
 *	@task task being freed
 *	Handle release of task-related resources. (Note that this can be called
 *	from interrupt context.)
675
676
677
678
679
 * @cred_alloc_blank:
 *	@cred points to the credentials.
 *	@gfp indicates the atomicity of any memory allocations.
 *	Only allocate sufficient memory and attach to @cred such that
 *	cred_transfer() will not get ENOMEM.
680
681
682
 * @cred_free:
 *	@cred points to the credentials.
 *	Deallocate and clear the cred->security field in a set of credentials.
683
684
685
686
687
 * @cred_prepare:
 *	@new points to the new credentials.
 *	@old points to the original credentials.
 *	@gfp indicates the atomicity of any memory allocations.
 *	Prepare a new set of credentials by copying the data from the old set.
688
689
690
691
 * @cred_transfer:
 *	@new points to the new credentials.
 *	@old points to the original credentials.
 *	Transfer data from original creds to new creds
692
693
694
695
696
697
698
699
700
701
702
703
704
 * @kernel_act_as:
 *	Set the credentials for a kernel service to act as (subjective context).
 *	@new points to the credentials to be modified.
 *	@secid specifies the security ID to be set
 *	The current task must be the one that nominated @secid.
 *	Return 0 if successful.
 * @kernel_create_files_as:
 *	Set the file creation context in a set of credentials to be the same as
 *	the objective context of the specified inode.
 *	@new points to the credentials to be modified.
 *	@inode points to the inode to use as a reference.
 *	The current task must be the one that nominated @inode.
 *	Return 0 if successful.
705
706
707
 * @kernel_module_request:
 *	Ability to trigger the kernel to automatically upcall to userspace for
 *	userspace to load a kernel module with the given name.
708
 *	@kmod_name name of the module requested by the kernel
709
 *	Return 0 if successful.
710
711
712
713
714
715
 * @kernel_module_from_file:
 *	Load a kernel module from userspace.
 *	@file contains the file structure pointing to the file containing
 *	the kernel module to load. If the module is being loaded from a blob,
 *	this argument will be NULL.
 *	Return 0 if permission is granted.
716
 * @task_fix_setuid:
Linus Torvalds's avatar
Linus Torvalds committed
717
718
719
 *	Update the module's state after setting one or more of the user
 *	identity attributes of the current process.  The @flags parameter
 *	indicates which of the set*uid system calls invoked this hook.  If
720
721
722
 *	@new is the set of credentials that will be installed.  Modifications
 *	should be made to this rather than to @current->cred.
 *	@old is the set of credentials that are being replaces
Linus Torvalds's avatar
Linus Torvalds committed
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
 *	@flags contains one of the LSM_SETID_* values.
 *	Return 0 on success.
 * @task_setpgid:
 *	Check permission before setting the process group identifier of the
 *	process @p to @pgid.
 *	@p contains the task_struct for process being modified.
 *	@pgid contains the new pgid.
 *	Return 0 if permission is granted.
 * @task_getpgid:
 *	Check permission before getting the process group identifier of the
 *	process @p.
 *	@p contains the task_struct for the process.
 *	Return 0 if permission is granted.
 * @task_getsid:
 *	Check permission before getting the session identifier of the process
 *	@p.
 *	@p contains the task_struct for the process.
 *	Return 0 if permission is granted.
741
742
743
 * @task_getsecid:
 *	Retrieve the security identifier of the process @p.
 *	@p contains the task_struct for the process and place is into @secid.
744
745
 *	In case of failure, @secid will be set to zero.
 *
Linus Torvalds's avatar
Linus Torvalds committed
746
747
748
749
750
 * @task_setnice:
 *	Check permission before setting the nice value of @p to @nice.
 *	@p contains the task_struct of process.
 *	@nice contains the new nice value.
 *	Return 0 if permission is granted.
751
752
753
754
755
 * @task_setioprio
 *	Check permission before setting the ioprio value of @p to @ioprio.
 *	@p contains the task_struct of process.
 *	@ioprio contains the new ioprio value
 *	Return 0 if permission is granted.
756
757
758
759
 * @task_getioprio
 *	Check permission before getting the ioprio value of @p.
 *	@p contains the task_struct of process.
 *	Return 0 if permission is granted.
Linus Torvalds's avatar
Linus Torvalds committed
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
 * @task_setrlimit:
 *	Check permission before setting the resource limits of the current
 *	process for @resource to @new_rlim.  The old resource limit values can
 *	be examined by dereferencing (current->signal->rlim + resource).
 *	@resource contains the resource whose limit is being set.
 *	@new_rlim contains the new limits for @resource.
 *	Return 0 if permission is granted.
 * @task_setscheduler:
 *	Check permission before setting scheduling policy and/or parameters of
 *	process @p based on @policy and @lp.
 *	@p contains the task_struct for process.
 *	@policy contains the scheduling policy.
 *	@lp contains the scheduling parameters.
 *	Return 0 if permission is granted.
 * @task_getscheduler:
 *	Check permission before obtaining scheduling information for process
 *	@p.
 *	@p contains the task_struct for process.
 *	Return 0 if permission is granted.
779
780
781
782
 * @task_movememory
 *	Check permission before moving memory owned by process @p.
 *	@p contains the task_struct for process.
 *	Return 0 if permission is granted.
Linus Torvalds's avatar
Linus Torvalds committed
783
784
785
786
787
788
789
790
791
792
 * @task_kill:
 *	Check permission before sending signal @sig to @p.  @info can be NULL,
 *	the constant 1, or a pointer to a siginfo structure.  If @info is 1 or
 *	SI_FROMKERNEL(info) is true, then the signal should be viewed as coming
 *	from the kernel and should typically be permitted.
 *	SIGIO signals are handled separately by the send_sigiotask hook in
 *	file_security_ops.
 *	@p contains the task_struct for process.
 *	@info contains the signal information.
 *	@sig contains the signal value.
793
 *	@secid contains the sid of the process where the signal originated
Linus Torvalds's avatar
Linus Torvalds committed
794
795
796
797
798
799
800
801
802
803
804
805
806
807
 *	Return 0 if permission is granted.
 * @task_wait:
 *	Check permission before allowing a process to reap a child process @p
 *	and collect its status information.
 *	@p contains the task_struct for process.
 *	Return 0 if permission is granted.
 * @task_prctl:
 *	Check permission before performing a process control operation on the
 *	current process.
 *	@option contains the operation.
 *	@arg2 contains a argument.
 *	@arg3 contains a argument.
 *	@arg4 contains a argument.
 *	@arg5 contains a argument.
808
809
 *	Return -ENOSYS if no-one wanted to handle this op, any other value to
 *	cause prctl() to return immediately with that value.
Linus Torvalds's avatar
Linus Torvalds committed
810
 * @task_to_inode:
811
812
 *	Set the security attributes for an inode based on an associated task's
 *	security attributes, e.g. for /proc/pid inodes.
Linus Torvalds's avatar
Linus Torvalds committed
813
814
815
816
817
818
819
820
821
 *	@p contains the task_struct for the task.
 *	@inode contains the inode structure for the inode.
 *
 * Security hooks for Netlink messaging.
 *
 * @netlink_send:
 *	Save security information for a netlink message so that permission
 *	checking can be performed when the message is processed.  The security
 *	information can be saved using the eff_cap field of the
822
 *	netlink_skb_parms structure.  Also may be used to provide fine
Linus Torvalds's avatar
Linus Torvalds committed
823
 *	grained control over message transmission.
824
 *	@sk associated sock of task sending the message.
Linus Torvalds's avatar
Linus Torvalds committed
825
826
827
828
829
830
831
832
833
 *	@skb contains the sk_buff structure for the netlink message.
 *	Return 0 if the information was successfully saved and message
 *	is allowed to be transmitted.
 *
 * Security hooks for Unix domain networking.
 *
 * @unix_stream_connect:
 *	Check permissions before establishing a Unix domain stream connection
 *	between @sock and @other.
834
835
836
 *	@sock contains the sock structure.
 *	@other contains the peer sock structure.
 *	@newsk contains the new sock structure.
Linus Torvalds's avatar
Linus Torvalds committed
837
838
839
840
841
 *	Return 0 if permission is granted.
 * @unix_may_send:
 *	Check permissions before connecting or sending datagrams from @sock to
 *	@other.
 *	@sock contains the socket structure.
842
 *	@other contains the peer socket structure.
Linus Torvalds's avatar
Linus Torvalds committed
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
 *	Return 0 if permission is granted.
 *
 * The @unix_stream_connect and @unix_may_send hooks were necessary because
 * Linux provides an alternative to the conventional file name space for Unix
 * domain sockets.  Whereas binding and connecting to sockets in the file name
 * space is mediated by the typical file permissions (and caught by the mknod
 * and permission hooks in inode_security_ops), binding and connecting to
 * sockets in the abstract name space is completely unmediated.  Sufficient
 * control of Unix domain sockets in the abstract name space isn't possible
 * using only the socket layer hooks, since we need to know the actual target
 * socket, which is not looked up until we are inside the af_unix code.
 *
 * Security hooks for socket operations.
 *
 * @socket_create:
 *	Check permissions prior to creating a new socket.
 *	@family contains the requested protocol family.
 *	@type contains the requested communications type.
 *	@protocol contains the requested protocol.
 *	@kern set to 1 if a kernel socket.
 *	Return 0 if permission is granted.
 * @socket_post_create:
 *	This hook allows a module to update or allocate a per-socket security
 *	structure. Note that the security field was not added directly to the
 *	socket structure, but rather, the socket security information is stored
 *	in the associated inode.  Typically, the inode alloc_security hook will
 *	allocate and and attach security information to
 *	sock->inode->i_security.  This hook may be used to update the
 *	sock->inode->i_security field with additional information that wasn't
 *	available when the inode was allocated.
 *	@sock contains the newly created socket structure.
 *	@family contains the requested protocol family.
 *	@type contains the requested communications type.
 *	@protocol contains the requested protocol.
 *	@kern set to 1 if a kernel socket.
 * @socket_bind:
 *	Check permission before socket protocol layer bind operation is
 *	performed and the socket @sock is bound to the address specified in the
 *	@address parameter.
 *	@sock contains the socket structure.
 *	@address contains the address to bind to.
 *	@addrlen contains the length of address.
885
 *	Return 0 if permission is granted.
Linus Torvalds's avatar
Linus Torvalds committed
886
887
888
889
890
891
 * @socket_connect:
 *	Check permission before socket protocol layer connect operation
 *	attempts to connect socket @sock to a remote address, @address.
 *	@sock contains the socket structure.
 *	@address contains the address of remote endpoint.
 *	@addrlen contains the length of address.
892
 *	Return 0 if permission is granted.
Linus Torvalds's avatar
Linus Torvalds committed
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
 * @socket_listen:
 *	Check permission before socket protocol layer listen operation.
 *	@sock contains the socket structure.
 *	@backlog contains the maximum length for the pending connection queue.
 *	Return 0 if permission is granted.
 * @socket_accept:
 *	Check permission before accepting a new connection.  Note that the new
 *	socket, @newsock, has been created and some information copied to it,
 *	but the accept operation has not actually been performed.
 *	@sock contains the listening socket structure.
 *	@newsock contains the newly created server socket for connection.
 *	Return 0 if permission is granted.
 * @socket_sendmsg:
 *	Check permission before transmitting a message to another socket.
 *	@sock contains the socket structure.
 *	@msg contains the message to be transmitted.
 *	@size contains the size of message.
 *	Return 0 if permission is granted.
 * @socket_recvmsg:
 *	Check permission before receiving a message from a socket.
 *	@sock contains the socket structure.
 *	@msg contains the message structure.
 *	@size contains the size of message structure.
 *	@flags contains the operational flags.
917
 *	Return 0 if permission is granted.
Linus Torvalds's avatar
Linus Torvalds committed
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
 * @socket_getsockname:
 *	Check permission before the local address (name) of the socket object
 *	@sock is retrieved.
 *	@sock contains the socket structure.
 *	Return 0 if permission is granted.
 * @socket_getpeername:
 *	Check permission before the remote address (name) of a socket object
 *	@sock is retrieved.
 *	@sock contains the socket structure.
 *	Return 0 if permission is granted.
 * @socket_getsockopt:
 *	Check permissions before retrieving the options associated with socket
 *	@sock.
 *	@sock contains the socket structure.
 *	@level contains the protocol level to retrieve option from.
 *	@optname contains the name of option to retrieve.
 *	Return 0 if permission is granted.
 * @socket_setsockopt:
 *	Check permissions before setting the options associated with socket
 *	@sock.
 *	@sock contains the socket structure.
 *	@level contains the protocol level to set options for.
 *	@optname contains the name of the option to set.
941
 *	Return 0 if permission is granted.
Linus Torvalds's avatar
Linus Torvalds committed
942
943
944
945
946
947
948
949
950
951
 * @socket_shutdown:
 *	Checks permission before all or part of a connection on the socket
 *	@sock is shut down.
 *	@sock contains the socket structure.
 *	@how contains the flag indicating how future sends and receives are handled.
 *	Return 0 if permission is granted.
 * @socket_sock_rcv_skb:
 *	Check permissions on incoming network packets.  This hook is distinct
 *	from Netfilter's IP input hooks since it is the first time that the
 *	incoming sk_buff @skb has been associated with a particular socket, @sk.
952
 *	Must not sleep inside this hook because some callers hold spinlocks.
Linus Torvalds's avatar
Linus Torvalds committed
953
954
 *	@sk contains the sock (not socket) associated with the incoming sk_buff.
 *	@skb contains the incoming network data.
955
 * @socket_getpeersec_stream:
Linus Torvalds's avatar
Linus Torvalds committed
956
 *	This hook allows the security module to provide peer socket security
957
958
959
 *	state for unix or connected tcp sockets to userspace via getsockopt
 *	SO_GETPEERSEC.  For tcp sockets this can be meaningful if the
 *	socket is associated with an ipsec SA.
Linus Torvalds's avatar
Linus Torvalds committed
960
961
962
963
964
965
966
967
 *	@sock is the local socket.
 *	@optval userspace memory where the security state is to be copied.
 *	@optlen userspace int where the module should copy the actual length
 *	of the security state.
 *	@len as input is the maximum length to copy to userspace provided
 *	by the caller.
 *	Return 0 if all is well, otherwise, typical getsockopt return
 *	values.
968
 * @socket_getpeersec_dgram:
969
970
971
972
973
974
975
976
977
978
 *	This hook allows the security module to provide peer socket security
 *	state for udp sockets on a per-packet basis to userspace via
 *	getsockopt SO_GETPEERSEC.  The application must first have indicated
 *	the IP_PASSSEC option via getsockopt.  It can then retrieve the
 *	security state returned by this hook for a packet via the SCM_SECURITY
 *	ancillary message type.
 *	@skb is the skbuff for the packet being queried
 *	@secdata is a pointer to a buffer in which to copy the security data
 *	@seclen is the maximum length for @secdata
 *	Return 0 on success, error on failure.
Linus Torvalds's avatar
Linus Torvalds committed
979
 * @sk_alloc_security:
980
981
 *	Allocate and attach a security structure to the sk->sk_security field,
 *	which is used to copy security attributes between local stream sockets.
Linus Torvalds's avatar
Linus Torvalds committed
982
983
 * @sk_free_security:
 *	Deallocate security structure.
984
985
 * @sk_clone_security:
 *	Clone/copy security structure.
986
987
 * @sk_getsecid:
 *	Retrieve the LSM-specific secid for the sock to enable caching of network
988
 *	authorizations.
989
 * @sock_graft:
990
991
992
993
 *	This hook is called in response to a newly created sock struct being
 *	grafted onto an existing socket and allows the security module to
 *	perform whatever security attribute management is necessary for both
 *	the sock and socket.
994
995
996
997
 * @inet_conn_request:
 *	Sets the openreq's sid to socket's sid with MLS portion taken from peer sid.
 * @inet_csk_clone:
 *	Sets the new child socket's sid to the openreq sid.
998
 * @inet_conn_established:
999
 *	Sets the connection's peersid to the secmark on skb.
1000
1001
1002
1003
1004
1005
 * @secmark_relabel_packet:
 *	check if the process should be allowed to relabel packets to the given secid
 * @security_secmark_refcount_inc
 *	tells the LSM to increment the number of secmark labeling rules loaded
 * @security_secmark_refcount_dec
 *	tells the LSM to decrement the number of secmark labeling rules loaded
1006
1007
 * @req_classify_flow:
 *	Sets the flow's sid to the openreq sid.
1008
1009
1010
1011
1012
1013
1014
1015
1016
 * @tun_dev_alloc_security:
 *	This hook allows a module to allocate a security structure for a TUN
 *	device.
 *	@security pointer to a security structure pointer.
 *	Returns a zero on success, negative values on failure.
 * @tun_dev_free_security:
 *	This hook allows a module to free the security structure for a TUN
 *	device.
 *	@security pointer to the TUN device's security structure
Paul Moore's avatar
Paul Moore committed
1017
1018
 * @tun_dev_create:
 *	Check permissions prior to creating a new TUN device.
1019
1020
1021
 * @tun_dev_attach_queue:
 *	Check permissions prior to attaching to a TUN device queue.
 *	@security pointer to the TUN device's security structure.
Paul Moore's avatar
Paul Moore committed
1022
 * @tun_dev_attach:
1023
 *	This hook can be used by the module to update any security state
Paul Moore's avatar
Paul Moore committed
1024
1025
 *	associated with the TUN device's sock structure.
 *	@sk contains the existing sock structure.
1026
1027
1028
1029
1030
 *	@security pointer to the TUN device's security structure.
 * @tun_dev_open:
 *	This hook can be used by the module to update any security state
 *	associated with the TUN device's security structure.
 *	@security pointer to the TUN devices's security structure.
1031
1032
1033
1034
 * @skb_owned_by:
 *	This hook sets the packet's owning sock.
 *	@skb is the packet.
 *	@sk the sock which owns the packet.
1035
1036
1037
1038
 *
 * Security hooks for XFRM operations.
 *
 * @xfrm_policy_alloc_security:
1039
1040
 *	@ctxp is a pointer to the xfrm_sec_ctx being added to Security Policy
 *	Database used by the XFRM system.
1041
1042
 *	@sec_ctx contains the security context information being provided by
 *	the user-level policy update program (e.g., setkey).
1043
 *	Allocate a security structure to the xp->security field; the security
1044
 *	field is initialized to NULL when the xfrm_policy is allocated.
1045
 *	Return 0 if operation was successful (memory to allocate, legal context)
1046
 *	@gfp is to specify the context for the allocation
1047
 * @xfrm_policy_clone_security:
1048
1049
1050
1051
 *	@old_ctx contains an existing xfrm_sec_ctx.
 *	@new_ctxp contains a new xfrm_sec_ctx being cloned from old.
 *	Allocate a security structure in new_ctxp that contains the
 *	information from the old_ctx structure.
1052
1053
 *	Return 0 if operation was successful (memory to allocate).
 * @xfrm_policy_free_security:
1054
 *	@ctx contains the xfrm_sec_ctx
1055
1056
 *	Deallocate xp->security.
 * @xfrm_policy_delete_security:
1057
 *	@ctx contains the xfrm_sec_ctx.
1058
 *	Authorize deletion of xp->security.
1059
 * @xfrm_state_alloc:
1060
1061
1062
1063
 *	@x contains the xfrm_state being added to the Security Association
 *	Database by the XFRM system.
 *	@sec_ctx contains the security context information being provided by
 *	the user-level SA generation program (e.g., setkey or racoon).
1064
1065
 *	Allocate a security structure to the x->security field; the security
 *	field is initialized to NULL when the xfrm_state is allocated. Set the
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
 *	context to correspond to sec_ctx. Return 0 if operation was successful
 *	(memory to allocate, legal context).
 * @xfrm_state_alloc_acquire:
 *	@x contains the xfrm_state being added to the Security Association
 *	Database by the XFRM system.
 *	@polsec contains the policy's security context.
 *	@secid contains the secid from which to take the mls portion of the
 *	context.
 *	Allocate a security structure to the x->security field; the security
 *	field is initialized to NULL when the xfrm_state is allocated. Set the
 *	context to correspond to secid. Return 0 if operation was successful
 *	(memory to allocate, legal context).
1078
1079
 * @xfrm_state_free_security:
 *	@x contains the xfrm_state.
1080
1081
1082
1083
 *	Deallocate x->security.
 * @xfrm_state_delete_security:
 *	@x contains the xfrm_state.
 *	Authorize deletion of x->security.
1084
 * @xfrm_policy_lookup:
1085
 *	@ctx contains the xfrm_sec_ctx for which the access control is being
1086
 *	checked.
1087
 *	@fl_secid contains the flow security label that is used to authorize
1088
1089
 *	access to the policy xp.
 *	@dir contains the direction of the flow (input or output).
1090
 *	Check permission when a flow selects a xfrm_policy for processing
1091
1092
 *	XFRMs on a packet.  The hook is called when selecting either a
 *	per-socket policy or a generic xfrm policy.
1093
1094
 *	Return 0 if permission is granted, -ESRCH otherwise, or -errno
 *	on other errors.
1095
1096
1097
1098
1099
1100
1101
 * @xfrm_state_pol_flow_match:
 *	@x contains the state to match.
 *	@xp contains the policy to check for a match.
 *	@fl contains the flow to check for a match.
 *	Return 1 if there is a match.
 * @xfrm_decode_session:
 *	@skb points to skb to decode.
1102
1103
1104
 *	@secid points to the flow key secid to set.
 *	@ckall says if all xfrms used should be checked for same secid.
 *	Return 0 if ckall is zero or all xfrms used have the same secid.
Linus Torvalds's avatar
Linus Torvalds committed
1105
 *
1106
1107
1108
1109
1110
1111
 * Security hooks affecting all Key Management operations
 *
 * @key_alloc:
 *	Permit allocation of a key and assign security data. Note that key does
 *	not have a serial number assigned at this point.
 *	@key points to the key.
1112
 *	@flags is the allocation flags
1113
1114
1115
1116
1117
1118
1119
 *	Return 0 if permission is granted, -ve error otherwise.
 * @key_free:
 *	Notification of destruction; free security data.
 *	@key points to the key.
 *	No return value.
 * @key_permission:
 *	See whether a specific operational right is granted to a process on a
1120
 *	key.
1121
 *	@key_ref refers to the key (key pointer + possession attribute bit).
1122
 *	@cred points to the credentials to provide the context against which to
1123
 *	evaluate the security data on the key.
1124
 *	@perm describes the combination of permissions required of this key.
1125
 *	Return 0 if permission is granted, -ve error otherwise.
1126
1127
1128
1129
1130
1131
1132
 * @key_getsecurity:
 *	Get a textual representation of the security context attached to a key
 *	for the purposes of honouring KEYCTL_GETSECURITY.  This function
 *	allocates the storage for the NUL-terminated string and the caller
 *	should free it.
 *	@key points to the key to be queried.
 *	@_buffer points to a pointer that should be set to point to the
1133
 *	resulting string (if no label or an error occurs).
1134
 *	Return the length of the string (including terminating NUL) or -ve if
1135
 *	an error.
1136
 *	May also return 0 (and a NULL buffer pointer) if there is no label.
1137
 *
Linus Torvalds's avatar
Linus Torvalds committed
1138
1139
1140
1141
1142
1143
1144
 * Security hooks affecting all System V IPC operations.
 *
 * @ipc_permission:
 *	Check permissions for access to IPC
 *	@ipcp contains the kernel IPC permission structure
 *	@flag contains the desired (requested) permission set
 *	Return 0 if permission is granted.
1145
1146
1147
1148
1149
 * @ipc_getsecid:
 *	Get the secid associated with the ipc object.
 *	@ipcp contains the kernel IPC permission structure.
 *	@secid contains a pointer to the location where result will be saved.
 *	In case of failure, @secid will be set to zero.
Linus Torvalds's avatar
Linus Torvalds committed
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
 *
 * Security hooks for individual messages held in System V IPC message queues
 * @msg_msg_alloc_security:
 *	Allocate and attach a security structure to the msg->security field.
 *	The security field is initialized to NULL when the structure is first
 *	created.
 *	@msg contains the message structure to be modified.
 *	Return 0 if operation was successful and permission is granted.
 * @msg_msg_free_security:
 *	Deallocate the security structure for this message.
 *	@msg contains the message structure to be modified.
 *
 * Security hooks for System V IPC Message Queues
 *
 * @msg_queue_alloc_security:
 *	Allocate and attach a security structure to the
 *	msq->q_perm.security field. The security field is initialized to
 *	NULL when the structure is first created.
 *	@msq contains the message queue structure to be modified.
 *	Return 0 if operation was successful and permission is granted.
 * @msg_queue_free_security:
 *	Deallocate security structure for this message queue.
 *	@msq contains the message queue structure to be modified.
 * @msg_queue_associate:
 *	Check permission when a message queue is requested through the
 *	msgget system call.  This hook is only called when returning the
 *	message queue identifier for an existing message queue, not when a
 *	new message queue is created.
 *	@msq contains the message queue to act upon.
 *	@msqflg contains the operation control flags.
 *	Return 0 if permission is granted.
 * @msg_queue_msgctl:
 *	Check permission when a message control operation specified by @cmd
 *	is to be performed on the message queue @msq.
 *	The @msq may be NULL, e.g. for IPC_INFO or MSG_INFO.
 *	@msq contains the message queue to act upon.  May be NULL.
 *	@cmd contains the operation to be performed.
1187
 *	Return 0 if permission is granted.
Linus Torvalds's avatar
Linus Torvalds committed
1188
1189
1190
1191
1192
1193
1194
1195
1196
 * @msg_queue_msgsnd:
 *	Check permission before a message, @msg, is enqueued on the message
 *	queue, @msq.
 *	@msq contains the message queue to send message to.
 *	@msg contains the message to be enqueued.
 *	@msqflg contains operational flags.
 *	Return 0 if permission is granted.
 * @msg_queue_msgrcv:
 *	Check permission before a message, @msg, is removed from the message
1197
1198
 *	queue, @msq.  The @target task structure contains a pointer to the
 *	process that will be receiving the message (not equal to the current
Linus Torvalds's avatar
Linus Torvalds committed
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
 *	process when inline receives are being performed).
 *	@msq contains the message queue to retrieve message from.
 *	@msg contains the message destination.
 *	@target contains the task structure for recipient process.
 *	@type contains the type of message requested.
 *	@mode contains the operational flags.
 *	Return 0 if permission is granted.
 *
 * Security hooks for System V Shared Memory Segments
 *
 * @shm_alloc_security:
 *	Allocate and attach a security structure to the shp->shm_perm.security
 *	field.  The security field is initialized to NULL when the structure is
 *	first created.
 *	@shp contains the shared memory structure to be modified.
 *	Return 0 if operation was successful and permission is granted.
 * @shm_free_security:
 *	Deallocate the security struct for this memory segment.
 *	@shp contains the shared memory structure to be modified.
 * @shm_associate:
 *	Check permission when a shared memory region is requested through the
 *	shmget system call.  This hook is only called when returning the shared
 *	memory region identifier for an existing region, not when a new shared
 *	memory region is created.
 *	@shp contains the shared memory structure to be modified.
 *	@shmflg contains the operation control flags.
 *	Return 0 if permission is granted.
 * @shm_shmctl:
 *	Check permission when a shared memory control operation specified by
 *	@cmd is to be performed on the shared memory region @shp.
 *	The @shp may be NULL, e.g. for IPC_INFO or SHM_INFO.
 *	@shp contains shared memory structure to be modified.
 *	@cmd contains the operation to be performed.
 *	Return 0 if permission is granted.
 * @shm_shmat:
 *	Check permissions prior to allowing the shmat system call to attach the
 *	shared memory segment @shp to the data segment of the calling process.
 *	The attaching address is specified by @shmaddr.
 *	@shp contains the shared memory structure to be modified.
 *	@shmaddr contains the address to attach memory region to.
 *	@shmflg contains the operational flags.
 *	Return 0 if permission is granted.
 *
 * Security hooks for System V Semaphores
 *
 * @sem_alloc_security:
 *	Allocate and attach a security structure to the sma->sem_perm.security
 *	field.  The security field is initialized to NULL when the structure is
 *	first created.
 *	@sma contains the semaphore structure
 *	Return 0 if operation was successful and permission is granted.
 * @sem_free_security:
 *	deallocate security struct for this semaphore
 *	@sma contains the semaphore structure.
 * @sem_associate:
 *	Check permission when a semaphore is requested through the semget
 *	system call.  This hook is only called when returning the semaphore
 *	identifier for an existing semaphore, not when a new one must be
 *	created.
 *	@sma contains the semaphore structure.
 *	@semflg contains the operation control flags.
 *	Return 0 if permission is granted.
 * @sem_semctl:
 *	Check permission when a semaphore operation specified by @cmd is to be
1263
 *	performed on the semaphore @sma.  The @sma may be NULL, e.g. for
Linus Torvalds's avatar
Linus Torvalds committed
1264
1265
1266
1267
1268
1269
 *	IPC_INFO or SEM_INFO.
 *	@sma contains the semaphore structure.  May be NULL.
 *	@cmd contains the operation to be performed.
 *	Return 0 if permission is granted.
 * @sem_semop
 *	Check permissions before performing operations on members of the
1270
1271
 *	semaphore set @sma.  If the @alter flag is nonzero, the semaphore set
 *	may be modified.
Linus Torvalds's avatar
Linus Torvalds committed
1272
1273
1274
1275
1276
1277
 *	@sma contains the semaphore structure.
 *	@sops contains the operations to perform.
 *	@nsops contains the number of operations to perform.
 *	@alter contains the flag indicating whether changes are to be made.
 *	Return 0 if permission is granted.
 *
1278
 * @ptrace_access_check:
1279
 *	Check permission before allowing the current process to trace the
Linus Torvalds's avatar
Linus Torvalds committed
1280
1281
1282
 *	@child process.
 *	Security modules may also want to perform a process tracing check
 *	during an execve in the set_security or apply_creds hooks of
1283
 *	tracing check during an execve in the bprm_set_creds hook of
Linus Torvalds's avatar
Linus Torvalds committed
1284
1285
 *	binprm_security_ops if the process is being traced and its security
 *	attributes would be changed by the execve.
1286
 *	@child contains the task_struct structure for the target process.
1287
 *	@mode contains the PTRACE_MODE flags indicating the form of access.
Linus Torvalds's avatar
Linus Torvalds committed
1288
 *	Return 0 if permission is granted.
1289
1290
1291
1292
1293
1294
 * @ptrace_traceme:
 *	Check that the @parent process has sufficient permission to trace the
 *	current process before allowing the current process to present itself
 *	to the @parent process for tracing.
 *	@parent contains the task_struct structure for debugger process.
 *	Return 0 if permission is granted.
Linus Torvalds's avatar
Linus Torvalds committed
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
 * @capget:
 *	Get the @effective, @inheritable, and @permitted capability sets for
 *	the @target process.  The hook may also perform permission checking to
 *	determine if the current process is allowed to see the capability sets
 *	of the @target process.
 *	@target contains the task_struct structure for target process.
 *	@effective contains the effective capability set.
 *	@inheritable contains the inheritable capability set.
 *	@permitted contains the permitted capability set.
 *	Return 0 if the capability sets were successfully obtained.
1305
 * @capset:
Linus Torvalds's avatar
Linus Torvalds committed
1306
 *	Set the @effective, @inheritable, and @permitted capability sets for
David Howells's avatar
David Howells committed
1307
 *	the current process.
1308
1309
 *	@new contains the new credentials structure for target process.
 *	@old contains the current credentials structure for target process.
Linus Torvalds's avatar
Linus Torvalds committed
1310
1311
1312
 *	@effective contains the effective capability set.
 *	@inheritable contains the inheritable capability set.
 *	@permitted contains the permitted capability set.
1313
 *	Return 0 and update @new if permission is granted.
1314
 * @capable:
1315
1316
1317
 *	Check whether the @tsk process has the @cap capability in the indicated
 *	credentials.
 *	@cred contains the credentials to use.
1318
 *	@ns contains the user namespace we want the capability in
1319
 *	@cap contains the capability <include/linux/capability.h>.
1320
 *	@audit: Whether to write an audit message or not
1321
 *	Return 0 if the capability is granted for @tsk.
Linus Torvalds's avatar
Linus Torvalds committed
1322
1323
1324
 * @syslog:
 *	Check permission before accessing the kernel message ring or changing
 *	logging to the console.
1325
 *	See the syslog(2) manual page for an explanation of the @type values.
Linus Torvalds's avatar
Linus Torvalds committed
1326
 *	@type contains the type of action.
1327
 *	@from_file indicates the context of action (if it came from /proc).
Linus Torvalds's avatar
Linus Torvalds committed
1328
1329
1330
1331
1332
1333
1334
1335
1336
 *	Return 0 if permission is granted.
 * @settime:
 *	Check permission to change the system time.
 *	struct timespec and timezone are defined in include/linux/time.h
 *	@ts contains new time
 *	@tz contains new timezone
 *	Return 0 if permission is granted.
 * @vm_enough_memory:
 *	Check permissions for allocating a new virtual mapping.
1337
 *	@mm contains the mm struct it is being added to.
1338
 *	@pages contains the number of pages.
Linus Torvalds's avatar
Linus Torvalds committed
1339
1340
 *	Return 0 if permission is granted.
 *
1341
1342
1343
1344
1345
1346
1347
 * @ismaclabel:
 *	Check if the extended attribute specified by @name
 *	represents a MAC label. Returns 1 if name is a MAC
 *	attribute otherwise returns 0.
 *	@name full extended attribute name to check against
 *	LSM as a MAC label.
 *
1348
 * @secid_to_secctx:
1349
1350
1351
1352
 *	Convert secid to security context.  If secdata is NULL the length of
 *	the result will be returned in seclen, but no secdata will be returned.
 *	This does mean that the length could change between calls to check the
 *	length and the next call which actually allocates and returns the secdata.
1353
1354
 *	@secid contains the security ID.
 *	@secdata contains the pointer that stores the converted security context.
1355
 *	@seclen pointer which contains the length of the data
1356
 * @secctx_to_secid:
1357
1358
1359
 *	Convert security context to secid.
 *	@secid contains the pointer to the generated security ID.
 *	@secdata contains the security context.
1360
1361
1362
1363
1364
1365
 *
 * @release_secctx:
 *	Release the security context.
 *	@secdata contains the security context.
 *	@seclen contains the length of the security context.
 *
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
 * Security hooks for Audit
 *
 * @audit_rule_init:
 *	Allocate and initialize an LSM audit rule structure.
 *	@field contains the required Audit action. Fields flags are defined in include/linux/audit.h
 *	@op contains the operator the rule uses.
 *	@rulestr contains the context where the rule will be applied to.
 *	@lsmrule contains a pointer to receive the result.
 *	Return 0 if @lsmrule has been successfully set,
 *	-EINVAL in case of an invalid rule.
 *
 * @audit_rule_known:
 *	Specifies whether given @rule contains any fields related to current LSM.
 *	@rule contains the audit rule of interest.
 *	Return 1 in case of relation found, 0 otherwise.
 *
 * @audit_rule_match:
 *	Determine if given @secid matches a rule previously approved
 *	by @audit_rule_known.
 *	@secid contains the security id in question.
 *	@field contains the field which relates to current LSM.
 *	@op contains the operator that will be used for matching.
 *	@rule points to the audit rule that will be checked against.
 *	@actx points to the audit context associated with the check.
 *	Return 1 if secid matches the rule, 0 if it does not, -ERRNO on failure.
 *
 * @audit_rule_free:
 *	Deallocate the LSM audit rule structure previously allocated by
 *	audit_rule_init.
 *	@rule contains the allocated rule
 *
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
 * @inode_notifysecctx:
 *	Notify the security module of what the security context of an inode
 *	should be.  Initializes the incore security context managed by the
 *	security module for this inode.  Example usage:  NFS client invokes
 *	this hook to initialize the security context in its incore inode to the
 *	value provided by the server for the file when the server returned the
 *	file's attributes to the client.
 *
 * 	Must be called with inode->i_mutex locked.
 *
 * 	@inode we wish to set the security context of.
 * 	@ctx contains the string which we wish to set in the inode.
 * 	@ctxlen contains the length of @ctx.
 *
 * @inode_setsecctx:
 * 	Change the security context of an inode.  Updates the
 * 	incore security context managed by the security module and invokes the
 * 	fs code as needed (via __vfs_setxattr_noperm) to update any backing
 * 	xattrs that represent the context.  Example usage:  NFS server invokes
 * 	this hook to change the security context in its incore inode and on the
 * 	backing filesystem to a value provided by the client on a SETATTR
 * 	operation.
 *
 * 	Must be called with inode->i_mutex locked.
 *
 * 	@dentry contains the inode we wish to set the security context of.
 * 	@ctx contains the string which we wish to set in the inode.
 * 	@ctxlen contains the length of @ctx.
 *
 * @inode_getsecctx:
1427
1428
 *	On success, returns 0 and fills out @ctx and @ctxlen with the security
 *	context for the given @inode.
1429
 *
1430
 * 	@inode we wish to get the security context of.
1431
1432
 *	@ctx is a pointer in which to place the allocated security context.
 *	@ctxlen points to the place to put the length of @ctx.
Linus Torvalds's avatar
Linus Torvalds committed
1433
1434
1435
 * This is the main security structure.
 */
struct security_operations {
1436
1437
	char name[SECURITY_NAME_MAX + 1];

1438
	int (*ptrace_access_check) (struct task_struct *child, unsigned int mode);
1439
	int (*ptrace_traceme) (struct task_struct *parent);
1440
1441
1442
	int (*capget) (struct task_struct *target,
		       kernel_cap_t *effective,
		       kernel_cap_t *inheritable, kernel_cap_t *permitted);
1443
1444
1445
1446
1447
	int (*capset) (struct cred *new,
		       const struct cred *old,
		       const kernel_cap_t *effective,
		       const kernel_cap_t *inheritable,
		       const kernel_cap_t *permitted);
1448
1449
	int (*capable) (const struct cred *cred, struct user_namespace *ns,
			int cap, int audit);
1450
1451
	int (*quotactl) (int cmds, int type, int id, struct super_block *sb);
	int (*quota_on) (struct dentry *dentry);
1452
	int (*syslog) (int type);
1453
	int (*settime) (const struct timespec *ts, const struct timezone *tz);
1454
	int (*vm_enough_memory) (struct mm_struct *mm, long pages);
Linus Torvalds's avatar
Linus Torvalds committed
1455

1456
	int (*bprm_set_creds) (struct linux_binprm *bprm);
1457
1458
	int (*bprm_check_security) (struct linux_binprm *bprm);
	int (*bprm_secureexec) (struct linux_binprm *bprm);
1459
1460
	void (*bprm_committing_creds) (struct linux_binprm *bprm);
	void (*bprm_committed_creds) (struct linux_binprm *bprm);
1461
1462
1463
1464

	int (*sb_alloc_security) (struct super_block *sb);
	void (*sb_free_security) (struct super_block *sb);
	int (*sb_copy_data) (char *orig, char *copy);
1465
	int (*sb_remount) (struct super_block *sb, void *data);
1466
	int (*sb_kern_mount) (struct super_block *sb, int flags, void *data);
1467
	int (*sb_show_options) (struct seq_file *m, struct super_block *sb);
1468
	int (*sb_statfs) (struct dentry *dentry);
Al Viro's avatar
Al Viro committed
1469
1470
	int (*sb_mount) (const char *dev_name, struct path *path,
			 const char *type, unsigned long flags, void *data);
1471
	int (*sb_umount) (struct vfsmount *mnt, int flags);
1472
1473
	int (*sb_pivotroot) (struct path *old_path,
			     struct path *new_path);
1474
	int (*sb_set_mnt_opts) (struct super_block *sb,
1475
1476
1477
				struct security_mnt_opts *opts,
				unsigned long kern_flags,
				unsigned long *set_kern_flags);
1478
	int (*sb_clone_mnt_opts) (const struct super_block *oldsb,
1479
				   struct super_block *newsb);
1480
	int (*sb_parse_opts_str) (char *options, struct security_mnt_opts *opts);
1481
1482
1483
1484
	int (*dentry_init_security) (struct dentry *dentry, int mode,
					struct qstr *name, void **ctx,
					u32 *ctxlen);

Linus Torvalds's avatar
Linus Torvalds committed
1485

1486
1487
#ifdef CONFIG_SECURITY_PATH
	int (*path_unlink) (struct path *dir, struct dentry *dentry);
Al Viro's avatar
Al Viro committed
1488
	int (*path_mkdir) (struct path *dir, struct dentry *dentry, umode_t mode);
1489
	int (*path_rmdir) (struct path *dir, struct dentry *dentry);
Al Viro's avatar
Al Viro committed
1490
	int (*path_mknod) (struct path *dir, struct dentry *dentry, umode_t mode,
1491
			   unsigned int dev);
1492
	int (*path_truncate) (struct path *path);
1493
1494
1495
1496
1497
1498
	int (*path_symlink) (struct path *dir, struct dentry *dentry,
			     const char *old_name);
	int (*path_link) (struct dentry *old_dentry, struct path *new_dir,
			  struct dentry *new_dentry);
	int (*path_rename) (struct path *old_dir, struct dentry *old_dentry,
			    struct path *new_dir, struct dentry *new_dentry);
1499
	int (*path_chmod) (struct path *path, umode_t mode);
1500
	int (*path_chown) (struct path *path, kuid_t uid, kgid_t gid);
1501
	int (*path_chroot) (struct path *path);
1502
1503
#endif

1504
	int (*inode_alloc_security) (struct inode *inode);
Linus Torvalds's avatar
Linus Torvalds committed
1505
	void (*inode_free_security) (struct inode *inode);
1506
	int (*inode_init_security) (struct inode *inode, struct inode *dir,
1507
				    const struct qstr *qstr, const char **name,
1508
				    void **value, size_t *len);
Linus Torvalds's avatar
Linus Torvalds committed
1509
	int (*inode_create) (struct inode *dir,
Al Viro's avatar
Al Viro committed
1510
			     struct dentry *dentry, umode_t mode);
Linus Torvalds's avatar
Linus Torvalds committed
1511
	int (*inode_link) (struct dentry *old_dentry,
1512
			   struct inode *dir, struct dentry *new_dentry);
Linus Torvalds's avatar
Linus Torvalds committed
1513
1514
	int (*inode_unlink) (struct inode *dir, struct dentry *dentry);
	int (*inode_symlink) (struct inode *dir,
1515
			      struct dentry *dentry, const char *old_name);
1516
	int (*inode_mkdir) (struct inode *dir, struct dentry *dentry, umode_t mode);
Linus Torvalds's avatar
Linus Torvalds committed
1517
1518
	int (*inode_rmdir) (struct inode *dir, struct dentry *dentry);
	int (*inode_mknod) (struct inode *dir, struct dentry *dentry,
Al Viro's avatar
Al Viro committed
1519