Blame view
include/linux/security.h
111 KB
1da177e4c Linux-2.6.12-rc2 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 |
/* * Linux Security plug * * Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com> * Copyright (C) 2001 Greg Kroah-Hartman <greg@kroah.com> * Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com> * Copyright (C) 2001 James Morris <jmorris@intercode.com.au> * Copyright (C) 2001 Silicon Graphics, Inc. (Trust Technology Group) * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * Due to this file being licensed under the GPL there is controversy over * whether this permits you to write a module that #includes this file * without placing your module under the GPL. Please consult a lawyer for * advice before doing this. * */ #ifndef __LINUX_SECURITY_H #define __LINUX_SECURITY_H #include <linux/fs.h> |
c4ec54b40 fsnotify: new fsn... |
26 |
#include <linux/fsnotify.h> |
1da177e4c Linux-2.6.12-rc2 |
27 |
#include <linux/binfmts.h> |
2a7dba391 fs/vfs/security: ... |
28 |
#include <linux/dcache.h> |
1da177e4c Linux-2.6.12-rc2 |
29 30 31 32 |
#include <linux/signal.h> #include <linux/resource.h> #include <linux/sem.h> #include <linux/shm.h> |
a2551df7e Security/SELinux:... |
33 |
#include <linux/mm.h> /* PAGE_ALIGN */ |
1da177e4c Linux-2.6.12-rc2 |
34 35 |
#include <linux/msg.h> #include <linux/sched.h> |
29db91906 [PATCH] Keys: Add... |
36 |
#include <linux/key.h> |
e0d1caa7b [MLSXFRM]: Flow b... |
37 |
#include <linux/xfrm.h> |
5a0e3ad6a include cleanup: ... |
38 |
#include <linux/slab.h> |
9d8f13ba3 security: new sec... |
39 |
#include <linux/xattr.h> |
beb8d13be [MLSXFRM]: Add fl... |
40 |
#include <net/flow.h> |
1da177e4c Linux-2.6.12-rc2 |
41 |
|
076c54c5b Security: Introdu... |
42 43 |
/* Maximum number of letters for an LSM name string */ #define SECURITY_NAME_MAX 10 |
06112163f Add a new capable... |
44 45 46 |
/* If capable should audit the security request */ #define SECURITY_CAP_NOAUDIT 0 #define SECURITY_CAP_AUDIT 1 |
1da177e4c Linux-2.6.12-rc2 |
47 |
struct ctl_table; |
03d37d25e LSM/Audit: Introd... |
48 |
struct audit_krule; |
3486740a4 userns: security:... |
49 |
struct user_namespace; |
1da177e4c Linux-2.6.12-rc2 |
50 51 52 53 54 |
/* * These functions are in security/capability.c and are used * as the default capabilities functions */ |
3699c53c4 CRED: Fix regress... |
55 |
extern int cap_capable(struct task_struct *tsk, const struct cred *cred, |
3486740a4 userns: security:... |
56 |
struct user_namespace *ns, int cap, int audit); |
1e6d76792 time: Correct the... |
57 |
extern int cap_settime(const struct timespec *ts, const struct timezone *tz); |
9e48858f7 security: rename ... |
58 |
extern int cap_ptrace_access_check(struct task_struct *child, unsigned int mode); |
5cd9c58fb security: Fix set... |
59 |
extern int cap_ptrace_traceme(struct task_struct *parent); |
7b41b1733 SELinux: include/... |
60 |
extern int cap_capget(struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted); |
d84f4f992 CRED: Inaugurate ... |
61 62 63 64 |
extern int cap_capset(struct cred *new, const struct cred *old, const kernel_cap_t *effective, const kernel_cap_t *inheritable, const kernel_cap_t *permitted); |
a6f76f23d CRED: Make execve... |
65 |
extern int cap_bprm_set_creds(struct linux_binprm *bprm); |
1da177e4c Linux-2.6.12-rc2 |
66 |
extern int cap_bprm_secureexec(struct linux_binprm *bprm); |
8f0cfa52a xattr: add missin... |
67 68 69 |
extern int cap_inode_setxattr(struct dentry *dentry, const char *name, const void *value, size_t size, int flags); extern int cap_inode_removexattr(struct dentry *dentry, const char *name); |
b53767719 Implement file po... |
70 71 |
extern int cap_inode_need_killpriv(struct dentry *dentry); extern int cap_inode_killpriv(struct dentry *dentry); |
7c73875e7 Capabilities: mov... |
72 73 74 |
extern int cap_file_mmap(struct file *file, unsigned long reqprot, unsigned long prot, unsigned long flags, unsigned long addr, unsigned long addr_only); |
d84f4f992 CRED: Inaugurate ... |
75 |
extern int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags); |
3898b1b4e capabilities: imp... |
76 |
extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3, |
d84f4f992 CRED: Inaugurate ... |
77 |
unsigned long arg4, unsigned long arg5); |
b0ae19811 security: remove ... |
78 |
extern int cap_task_setscheduler(struct task_struct *p); |
7b41b1733 SELinux: include/... |
79 80 |
extern int cap_task_setioprio(struct task_struct *p, int ioprio); extern int cap_task_setnice(struct task_struct *p, int nice); |
20510f2f4 security: Convert... |
81 |
extern int cap_vm_enough_memory(struct mm_struct *mm, long pages); |
1da177e4c Linux-2.6.12-rc2 |
82 83 84 85 86 87 |
struct msghdr; struct sk_buff; struct sock; struct sockaddr; struct socket; |
df71837d5 [LSM-IPSec]: Secu... |
88 89 90 91 92 93 |
struct flowi; struct dst_entry; struct xfrm_selector; struct xfrm_policy; struct xfrm_state; struct xfrm_user_sec_ctx; |
2069f4578 LSM/SELinux: show... |
94 |
struct seq_file; |
1da177e4c Linux-2.6.12-rc2 |
95 96 |
extern int cap_netlink_send(struct sock *sk, struct sk_buff *skb); |
c7bdb545d [NETLINK]: Encaps... |
97 |
extern int cap_netlink_recv(struct sk_buff *skb, int cap); |
1da177e4c Linux-2.6.12-rc2 |
98 |
|
189b3b1c8 Security: add sta... |
99 |
void reset_security_ops(void); |
6e1415467 NOMMU: Optimise a... |
100 |
#ifdef CONFIG_MMU |
ed0321895 security: Protect... |
101 |
extern unsigned long mmap_min_addr; |
a2551df7e Security/SELinux:... |
102 |
extern unsigned long dac_mmap_min_addr; |
6e1415467 NOMMU: Optimise a... |
103 104 105 |
#else #define dac_mmap_min_addr 0UL #endif |
1da177e4c Linux-2.6.12-rc2 |
106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 |
/* * Values used in the task_security_ops calls */ /* setuid or setgid, id0 == uid or gid */ #define LSM_SETID_ID 1 /* setreuid or setregid, id0 == real, id1 == eff */ #define LSM_SETID_RE 2 /* setresuid or setresgid, id0 == real, id1 == eff, uid2 == saved */ #define LSM_SETID_RES 4 /* setfsuid or setfsgid, id0 == fsuid or fsgid */ #define LSM_SETID_FS 8 /* forward declares to avoid warnings */ |
1da177e4c Linux-2.6.12-rc2 |
122 |
struct sched_param; |
4237c75c0 [MLSXFRM]: Auto-l... |
123 |
struct request_sock; |
1da177e4c Linux-2.6.12-rc2 |
124 |
|
a6f76f23d CRED: Make execve... |
125 |
/* bprm->unsafe reasons */ |
1da177e4c Linux-2.6.12-rc2 |
126 127 128 |
#define LSM_UNSAFE_SHARE 1 #define LSM_UNSAFE_PTRACE 2 #define LSM_UNSAFE_PTRACE_CAP 4 |
6e1415467 NOMMU: Optimise a... |
129 |
#ifdef CONFIG_MMU |
47d439e9f security: define ... |
130 131 132 133 134 135 136 137 138 139 140 141 |
/* * If a hint addr is less than mmap_min_addr change hint to be as * low as possible but still greater than mmap_min_addr */ static inline unsigned long round_hint_to_min(unsigned long hint) { hint &= PAGE_MASK; if (((void *)hint != NULL) && (hint < mmap_min_addr)) return PAGE_ALIGN(mmap_min_addr); return hint; } |
8d65af789 sysctl: remove "s... |
142 |
extern int mmap_min_addr_handler(struct ctl_table *table, int write, |
47d439e9f security: define ... |
143 |
void __user *buffer, size_t *lenp, loff_t *ppos); |
6e1415467 NOMMU: Optimise a... |
144 |
#endif |
47d439e9f security: define ... |
145 |
|
9d8f13ba3 security: new sec... |
146 147 148 |
/* security_inode_init_security callback function to write xattrs */ typedef int (*initxattrs) (struct inode *inode, const struct xattr *xattr_array, void *fs_data); |
1da177e4c Linux-2.6.12-rc2 |
149 |
#ifdef CONFIG_SECURITY |
e00075298 LSM/SELinux: Inte... |
150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 |
struct security_mnt_opts { char **mnt_opts; int *mnt_opts_flags; int num_mnt_opts; }; static inline void security_init_mnt_opts(struct security_mnt_opts *opts) { opts->mnt_opts = NULL; opts->mnt_opts_flags = NULL; opts->num_mnt_opts = 0; } static inline void security_free_mnt_opts(struct security_mnt_opts *opts) { int i; if (opts->mnt_opts) |
7b41b1733 SELinux: include/... |
167 |
for (i = 0; i < opts->num_mnt_opts; i++) |
e00075298 LSM/SELinux: Inte... |
168 169 170 171 172 173 174 |
kfree(opts->mnt_opts[i]); kfree(opts->mnt_opts); opts->mnt_opts = NULL; kfree(opts->mnt_opts_flags); opts->mnt_opts_flags = NULL; opts->num_mnt_opts = 0; } |
1da177e4c Linux-2.6.12-rc2 |
175 176 177 |
/** * struct security_operations - main security structure * |
076c54c5b Security: Introdu... |
178 179 180 181 182 183 |
* Security module identifier. * * @name: * A string that acts as a unique identifeir for the LSM with max number * of characters = SECURITY_NAME_MAX. * |
1da177e4c Linux-2.6.12-rc2 |
184 185 |
* Security hooks for program execution operations. * |
a6f76f23d CRED: Make execve... |
186 |
* @bprm_set_creds: |
1da177e4c Linux-2.6.12-rc2 |
187 188 189 190 191 192 193 194 195 196 197 198 |
* Save security information in the bprm->security field, typically based * on information about the bprm->file, for later use by the apply_creds * hook. This hook may also optionally check permissions (e.g. for * transitions between security domains). * This hook may be called multiple times during a single execve, e.g. for * interpreters. The hook can tell whether it has already been called by * checking to see if @bprm->security is non-NULL. If so, then the hook * may decide either to retain the security information saved earlier or * to replace it. * @bprm contains the linux_binprm structure. * Return 0 if the hook is successful and permission is granted. * @bprm_check_security: |
a6f76f23d CRED: Make execve... |
199 200 201 202 203 204 |
* This hook mediates the point when a search for a binary handler will * begin. It allows a check the @bprm->security value which is set in the * preceding set_creds call. The primary difference from set_creds is * that the argv list and envp list are reliably available in @bprm. This * hook may be called multiple times during a single execve; and in each * pass set_creds is called first. |
7b41b1733 SELinux: include/... |
205 |
* @bprm contains the linux_binprm structure. |
1da177e4c Linux-2.6.12-rc2 |
206 |
* Return 0 if the hook is successful and permission is granted. |
a6f76f23d CRED: Make execve... |
207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 |
* @bprm_committing_creds: * Prepare to install the new security attributes of a process being * transformed by an execve operation, based on the old credentials * pointed to by @current->cred and the information set in @bprm->cred by * the bprm_set_creds hook. @bprm points to the linux_binprm structure. * This hook is a good place to perform state changes on the process such * as closing open file descriptors to which access will no longer be * granted when the attributes are changed. This is called immediately * before commit_creds(). * @bprm_committed_creds: * Tidy up after the installation of the new security attributes of a * process being transformed by an execve operation. The new credentials * have, by this point, been set to @current->cred. @bprm points to the * linux_binprm structure. This hook is a good place to perform state * changes on the process such as clearing out non-inheritable signal * state. This is called immediately after commit_creds(). |
1da177e4c Linux-2.6.12-rc2 |
223 |
* @bprm_secureexec: |
7b41b1733 SELinux: include/... |
224 225 226 227 228 |
* Return a boolean value (0 or 1) indicating whether a "secure exec" * is required. The flag is passed in the auxiliary table * on the initial stack to the ELF interpreter to indicate whether libc * should enable secure mode. * @bprm contains the linux_binprm structure. |
1da177e4c Linux-2.6.12-rc2 |
229 230 231 232 233 234 235 236 237 238 239 240 241 |
* * Security hooks for filesystem operations. * * @sb_alloc_security: * Allocate and attach a security structure to the sb->s_security field. * The s_security field is initialized to NULL when the structure is * allocated. * @sb contains the super_block structure to be modified. * Return 0 if operation was successful. * @sb_free_security: * Deallocate and clear the sb->s_security field. * @sb contains the super_block structure to be modified. * @sb_statfs: |
726c33422 [PATCH] VFS: Perm... |
242 243 244 |
* Check permission before obtaining filesystem statistics for the @mnt * mountpoint. * @dentry is a handle on the superblock for the filesystem. |
7b41b1733 SELinux: include/... |
245 |
* Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
246 247 248 249 250 251 252 253 |
* @sb_mount: * Check permission before an object specified by @dev_name is mounted on * the mount point named by @nd. For an ordinary mount, @dev_name * identifies a device if the file system type requires a device. For a * remount (@flags & MS_REMOUNT), @dev_name is irrelevant. For a * loopback/bind mount (@flags & MS_BIND), @dev_name identifies the * pathname of the object being mounted. * @dev_name contains the name for object being mounted. |
b5266eb4c [PATCH] switch a ... |
254 |
* @path contains the path for mount point object. |
1da177e4c Linux-2.6.12-rc2 |
255 256 257 258 259 260 261 262 263 264 265 266 267 268 |
* @type contains the filesystem type. * @flags contains the mount flags. * @data contains the filesystem-specific data. * Return 0 if permission is granted. * @sb_copy_data: * Allow mount option data to be copied prior to parsing by the filesystem, * so that the security module can extract security-specific mount * options cleanly (a filesystem may modify the data e.g. with strsep()). * This also allows the original mount data to be stripped of security- * specific options to avoid having to make filesystems aware of them. * @type the type of filesystem being mounted. * @orig the original mount data copied from userspace. * @copy copied data which will be passed to the security module. * Returns 0 if the copy was successful. |
ff36fe2c8 LSM: Pass -o remo... |
269 270 271 272 273 274 |
* @sb_remount: * Extracts security system specifc mount options and verifys no changes * are being made to those options. * @sb superblock being remounted * @data contains the filesystem-specific data. * Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
275 276 277 278 279 |
* @sb_umount: * Check permission before the @mnt file system is unmounted. * @mnt contains the mounted file system. * @flags contains the unmount flags, e.g. MNT_FORCE. * Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
280 281 |
* @sb_pivotroot: * Check permission before pivoting the root filesystem. |
b5266eb4c [PATCH] switch a ... |
282 |
* @old_path contains the path for the new location of the current root (put_old). |
7b41b1733 SELinux: include/... |
283 |
* @new_path contains the path for the new root (new_root). |
1da177e4c Linux-2.6.12-rc2 |
284 |
* Return 0 if permission is granted. |
c9180a57a Security: add get... |
285 286 287 |
* @sb_set_mnt_opts: * Set the security relevant mount options used for a superblock * @sb the superblock to set security mount options for |
e00075298 LSM/SELinux: Inte... |
288 |
* @opts binary data structure containing all lsm mount data |
c9180a57a Security: add get... |
289 290 291 292 |
* @sb_clone_mnt_opts: * Copy all security options from a given superblock to another * @oldsb old superblock which contain information to clone * @newsb new superblock which needs filled in |
e00075298 LSM/SELinux: Inte... |
293 294 295 296 |
* @sb_parse_opts_str: * Parse a string of security data filling in the opts structure * @options string containing all mount options known by the LSM * @opts binary data structure usable by the LSM |
1da177e4c Linux-2.6.12-rc2 |
297 298 299 300 301 302 303 304 305 306 307 308 |
* * Security hooks for inode operations. * * @inode_alloc_security: * Allocate and attach a security structure to @inode->i_security. The * i_security field is initialized to NULL when the inode structure is * allocated. * @inode contains the inode structure. * Return 0 if operation was successful. * @inode_free_security: * @inode contains the inode structure. * Deallocate the inode security structure and set @inode->i_security to |
7b41b1733 SELinux: include/... |
309 |
* NULL. |
5e41ff9e0 [PATCH] security:... |
310 |
* @inode_init_security: |
7b41b1733 SELinux: include/... |
311 |
* Obtain the security attribute name suffix and value to set on a newly |
5e41ff9e0 [PATCH] security:... |
312 313 314 315 316 317 318 319 320 321 322 |
* created inode and set up the incore security field for the new inode. * This hook is called by the fs code as part of the inode creation * transaction and provides for atomic labeling of the inode, unlike * the post_create/mkdir/... hooks called by the VFS. The hook function * is expected to allocate the name and value via kmalloc, with the caller * being responsible for calling kfree after using them. * If the security module does not use security attributes or does * not wish to put a security attribute on this particular inode, * then it should return -EOPNOTSUPP to skip this processing. * @inode contains the inode structure of the newly created inode. * @dir contains the inode structure of the parent directory. |
2a7dba391 fs/vfs/security: ... |
323 |
* @qstr contains the last path component of the new object |
5e41ff9e0 [PATCH] security:... |
324 325 326 327 328 329 |
* @name will be set to the allocated name suffix (e.g. selinux). * @value will be set to the allocated attribute value. * @len will be set to the length of the value. * Returns 0 if @name and @value have been successfully set, * -EOPNOTSUPP if no security attribute is needed, or * -ENOMEM on memory allocation failure. |
1da177e4c Linux-2.6.12-rc2 |
330 331 332 333 334 335 |
* @inode_create: * Check permission to create a regular file. * @dir contains inode structure of the parent of the new file. * @dentry contains the dentry structure for the file to be created. * @mode contains the file mode of the file to be created. * Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
336 337 338 339 340 341 |
* @inode_link: * Check permission before creating a new hard link to a file. * @old_dentry contains the dentry structure for an existing link to the file. * @dir contains the inode structure of the parent directory of the new link. * @new_dentry contains the dentry structure for the new link. * Return 0 if permission is granted. |
be6d3e56a introduce new LSM... |
342 343 344 345 346 347 348 349 |
* @path_link: * Check permission before creating a new hard link to a file. * @old_dentry contains the dentry structure for an existing link * to the file. * @new_dir contains the path structure of the parent directory of * the new link. * @new_dentry contains the dentry structure for the new link. * Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
350 |
* @inode_unlink: |
7b41b1733 SELinux: include/... |
351 |
* Check the permission to remove a hard link to a file. |
1da177e4c Linux-2.6.12-rc2 |
352 353 354 |
* @dir contains the inode structure of parent directory of the file. * @dentry contains the dentry structure for file to be unlinked. * Return 0 if permission is granted. |
be6d3e56a introduce new LSM... |
355 356 357 358 359 |
* @path_unlink: * Check the permission to remove a hard link to a file. * @dir contains the path structure of parent directory of the file. * @dentry contains the dentry structure for file to be unlinked. * Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
360 361 362 363 364 365 |
* @inode_symlink: * Check the permission to create a symbolic link to a file. * @dir contains the inode structure of parent directory of the symbolic link. * @dentry contains the dentry structure of the symbolic link. * @old_name contains the pathname of file. * Return 0 if permission is granted. |
be6d3e56a introduce new LSM... |
366 367 368 369 370 371 372 |
* @path_symlink: * Check the permission to create a symbolic link to a file. * @dir contains the path structure of parent directory of * the symbolic link. * @dentry contains the dentry structure of the symbolic link. * @old_name contains the pathname of file. * Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
373 374 |
* @inode_mkdir: * Check permissions to create a new directory in the existing directory |
7b41b1733 SELinux: include/... |
375 |
* associated with inode strcture @dir. |
1da177e4c Linux-2.6.12-rc2 |
376 377 378 379 |
* @dir containst the inode structure of parent of the directory to be created. * @dentry contains the dentry structure of new directory. * @mode contains the mode of new directory. * Return 0 if permission is granted. |
be6d3e56a introduce new LSM... |
380 381 382 383 384 385 386 387 |
* @path_mkdir: * Check permissions to create a new directory in the existing directory * associated with path strcture @path. * @dir containst the path structure of parent of the directory * to be created. * @dentry contains the dentry structure of new directory. * @mode contains the mode of new directory. * Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
388 389 390 391 392 |
* @inode_rmdir: * Check the permission to remove a directory. * @dir contains the inode structure of parent of the directory to be removed. * @dentry contains the dentry structure of directory to be removed. * Return 0 if permission is granted. |
be6d3e56a introduce new LSM... |
393 394 395 396 397 398 |
* @path_rmdir: * Check the permission to remove a directory. * @dir contains the path structure of parent of the directory to be * removed. * @dentry contains the dentry structure of directory to be removed. * Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
399 400 401 402 403 404 405 406 |
* @inode_mknod: * Check permissions when creating a special file (or a socket or a fifo * file created via the mknod system call). Note that if mknod operation * is being done for a regular file, then the create hook will be called * and not this hook. * @dir contains the inode structure of parent of the new file. * @dentry contains the dentry structure of the new file. * @mode contains the mode of the new file. |
59c51591a Fix occurrences o... |
407 |
* @dev contains the device number. |
1da177e4c Linux-2.6.12-rc2 |
408 |
* Return 0 if permission is granted. |
be6d3e56a introduce new LSM... |
409 410 411 412 413 414 415 416 417 |
* @path_mknod: * Check permissions when creating a file. Note that this hook is called * even if mknod operation is being done for a regular file. * @dir contains the path structure of parent of the new file. * @dentry contains the dentry structure of the new file. * @mode contains the mode of the new file. * @dev contains the undecoded device number. Use new_decode_dev() to get * the decoded device number. * Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
418 419 420 421 422 423 424 |
* @inode_rename: * Check for permission to rename a file or directory. * @old_dir contains the inode structure for parent of the old link. * @old_dentry contains the dentry structure of the old link. * @new_dir contains the inode structure for parent of the new link. * @new_dentry contains the dentry structure of the new link. * Return 0 if permission is granted. |
be6d3e56a introduce new LSM... |
425 426 427 428 429 430 431 |
* @path_rename: * Check for permission to rename a file or directory. * @old_dir contains the path structure for parent of the old link. * @old_dentry contains the dentry structure of the old link. * @new_dir contains the path structure for parent of the new link. * @new_dentry contains the dentry structure of the new link. * Return 0 if permission is granted. |
89eda0683 LSM: Add security... |
432 433 434 435 436 437 438 439 440 441 442 443 |
* @path_chmod: * Check for permission to change DAC's permission of a file or directory. * @dentry contains the dentry structure. * @mnt contains the vfsmnt structure. * @mode contains DAC's mode. * Return 0 if permission is granted. * @path_chown: * Check for permission to change owner/group of a file or directory. * @path contains the path structure. * @uid contains new owner's ID. * @gid contains new group's ID. * Return 0 if permission is granted. |
8b8efb440 LSM: Add security... |
444 445 446 447 |
* @path_chroot: * Check for permission to change root directory. * @path contains the path structure. * Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 |
* @inode_readlink: * Check the permission to read the symbolic link. * @dentry contains the dentry structure for the file link. * Return 0 if permission is granted. * @inode_follow_link: * Check permission to follow a symbolic link when looking up a pathname. * @dentry contains the dentry structure for the link. * @nd contains the nameidata structure for the parent directory. * Return 0 if permission is granted. * @inode_permission: * Check permission before accessing an inode. This hook is called by the * existing Linux permission function, so a security module can use it to * provide additional checking for existing Linux permission checks. * Notice that this hook is called when a file is opened (as well as many * other operations), whereas the file_security_ops permission hook is * called when the actual read/write operations are performed. * @inode contains the inode structure to check. * @mask contains the permission mask. |
1da177e4c Linux-2.6.12-rc2 |
466 467 468 469 470 471 472 473 474 |
* Return 0 if permission is granted. * @inode_setattr: * Check permission before setting file attributes. Note that the kernel * call to notify_change is performed from several locations, whenever * file attributes change (such as when a file is truncated, chown/chmod * operations, transferring disk quotas, etc). * @dentry contains the dentry structure for the file. * @attr is the iattr structure containing the new file attributes. * Return 0 if permission is granted. |
be6d3e56a introduce new LSM... |
475 476 477 |
* @path_truncate: * Check permission before truncating a file. * @path contains the path structure for the file. |
be6d3e56a introduce new LSM... |
478 |
* Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
479 480 481 482 483 |
* @inode_getattr: * Check permission before obtaining file attributes. * @mnt is the vfsmount where the dentry was looked up * @dentry contains the dentry structure for the file. * Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
484 |
* @inode_setxattr: |
7b41b1733 SELinux: include/... |
485 486 487 |
* Check permission before setting the extended attributes * @value identified by @name for @dentry. * Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
488 |
* @inode_post_setxattr: |
7b41b1733 SELinux: include/... |
489 490 |
* Update inode security field after successful setxattr operation. * @value identified by @name for @dentry. |
1da177e4c Linux-2.6.12-rc2 |
491 |
* @inode_getxattr: |
7b41b1733 SELinux: include/... |
492 493 494 |
* Check permission before obtaining the extended attributes * identified by @name for @dentry. * Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
495 |
* @inode_listxattr: |
7b41b1733 SELinux: include/... |
496 497 498 |
* Check permission before obtaining the list of extended attribute * names for @dentry. * Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
499 |
* @inode_removexattr: |
7b41b1733 SELinux: include/... |
500 501 502 |
* Check permission before removing the extended attribute * identified by @name for @dentry. * Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
503 |
* @inode_getsecurity: |
424925940 VFS/Security: Rew... |
504 505 506 507 508 509 |
* Retrieve a copy of the extended attribute representation of the * security label associated with @name for @inode via @buffer. Note that * @name is the remainder of the attribute name after the security prefix * has been removed. @alloc is used to specify of the call should return a * value via the buffer or just the value length Return size of buffer on * success. |
1da177e4c Linux-2.6.12-rc2 |
510 511 512 513 |
* @inode_setsecurity: * Set the security label associated with @name for @inode from the * extended attribute value @value. @size indicates the size of the * @value in bytes. @flags may be XATTR_CREATE, XATTR_REPLACE, or 0. |
7b41b1733 SELinux: include/... |
514 |
* Note that @name is the remainder of the attribute name after the |
1da177e4c Linux-2.6.12-rc2 |
515 516 517 518 519 520 521 522 |
* security. prefix has been removed. * Return 0 on success. * @inode_listsecurity: * Copy the extended attribute names for the security labels * associated with @inode into @buffer. The maximum size of @buffer * is specified by @buffer_size. @buffer may be NULL to request * the size of the buffer required. * Returns number of bytes used/required on success. |
b53767719 Implement file po... |
523 524 525 526 527 528 529 530 531 532 533 534 |
* @inode_need_killpriv: * Called when an inode has been changed. * @dentry is the dentry being changed. * Return <0 on error to abort the inode change operation. * Return 0 if inode_killpriv does not need to be called. * Return >0 if inode_killpriv does need to be called. * @inode_killpriv: * The setuid bit is being removed. Remove similar security labels. * Called with the dentry->d_inode->i_mutex held. * @dentry is the dentry being changed. * Return 0 on success. If error is returned, then the operation * causing setuid bit removal is failed. |
8a076191f LSM: Introduce in... |
535 536 537 538 539 |
* @inode_getsecid: * Get the secid associated with the node. * @inode contains a pointer to the inode. * @secid contains a pointer to the location where result will be saved. * In case of failure, @secid will be set to zero. |
1da177e4c Linux-2.6.12-rc2 |
540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 |
* * Security hooks for file operations * * @file_permission: * Check file permissions before accessing an open file. This hook is * called by various operations that read or write files. A security * module can use this hook to perform additional checking on these * operations, e.g. to revalidate permissions on use to support privilege * bracketing or policy changes. Notice that this hook is used when the * actual read/write operations are performed, whereas the * inode_security_ops hook is called when a file is opened (as well as * many other operations). * Caveat: Although this hook can be used to revalidate permissions for * various system call operations that read or write files, it does not * address the revalidation of permissions for memory-mapped files. * Security modules must handle this separately if they need such * revalidation. * @file contains the file structure being accessed. * @mask contains the requested permissions. * Return 0 if permission is granted. * @file_alloc_security: * Allocate and attach a security structure to the file->f_security field. * The security field is initialized to NULL when the structure is first * created. * @file contains the file structure to secure. * Return 0 if the hook is successful and permission is granted. * @file_free_security: * Deallocate and free any security structures stored in file->f_security. * @file contains the file structure being modified. * @file_ioctl: * @file contains the file structure. * @cmd contains the operation to perform. * @arg contains the operational arguments. * Check permission for an ioctl operation on @file. Note that @arg can * sometimes represents a user space pointer; in other cases, it may be a * simple integer value. When @arg represents a user space pointer, it * should never be used by the security module. * Return 0 if permission is granted. * @file_mmap : * Check permissions for a mmap operation. The @file may be NULL, e.g. * if mapping anonymous memory. * @file contains the file structure for file to map (may be NULL). * @reqprot contains the protection requested by the application. * @prot contains the protection that will be applied by the kernel. * @flags contains the operational flags. * Return 0 if permission is granted. * @file_mprotect: * Check permissions before changing memory access permissions. * @vma contains the memory region to modify. * @reqprot contains the protection requested by the application. * @prot contains the protection that will be applied by the kernel. * Return 0 if permission is granted. * @file_lock: * Check permission before performing file locking operations. * Note: this hook mediates both flock and fcntl style locks. * @file contains the file structure. * @cmd contains the posix-translated lock operation to perform * (e.g. F_RDLCK, F_WRLCK). * Return 0 if permission is granted. * @file_fcntl: * Check permission before allowing the file operation specified by @cmd * from being performed on the file @file. Note that @arg can sometimes * represents a user space pointer; in other cases, it may be a simple * integer value. When @arg represents a user space pointer, it should * never be used by the security module. * @file contains the file structure. * @cmd contains the operation to be performed. * @arg contains the operational arguments. * Return 0 if permission is granted. * @file_set_fowner: * Save owner security information (typically from current->security) in * file->f_security for later use by the send_sigiotask hook. * @file contains the file structure to update. * Return 0 on success. * @file_send_sigiotask: * Check permission for the file owner @fown to send SIGIO or SIGURG to the * process @tsk. Note that this hook is sometimes called from interrupt. * Note that the fown_struct, @fown, is never outside the context of a * struct file, so the file structure (and associated security information) * can always be obtained: |
b385a144e [PATCH] Replace r... |
620 |
* container_of(fown, struct file, f_owner) |
7b41b1733 SELinux: include/... |
621 |
* @tsk contains the structure of task receiving signal. |
1da177e4c Linux-2.6.12-rc2 |
622 623 624 625 626 627 628 629 630 |
* @fown contains the file owner information. * @sig is the signal that will be sent. When 0, kernel sends SIGIO. * Return 0 if permission is granted. * @file_receive: * This hook allows security modules to control the ability of a process * to receive an open file descriptor via socket IPC. * @file contains the file structure being received. * Return 0 if permission is granted. * |
788e7dd4c SELinux: Improve ... |
631 632 633 634 635 636 637 |
* Security hook for dentry * * @dentry_open * Save open-time permission checking state for later use upon * file_permission, and recheck access if anything has changed * since inode_permission. * |
1da177e4c Linux-2.6.12-rc2 |
638 639 640 641 642 643 644 |
* Security hooks for task operations. * * @task_create: * Check permission before creating a child process. See the clone(2) * manual page for definitions of the @clone_flags. * @clone_flags contains the flags indicating what should be shared. * Return 0 if permission is granted. |
ee18d64c1 KEYS: Add a keyct... |
645 646 647 648 649 |
* @cred_alloc_blank: * @cred points to the credentials. * @gfp indicates the atomicity of any memory allocations. * Only allocate sufficient memory and attach to @cred such that * cred_transfer() will not get ENOMEM. |
f1752eec6 CRED: Detach the ... |
650 651 652 |
* @cred_free: * @cred points to the credentials. * Deallocate and clear the cred->security field in a set of credentials. |
d84f4f992 CRED: Inaugurate ... |
653 654 655 656 657 |
* @cred_prepare: * @new points to the new credentials. * @old points to the original credentials. * @gfp indicates the atomicity of any memory allocations. * Prepare a new set of credentials by copying the data from the old set. |
ee18d64c1 KEYS: Add a keyct... |
658 659 660 661 |
* @cred_transfer: * @new points to the new credentials. * @old points to the original credentials. * Transfer data from original creds to new creds |
3a3b7ce93 CRED: Allow kerne... |
662 663 664 665 666 667 668 669 670 671 672 673 674 |
* @kernel_act_as: * Set the credentials for a kernel service to act as (subjective context). * @new points to the credentials to be modified. * @secid specifies the security ID to be set * The current task must be the one that nominated @secid. * Return 0 if successful. * @kernel_create_files_as: * Set the file creation context in a set of credentials to be the same as * the objective context of the specified inode. * @new points to the credentials to be modified. * @inode points to the inode to use as a reference. * The current task must be the one that nominated @inode. * Return 0 if successful. |
9188499cd security: introdu... |
675 676 677 |
* @kernel_module_request: * Ability to trigger the kernel to automatically upcall to userspace for * userspace to load a kernel module with the given name. |
dd8dbf2e6 security: report ... |
678 |
* @kmod_name name of the module requested by the kernel |
f322abf83 security: update ... |
679 |
* Return 0 if successful. |
d84f4f992 CRED: Inaugurate ... |
680 |
* @task_fix_setuid: |
1da177e4c Linux-2.6.12-rc2 |
681 682 683 |
* Update the module's state after setting one or more of the user * identity attributes of the current process. The @flags parameter * indicates which of the set*uid system calls invoked this hook. If |
d84f4f992 CRED: Inaugurate ... |
684 685 686 |
* @new is the set of credentials that will be installed. Modifications * should be made to this rather than to @current->cred. * @old is the set of credentials that are being replaces |
1da177e4c Linux-2.6.12-rc2 |
687 688 |
* @flags contains one of the LSM_SETID_* values. * Return 0 on success. |
1da177e4c Linux-2.6.12-rc2 |
689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 |
* @task_setpgid: * Check permission before setting the process group identifier of the * process @p to @pgid. * @p contains the task_struct for process being modified. * @pgid contains the new pgid. * Return 0 if permission is granted. * @task_getpgid: * Check permission before getting the process group identifier of the * process @p. * @p contains the task_struct for the process. * Return 0 if permission is granted. * @task_getsid: * Check permission before getting the session identifier of the process * @p. * @p contains the task_struct for the process. * Return 0 if permission is granted. |
f9008e4c5 [PATCH] SELinux: ... |
705 706 707 |
* @task_getsecid: * Retrieve the security identifier of the process @p. * @p contains the task_struct for the process and place is into @secid. |
8a076191f LSM: Introduce in... |
708 709 |
* In case of failure, @secid will be set to zero. * |
1da177e4c Linux-2.6.12-rc2 |
710 711 712 713 714 |
* @task_setnice: * Check permission before setting the nice value of @p to @nice. * @p contains the task_struct of process. * @nice contains the new nice value. * Return 0 if permission is granted. |
03e680606 [PATCH] lsm: add ... |
715 716 717 718 719 |
* @task_setioprio * Check permission before setting the ioprio value of @p to @ioprio. * @p contains the task_struct of process. * @ioprio contains the new ioprio value * Return 0 if permission is granted. |
a1836a42d [PATCH] SELinux: ... |
720 721 722 723 |
* @task_getioprio * Check permission before getting the ioprio value of @p. * @p contains the task_struct of process. * Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 |
* @task_setrlimit: * Check permission before setting the resource limits of the current * process for @resource to @new_rlim. The old resource limit values can * be examined by dereferencing (current->signal->rlim + resource). * @resource contains the resource whose limit is being set. * @new_rlim contains the new limits for @resource. * Return 0 if permission is granted. * @task_setscheduler: * Check permission before setting scheduling policy and/or parameters of * process @p based on @policy and @lp. * @p contains the task_struct for process. * @policy contains the scheduling policy. * @lp contains the scheduling parameters. * Return 0 if permission is granted. * @task_getscheduler: * Check permission before obtaining scheduling information for process * @p. * @p contains the task_struct for process. * Return 0 if permission is granted. |
35601547b [PATCH] SELinux: ... |
743 744 745 746 |
* @task_movememory * Check permission before moving memory owned by process @p. * @p contains the task_struct for process. * Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
747 748 749 750 751 752 753 754 755 756 |
* @task_kill: * Check permission before sending signal @sig to @p. @info can be NULL, * the constant 1, or a pointer to a siginfo structure. If @info is 1 or * SI_FROMKERNEL(info) is true, then the signal should be viewed as coming * from the kernel and should typically be permitted. * SIGIO signals are handled separately by the send_sigiotask hook in * file_security_ops. * @p contains the task_struct for process. * @info contains the signal information. * @sig contains the signal value. |
f9008e4c5 [PATCH] SELinux: ... |
757 |
* @secid contains the sid of the process where the signal originated |
1da177e4c Linux-2.6.12-rc2 |
758 759 760 761 762 763 764 765 766 767 768 769 770 771 |
* Return 0 if permission is granted. * @task_wait: * Check permission before allowing a process to reap a child process @p * and collect its status information. * @p contains the task_struct for process. * Return 0 if permission is granted. * @task_prctl: * Check permission before performing a process control operation on the * current process. * @option contains the operation. * @arg2 contains a argument. * @arg3 contains a argument. * @arg4 contains a argument. * @arg5 contains a argument. |
d84f4f992 CRED: Inaugurate ... |
772 773 |
* Return -ENOSYS if no-one wanted to handle this op, any other value to * cause prctl() to return immediately with that value. |
1da177e4c Linux-2.6.12-rc2 |
774 |
* @task_to_inode: |
7b41b1733 SELinux: include/... |
775 776 |
* Set the security attributes for an inode based on an associated task's * security attributes, e.g. for /proc/pid inodes. |
1da177e4c Linux-2.6.12-rc2 |
777 778 779 780 781 782 783 784 785 |
* @p contains the task_struct for the task. * @inode contains the inode structure for the inode. * * Security hooks for Netlink messaging. * * @netlink_send: * Save security information for a netlink message so that permission * checking can be performed when the message is processed. The security * information can be saved using the eff_cap field of the |
7b41b1733 SELinux: include/... |
786 |
* netlink_skb_parms structure. Also may be used to provide fine |
1da177e4c Linux-2.6.12-rc2 |
787 788 789 790 791 792 793 794 795 |
* grained control over message transmission. * @sk associated sock of task sending the message., * @skb contains the sk_buff structure for the netlink message. * Return 0 if the information was successfully saved and message * is allowed to be transmitted. * @netlink_recv: * Check permission before processing the received netlink message in * @skb. * @skb contains the sk_buff structure for the netlink message. |
c7bdb545d [NETLINK]: Encaps... |
796 |
* @cap indicates the capability required |
1da177e4c Linux-2.6.12-rc2 |
797 798 799 800 801 802 803 |
* Return 0 if permission is granted. * * Security hooks for Unix domain networking. * * @unix_stream_connect: * Check permissions before establishing a Unix domain stream connection * between @sock and @other. |
3610cda53 af_unix: Avoid so... |
804 805 806 |
* @sock contains the sock structure. * @other contains the peer sock structure. * @newsk contains the new sock structure. |
1da177e4c Linux-2.6.12-rc2 |
807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 |
* Return 0 if permission is granted. * @unix_may_send: * Check permissions before connecting or sending datagrams from @sock to * @other. * @sock contains the socket structure. * @sock contains the peer socket structure. * Return 0 if permission is granted. * * The @unix_stream_connect and @unix_may_send hooks were necessary because * Linux provides an alternative to the conventional file name space for Unix * domain sockets. Whereas binding and connecting to sockets in the file name * space is mediated by the typical file permissions (and caught by the mknod * and permission hooks in inode_security_ops), binding and connecting to * sockets in the abstract name space is completely unmediated. Sufficient * control of Unix domain sockets in the abstract name space isn't possible * using only the socket layer hooks, since we need to know the actual target * socket, which is not looked up until we are inside the af_unix code. * * Security hooks for socket operations. * * @socket_create: * Check permissions prior to creating a new socket. * @family contains the requested protocol family. * @type contains the requested communications type. * @protocol contains the requested protocol. * @kern set to 1 if a kernel socket. * Return 0 if permission is granted. * @socket_post_create: * This hook allows a module to update or allocate a per-socket security * structure. Note that the security field was not added directly to the * socket structure, but rather, the socket security information is stored * in the associated inode. Typically, the inode alloc_security hook will * allocate and and attach security information to * sock->inode->i_security. This hook may be used to update the * sock->inode->i_security field with additional information that wasn't * available when the inode was allocated. * @sock contains the newly created socket structure. * @family contains the requested protocol family. * @type contains the requested communications type. * @protocol contains the requested protocol. * @kern set to 1 if a kernel socket. * @socket_bind: * Check permission before socket protocol layer bind operation is * performed and the socket @sock is bound to the address specified in the * @address parameter. * @sock contains the socket structure. * @address contains the address to bind to. * @addrlen contains the length of address. |
7b41b1733 SELinux: include/... |
855 |
* Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
856 857 858 859 860 861 |
* @socket_connect: * Check permission before socket protocol layer connect operation * attempts to connect socket @sock to a remote address, @address. * @sock contains the socket structure. * @address contains the address of remote endpoint. * @addrlen contains the length of address. |
7b41b1733 SELinux: include/... |
862 |
* Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
863 864 865 866 867 868 869 870 871 872 873 874 |
* @socket_listen: * Check permission before socket protocol layer listen operation. * @sock contains the socket structure. * @backlog contains the maximum length for the pending connection queue. * Return 0 if permission is granted. * @socket_accept: * Check permission before accepting a new connection. Note that the new * socket, @newsock, has been created and some information copied to it, * but the accept operation has not actually been performed. * @sock contains the listening socket structure. * @newsock contains the newly created server socket for connection. * Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
875 876 877 878 879 880 881 882 883 884 885 886 |
* @socket_sendmsg: * Check permission before transmitting a message to another socket. * @sock contains the socket structure. * @msg contains the message to be transmitted. * @size contains the size of message. * Return 0 if permission is granted. * @socket_recvmsg: * Check permission before receiving a message from a socket. * @sock contains the socket structure. * @msg contains the message structure. * @size contains the size of message structure. * @flags contains the operational flags. |
7b41b1733 SELinux: include/... |
887 |
* Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 |
* @socket_getsockname: * Check permission before the local address (name) of the socket object * @sock is retrieved. * @sock contains the socket structure. * Return 0 if permission is granted. * @socket_getpeername: * Check permission before the remote address (name) of a socket object * @sock is retrieved. * @sock contains the socket structure. * Return 0 if permission is granted. * @socket_getsockopt: * Check permissions before retrieving the options associated with socket * @sock. * @sock contains the socket structure. * @level contains the protocol level to retrieve option from. * @optname contains the name of option to retrieve. * Return 0 if permission is granted. * @socket_setsockopt: * Check permissions before setting the options associated with socket * @sock. * @sock contains the socket structure. * @level contains the protocol level to set options for. * @optname contains the name of the option to set. |
7b41b1733 SELinux: include/... |
911 |
* Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
912 913 914 915 916 917 918 919 920 921 |
* @socket_shutdown: * Checks permission before all or part of a connection on the socket * @sock is shut down. * @sock contains the socket structure. * @how contains the flag indicating how future sends and receives are handled. * Return 0 if permission is granted. * @socket_sock_rcv_skb: * Check permissions on incoming network packets. This hook is distinct * from Netfilter's IP input hooks since it is the first time that the * incoming sk_buff @skb has been associated with a particular socket, @sk. |
0ed731859 LSM: Update comme... |
922 |
* Must not sleep inside this hook because some callers hold spinlocks. |
1da177e4c Linux-2.6.12-rc2 |
923 924 |
* @sk contains the sock (not socket) associated with the incoming sk_buff. * @skb contains the incoming network data. |
6da34bae2 fix up security_s... |
925 |
* @socket_getpeersec_stream: |
1da177e4c Linux-2.6.12-rc2 |
926 |
* This hook allows the security module to provide peer socket security |
6da34bae2 fix up security_s... |
927 928 929 |
* state for unix or connected tcp sockets to userspace via getsockopt * SO_GETPEERSEC. For tcp sockets this can be meaningful if the * socket is associated with an ipsec SA. |
1da177e4c Linux-2.6.12-rc2 |
930 931 932 933 934 935 936 937 |
* @sock is the local socket. * @optval userspace memory where the security state is to be copied. * @optlen userspace int where the module should copy the actual length * of the security state. * @len as input is the maximum length to copy to userspace provided * by the caller. * Return 0 if all is well, otherwise, typical getsockopt return * values. |
6da34bae2 fix up security_s... |
938 |
* @socket_getpeersec_dgram: |
7b41b1733 SELinux: include/... |
939 940 941 942 943 944 945 946 947 948 |
* This hook allows the security module to provide peer socket security * state for udp sockets on a per-packet basis to userspace via * getsockopt SO_GETPEERSEC. The application must first have indicated * the IP_PASSSEC option via getsockopt. It can then retrieve the * security state returned by this hook for a packet via the SCM_SECURITY * ancillary message type. * @skb is the skbuff for the packet being queried * @secdata is a pointer to a buffer in which to copy the security data * @seclen is the maximum length for @secdata * Return 0 on success, error on failure. |
1da177e4c Linux-2.6.12-rc2 |
949 |
* @sk_alloc_security: |
7b41b1733 SELinux: include/... |
950 951 |
* Allocate and attach a security structure to the sk->sk_security field, * which is used to copy security attributes between local stream sockets. |
1da177e4c Linux-2.6.12-rc2 |
952 953 |
* @sk_free_security: * Deallocate security structure. |
892c141e6 [MLSXFRM]: Add se... |
954 955 |
* @sk_clone_security: * Clone/copy security structure. |
beb8d13be [MLSXFRM]: Add fl... |
956 957 |
* @sk_getsecid: * Retrieve the LSM-specific secid for the sock to enable caching of network |
df71837d5 [LSM-IPSec]: Secu... |
958 |
* authorizations. |
4237c75c0 [MLSXFRM]: Auto-l... |
959 960 961 962 963 964 |
* @sock_graft: * Sets the socket's isec sid to the sock's sid. * @inet_conn_request: * Sets the openreq's sid to socket's sid with MLS portion taken from peer sid. * @inet_csk_clone: * Sets the new child socket's sid to the openreq sid. |
6b877699c SELinux: Return c... |
965 |
* @inet_conn_established: |
7b41b1733 SELinux: include/... |
966 |
* Sets the connection's peersid to the secmark on skb. |
2606fd1fa secmark: make sec... |
967 968 969 970 971 972 |
* @secmark_relabel_packet: * check if the process should be allowed to relabel packets to the given secid * @security_secmark_refcount_inc * tells the LSM to increment the number of secmark labeling rules loaded * @security_secmark_refcount_dec * tells the LSM to decrement the number of secmark labeling rules loaded |
4237c75c0 [MLSXFRM]: Auto-l... |
973 974 |
* @req_classify_flow: * Sets the flow's sid to the openreq sid. |
2b980dbd7 lsm: Add hooks to... |
975 976 977 978 979 980 981 982 983 984 985 |
* @tun_dev_create: * Check permissions prior to creating a new TUN device. * @tun_dev_post_create: * This hook allows a module to update or allocate a per-socket security * structure. * @sk contains the newly created sock structure. * @tun_dev_attach: * Check permissions prior to attaching to a persistent TUN device. This * hook can also be used by the module to update any security state * associated with the TUN device's sock structure. * @sk contains the existing sock structure. |
df71837d5 [LSM-IPSec]: Secu... |
986 987 988 989 |
* * Security hooks for XFRM operations. * * @xfrm_policy_alloc_security: |
03e1ad7b5 LSM: Make the Lab... |
990 991 |
* @ctxp is a pointer to the xfrm_sec_ctx being added to Security Policy * Database used by the XFRM system. |
df71837d5 [LSM-IPSec]: Secu... |
992 993 |
* @sec_ctx contains the security context information being provided by * the user-level policy update program (e.g., setkey). |
e0d1caa7b [MLSXFRM]: Flow b... |
994 |
* Allocate a security structure to the xp->security field; the security |
c1a856c96 SELinux: Various ... |
995 |
* field is initialized to NULL when the xfrm_policy is allocated. |
df71837d5 [LSM-IPSec]: Secu... |
996 997 |
* Return 0 if operation was successful (memory to allocate, legal context) * @xfrm_policy_clone_security: |
03e1ad7b5 LSM: Make the Lab... |
998 999 1000 1001 |
* @old_ctx contains an existing xfrm_sec_ctx. * @new_ctxp contains a new xfrm_sec_ctx being cloned from old. * Allocate a security structure in new_ctxp that contains the * information from the old_ctx structure. |
df71837d5 [LSM-IPSec]: Secu... |
1002 1003 |
* Return 0 if operation was successful (memory to allocate). * @xfrm_policy_free_security: |
03e1ad7b5 LSM: Make the Lab... |
1004 |
* @ctx contains the xfrm_sec_ctx |
c8c05a8ee [LSM-IPsec]: SELi... |
1005 1006 |
* Deallocate xp->security. * @xfrm_policy_delete_security: |
03e1ad7b5 LSM: Make the Lab... |
1007 |
* @ctx contains the xfrm_sec_ctx. |
c8c05a8ee [LSM-IPsec]: SELi... |
1008 |
* Authorize deletion of xp->security. |
df71837d5 [LSM-IPSec]: Secu... |
1009 1010 1011 1012 1013 |
* @xfrm_state_alloc_security: * @x contains the xfrm_state being added to the Security Association * Database by the XFRM system. * @sec_ctx contains the security context information being provided by * the user-level SA generation program (e.g., setkey or racoon). |
e0d1caa7b [MLSXFRM]: Flow b... |
1014 1015 1016 1017 1018 |
* @secid contains the secid from which to take the mls portion of the context. * Allocate a security structure to the x->security field; the security * field is initialized to NULL when the xfrm_state is allocated. Set the * context to correspond to either sec_ctx or polsec, with the mls portion * taken from secid in the latter case. |
df71837d5 [LSM-IPSec]: Secu... |
1019 1020 1021 |
* Return 0 if operation was successful (memory to allocate, legal context). * @xfrm_state_free_security: * @x contains the xfrm_state. |
c8c05a8ee [LSM-IPsec]: SELi... |
1022 1023 1024 1025 |
* Deallocate x->security. * @xfrm_state_delete_security: * @x contains the xfrm_state. * Authorize deletion of x->security. |
df71837d5 [LSM-IPSec]: Secu... |
1026 |
* @xfrm_policy_lookup: |
03e1ad7b5 LSM: Make the Lab... |
1027 |
* @ctx contains the xfrm_sec_ctx for which the access control is being |
df71837d5 [LSM-IPSec]: Secu... |
1028 |
* checked. |
e0d1caa7b [MLSXFRM]: Flow b... |
1029 |
* @fl_secid contains the flow security label that is used to authorize |
df71837d5 [LSM-IPSec]: Secu... |
1030 1031 |
* access to the policy xp. * @dir contains the direction of the flow (input or output). |
e0d1caa7b [MLSXFRM]: Flow b... |
1032 |
* Check permission when a flow selects a xfrm_policy for processing |
df71837d5 [LSM-IPSec]: Secu... |
1033 1034 |
* XFRMs on a packet. The hook is called when selecting either a * per-socket policy or a generic xfrm policy. |
5b368e61c IPsec: correct se... |
1035 1036 |
* Return 0 if permission is granted, -ESRCH otherwise, or -errno * on other errors. |
e0d1caa7b [MLSXFRM]: Flow b... |
1037 1038 1039 1040 1041 |
* @xfrm_state_pol_flow_match: * @x contains the state to match. * @xp contains the policy to check for a match. * @fl contains the flow to check for a match. * Return 1 if there is a match. |
e0d1caa7b [MLSXFRM]: Flow b... |
1042 1043 |
* @xfrm_decode_session: * @skb points to skb to decode. |
beb8d13be [MLSXFRM]: Add fl... |
1044 1045 1046 |
* @secid points to the flow key secid to set. * @ckall says if all xfrms used should be checked for same secid. * Return 0 if ckall is zero or all xfrms used have the same secid. |
1da177e4c Linux-2.6.12-rc2 |
1047 |
* |
29db91906 [PATCH] Keys: Add... |
1048 1049 1050 1051 1052 1053 |
* Security hooks affecting all Key Management operations * * @key_alloc: * Permit allocation of a key and assign security data. Note that key does * not have a serial number assigned at this point. * @key points to the key. |
7e047ef5f [PATCH] keys: sor... |
1054 |
* @flags is the allocation flags |
29db91906 [PATCH] Keys: Add... |
1055 1056 1057 1058 1059 1060 1061 |
* Return 0 if permission is granted, -ve error otherwise. * @key_free: * Notification of destruction; free security data. * @key points to the key. * No return value. * @key_permission: * See whether a specific operational right is granted to a process on a |
7b41b1733 SELinux: include/... |
1062 |
* key. |
29db91906 [PATCH] Keys: Add... |
1063 |
* @key_ref refers to the key (key pointer + possession attribute bit). |
d84f4f992 CRED: Inaugurate ... |
1064 |
* @cred points to the credentials to provide the context against which to |
7b41b1733 SELinux: include/... |
1065 |
* evaluate the security data on the key. |
29db91906 [PATCH] Keys: Add... |
1066 |
* @perm describes the combination of permissions required of this key. |
ad9c2b048 security: Fix com... |
1067 |
* Return 0 if permission is granted, -ve error otherwise. |
70a5bb72b keys: add keyctl ... |
1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 |
* @key_getsecurity: * Get a textual representation of the security context attached to a key * for the purposes of honouring KEYCTL_GETSECURITY. This function * allocates the storage for the NUL-terminated string and the caller * should free it. * @key points to the key to be queried. * @_buffer points to a pointer that should be set to point to the * resulting string (if no label or an error occurs). * Return the length of the string (including terminating NUL) or -ve if * an error. * May also return 0 (and a NULL buffer pointer) if there is no label. |
29db91906 [PATCH] Keys: Add... |
1079 |
* |
1da177e4c Linux-2.6.12-rc2 |
1080 1081 1082 1083 1084 1085 1086 |
* Security hooks affecting all System V IPC operations. * * @ipc_permission: * Check permissions for access to IPC * @ipcp contains the kernel IPC permission structure * @flag contains the desired (requested) permission set * Return 0 if permission is granted. |
8a076191f LSM: Introduce in... |
1087 1088 1089 1090 1091 |
* @ipc_getsecid: * Get the secid associated with the ipc object. * @ipcp contains the kernel IPC permission structure. * @secid contains a pointer to the location where result will be saved. * In case of failure, @secid will be set to zero. |
1da177e4c Linux-2.6.12-rc2 |
1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 |
* * Security hooks for individual messages held in System V IPC message queues * @msg_msg_alloc_security: * Allocate and attach a security structure to the msg->security field. * The security field is initialized to NULL when the structure is first * created. * @msg contains the message structure to be modified. * Return 0 if operation was successful and permission is granted. * @msg_msg_free_security: * Deallocate the security structure for this message. * @msg contains the message structure to be modified. * * Security hooks for System V IPC Message Queues * * @msg_queue_alloc_security: * Allocate and attach a security structure to the * msq->q_perm.security field. The security field is initialized to * NULL when the structure is first created. * @msq contains the message queue structure to be modified. * Return 0 if operation was successful and permission is granted. * @msg_queue_free_security: * Deallocate security structure for this message queue. * @msq contains the message queue structure to be modified. * @msg_queue_associate: * Check permission when a message queue is requested through the * msgget system call. This hook is only called when returning the * message queue identifier for an existing message queue, not when a * new message queue is created. * @msq contains the message queue to act upon. * @msqflg contains the operation control flags. * Return 0 if permission is granted. * @msg_queue_msgctl: * Check permission when a message control operation specified by @cmd * is to be performed on the message queue @msq. * The @msq may be NULL, e.g. for IPC_INFO or MSG_INFO. * @msq contains the message queue to act upon. May be NULL. * @cmd contains the operation to be performed. |
7b41b1733 SELinux: include/... |
1129 |
* Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
1130 1131 1132 1133 1134 1135 1136 1137 1138 |
* @msg_queue_msgsnd: * Check permission before a message, @msg, is enqueued on the message * queue, @msq. * @msq contains the message queue to send message to. * @msg contains the message to be enqueued. * @msqflg contains operational flags. * Return 0 if permission is granted. * @msg_queue_msgrcv: * Check permission before a message, @msg, is removed from the message |
7b41b1733 SELinux: include/... |
1139 1140 |
* queue, @msq. The @target task structure contains a pointer to the * process that will be receiving the message (not equal to the current |
1da177e4c Linux-2.6.12-rc2 |
1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 |
* process when inline receives are being performed). * @msq contains the message queue to retrieve message from. * @msg contains the message destination. * @target contains the task structure for recipient process. * @type contains the type of message requested. * @mode contains the operational flags. * Return 0 if permission is granted. * * Security hooks for System V Shared Memory Segments * * @shm_alloc_security: * Allocate and attach a security structure to the shp->shm_perm.security * field. The security field is initialized to NULL when the structure is * first created. * @shp contains the shared memory structure to be modified. * Return 0 if operation was successful and permission is granted. * @shm_free_security: * Deallocate the security struct for this memory segment. * @shp contains the shared memory structure to be modified. * @shm_associate: * Check permission when a shared memory region is requested through the * shmget system call. This hook is only called when returning the shared * memory region identifier for an existing region, not when a new shared * memory region is created. * @shp contains the shared memory structure to be modified. * @shmflg contains the operation control flags. * Return 0 if permission is granted. * @shm_shmctl: * Check permission when a shared memory control operation specified by * @cmd is to be performed on the shared memory region @shp. * The @shp may be NULL, e.g. for IPC_INFO or SHM_INFO. * @shp contains shared memory structure to be modified. * @cmd contains the operation to be performed. * Return 0 if permission is granted. * @shm_shmat: * Check permissions prior to allowing the shmat system call to attach the * shared memory segment @shp to the data segment of the calling process. * The attaching address is specified by @shmaddr. * @shp contains the shared memory structure to be modified. * @shmaddr contains the address to attach memory region to. * @shmflg contains the operational flags. * Return 0 if permission is granted. * * Security hooks for System V Semaphores * * @sem_alloc_security: * Allocate and attach a security structure to the sma->sem_perm.security * field. The security field is initialized to NULL when the structure is * first created. * @sma contains the semaphore structure * Return 0 if operation was successful and permission is granted. * @sem_free_security: * deallocate security struct for this semaphore * @sma contains the semaphore structure. * @sem_associate: * Check permission when a semaphore is requested through the semget * system call. This hook is only called when returning the semaphore * identifier for an existing semaphore, not when a new one must be * created. * @sma contains the semaphore structure. * @semflg contains the operation control flags. * Return 0 if permission is granted. * @sem_semctl: * Check permission when a semaphore operation specified by @cmd is to be |
7b41b1733 SELinux: include/... |
1205 |
* performed on the semaphore @sma. The @sma may be NULL, e.g. for |
1da177e4c Linux-2.6.12-rc2 |
1206 1207 1208 1209 1210 1211 |
* IPC_INFO or SEM_INFO. * @sma contains the semaphore structure. May be NULL. * @cmd contains the operation to be performed. * Return 0 if permission is granted. * @sem_semop * Check permissions before performing operations on members of the |
7b41b1733 SELinux: include/... |
1212 1213 |
* semaphore set @sma. If the @alter flag is nonzero, the semaphore set * may be modified. |
1da177e4c Linux-2.6.12-rc2 |
1214 1215 1216 1217 1218 1219 |
* @sma contains the semaphore structure. * @sops contains the operations to perform. * @nsops contains the number of operations to perform. * @alter contains the flag indicating whether changes are to be made. * Return 0 if permission is granted. * |
9e48858f7 security: rename ... |
1220 |
* @ptrace_access_check: |
5cd9c58fb security: Fix set... |
1221 |
* Check permission before allowing the current process to trace the |
1da177e4c Linux-2.6.12-rc2 |
1222 1223 1224 |
* @child process. * Security modules may also want to perform a process tracing check * during an execve in the set_security or apply_creds hooks of |
d84f4f992 CRED: Inaugurate ... |
1225 |
* tracing check during an execve in the bprm_set_creds hook of |
1da177e4c Linux-2.6.12-rc2 |
1226 1227 |
* binprm_security_ops if the process is being traced and its security * attributes would be changed by the execve. |
5cd9c58fb security: Fix set... |
1228 |
* @child contains the task_struct structure for the target process. |
006ebb40d Security: split p... |
1229 |
* @mode contains the PTRACE_MODE flags indicating the form of access. |
1da177e4c Linux-2.6.12-rc2 |
1230 |
* Return 0 if permission is granted. |
5cd9c58fb security: Fix set... |
1231 1232 1233 1234 |
* @ptrace_traceme: * Check that the @parent process has sufficient permission to trace the * current process before allowing the current process to present itself * to the @parent process for tracing. |
9e48858f7 security: rename ... |
1235 |
* The parent process will still have to undergo the ptrace_access_check |
5cd9c58fb security: Fix set... |
1236 1237 1238 |
* checks before it is allowed to trace this one. * @parent contains the task_struct structure for debugger process. * Return 0 if permission is granted. |
1da177e4c Linux-2.6.12-rc2 |
1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 |
* @capget: * Get the @effective, @inheritable, and @permitted capability sets for * the @target process. The hook may also perform permission checking to * determine if the current process is allowed to see the capability sets * of the @target process. * @target contains the task_struct structure for target process. * @effective contains the effective capability set. * @inheritable contains the inheritable capability set. * @permitted contains the permitted capability set. * Return 0 if the capability sets were successfully obtained. |
d84f4f992 CRED: Inaugurate ... |
1249 |
* @capset: |
1da177e4c Linux-2.6.12-rc2 |
1250 |
* Set the @effective, @inheritable, and @permitted capability sets for |
1cdcbec1a CRED: Neuter sys_... |
1251 |
* the current process. |
d84f4f992 CRED: Inaugurate ... |
1252 1253 |
* @new contains the new credentials structure for target process. * @old contains the current credentials structure for target process. |
1da177e4c Linux-2.6.12-rc2 |
1254 1255 1256 |
* @effective contains the effective capability set. * @inheritable contains the inheritable capability set. * @permitted contains the permitted capability set. |
d84f4f992 CRED: Inaugurate ... |
1257 |
* Return 0 and update @new if permission is granted. |
12b5989be [PATCH] refactor ... |
1258 |
* @capable: |
3699c53c4 CRED: Fix regress... |
1259 1260 |
* Check whether the @tsk process has the @cap capability in the indicated * credentials. |
12b5989be [PATCH] refactor ... |
1261 |
* @tsk contains the task_struct for the process. |
3699c53c4 CRED: Fix regress... |
1262 |
* @cred contains the credentials to use. |
3486740a4 userns: security:... |
1263 |
* @ns contains the user namespace we want the capability in |
12b5989be [PATCH] refactor ... |
1264 |
* @cap contains the capability <include/linux/capability.h>. |
3699c53c4 CRED: Fix regress... |
1265 |
* @audit: Whether to write an audit message or not |
12b5989be [PATCH] refactor ... |
1266 |
* Return 0 if the capability is granted for @tsk. |
1da177e4c Linux-2.6.12-rc2 |
1267 1268 1269 |
* @syslog: * Check permission before accessing the kernel message ring or changing * logging to the console. |
7b41b1733 SELinux: include/... |
1270 |
* See the syslog(2) manual page for an explanation of the @type values. |
1da177e4c Linux-2.6.12-rc2 |
1271 |
* @type contains the type of action. |
002345925 syslog: distingui... |
1272 |
* @from_file indicates the context of action (if it came from /proc). |
1da177e4c Linux-2.6.12-rc2 |
1273 1274 1275 1276 1277 1278 1279 1280 1281 |
* Return 0 if permission is granted. * @settime: * Check permission to change the system time. * struct timespec and timezone are defined in include/linux/time.h * @ts contains new time * @tz contains new timezone * Return 0 if permission is granted. * @vm_enough_memory: * Check permissions for allocating a new virtual mapping. |
34b4e4aa3 fix NULL pointer ... |
1282 |
* @mm contains the mm struct it is being added to. |
7b41b1733 SELinux: include/... |
1283 |
* @pages contains the number of pages. |
1da177e4c Linux-2.6.12-rc2 |
1284 1285 |
* Return 0 if permission is granted. * |
dc49c1f94 [AF_UNIX]: Kernel... |
1286 |
* @secid_to_secctx: |
d5630b9d2 security: secid_t... |
1287 1288 1289 1290 |
* Convert secid to security context. If secdata is NULL the length of * the result will be returned in seclen, but no secdata will be returned. * This does mean that the length could change between calls to check the * length and the next call which actually allocates and returns the secdata. |
dc49c1f94 [AF_UNIX]: Kernel... |
1291 1292 |
* @secid contains the security ID. * @secdata contains the pointer that stores the converted security context. |
d5630b9d2 security: secid_t... |
1293 |
* @seclen pointer which contains the length of the data |
63cb34492 security: add a s... |
1294 |
* @secctx_to_secid: |
7b41b1733 SELinux: include/... |
1295 1296 1297 |
* Convert security context to secid. * @secid contains the pointer to the generated security ID. * @secdata contains the security context. |
dc49c1f94 [AF_UNIX]: Kernel... |
1298 1299 1300 1301 1302 1303 |
* * @release_secctx: * Release the security context. * @secdata contains the security context. * @seclen contains the length of the security context. * |
03d37d25e LSM/Audit: Introd... |
1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 |
* Security hooks for Audit * * @audit_rule_init: * Allocate and initialize an LSM audit rule structure. * @field contains the required Audit action. Fields flags are defined in include/linux/audit.h * @op contains the operator the rule uses. * @rulestr contains the context where the rule will be applied to. * @lsmrule contains a pointer to receive the result. * Return 0 if @lsmrule has been successfully set, * -EINVAL in case of an invalid rule. * * @audit_rule_known: * Specifies whether given @rule contains any fields related to current LSM. * @rule contains the audit rule of interest. * Return 1 in case of relation found, 0 otherwise. * * @audit_rule_match: * Determine if given @secid matches a rule previously approved * by @audit_rule_known. * @secid contains the security id in question. * @field contains the field which relates to current LSM. * @op contains the operator that will be used for matching. * @rule points to the audit rule that will be checked against. * @actx points to the audit context associated with the check. * Return 1 if secid matches the rule, 0 if it does not, -ERRNO on failure. * * @audit_rule_free: * Deallocate the LSM audit rule structure previously allocated by * audit_rule_init. * @rule contains the allocated rule * |
1ee65e37e LSM/SELinux: inod... |
1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 |
* @inode_notifysecctx: * Notify the security module of what the security context of an inode * should be. Initializes the incore security context managed by the * security module for this inode. Example usage: NFS client invokes * this hook to initialize the security context in its incore inode to the * value provided by the server for the file when the server returned the * file's attributes to the client. * * Must be called with inode->i_mutex locked. * * @inode we wish to set the security context of. * @ctx contains the string which we wish to set in the inode. * @ctxlen contains the length of @ctx. * * @inode_setsecctx: * Change the security context of an inode. Updates the * incore security context managed by the security module and invokes the * fs code as needed (via __vfs_setxattr_noperm) to update any backing * xattrs that represent the context. Example usage: NFS server invokes * this hook to change the security context in its incore inode and on the * backing filesystem to a value provided by the client on a SETATTR * operation. * * Must be called with inode->i_mutex locked. * * @dentry contains the inode we wish to set the security context of. * @ctx contains the string which we wish to set in the inode. * @ctxlen contains the length of @ctx. * * @inode_getsecctx: * Returns a string containing all relavent security context information * |
fc9ff9b7e security: Fix a typo |
1367 |
* @inode we wish to get the security context of. |
1ee65e37e LSM/SELinux: inod... |
1368 1369 |
* @ctx is a pointer in which to place the allocated security context. * @ctxlen points to the place to put the length of @ctx. |
1da177e4c Linux-2.6.12-rc2 |
1370 1371 1372 |
* This is the main security structure. */ struct security_operations { |
076c54c5b Security: Introdu... |
1373 |
char name[SECURITY_NAME_MAX + 1]; |
9e48858f7 security: rename ... |
1374 |
int (*ptrace_access_check) (struct task_struct *child, unsigned int mode); |
5cd9c58fb security: Fix set... |
1375 |
int (*ptrace_traceme) (struct task_struct *parent); |
7b41b1733 SELinux: include/... |
1376 1377 1378 |
int (*capget) (struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted); |
d84f4f992 CRED: Inaugurate ... |
1379 1380 1381 1382 1383 |
int (*capset) (struct cred *new, const struct cred *old, const kernel_cap_t *effective, const kernel_cap_t *inheritable, const kernel_cap_t *permitted); |
3699c53c4 CRED: Fix regress... |
1384 |
int (*capable) (struct task_struct *tsk, const struct cred *cred, |
3486740a4 userns: security:... |
1385 |
struct user_namespace *ns, int cap, int audit); |
7b41b1733 SELinux: include/... |
1386 1387 |
int (*quotactl) (int cmds, int type, int id, struct super_block *sb); int (*quota_on) (struct dentry *dentry); |
12b3052c3 capabilities/sysl... |
1388 |
int (*syslog) (int type); |
1e6d76792 time: Correct the... |
1389 |
int (*settime) (const struct timespec *ts, const struct timezone *tz); |
34b4e4aa3 fix NULL pointer ... |
1390 |
int (*vm_enough_memory) (struct mm_struct *mm, long pages); |
1da177e4c Linux-2.6.12-rc2 |
1391 |
|
a6f76f23d CRED: Make execve... |
1392 |
int (*bprm_set_creds) (struct linux_binprm *bprm); |
7b41b1733 SELinux: include/... |
1393 1394 |
int (*bprm_check_security) (struct linux_binprm *bprm); int (*bprm_secureexec) (struct linux_binprm *bprm); |
a6f76f23d CRED: Make execve... |
1395 1396 |
void (*bprm_committing_creds) (struct linux_binprm *bprm); void (*bprm_committed_creds) (struct linux_binprm *bprm); |
7b41b1733 SELinux: include/... |
1397 1398 1399 1400 |
int (*sb_alloc_security) (struct super_block *sb); void (*sb_free_security) (struct super_block *sb); int (*sb_copy_data) (char *orig, char *copy); |
ff36fe2c8 LSM: Pass -o remo... |
1401 |
int (*sb_remount) (struct super_block *sb, void *data); |
12204e24b security: pass mo... |
1402 |
int (*sb_kern_mount) (struct super_block *sb, int flags, void *data); |
2069f4578 LSM/SELinux: show... |
1403 |
int (*sb_show_options) (struct seq_file *m, struct super_block *sb); |
726c33422 [PATCH] VFS: Perm... |
1404 |
int (*sb_statfs) (struct dentry *dentry); |
b5266eb4c [PATCH] switch a ... |
1405 |
int (*sb_mount) (char *dev_name, struct path *path, |
1da177e4c Linux-2.6.12-rc2 |
1406 |
char *type, unsigned long flags, void *data); |
7b41b1733 SELinux: include/... |
1407 |
int (*sb_umount) (struct vfsmount *mnt, int flags); |
b5266eb4c [PATCH] switch a ... |
1408 1409 |
int (*sb_pivotroot) (struct path *old_path, struct path *new_path); |
e00075298 LSM/SELinux: Inte... |
1410 1411 |
int (*sb_set_mnt_opts) (struct super_block *sb, struct security_mnt_opts *opts); |
c9180a57a Security: add get... |
1412 1413 |
void (*sb_clone_mnt_opts) (const struct super_block *oldsb, struct super_block *newsb); |
e00075298 LSM/SELinux: Inte... |
1414 |
int (*sb_parse_opts_str) (char *options, struct security_mnt_opts *opts); |
1da177e4c Linux-2.6.12-rc2 |
1415 |
|
be6d3e56a introduce new LSM... |
1416 1417 1418 1419 1420 1421 |
#ifdef CONFIG_SECURITY_PATH int (*path_unlink) (struct path *dir, struct dentry *dentry); int (*path_mkdir) (struct path *dir, struct dentry *dentry, int mode); int (*path_rmdir) (struct path *dir, struct dentry *dentry); int (*path_mknod) (struct path *dir, struct dentry *dentry, int mode, unsigned int dev); |
ea0d3ab23 LSM: Remove unuse... |
1422 |
int (*path_truncate) (struct path *path); |
be6d3e56a introduce new LSM... |
1423 1424 1425 1426 1427 1428 |
int (*path_symlink) (struct path *dir, struct dentry *dentry, const char *old_name); int (*path_link) (struct dentry *old_dentry, struct path *new_dir, struct dentry *new_dentry); int (*path_rename) (struct path *old_dir, struct dentry *old_dentry, struct path *new_dir, struct dentry *new_dentry); |
89eda0683 LSM: Add security... |
1429 1430 1431 |
int (*path_chmod) (struct dentry *dentry, struct vfsmount *mnt, mode_t mode); int (*path_chown) (struct path *path, uid_t uid, gid_t gid); |
8b8efb440 LSM: Add security... |
1432 |
int (*path_chroot) (struct path *path); |
be6d3e56a introduce new LSM... |
1433 |
#endif |
7b41b1733 SELinux: include/... |
1434 |
int (*inode_alloc_security) (struct inode *inode); |
1da177e4c Linux-2.6.12-rc2 |
1435 |
void (*inode_free_security) (struct inode *inode); |
5e41ff9e0 [PATCH] security:... |
1436 |
int (*inode_init_security) (struct inode *inode, struct inode *dir, |
2a7dba391 fs/vfs/security: ... |
1437 1438 |
const struct qstr *qstr, char **name, void **value, size_t *len); |
1da177e4c Linux-2.6.12-rc2 |
1439 |
int (*inode_create) (struct inode *dir, |
7b41b1733 SELinux: include/... |
1440 |
struct dentry *dentry, int mode); |
1da177e4c Linux-2.6.12-rc2 |
1441 |
int (*inode_link) (struct dentry *old_dentry, |
7b41b1733 SELinux: include/... |
1442 |
struct inode *dir, struct dentry *new_dentry); |
1da177e4c Linux-2.6.12-rc2 |
1443 1444 |
int (*inode_unlink) (struct inode *dir, struct dentry *dentry); int (*inode_symlink) (struct inode *dir, |
7b41b1733 SELinux: include/... |
1445 |
struct dentry *dentry, const char *old_name); |
1da177e4c Linux-2.6.12-rc2 |
1446 |
int (*inode_mkdir) (struct inode *dir, struct dentry *dentry, int mode); |
1da177e4c Linux-2.6.12-rc2 |
1447 1448 |
int (*inode_rmdir) (struct inode *dir, struct dentry *dentry); int (*inode_mknod) (struct inode *dir, struct dentry *dentry, |
7b41b1733 SELinux: include/... |
1449 |
int mode, dev_t dev); |
1da177e4c Linux-2.6.12-rc2 |
1450 |
int (*inode_rename) (struct inode *old_dir, struct dentry *old_dentry, |
7b41b1733 SELinux: include/... |
1451 |
struct inode *new_dir, struct dentry *new_dentry); |
1da177e4c Linux-2.6.12-rc2 |
1452 1453 |
int (*inode_readlink) (struct dentry *dentry); int (*inode_follow_link) (struct dentry *dentry, struct nameidata *nd); |
e74f71eb7 ->permission() sa... |
1454 |
int (*inode_permission) (struct inode *inode, int mask); |
1da177e4c Linux-2.6.12-rc2 |
1455 1456 |
int (*inode_setattr) (struct dentry *dentry, struct iattr *attr); int (*inode_getattr) (struct vfsmount *mnt, struct dentry *dentry); |
8f0cfa52a xattr: add missin... |
1457 1458 1459 1460 1461 |
int (*inode_setxattr) (struct dentry *dentry, const char *name, const void *value, size_t size, int flags); void (*inode_post_setxattr) (struct dentry *dentry, const char *name, const void *value, size_t size, int flags); int (*inode_getxattr) (struct dentry *dentry, const char *name); |
1da177e4c Linux-2.6.12-rc2 |
1462 |
int (*inode_listxattr) (struct dentry *dentry); |
8f0cfa52a xattr: add missin... |
1463 |
int (*inode_removexattr) (struct dentry *dentry, const char *name); |
b53767719 Implement file po... |
1464 1465 |
int (*inode_need_killpriv) (struct dentry *dentry); int (*inode_killpriv) (struct dentry *dentry); |
7b41b1733 SELinux: include/... |
1466 1467 1468 1469 1470 1471 1472 1473 1474 |
int (*inode_getsecurity) (const struct inode *inode, const char *name, void **buffer, bool alloc); int (*inode_setsecurity) (struct inode *inode, const char *name, const void *value, size_t size, int flags); int (*inode_listsecurity) (struct inode *inode, char *buffer, size_t buffer_size); void (*inode_getsecid) (const struct inode *inode, u32 *secid); int (*file_permission) (struct file *file, int mask); int (*file_alloc_security) (struct file *file); void (*file_free_security) (struct file *file); int (*file_ioctl) (struct file *file, unsigned int cmd, |
1da177e4c Linux-2.6.12-rc2 |
1475 |
unsigned long arg); |
7b41b1733 SELinux: include/... |
1476 |
int (*file_mmap) (struct file *file, |
ed0321895 security: Protect... |
1477 1478 1479 |
unsigned long reqprot, unsigned long prot, unsigned long flags, unsigned long addr, unsigned long addr_only); |
7b41b1733 SELinux: include/... |
1480 |
int (*file_mprotect) (struct vm_area_struct *vma, |
1da177e4c Linux-2.6.12-rc2 |
1481 1482 |
unsigned long reqprot, unsigned long prot); |
7b41b1733 SELinux: include/... |
1483 1484 |
int (*file_lock) (struct file *file, unsigned int cmd); int (*file_fcntl) (struct file *file, unsigned int cmd, |
1da177e4c Linux-2.6.12-rc2 |
1485 |
unsigned long arg); |
7b41b1733 SELinux: include/... |
1486 1487 1488 1489 |
int (*file_set_fowner) (struct file *file); int (*file_send_sigiotask) (struct task_struct *tsk, struct fown_struct *fown, int sig); int (*file_receive) (struct file *file); |
745ca2475 CRED: Pass creden... |
1490 |
int (*dentry_open) (struct file *file, const struct cred *cred); |
1da177e4c Linux-2.6.12-rc2 |
1491 1492 |
int (*task_create) (unsigned long clone_flags); |
ee18d64c1 KEYS: Add a keyct... |
1493 |
int (*cred_alloc_blank) (struct cred *cred, gfp_t gfp); |
f1752eec6 CRED: Detach the ... |
1494 |
void (*cred_free) (struct cred *cred); |
d84f4f992 CRED: Inaugurate ... |
1495 1496 |
int (*cred_prepare)(struct cred *new, const struct cred *old, gfp_t gfp); |
ee18d64c1 KEYS: Add a keyct... |
1497 |
void (*cred_transfer)(struct cred *new, const struct cred *old); |
3a3b7ce93 CRED: Allow kerne... |
1498 1499 |
int (*kernel_act_as)(struct cred *new, u32 secid); int (*kernel_create_files_as)(struct cred *new, struct inode *inode); |
dd8dbf2e6 security: report ... |
1500 |
int (*kernel_module_request)(char *kmod_name); |
d84f4f992 CRED: Inaugurate ... |
1501 1502 |
int (*task_fix_setuid) (struct cred *new, const struct cred *old, int flags); |
7b41b1733 SELinux: include/... |
1503 1504 1505 1506 |
int (*task_setpgid) (struct task_struct *p, pid_t pgid); int (*task_getpgid) (struct task_struct *p); int (*task_getsid) (struct task_struct *p); void (*task_getsecid) (struct task_struct *p, u32 *secid); |
7b41b1733 SELinux: include/... |
1507 1508 1509 |
int (*task_setnice) (struct task_struct *p, int nice); int (*task_setioprio) (struct task_struct *p, int ioprio); int (*task_getioprio) (struct task_struct *p); |
8fd00b4d7 rlimits: security... |
1510 1511 |
int (*task_setrlimit) (struct task_struct *p, unsigned int resource, struct rlimit *new_rlim); |
b0ae19811 security: remove ... |
1512 |
int (*task_setscheduler) (struct task_struct *p); |
7b41b1733 SELinux: include/... |
1513 1514 1515 1516 1517 |
int (*task_getscheduler) (struct task_struct *p); int (*task_movememory) (struct task_struct *p); int (*task_kill) (struct task_struct *p, struct siginfo *info, int sig, u32 secid); int (*task_wait) (struct task_struct *p); |
1da177e4c Linux-2.6.12-rc2 |
1518 1519 |
int (*task_prctl) (int option, unsigned long arg2, unsigned long arg3, unsigned long arg4, |
d84f4f992 CRED: Inaugurate ... |
1520 |
unsigned long arg5); |
7b41b1733 SELinux: include/... |
1521 |
void (*task_to_inode) (struct task_struct *p, struct inode *inode); |
1da177e4c Linux-2.6.12-rc2 |
1522 |
|
7b41b1733 SELinux: include/... |
1523 |
int (*ipc_permission) (struct kern_ipc_perm *ipcp, short flag); |
8a076191f LSM: Introduce in... |
1524 |
void (*ipc_getsecid) (struct kern_ipc_perm *ipcp, u32 *secid); |
1da177e4c Linux-2.6.12-rc2 |
1525 |
|
7b41b1733 SELinux: include/... |
1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1537 |
int (*msg_msg_alloc_security) (struct msg_msg *msg); void (*msg_msg_free_security) (struct msg_msg *msg); int (*msg_queue_alloc_security) (struct msg_queue *msq); void (*msg_queue_free_security) (struct msg_queue *msq); int (*msg_queue_associate) (struct msg_queue *msq, int msqflg); int (*msg_queue_msgctl) (struct msg_queue *msq, int cmd); int (*msg_queue_msgsnd) (struct msg_queue *msq, struct msg_msg *msg, int msqflg); int (*msg_queue_msgrcv) (struct msg_queue *msq, struct msg_msg *msg, struct task_struct *target, |
1da177e4c Linux-2.6.12-rc2 |
1538 |
long type, int mode); |
7b41b1733 SELinux: include/... |
1539 1540 1541 1542 1543 |
int (*shm_alloc_security) (struct shmid_kernel *shp); void (*shm_free_security) (struct shmid_kernel *shp); int (*shm_associate) (struct shmid_kernel *shp, int shmflg); int (*shm_shmctl) (struct shmid_kernel *shp, int cmd); int (*shm_shmat) (struct shmid_kernel *shp, |
1da177e4c Linux-2.6.12-rc2 |
1544 |
char __user *shmaddr, int shmflg); |
7b41b1733 SELinux: include/... |
1545 1546 1547 1548 1549 1550 |
int (*sem_alloc_security) (struct sem_array *sma); void (*sem_free_security) (struct sem_array *sma); int (*sem_associate) (struct sem_array *sma, int semflg); int (*sem_semctl) (struct sem_array *sma, int cmd); int (*sem_semop) (struct sem_array *sma, struct sembuf *sops, unsigned nsops, int alter); |
1da177e4c Linux-2.6.12-rc2 |
1551 |
|
7b41b1733 SELinux: include/... |
1552 1553 |
int (*netlink_send) (struct sock *sk, struct sk_buff *skb); int (*netlink_recv) (struct sk_buff *skb, int cap); |
1da177e4c Linux-2.6.12-rc2 |
1554 |
|
1da177e4c Linux-2.6.12-rc2 |
1555 |
void (*d_instantiate) (struct dentry *dentry, struct inode *inode); |
7b41b1733 SELinux: include/... |
1556 1557 1558 |
int (*getprocattr) (struct task_struct *p, char *name, char **value); int (*setprocattr) (struct task_struct *p, char *name, void *value, size_t size); int (*secid_to_secctx) (u32 secid, char **secdata, u32 *seclen); |
7bf570dc8 Security: Make se... |
1559 |
int (*secctx_to_secid) (const char *secdata, u32 seclen, u32 *secid); |
7b41b1733 SELinux: include/... |
1560 |
void (*release_secctx) (char *secdata, u32 seclen); |
1da177e4c Linux-2.6.12-rc2 |
1561 |
|
1ee65e37e LSM/SELinux: inod... |
1562 1563 1564 |
int (*inode_notifysecctx)(struct inode *inode, void *ctx, u32 ctxlen); int (*inode_setsecctx)(struct dentry *dentry, void *ctx, u32 ctxlen); int (*inode_getsecctx)(struct inode *inode, void **ctx, u32 *ctxlen); |
1da177e4c Linux-2.6.12-rc2 |
1565 |
#ifdef CONFIG_SECURITY_NETWORK |
3610cda53 af_unix: Avoid so... |
1566 |
int (*unix_stream_connect) (struct sock *sock, struct sock *other, struct sock *newsk); |
7b41b1733 SELinux: include/... |
1567 |
int (*unix_may_send) (struct socket *sock, struct socket *other); |
1da177e4c Linux-2.6.12-rc2 |
1568 1569 |
int (*socket_create) (int family, int type, int protocol, int kern); |
7b41b1733 SELinux: include/... |
1570 |
int (*socket_post_create) (struct socket *sock, int family, |
7420ed23a [NetLabel]: SELin... |
1571 |
int type, int protocol, int kern); |
7b41b1733 SELinux: include/... |
1572 1573 1574 1575 1576 1577 |
int (*socket_bind) (struct socket *sock, struct sockaddr *address, int addrlen); int (*socket_connect) (struct socket *sock, struct sockaddr *address, int addrlen); int (*socket_listen) (struct socket *sock, int backlog); int (*socket_accept) (struct socket *sock, struct socket *newsock); |
7b41b1733 SELinux: include/... |
1578 1579 1580 1581 1582 1583 1584 1585 1586 1587 |
int (*socket_sendmsg) (struct socket *sock, struct msghdr *msg, int size); int (*socket_recvmsg) (struct socket *sock, struct msghdr *msg, int size, int flags); int (*socket_getsockname) (struct socket *sock); int (*socket_getpeername) (struct socket *sock); int (*socket_getsockopt) (struct socket *sock, int level, int optname); int (*socket_setsockopt) (struct socket *sock, int level, int optname); int (*socket_shutdown) (struct socket *sock, int how); int (*socket_sock_rcv_skb) (struct sock *sk, struct sk_buff *skb); |
2c7946a7b [SECURITY]: TCP/U... |
1588 |
int (*socket_getpeersec_stream) (struct socket *sock, char __user *optval, int __user *optlen, unsigned len); |
dc49c1f94 [AF_UNIX]: Kernel... |
1589 |
int (*socket_getpeersec_dgram) (struct socket *sock, struct sk_buff *skb, u32 *secid); |
7d877f3bd [PATCH] gfp_t: net/* |
1590 |
int (*sk_alloc_security) (struct sock *sk, int family, gfp_t priority); |
1da177e4c Linux-2.6.12-rc2 |
1591 |
void (*sk_free_security) (struct sock *sk); |
892c141e6 [MLSXFRM]: Add se... |
1592 |
void (*sk_clone_security) (const struct sock *sk, struct sock *newsk); |
beb8d13be [MLSXFRM]: Add fl... |
1593 |
void (*sk_getsecid) (struct sock *sk, u32 *secid); |
7b41b1733 SELinux: include/... |
1594 1595 1596 1597 1598 |
void (*sock_graft) (struct sock *sk, struct socket *parent); int (*inet_conn_request) (struct sock *sk, struct sk_buff *skb, struct request_sock *req); void (*inet_csk_clone) (struct sock *newsk, const struct request_sock *req); void (*inet_conn_established) (struct sock *sk, struct sk_buff *skb); |
2606fd1fa secmark: make sec... |
1599 1600 1601 |
int (*secmark_relabel_packet) (u32 secid); void (*secmark_refcount_inc) (void); void (*secmark_refcount_dec) (void); |
7b41b1733 SELinux: include/... |
1602 |
void (*req_classify_flow) (const struct request_sock *req, struct flowi *fl); |
2b980dbd7 lsm: Add hooks to... |
1603 1604 1605 |
int (*tun_dev_create)(void); void (*tun_dev_post_create)(struct sock *sk); int (*tun_dev_attach)(struct sock *sk); |
1da177e4c Linux-2.6.12-rc2 |
1606 |
#endif /* CONFIG_SECURITY_NETWORK */ |
29db91906 [PATCH] Keys: Add... |
1607 |
|
df71837d5 [LSM-IPSec]: Secu... |
1608 |
#ifdef CONFIG_SECURITY_NETWORK_XFRM |
03e1ad7b5 LSM: Make the Lab... |
1609 |
int (*xfrm_policy_alloc_security) (struct xfrm_sec_ctx **ctxp, |
c1a856c96 SELinux: Various ... |
1610 |
struct xfrm_user_sec_ctx *sec_ctx); |
03e1ad7b5 LSM: Make the Lab... |
1611 1612 1613 |
int (*xfrm_policy_clone_security) (struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctx); void (*xfrm_policy_free_security) (struct xfrm_sec_ctx *ctx); int (*xfrm_policy_delete_security) (struct xfrm_sec_ctx *ctx); |
e0d1caa7b [MLSXFRM]: Flow b... |
1614 |
int (*xfrm_state_alloc_security) (struct xfrm_state *x, |
c1a856c96 SELinux: Various ... |
1615 |
struct xfrm_user_sec_ctx *sec_ctx, |
e0d1caa7b [MLSXFRM]: Flow b... |
1616 |
u32 secid); |
df71837d5 [LSM-IPSec]: Secu... |
1617 |
void (*xfrm_state_free_security) (struct xfrm_state *x); |
c8c05a8ee [LSM-IPsec]: SELi... |
1618 |
int (*xfrm_state_delete_security) (struct xfrm_state *x); |
7b41b1733 SELinux: include/... |
1619 1620 1621 |
int (*xfrm_policy_lookup) (struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir); int (*xfrm_state_pol_flow_match) (struct xfrm_state *x, struct xfrm_policy *xp, |
e33f77042 xfrm: Mark flowi ... |
1622 |
const struct flowi *fl); |
7b41b1733 SELinux: include/... |
1623 |
int (*xfrm_decode_session) (struct sk_buff *skb, u32 *secid, int ckall); |
df71837d5 [LSM-IPSec]: Secu... |
1624 |
#endif /* CONFIG_SECURITY_NETWORK_XFRM */ |
29db91906 [PATCH] Keys: Add... |
1625 1626 |
/* key management security hooks */ #ifdef CONFIG_KEYS |
d84f4f992 CRED: Inaugurate ... |
1627 |
int (*key_alloc) (struct key *key, const struct cred *cred, unsigned long flags); |
7b41b1733 SELinux: include/... |
1628 1629 |
void (*key_free) (struct key *key); int (*key_permission) (key_ref_t key_ref, |
d84f4f992 CRED: Inaugurate ... |
1630 |
const struct cred *cred, |
7b41b1733 SELinux: include/... |
1631 |
key_perm_t perm); |
70a5bb72b keys: add keyctl ... |
1632 |
int (*key_getsecurity)(struct key *key, char **_buffer); |
29db91906 [PATCH] Keys: Add... |
1633 |
#endif /* CONFIG_KEYS */ |
03d37d25e LSM/Audit: Introd... |
1634 |
#ifdef CONFIG_AUDIT |
7b41b1733 SELinux: include/... |
1635 1636 1637 1638 1639 |
int (*audit_rule_init) (u32 field, u32 op, char *rulestr, void **lsmrule); int (*audit_rule_known) (struct audit_krule *krule); int (*audit_rule_match) (u32 secid, u32 field, u32 op, void *lsmrule, struct audit_context *actx); void (*audit_rule_free) (void *lsmrule); |
03d37d25e LSM/Audit: Introd... |
1640 |
#endif /* CONFIG_AUDIT */ |
1da177e4c Linux-2.6.12-rc2 |
1641 |
}; |
1da177e4c Linux-2.6.12-rc2 |
1642 |
/* prototypes */ |
7b41b1733 SELinux: include/... |
1643 |
extern int security_init(void); |
076c54c5b Security: Introdu... |
1644 |
extern int security_module_enable(struct security_operations *ops); |
7b41b1733 SELinux: include/... |
1645 |
extern int register_security(struct security_operations *ops); |
5dbe3040c security: sparse ... |
1646 |
extern void __init security_fixup_ops(struct security_operations *ops); |
1da177e4c Linux-2.6.12-rc2 |
1647 |
|
20510f2f4 security: Convert... |
1648 |
/* Security operations */ |
9e48858f7 security: rename ... |
1649 |
int security_ptrace_access_check(struct task_struct *child, unsigned int mode); |
5cd9c58fb security: Fix set... |
1650 |
int security_ptrace_traceme(struct task_struct *parent); |
20510f2f4 security: Convert... |
1651 |
int security_capget(struct task_struct *target, |
7b41b1733 SELinux: include/... |
1652 1653 1654 |
kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted); |
d84f4f992 CRED: Inaugurate ... |
1655 1656 1657 1658 |
int security_capset(struct cred *new, const struct cred *old, const kernel_cap_t *effective, const kernel_cap_t *inheritable, const kernel_cap_t *permitted); |
3486740a4 userns: security:... |
1659 1660 1661 1662 1663 1664 |
int security_capable(struct user_namespace *ns, const struct cred *cred, int cap); int security_real_capable(struct task_struct *tsk, struct user_namespace *ns, int cap); int security_real_capable_noaudit(struct task_struct *tsk, struct user_namespace *ns, int cap); |
20510f2f4 security: Convert... |
1665 1666 |
int security_quotactl(int cmds, int type, int id, struct super_block *sb); int security_quota_on(struct dentry *dentry); |
12b3052c3 capabilities/sysl... |
1667 |
int security_syslog(int type); |
1e6d76792 time: Correct the... |
1668 |
int security_settime(const struct timespec *ts, const struct timezone *tz); |
20510f2f4 security: Convert... |
1669 1670 |
int security_vm_enough_memory(long pages); int security_vm_enough_memory_mm(struct mm_struct *mm, long pages); |
731572d39 nfsd: fix vm over... |
1671 |
int security_vm_enough_memory_kern(long pages); |
a6f76f23d CRED: Make execve... |
1672 |
int security_bprm_set_creds(struct linux_binprm *bprm); |
20510f2f4 security: Convert... |
1673 |
int security_bprm_check(struct linux_binprm *bprm); |
a6f76f23d CRED: Make execve... |
1674 1675 |
void security_bprm_committing_creds(struct linux_binprm *bprm); void security_bprm_committed_creds(struct linux_binprm *bprm); |
20510f2f4 security: Convert... |
1676 1677 1678 |
int security_bprm_secureexec(struct linux_binprm *bprm); int security_sb_alloc(struct super_block *sb); void security_sb_free(struct super_block *sb); |
e00075298 LSM/SELinux: Inte... |
1679 |
int security_sb_copy_data(char *orig, char *copy); |
ff36fe2c8 LSM: Pass -o remo... |
1680 |
int security_sb_remount(struct super_block *sb, void *data); |
12204e24b security: pass mo... |
1681 |
int security_sb_kern_mount(struct super_block *sb, int flags, void *data); |
2069f4578 LSM/SELinux: show... |
1682 |
int security_sb_show_options(struct seq_file *m, struct super_block *sb); |
20510f2f4 security: Convert... |
1683 |
int security_sb_statfs(struct dentry *dentry); |
b5266eb4c [PATCH] switch a ... |
1684 |
int security_sb_mount(char *dev_name, struct path *path, |
7b41b1733 SELinux: include/... |
1685 |
char *type, unsigned long flags, void *data); |
20510f2f4 security: Convert... |
1686 |
int security_sb_umount(struct vfsmount *mnt, int flags); |
b5266eb4c [PATCH] switch a ... |
1687 |
int security_sb_pivotroot(struct path *old_path, struct path *new_path); |
e00075298 LSM/SELinux: Inte... |
1688 |
int security_sb_set_mnt_opts(struct super_block *sb, struct security_mnt_opts *opts); |
c9180a57a Security: add get... |
1689 1690 |
void security_sb_clone_mnt_opts(const struct super_block *oldsb, struct super_block *newsb); |
e00075298 LSM/SELinux: Inte... |
1691 |
int security_sb_parse_opts_str(char *options, struct security_mnt_opts *opts); |
c9180a57a Security: add get... |
1692 |
|
20510f2f4 security: Convert... |
1693 1694 1695 |
int security_inode_alloc(struct inode *inode); void security_inode_free(struct inode *inode); int security_inode_init_security(struct inode *inode, struct inode *dir, |
9d8f13ba3 security: new sec... |
1696 1697 1698 1699 1700 |
const struct qstr *qstr, initxattrs initxattrs, void *fs_data); int security_old_inode_init_security(struct inode *inode, struct inode *dir, const struct qstr *qstr, char **name, void **value, size_t *len); |
20510f2f4 security: Convert... |
1701 1702 1703 1704 1705 |
int security_inode_create(struct inode *dir, struct dentry *dentry, int mode); int security_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry); int security_inode_unlink(struct inode *dir, struct dentry *dentry); int security_inode_symlink(struct inode *dir, struct dentry *dentry, |
7b41b1733 SELinux: include/... |
1706 |
const char *old_name); |
20510f2f4 security: Convert... |
1707 1708 1709 1710 |
int security_inode_mkdir(struct inode *dir, struct dentry *dentry, int mode); int security_inode_rmdir(struct inode *dir, struct dentry *dentry); int security_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev); int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry, |
7b41b1733 SELinux: include/... |
1711 |
struct inode *new_dir, struct dentry *new_dentry); |
20510f2f4 security: Convert... |
1712 1713 |
int security_inode_readlink(struct dentry *dentry); int security_inode_follow_link(struct dentry *dentry, struct nameidata *nd); |
b77b0646e [PATCH] pass MAY_... |
1714 |
int security_inode_permission(struct inode *inode, int mask); |
20510f2f4 security: Convert... |
1715 1716 |
int security_inode_setattr(struct dentry *dentry, struct iattr *attr); int security_inode_getattr(struct vfsmount *mnt, struct dentry *dentry); |
8f0cfa52a xattr: add missin... |
1717 1718 1719 1720 1721 |
int security_inode_setxattr(struct dentry *dentry, const char *name, const void *value, size_t size, int flags); void security_inode_post_setxattr(struct dentry *dentry, const char *name, const void *value, size_t size, int flags); int security_inode_getxattr(struct dentry *dentry, const char *name); |
20510f2f4 security: Convert... |
1722 |
int security_inode_listxattr(struct dentry *dentry); |
8f0cfa52a xattr: add missin... |
1723 |
int security_inode_removexattr(struct dentry *dentry, const char *name); |
b53767719 Implement file po... |
1724 1725 |
int security_inode_need_killpriv(struct dentry *dentry); int security_inode_killpriv(struct dentry *dentry); |
424925940 VFS/Security: Rew... |
1726 |
int security_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc); |
20510f2f4 security: Convert... |
1727 1728 |
int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags); int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size); |
8a076191f LSM: Introduce in... |
1729 |
void security_inode_getsecid(const struct inode *inode, u32 *secid); |
20510f2f4 security: Convert... |
1730 1731 1732 1733 1734 1735 1736 1737 |
int security_file_permission(struct file *file, int mask); int security_file_alloc(struct file *file); void security_file_free(struct file *file); int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg); int security_file_mmap(struct file *file, unsigned long reqprot, unsigned long prot, unsigned long flags, unsigned long addr, unsigned long addr_only); int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, |
7b41b1733 SELinux: include/... |
1738 |
unsigned long prot); |
20510f2f4 security: Convert... |
1739 1740 1741 1742 |
int security_file_lock(struct file *file, unsigned int cmd); int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg); int security_file_set_fowner(struct file *file); int security_file_send_sigiotask(struct task_struct *tsk, |
7b41b1733 SELinux: include/... |
1743 |
struct fown_struct *fown, int sig); |
20510f2f4 security: Convert... |
1744 |
int security_file_receive(struct file *file); |
745ca2475 CRED: Pass creden... |
1745 |
int security_dentry_open(struct file *file, const struct cred *cred); |
20510f2f4 security: Convert... |
1746 |
int security_task_create(unsigned long clone_flags); |
ee18d64c1 KEYS: Add a keyct... |
1747 |
int security_cred_alloc_blank(struct cred *cred, gfp_t gfp); |
f1752eec6 CRED: Detach the ... |
1748 |
void security_cred_free(struct cred *cred); |
d84f4f992 CRED: Inaugurate ... |
1749 |
int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp); |
ee18d64c1 KEYS: Add a keyct... |
1750 |
void security_transfer_creds(struct cred *new, const struct cred *old); |
3a3b7ce93 CRED: Allow kerne... |
1751 1752 |
int security_kernel_act_as(struct cred *new, u32 secid); int security_kernel_create_files_as(struct cred *new, struct inode *inode); |
dd8dbf2e6 security: report ... |
1753 |
int security_kernel_module_request(char *kmod_name); |
d84f4f992 CRED: Inaugurate ... |
1754 1755 |
int security_task_fix_setuid(struct cred *new, const struct cred *old, int flags); |
20510f2f4 security: Convert... |
1756 1757 1758 1759 |
int security_task_setpgid(struct task_struct *p, pid_t pgid); int security_task_getpgid(struct task_struct *p); int security_task_getsid(struct task_struct *p); void security_task_getsecid(struct task_struct *p, u32 *secid); |
20510f2f4 security: Convert... |
1760 1761 1762 |
int security_task_setnice(struct task_struct *p, int nice); int security_task_setioprio(struct task_struct *p, int ioprio); int security_task_getioprio(struct task_struct *p); |
8fd00b4d7 rlimits: security... |
1763 1764 |
int security_task_setrlimit(struct task_struct *p, unsigned int resource, struct rlimit *new_rlim); |
b0ae19811 security: remove ... |
1765 |
int security_task_setscheduler(struct task_struct *p); |
20510f2f4 security: Convert... |
1766 1767 1768 1769 1770 1771 |
int security_task_getscheduler(struct task_struct *p); int security_task_movememory(struct task_struct *p); int security_task_kill(struct task_struct *p, struct siginfo *info, int sig, u32 secid); int security_task_wait(struct task_struct *p); int security_task_prctl(int option, unsigned long arg2, unsigned long arg3, |
d84f4f992 CRED: Inaugurate ... |
1772 |
unsigned long arg4, unsigned long arg5); |
20510f2f4 security: Convert... |
1773 1774 |
void security_task_to_inode(struct task_struct *p, struct inode *inode); int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag); |
8a076191f LSM: Introduce in... |
1775 |
void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid); |
20510f2f4 security: Convert... |
1776 1777 1778 1779 1780 1781 1782 |
int security_msg_msg_alloc(struct msg_msg *msg); void security_msg_msg_free(struct msg_msg *msg); int security_msg_queue_alloc(struct msg_queue *msq); void security_msg_queue_free(struct msg_queue *msq); int security_msg_queue_associate(struct msg_queue *msq, int msqflg); int security_msg_queue_msgctl(struct msg_queue *msq, int cmd); int security_msg_queue_msgsnd(struct msg_queue *msq, |
7b41b1733 SELinux: include/... |
1783 |
struct msg_msg *msg, int msqflg); |
20510f2f4 security: Convert... |
1784 |
int security_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg, |
7b41b1733 SELinux: include/... |
1785 |
struct task_struct *target, long type, int mode); |
20510f2f4 security: Convert... |
1786 1787 1788 1789 1790 1791 1792 1793 1794 1795 1796 |
int security_shm_alloc(struct shmid_kernel *shp); void security_shm_free(struct shmid_kernel *shp); int security_shm_associate(struct shmid_kernel *shp, int shmflg); int security_shm_shmctl(struct shmid_kernel *shp, int cmd); int security_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr, int shmflg); int security_sem_alloc(struct sem_array *sma); void security_sem_free(struct sem_array *sma); int security_sem_associate(struct sem_array *sma, int semflg); int security_sem_semctl(struct sem_array *sma, int cmd); int security_sem_semop(struct sem_array *sma, struct sembuf *sops, unsigned nsops, int alter); |
7b41b1733 SELinux: include/... |
1797 |
void security_d_instantiate(struct dentry *dentry, struct inode *inode); |
20510f2f4 security: Convert... |
1798 1799 1800 1801 1802 |
int security_getprocattr(struct task_struct *p, char *name, char **value); int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size); int security_netlink_send(struct sock *sk, struct sk_buff *skb); int security_netlink_recv(struct sk_buff *skb, int cap); int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen); |
7bf570dc8 Security: Make se... |
1803 |
int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid); |
20510f2f4 security: Convert... |
1804 |
void security_release_secctx(char *secdata, u32 seclen); |
1ee65e37e LSM/SELinux: inod... |
1805 1806 1807 |
int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen); int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen); int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen); |
1da177e4c Linux-2.6.12-rc2 |
1808 |
#else /* CONFIG_SECURITY */ |
e00075298 LSM/SELinux: Inte... |
1809 1810 1811 1812 1813 1814 1815 1816 1817 1818 |
struct security_mnt_opts { }; static inline void security_init_mnt_opts(struct security_mnt_opts *opts) { } static inline void security_free_mnt_opts(struct security_mnt_opts *opts) { } |
1da177e4c Linux-2.6.12-rc2 |
1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 |
/* * This is the default capabilities functionality. Most of these functions * are just stubbed out, but a few must call the proper capable code. */ static inline int security_init(void) { return 0; } |
9e48858f7 security: rename ... |
1829 |
static inline int security_ptrace_access_check(struct task_struct *child, |
5cd9c58fb security: Fix set... |
1830 1831 |
unsigned int mode) { |
9e48858f7 security: rename ... |
1832 |
return cap_ptrace_access_check(child, mode); |
5cd9c58fb security: Fix set... |
1833 |
} |
5e186b57e security.h: fix b... |
1834 |
static inline int security_ptrace_traceme(struct task_struct *parent) |
1da177e4c Linux-2.6.12-rc2 |
1835 |
{ |
5cd9c58fb security: Fix set... |
1836 |
return cap_ptrace_traceme(parent); |
1da177e4c Linux-2.6.12-rc2 |
1837 |
} |
7b41b1733 SELinux: include/... |
1838 |
static inline int security_capget(struct task_struct *target, |
1da177e4c Linux-2.6.12-rc2 |
1839 1840 1841 1842 |
kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted) { |
7b41b1733 SELinux: include/... |
1843 |
return cap_capget(target, effective, inheritable, permitted); |
1da177e4c Linux-2.6.12-rc2 |
1844 |
} |
d84f4f992 CRED: Inaugurate ... |
1845 1846 1847 1848 1849 |
static inline int security_capset(struct cred *new, const struct cred *old, const kernel_cap_t *effective, const kernel_cap_t *inheritable, const kernel_cap_t *permitted) |
1da177e4c Linux-2.6.12-rc2 |
1850 |
{ |
d84f4f992 CRED: Inaugurate ... |
1851 |
return cap_capset(new, old, effective, inheritable, permitted); |
1da177e4c Linux-2.6.12-rc2 |
1852 |
} |
3486740a4 userns: security:... |
1853 1854 |
static inline int security_capable(struct user_namespace *ns, const struct cred *cred, int cap) |
12b5989be [PATCH] refactor ... |
1855 |
{ |
3486740a4 userns: security:... |
1856 |
return cap_capable(current, cred, ns, cap, SECURITY_CAP_AUDIT); |
06112163f Add a new capable... |
1857 |
} |
3486740a4 userns: security:... |
1858 |
static inline int security_real_capable(struct task_struct *tsk, struct user_namespace *ns, int cap) |
06112163f Add a new capable... |
1859 |
{ |
3699c53c4 CRED: Fix regress... |
1860 1861 1862 |
int ret; rcu_read_lock(); |
3486740a4 userns: security:... |
1863 |
ret = cap_capable(tsk, __task_cred(tsk), ns, cap, SECURITY_CAP_AUDIT); |
3699c53c4 CRED: Fix regress... |
1864 1865 1866 1867 1868 |
rcu_read_unlock(); return ret; } static inline |
3486740a4 userns: security:... |
1869 |
int security_real_capable_noaudit(struct task_struct *tsk, struct user_namespace *ns, int cap) |
3699c53c4 CRED: Fix regress... |
1870 1871 1872 1873 |
{ int ret; rcu_read_lock(); |
3486740a4 userns: security:... |
1874 |
ret = cap_capable(tsk, __task_cred(tsk), ns, cap, |
3699c53c4 CRED: Fix regress... |
1875 1876 1877 |
SECURITY_CAP_NOAUDIT); rcu_read_unlock(); return ret; |
12b5989be [PATCH] refactor ... |
1878 |
} |
7b41b1733 SELinux: include/... |
1879 1880 |
static inline int security_quotactl(int cmds, int type, int id, struct super_block *sb) |
1da177e4c Linux-2.6.12-rc2 |
1881 1882 1883 |
{ return 0; } |
7b41b1733 SELinux: include/... |
1884 |
static inline int security_quota_on(struct dentry *dentry) |
1da177e4c Linux-2.6.12-rc2 |
1885 1886 1887 |
{ return 0; } |
12b3052c3 capabilities/sysl... |
1888 |
static inline int security_syslog(int type) |
1da177e4c Linux-2.6.12-rc2 |
1889 |
{ |
12b3052c3 capabilities/sysl... |
1890 |
return 0; |
1da177e4c Linux-2.6.12-rc2 |
1891 |
} |
1e6d76792 time: Correct the... |
1892 1893 |
static inline int security_settime(const struct timespec *ts, const struct timezone *tz) |
1da177e4c Linux-2.6.12-rc2 |
1894 1895 1896 1897 1898 1899 |
{ return cap_settime(ts, tz); } static inline int security_vm_enough_memory(long pages) { |
1b79cd04f nfsd: fix vm over... |
1900 |
WARN_ON(current->mm == NULL); |
34b4e4aa3 fix NULL pointer ... |
1901 1902 |
return cap_vm_enough_memory(current->mm, pages); } |
1b79cd04f nfsd: fix vm over... |
1903 |
static inline int security_vm_enough_memory_mm(struct mm_struct *mm, long pages) |
731572d39 nfsd: fix vm over... |
1904 |
{ |
1b79cd04f nfsd: fix vm over... |
1905 1906 |
WARN_ON(mm == NULL); return cap_vm_enough_memory(mm, pages); |
731572d39 nfsd: fix vm over... |
1907 |
} |
1b79cd04f nfsd: fix vm over... |
1908 |
static inline int security_vm_enough_memory_kern(long pages) |
34b4e4aa3 fix NULL pointer ... |
1909 |
{ |
1b79cd04f nfsd: fix vm over... |
1910 1911 1912 |
/* If current->mm is a kernel thread then we will pass NULL, for this specific case that is fine */ return cap_vm_enough_memory(current->mm, pages); |
1da177e4c Linux-2.6.12-rc2 |
1913 |
} |
a6f76f23d CRED: Make execve... |
1914 |
static inline int security_bprm_set_creds(struct linux_binprm *bprm) |
7b41b1733 SELinux: include/... |
1915 |
{ |
a6f76f23d CRED: Make execve... |
1916 |
return cap_bprm_set_creds(bprm); |
1da177e4c Linux-2.6.12-rc2 |
1917 |
} |
a6f76f23d CRED: Make execve... |
1918 |
static inline int security_bprm_check(struct linux_binprm *bprm) |
1da177e4c Linux-2.6.12-rc2 |
1919 |
{ |
a6f76f23d CRED: Make execve... |
1920 |
return 0; |
1da177e4c Linux-2.6.12-rc2 |
1921 |
} |
a6f76f23d CRED: Make execve... |
1922 |
static inline void security_bprm_committing_creds(struct linux_binprm *bprm) |
1da177e4c Linux-2.6.12-rc2 |
1923 |
{ |
1da177e4c Linux-2.6.12-rc2 |
1924 |
} |
a6f76f23d CRED: Make execve... |
1925 |
static inline void security_bprm_committed_creds(struct linux_binprm *bprm) |
1da177e4c Linux-2.6.12-rc2 |
1926 |
{ |
1da177e4c Linux-2.6.12-rc2 |
1927 |
} |
7b41b1733 SELinux: include/... |
1928 |
static inline int security_bprm_secureexec(struct linux_binprm *bprm) |
1da177e4c Linux-2.6.12-rc2 |
1929 1930 1931 |
{ return cap_bprm_secureexec(bprm); } |
7b41b1733 SELinux: include/... |
1932 |
static inline int security_sb_alloc(struct super_block *sb) |
1da177e4c Linux-2.6.12-rc2 |
1933 1934 1935 |
{ return 0; } |
7b41b1733 SELinux: include/... |
1936 |
static inline void security_sb_free(struct super_block *sb) |
1da177e4c Linux-2.6.12-rc2 |
1937 |
{ } |
7b41b1733 SELinux: include/... |
1938 |
static inline int security_sb_copy_data(char *orig, char *copy) |
1da177e4c Linux-2.6.12-rc2 |
1939 1940 1941 |
{ return 0; } |
ff36fe2c8 LSM: Pass -o remo... |
1942 1943 1944 1945 |
static inline int security_sb_remount(struct super_block *sb, void *data) { return 0; } |
12204e24b security: pass mo... |
1946 |
static inline int security_sb_kern_mount(struct super_block *sb, int flags, void *data) |
1da177e4c Linux-2.6.12-rc2 |
1947 1948 1949 |
{ return 0; } |
2069f4578 LSM/SELinux: show... |
1950 1951 1952 1953 1954 |
static inline int security_sb_show_options(struct seq_file *m, struct super_block *sb) { return 0; } |
7b41b1733 SELinux: include/... |
1955 |
static inline int security_sb_statfs(struct dentry *dentry) |
1da177e4c Linux-2.6.12-rc2 |
1956 1957 1958 |
{ return 0; } |
7b41b1733 SELinux: include/... |
1959 |
static inline int security_sb_mount(char *dev_name, struct path *path, |
1da177e4c Linux-2.6.12-rc2 |
1960 1961 1962 1963 1964 |
char *type, unsigned long flags, void *data) { return 0; } |
7b41b1733 SELinux: include/... |
1965 |
static inline int security_sb_umount(struct vfsmount *mnt, int flags) |
1da177e4c Linux-2.6.12-rc2 |
1966 1967 1968 |
{ return 0; } |
7b41b1733 SELinux: include/... |
1969 1970 |
static inline int security_sb_pivotroot(struct path *old_path, struct path *new_path) |
1da177e4c Linux-2.6.12-rc2 |
1971 1972 1973 |
{ return 0; } |
e00075298 LSM/SELinux: Inte... |
1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 |
static inline int security_sb_set_mnt_opts(struct super_block *sb, struct security_mnt_opts *opts) { return 0; } static inline void security_sb_clone_mnt_opts(const struct super_block *oldsb, struct super_block *newsb) { } static inline int security_sb_parse_opts_str(char *options, struct security_mnt_opts *opts) { return 0; } |
1da177e4c Linux-2.6.12-rc2 |
1988 |
|
7b41b1733 SELinux: include/... |
1989 |
static inline int security_inode_alloc(struct inode *inode) |
1da177e4c Linux-2.6.12-rc2 |
1990 1991 1992 |
{ return 0; } |
7b41b1733 SELinux: include/... |
1993 |
static inline void security_inode_free(struct inode *inode) |
1da177e4c Linux-2.6.12-rc2 |
1994 |
{ } |
5e41ff9e0 [PATCH] security:... |
1995 |
|
7b41b1733 SELinux: include/... |
1996 |
static inline int security_inode_init_security(struct inode *inode, |
5e41ff9e0 [PATCH] security:... |
1997 |
struct inode *dir, |
2a7dba391 fs/vfs/security: ... |
1998 |
const struct qstr *qstr, |
9d8f13ba3 security: new sec... |
1999 2000 |
initxattrs initxattrs, void *fs_data) |
5e41ff9e0 [PATCH] security:... |
2001 |
{ |
1e39f384b evm: fix build pr... |
2002 |
return 0; |
5e41ff9e0 [PATCH] security:... |
2003 |
} |
7b41b1733 SELinux: include/... |
2004 |
|
1e39f384b evm: fix build pr... |
2005 2006 2007 2008 2009 |
static inline int security_old_inode_init_security(struct inode *inode, struct inode *dir, const struct qstr *qstr, char **name, void **value, size_t *len) |
e1c9b23ad evm: building wit... |
2010 |
{ |
1e39f384b evm: fix build pr... |
2011 |
return 0; |
e1c9b23ad evm: building wit... |
2012 |
} |
7b41b1733 SELinux: include/... |
2013 |
static inline int security_inode_create(struct inode *dir, |
1da177e4c Linux-2.6.12-rc2 |
2014 2015 2016 2017 2018 |
struct dentry *dentry, int mode) { return 0; } |
7b41b1733 SELinux: include/... |
2019 |
static inline int security_inode_link(struct dentry *old_dentry, |
1da177e4c Linux-2.6.12-rc2 |
2020 2021 2022 2023 2024 |
struct inode *dir, struct dentry *new_dentry) { return 0; } |
7b41b1733 SELinux: include/... |
2025 |
static inline int security_inode_unlink(struct inode *dir, |
1da177e4c Linux-2.6.12-rc2 |
2026 2027 2028 2029 |
struct dentry *dentry) { return 0; } |
7b41b1733 SELinux: include/... |
2030 |
static inline int security_inode_symlink(struct inode *dir, |
1da177e4c Linux-2.6.12-rc2 |
2031 2032 2033 2034 2035 |
struct dentry *dentry, const char *old_name) { return 0; } |
7b41b1733 SELinux: include/... |
2036 |
static inline int security_inode_mkdir(struct inode *dir, |
1da177e4c Linux-2.6.12-rc2 |
2037 2038 2039 2040 2041 |
struct dentry *dentry, int mode) { return 0; } |
7b41b1733 SELinux: include/... |
2042 |
static inline int security_inode_rmdir(struct inode *dir, |
1da177e4c Linux-2.6.12-rc2 |
2043 2044 2045 2046 |
struct dentry *dentry) { return 0; } |
7b41b1733 SELinux: include/... |
2047 |
static inline int security_inode_mknod(struct inode *dir, |
1da177e4c Linux-2.6.12-rc2 |
2048 2049 2050 2051 2052 |
struct dentry *dentry, int mode, dev_t dev) { return 0; } |
7b41b1733 SELinux: include/... |
2053 |
static inline int security_inode_rename(struct inode *old_dir, |
1da177e4c Linux-2.6.12-rc2 |
2054 2055 2056 2057 2058 2059 |
struct dentry *old_dentry, struct inode *new_dir, struct dentry *new_dentry) { return 0; } |
7b41b1733 SELinux: include/... |
2060 |
static inline int security_inode_readlink(struct dentry *dentry) |
1da177e4c Linux-2.6.12-rc2 |
2061 2062 2063 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2064 |
static inline int security_inode_follow_link(struct dentry *dentry, |
1da177e4c Linux-2.6.12-rc2 |
2065 2066 2067 2068 |
struct nameidata *nd) { return 0; } |
b77b0646e [PATCH] pass MAY_... |
2069 |
static inline int security_inode_permission(struct inode *inode, int mask) |
1da177e4c Linux-2.6.12-rc2 |
2070 2071 2072 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2073 |
static inline int security_inode_setattr(struct dentry *dentry, |
1da177e4c Linux-2.6.12-rc2 |
2074 2075 2076 2077 |
struct iattr *attr) { return 0; } |
7b41b1733 SELinux: include/... |
2078 |
static inline int security_inode_getattr(struct vfsmount *mnt, |
1da177e4c Linux-2.6.12-rc2 |
2079 2080 2081 2082 |
struct dentry *dentry) { return 0; } |
8f0cfa52a xattr: add missin... |
2083 2084 |
static inline int security_inode_setxattr(struct dentry *dentry, const char *name, const void *value, size_t size, int flags) |
1da177e4c Linux-2.6.12-rc2 |
2085 2086 2087 |
{ return cap_inode_setxattr(dentry, name, value, size, flags); } |
8f0cfa52a xattr: add missin... |
2088 2089 |
static inline void security_inode_post_setxattr(struct dentry *dentry, const char *name, const void *value, size_t size, int flags) |
1da177e4c Linux-2.6.12-rc2 |
2090 |
{ } |
8f0cfa52a xattr: add missin... |
2091 2092 |
static inline int security_inode_getxattr(struct dentry *dentry, const char *name) |
1da177e4c Linux-2.6.12-rc2 |
2093 2094 2095 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2096 |
static inline int security_inode_listxattr(struct dentry *dentry) |
1da177e4c Linux-2.6.12-rc2 |
2097 2098 2099 |
{ return 0; } |
8f0cfa52a xattr: add missin... |
2100 2101 |
static inline int security_inode_removexattr(struct dentry *dentry, const char *name) |
1da177e4c Linux-2.6.12-rc2 |
2102 2103 2104 |
{ return cap_inode_removexattr(dentry, name); } |
b53767719 Implement file po... |
2105 2106 2107 2108 2109 2110 2111 2112 2113 |
static inline int security_inode_need_killpriv(struct dentry *dentry) { return cap_inode_need_killpriv(dentry); } static inline int security_inode_killpriv(struct dentry *dentry) { return cap_inode_killpriv(dentry); } |
424925940 VFS/Security: Rew... |
2114 |
static inline int security_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc) |
1da177e4c Linux-2.6.12-rc2 |
2115 2116 2117 2118 2119 2120 2121 2122 2123 2124 2125 2126 2127 |
{ return -EOPNOTSUPP; } static inline int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags) { return -EOPNOTSUPP; } static inline int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size) { return 0; } |
8a076191f LSM: Introduce in... |
2128 2129 2130 2131 |
static inline void security_inode_getsecid(const struct inode *inode, u32 *secid) { *secid = 0; } |
7b41b1733 SELinux: include/... |
2132 |
static inline int security_file_permission(struct file *file, int mask) |
1da177e4c Linux-2.6.12-rc2 |
2133 2134 2135 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2136 |
static inline int security_file_alloc(struct file *file) |
1da177e4c Linux-2.6.12-rc2 |
2137 2138 2139 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2140 |
static inline void security_file_free(struct file *file) |
1da177e4c Linux-2.6.12-rc2 |
2141 |
{ } |
7b41b1733 SELinux: include/... |
2142 2143 |
static inline int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg) |
1da177e4c Linux-2.6.12-rc2 |
2144 2145 2146 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2147 2148 2149 2150 2151 |
static inline int security_file_mmap(struct file *file, unsigned long reqprot, unsigned long prot, unsigned long flags, unsigned long addr, unsigned long addr_only) |
1da177e4c Linux-2.6.12-rc2 |
2152 |
{ |
7c73875e7 Capabilities: mov... |
2153 |
return cap_file_mmap(file, reqprot, prot, flags, addr, addr_only); |
1da177e4c Linux-2.6.12-rc2 |
2154 |
} |
7b41b1733 SELinux: include/... |
2155 2156 2157 |
static inline int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, unsigned long prot) |
1da177e4c Linux-2.6.12-rc2 |
2158 2159 2160 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2161 |
static inline int security_file_lock(struct file *file, unsigned int cmd) |
1da177e4c Linux-2.6.12-rc2 |
2162 2163 2164 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2165 2166 |
static inline int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg) |
1da177e4c Linux-2.6.12-rc2 |
2167 2168 2169 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2170 |
static inline int security_file_set_fowner(struct file *file) |
1da177e4c Linux-2.6.12-rc2 |
2171 2172 2173 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2174 2175 2176 |
static inline int security_file_send_sigiotask(struct task_struct *tsk, struct fown_struct *fown, int sig) |
1da177e4c Linux-2.6.12-rc2 |
2177 2178 2179 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2180 |
static inline int security_file_receive(struct file *file) |
1da177e4c Linux-2.6.12-rc2 |
2181 2182 2183 |
{ return 0; } |
745ca2475 CRED: Pass creden... |
2184 2185 |
static inline int security_dentry_open(struct file *file, const struct cred *cred) |
788e7dd4c SELinux: Improve ... |
2186 2187 2188 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2189 |
static inline int security_task_create(unsigned long clone_flags) |
1da177e4c Linux-2.6.12-rc2 |
2190 2191 2192 |
{ return 0; } |
945af7c32 KEYS: security_cr... |
2193 2194 2195 2196 |
static inline int security_cred_alloc_blank(struct cred *cred, gfp_t gfp) { return 0; } |
ee18d64c1 KEYS: Add a keyct... |
2197 |
|
d84f4f992 CRED: Inaugurate ... |
2198 2199 2200 2201 2202 2203 |
static inline void security_cred_free(struct cred *cred) { } static inline int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp) |
1da177e4c Linux-2.6.12-rc2 |
2204 2205 2206 |
{ return 0; } |
ee18d64c1 KEYS: Add a keyct... |
2207 2208 2209 2210 |
static inline void security_transfer_creds(struct cred *new, const struct cred *old) { } |
3a3b7ce93 CRED: Allow kerne... |
2211 2212 2213 2214 2215 2216 2217 2218 2219 2220 |
static inline int security_kernel_act_as(struct cred *cred, u32 secid) { return 0; } static inline int security_kernel_create_files_as(struct cred *cred, struct inode *inode) { return 0; } |
dd8dbf2e6 security: report ... |
2221 |
static inline int security_kernel_module_request(char *kmod_name) |
9188499cd security: introdu... |
2222 2223 |
{ return 0; |
1da177e4c Linux-2.6.12-rc2 |
2224 |
} |
d84f4f992 CRED: Inaugurate ... |
2225 2226 2227 |
static inline int security_task_fix_setuid(struct cred *new, const struct cred *old, int flags) |
1da177e4c Linux-2.6.12-rc2 |
2228 |
{ |
d84f4f992 CRED: Inaugurate ... |
2229 |
return cap_task_fix_setuid(new, old, flags); |
1da177e4c Linux-2.6.12-rc2 |
2230 |
} |
7b41b1733 SELinux: include/... |
2231 |
static inline int security_task_setpgid(struct task_struct *p, pid_t pgid) |
1da177e4c Linux-2.6.12-rc2 |
2232 2233 2234 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2235 |
static inline int security_task_getpgid(struct task_struct *p) |
1da177e4c Linux-2.6.12-rc2 |
2236 2237 2238 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2239 |
static inline int security_task_getsid(struct task_struct *p) |
1da177e4c Linux-2.6.12-rc2 |
2240 2241 2242 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2243 |
static inline void security_task_getsecid(struct task_struct *p, u32 *secid) |
8a076191f LSM: Introduce in... |
2244 2245 2246 |
{ *secid = 0; } |
f9008e4c5 [PATCH] SELinux: ... |
2247 |
|
7b41b1733 SELinux: include/... |
2248 |
static inline int security_task_setnice(struct task_struct *p, int nice) |
1da177e4c Linux-2.6.12-rc2 |
2249 |
{ |
b53767719 Implement file po... |
2250 |
return cap_task_setnice(p, nice); |
1da177e4c Linux-2.6.12-rc2 |
2251 |
} |
7b41b1733 SELinux: include/... |
2252 |
static inline int security_task_setioprio(struct task_struct *p, int ioprio) |
03e680606 [PATCH] lsm: add ... |
2253 |
{ |
b53767719 Implement file po... |
2254 |
return cap_task_setioprio(p, ioprio); |
03e680606 [PATCH] lsm: add ... |
2255 |
} |
7b41b1733 SELinux: include/... |
2256 |
static inline int security_task_getioprio(struct task_struct *p) |
a1836a42d [PATCH] SELinux: ... |
2257 2258 2259 |
{ return 0; } |
8fd00b4d7 rlimits: security... |
2260 2261 |
static inline int security_task_setrlimit(struct task_struct *p, unsigned int resource, |
7b41b1733 SELinux: include/... |
2262 |
struct rlimit *new_rlim) |
1da177e4c Linux-2.6.12-rc2 |
2263 2264 2265 |
{ return 0; } |
b0ae19811 security: remove ... |
2266 |
static inline int security_task_setscheduler(struct task_struct *p) |
1da177e4c Linux-2.6.12-rc2 |
2267 |
{ |
b0ae19811 security: remove ... |
2268 |
return cap_task_setscheduler(p); |
1da177e4c Linux-2.6.12-rc2 |
2269 |
} |
7b41b1733 SELinux: include/... |
2270 |
static inline int security_task_getscheduler(struct task_struct *p) |
1da177e4c Linux-2.6.12-rc2 |
2271 2272 2273 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2274 |
static inline int security_task_movememory(struct task_struct *p) |
35601547b [PATCH] SELinux: ... |
2275 2276 2277 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2278 2279 2280 |
static inline int security_task_kill(struct task_struct *p, struct siginfo *info, int sig, u32 secid) |
1da177e4c Linux-2.6.12-rc2 |
2281 |
{ |
aedb60a67 file capabilities... |
2282 |
return 0; |
1da177e4c Linux-2.6.12-rc2 |
2283 |
} |
7b41b1733 SELinux: include/... |
2284 |
static inline int security_task_wait(struct task_struct *p) |
1da177e4c Linux-2.6.12-rc2 |
2285 2286 2287 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2288 2289 2290 |
static inline int security_task_prctl(int option, unsigned long arg2, unsigned long arg3, unsigned long arg4, |
d84f4f992 CRED: Inaugurate ... |
2291 |
unsigned long arg5) |
1da177e4c Linux-2.6.12-rc2 |
2292 |
{ |
d84f4f992 CRED: Inaugurate ... |
2293 |
return cap_task_prctl(option, arg2, arg3, arg3, arg5); |
1da177e4c Linux-2.6.12-rc2 |
2294 2295 2296 2297 |
} static inline void security_task_to_inode(struct task_struct *p, struct inode *inode) { } |
7b41b1733 SELinux: include/... |
2298 2299 |
static inline int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag) |
1da177e4c Linux-2.6.12-rc2 |
2300 2301 2302 |
{ return 0; } |
8a076191f LSM: Introduce in... |
2303 2304 2305 2306 |
static inline void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid) { *secid = 0; } |
7b41b1733 SELinux: include/... |
2307 |
static inline int security_msg_msg_alloc(struct msg_msg *msg) |
1da177e4c Linux-2.6.12-rc2 |
2308 2309 2310 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2311 |
static inline void security_msg_msg_free(struct msg_msg *msg) |
1da177e4c Linux-2.6.12-rc2 |
2312 |
{ } |
7b41b1733 SELinux: include/... |
2313 |
static inline int security_msg_queue_alloc(struct msg_queue *msq) |
1da177e4c Linux-2.6.12-rc2 |
2314 2315 2316 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2317 |
static inline void security_msg_queue_free(struct msg_queue *msq) |
1da177e4c Linux-2.6.12-rc2 |
2318 |
{ } |
7b41b1733 SELinux: include/... |
2319 2320 |
static inline int security_msg_queue_associate(struct msg_queue *msq, int msqflg) |
1da177e4c Linux-2.6.12-rc2 |
2321 2322 2323 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2324 |
static inline int security_msg_queue_msgctl(struct msg_queue *msq, int cmd) |
1da177e4c Linux-2.6.12-rc2 |
2325 2326 2327 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2328 2329 |
static inline int security_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg) |
1da177e4c Linux-2.6.12-rc2 |
2330 2331 2332 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2333 2334 2335 2336 |
static inline int security_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg, struct task_struct *target, long type, int mode) |
1da177e4c Linux-2.6.12-rc2 |
2337 2338 2339 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2340 |
static inline int security_shm_alloc(struct shmid_kernel *shp) |
1da177e4c Linux-2.6.12-rc2 |
2341 2342 2343 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2344 |
static inline void security_shm_free(struct shmid_kernel *shp) |
1da177e4c Linux-2.6.12-rc2 |
2345 |
{ } |
7b41b1733 SELinux: include/... |
2346 2347 |
static inline int security_shm_associate(struct shmid_kernel *shp, int shmflg) |
1da177e4c Linux-2.6.12-rc2 |
2348 2349 2350 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2351 |
static inline int security_shm_shmctl(struct shmid_kernel *shp, int cmd) |
1da177e4c Linux-2.6.12-rc2 |
2352 2353 2354 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2355 2356 |
static inline int security_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr, int shmflg) |
1da177e4c Linux-2.6.12-rc2 |
2357 2358 2359 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2360 |
static inline int security_sem_alloc(struct sem_array *sma) |
1da177e4c Linux-2.6.12-rc2 |
2361 2362 2363 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2364 |
static inline void security_sem_free(struct sem_array *sma) |
1da177e4c Linux-2.6.12-rc2 |
2365 |
{ } |
7b41b1733 SELinux: include/... |
2366 |
static inline int security_sem_associate(struct sem_array *sma, int semflg) |
1da177e4c Linux-2.6.12-rc2 |
2367 2368 2369 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2370 |
static inline int security_sem_semctl(struct sem_array *sma, int cmd) |
1da177e4c Linux-2.6.12-rc2 |
2371 2372 2373 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2374 2375 2376 |
static inline int security_sem_semop(struct sem_array *sma, struct sembuf *sops, unsigned nsops, int alter) |
1da177e4c Linux-2.6.12-rc2 |
2377 2378 2379 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2380 |
static inline void security_d_instantiate(struct dentry *dentry, struct inode *inode) |
1da177e4c Linux-2.6.12-rc2 |
2381 |
{ } |
04ff97086 [PATCH] sanitize ... |
2382 |
static inline int security_getprocattr(struct task_struct *p, char *name, char **value) |
1da177e4c Linux-2.6.12-rc2 |
2383 2384 2385 2386 2387 2388 2389 2390 |
{ return -EINVAL; } static inline int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size) { return -EINVAL; } |
7b41b1733 SELinux: include/... |
2391 |
static inline int security_netlink_send(struct sock *sk, struct sk_buff *skb) |
1da177e4c Linux-2.6.12-rc2 |
2392 |
{ |
7b41b1733 SELinux: include/... |
2393 |
return cap_netlink_send(sk, skb); |
1da177e4c Linux-2.6.12-rc2 |
2394 |
} |
7b41b1733 SELinux: include/... |
2395 |
static inline int security_netlink_recv(struct sk_buff *skb, int cap) |
1da177e4c Linux-2.6.12-rc2 |
2396 |
{ |
7b41b1733 SELinux: include/... |
2397 |
return cap_netlink_recv(skb, cap); |
1da177e4c Linux-2.6.12-rc2 |
2398 |
} |
dc49c1f94 [AF_UNIX]: Kernel... |
2399 2400 2401 2402 |
static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) { return -EOPNOTSUPP; } |
7bf570dc8 Security: Make se... |
2403 |
static inline int security_secctx_to_secid(const char *secdata, |
63cb34492 security: add a s... |
2404 2405 2406 2407 2408 |
u32 seclen, u32 *secid) { return -EOPNOTSUPP; } |
dc49c1f94 [AF_UNIX]: Kernel... |
2409 2410 |
static inline void security_release_secctx(char *secdata, u32 seclen) { |
dc49c1f94 [AF_UNIX]: Kernel... |
2411 |
} |
1ee65e37e LSM/SELinux: inod... |
2412 2413 2414 2415 2416 2417 2418 2419 2420 2421 2422 2423 2424 |
static inline int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen) { return -EOPNOTSUPP; } static inline int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen) { return -EOPNOTSUPP; } static inline int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen) { return -EOPNOTSUPP; } |
1da177e4c Linux-2.6.12-rc2 |
2425 2426 2427 |
#endif /* CONFIG_SECURITY */ #ifdef CONFIG_SECURITY_NETWORK |
4237c75c0 [MLSXFRM]: Auto-l... |
2428 |
|
3610cda53 af_unix: Avoid so... |
2429 |
int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk); |
20510f2f4 security: Convert... |
2430 2431 2432 2433 2434 2435 2436 2437 |
int security_unix_may_send(struct socket *sock, struct socket *other); int security_socket_create(int family, int type, int protocol, int kern); int security_socket_post_create(struct socket *sock, int family, int type, int protocol, int kern); int security_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen); int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen); int security_socket_listen(struct socket *sock, int backlog); int security_socket_accept(struct socket *sock, struct socket *newsock); |
20510f2f4 security: Convert... |
2438 2439 2440 2441 2442 2443 2444 2445 2446 2447 2448 2449 2450 2451 2452 2453 2454 2455 2456 2457 2458 2459 2460 2461 |
int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size); int security_socket_recvmsg(struct socket *sock, struct msghdr *msg, int size, int flags); int security_socket_getsockname(struct socket *sock); int security_socket_getpeername(struct socket *sock); int security_socket_getsockopt(struct socket *sock, int level, int optname); int security_socket_setsockopt(struct socket *sock, int level, int optname); int security_socket_shutdown(struct socket *sock, int how); int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb); int security_socket_getpeersec_stream(struct socket *sock, char __user *optval, int __user *optlen, unsigned len); int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid); int security_sk_alloc(struct sock *sk, int family, gfp_t priority); void security_sk_free(struct sock *sk); void security_sk_clone(const struct sock *sk, struct sock *newsk); void security_sk_classify_flow(struct sock *sk, struct flowi *fl); void security_req_classify_flow(const struct request_sock *req, struct flowi *fl); void security_sock_graft(struct sock*sk, struct socket *parent); int security_inet_conn_request(struct sock *sk, struct sk_buff *skb, struct request_sock *req); void security_inet_csk_clone(struct sock *newsk, const struct request_sock *req); void security_inet_conn_established(struct sock *sk, struct sk_buff *skb); |
2606fd1fa secmark: make sec... |
2462 2463 2464 |
int security_secmark_relabel_packet(u32 secid); void security_secmark_refcount_inc(void); void security_secmark_refcount_dec(void); |
2b980dbd7 lsm: Add hooks to... |
2465 2466 2467 |
int security_tun_dev_create(void); void security_tun_dev_post_create(struct sock *sk); int security_tun_dev_attach(struct sock *sk); |
6b877699c SELinux: Return c... |
2468 |
|
1da177e4c Linux-2.6.12-rc2 |
2469 |
#else /* CONFIG_SECURITY_NETWORK */ |
3610cda53 af_unix: Avoid so... |
2470 2471 |
static inline int security_unix_stream_connect(struct sock *sock, struct sock *other, |
7b41b1733 SELinux: include/... |
2472 |
struct sock *newsk) |
1da177e4c Linux-2.6.12-rc2 |
2473 2474 2475 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2476 2477 |
static inline int security_unix_may_send(struct socket *sock, struct socket *other) |
1da177e4c Linux-2.6.12-rc2 |
2478 2479 2480 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2481 2482 |
static inline int security_socket_create(int family, int type, int protocol, int kern) |
1da177e4c Linux-2.6.12-rc2 |
2483 2484 2485 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2486 |
static inline int security_socket_post_create(struct socket *sock, |
7420ed23a [NetLabel]: SELin... |
2487 2488 2489 |
int family, int type, int protocol, int kern) |
1da177e4c Linux-2.6.12-rc2 |
2490 |
{ |
7420ed23a [NetLabel]: SELin... |
2491 |
return 0; |
1da177e4c Linux-2.6.12-rc2 |
2492 |
} |
7b41b1733 SELinux: include/... |
2493 2494 |
static inline int security_socket_bind(struct socket *sock, struct sockaddr *address, |
1da177e4c Linux-2.6.12-rc2 |
2495 2496 2497 2498 |
int addrlen) { return 0; } |
7b41b1733 SELinux: include/... |
2499 2500 |
static inline int security_socket_connect(struct socket *sock, struct sockaddr *address, |
1da177e4c Linux-2.6.12-rc2 |
2501 2502 2503 2504 |
int addrlen) { return 0; } |
7b41b1733 SELinux: include/... |
2505 |
static inline int security_socket_listen(struct socket *sock, int backlog) |
1da177e4c Linux-2.6.12-rc2 |
2506 2507 2508 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2509 2510 |
static inline int security_socket_accept(struct socket *sock, struct socket *newsock) |
1da177e4c Linux-2.6.12-rc2 |
2511 2512 2513 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2514 2515 |
static inline int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size) |
1da177e4c Linux-2.6.12-rc2 |
2516 2517 2518 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2519 2520 |
static inline int security_socket_recvmsg(struct socket *sock, struct msghdr *msg, int size, |
1da177e4c Linux-2.6.12-rc2 |
2521 2522 2523 2524 |
int flags) { return 0; } |
7b41b1733 SELinux: include/... |
2525 |
static inline int security_socket_getsockname(struct socket *sock) |
1da177e4c Linux-2.6.12-rc2 |
2526 2527 2528 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2529 |
static inline int security_socket_getpeername(struct socket *sock) |
1da177e4c Linux-2.6.12-rc2 |
2530 2531 2532 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2533 |
static inline int security_socket_getsockopt(struct socket *sock, |
1da177e4c Linux-2.6.12-rc2 |
2534 2535 2536 2537 |
int level, int optname) { return 0; } |
7b41b1733 SELinux: include/... |
2538 |
static inline int security_socket_setsockopt(struct socket *sock, |
1da177e4c Linux-2.6.12-rc2 |
2539 2540 2541 2542 |
int level, int optname) { return 0; } |
7b41b1733 SELinux: include/... |
2543 |
static inline int security_socket_shutdown(struct socket *sock, int how) |
1da177e4c Linux-2.6.12-rc2 |
2544 2545 2546 |
{ return 0; } |
7b41b1733 SELinux: include/... |
2547 2548 |
static inline int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) |
1da177e4c Linux-2.6.12-rc2 |
2549 2550 2551 |
{ return 0; } |
2c7946a7b [SECURITY]: TCP/U... |
2552 2553 2554 2555 2556 |
static inline int security_socket_getpeersec_stream(struct socket *sock, char __user *optval, int __user *optlen, unsigned len) { return -ENOPROTOOPT; } |
dc49c1f94 [AF_UNIX]: Kernel... |
2557 |
static inline int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid) |
1da177e4c Linux-2.6.12-rc2 |
2558 2559 2560 |
{ return -ENOPROTOOPT; } |
dd0fc66fb [PATCH] gfp flags... |
2561 |
static inline int security_sk_alloc(struct sock *sk, int family, gfp_t priority) |
1da177e4c Linux-2.6.12-rc2 |
2562 2563 2564 2565 2566 |
{ return 0; } static inline void security_sk_free(struct sock *sk) |
892c141e6 [MLSXFRM]: Add se... |
2567 2568 2569 2570 |
{ } static inline void security_sk_clone(const struct sock *sk, struct sock *newsk) |
1da177e4c Linux-2.6.12-rc2 |
2571 2572 |
{ } |
df71837d5 [LSM-IPSec]: Secu... |
2573 |
|
beb8d13be [MLSXFRM]: Add fl... |
2574 |
static inline void security_sk_classify_flow(struct sock *sk, struct flowi *fl) |
df71837d5 [LSM-IPSec]: Secu... |
2575 |
{ |
df71837d5 [LSM-IPSec]: Secu... |
2576 |
} |
4237c75c0 [MLSXFRM]: Auto-l... |
2577 2578 2579 2580 |
static inline void security_req_classify_flow(const struct request_sock *req, struct flowi *fl) { } |
7b41b1733 SELinux: include/... |
2581 |
static inline void security_sock_graft(struct sock *sk, struct socket *parent) |
4237c75c0 [MLSXFRM]: Auto-l... |
2582 2583 2584 2585 2586 2587 2588 2589 2590 2591 2592 2593 2594 |
{ } static inline int security_inet_conn_request(struct sock *sk, struct sk_buff *skb, struct request_sock *req) { return 0; } static inline void security_inet_csk_clone(struct sock *newsk, const struct request_sock *req) { } |
6b877699c SELinux: Return c... |
2595 2596 2597 2598 2599 |
static inline void security_inet_conn_established(struct sock *sk, struct sk_buff *skb) { } |
2b980dbd7 lsm: Add hooks to... |
2600 |
|
2606fd1fa secmark: make sec... |
2601 2602 2603 2604 2605 2606 2607 2608 2609 2610 2611 2612 |
static inline int security_secmark_relabel_packet(u32 secid) { return 0; } static inline void security_secmark_refcount_inc(void) { } static inline void security_secmark_refcount_dec(void) { } |
2b980dbd7 lsm: Add hooks to... |
2613 2614 2615 2616 2617 2618 2619 2620 2621 2622 2623 2624 2625 |
static inline int security_tun_dev_create(void) { return 0; } static inline void security_tun_dev_post_create(struct sock *sk) { } static inline int security_tun_dev_attach(struct sock *sk) { return 0; } |
1da177e4c Linux-2.6.12-rc2 |
2626 |
#endif /* CONFIG_SECURITY_NETWORK */ |
df71837d5 [LSM-IPSec]: Secu... |
2627 |
#ifdef CONFIG_SECURITY_NETWORK_XFRM |
beb8d13be [MLSXFRM]: Add fl... |
2628 |
|
03e1ad7b5 LSM: Make the Lab... |
2629 2630 2631 2632 |
int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *sec_ctx); int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctxp); void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx); int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx); |
20510f2f4 security: Convert... |
2633 2634 2635 2636 2637 |
int security_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx); int security_xfrm_state_alloc_acquire(struct xfrm_state *x, struct xfrm_sec_ctx *polsec, u32 secid); int security_xfrm_state_delete(struct xfrm_state *x); void security_xfrm_state_free(struct xfrm_state *x); |
03e1ad7b5 LSM: Make the Lab... |
2638 |
int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir); |
20510f2f4 security: Convert... |
2639 |
int security_xfrm_state_pol_flow_match(struct xfrm_state *x, |
e33f77042 xfrm: Mark flowi ... |
2640 2641 |
struct xfrm_policy *xp, const struct flowi *fl); |
20510f2f4 security: Convert... |
2642 2643 |
int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid); void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl); |
beb8d13be [MLSXFRM]: Add fl... |
2644 |
|
df71837d5 [LSM-IPSec]: Secu... |
2645 |
#else /* CONFIG_SECURITY_NETWORK_XFRM */ |
20510f2f4 security: Convert... |
2646 |
|
03e1ad7b5 LSM: Make the Lab... |
2647 |
static inline int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *sec_ctx) |
df71837d5 [LSM-IPSec]: Secu... |
2648 2649 2650 |
{ return 0; } |
03e1ad7b5 LSM: Make the Lab... |
2651 |
static inline int security_xfrm_policy_clone(struct xfrm_sec_ctx *old, struct xfrm_sec_ctx **new_ctxp) |
df71837d5 [LSM-IPSec]: Secu... |
2652 2653 2654 |
{ return 0; } |
03e1ad7b5 LSM: Make the Lab... |
2655 |
static inline void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx) |
df71837d5 [LSM-IPSec]: Secu... |
2656 2657 |
{ } |
03e1ad7b5 LSM: Make the Lab... |
2658 |
static inline int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx) |
c8c05a8ee [LSM-IPsec]: SELi... |
2659 2660 2661 |
{ return 0; } |
e0d1caa7b [MLSXFRM]: Flow b... |
2662 2663 2664 2665 2666 2667 2668 2669 |
static inline int security_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx) { return 0; } static inline int security_xfrm_state_alloc_acquire(struct xfrm_state *x, struct xfrm_sec_ctx *polsec, u32 secid) |
df71837d5 [LSM-IPSec]: Secu... |
2670 2671 2672 2673 2674 2675 2676 |
{ return 0; } static inline void security_xfrm_state_free(struct xfrm_state *x) { } |
6f68dc377 [NET]: Fix warnin... |
2677 |
static inline int security_xfrm_state_delete(struct xfrm_state *x) |
c8c05a8ee [LSM-IPsec]: SELi... |
2678 2679 2680 |
{ return 0; } |
03e1ad7b5 LSM: Make the Lab... |
2681 |
static inline int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir) |
df71837d5 [LSM-IPSec]: Secu... |
2682 2683 2684 |
{ return 0; } |
e0d1caa7b [MLSXFRM]: Flow b... |
2685 2686 |
static inline int security_xfrm_state_pol_flow_match(struct xfrm_state *x, |
e33f77042 xfrm: Mark flowi ... |
2687 |
struct xfrm_policy *xp, const struct flowi *fl) |
e0d1caa7b [MLSXFRM]: Flow b... |
2688 2689 2690 |
{ return 1; } |
beb8d13be [MLSXFRM]: Add fl... |
2691 |
static inline int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid) |
e0d1caa7b [MLSXFRM]: Flow b... |
2692 2693 2694 |
{ return 0; } |
beb8d13be [MLSXFRM]: Add fl... |
2695 2696 2697 |
static inline void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl) { } |
df71837d5 [LSM-IPSec]: Secu... |
2698 |
#endif /* CONFIG_SECURITY_NETWORK_XFRM */ |
be6d3e56a introduce new LSM... |
2699 2700 2701 2702 2703 2704 |
#ifdef CONFIG_SECURITY_PATH int security_path_unlink(struct path *dir, struct dentry *dentry); int security_path_mkdir(struct path *dir, struct dentry *dentry, int mode); int security_path_rmdir(struct path *dir, struct dentry *dentry); int security_path_mknod(struct path *dir, struct dentry *dentry, int mode, unsigned int dev); |
ea0d3ab23 LSM: Remove unuse... |
2705 |
int security_path_truncate(struct path *path); |
be6d3e56a introduce new LSM... |
2706 2707 2708 2709 2710 2711 |
int security_path_symlink(struct path *dir, struct dentry *dentry, const char *old_name); int security_path_link(struct dentry *old_dentry, struct path *new_dir, struct dentry *new_dentry); int security_path_rename(struct path *old_dir, struct dentry *old_dentry, struct path *new_dir, struct dentry *new_dentry); |
89eda0683 LSM: Add security... |
2712 2713 2714 |
int security_path_chmod(struct dentry *dentry, struct vfsmount *mnt, mode_t mode); int security_path_chown(struct path *path, uid_t uid, gid_t gid); |
8b8efb440 LSM: Add security... |
2715 |
int security_path_chroot(struct path *path); |
be6d3e56a introduce new LSM... |
2716 2717 2718 2719 2720 2721 2722 2723 2724 2725 2726 2727 2728 2729 2730 2731 2732 2733 2734 2735 2736 2737 |
#else /* CONFIG_SECURITY_PATH */ static inline int security_path_unlink(struct path *dir, struct dentry *dentry) { return 0; } static inline int security_path_mkdir(struct path *dir, struct dentry *dentry, int mode) { return 0; } static inline int security_path_rmdir(struct path *dir, struct dentry *dentry) { return 0; } static inline int security_path_mknod(struct path *dir, struct dentry *dentry, int mode, unsigned int dev) { return 0; } |
ea0d3ab23 LSM: Remove unuse... |
2738 |
static inline int security_path_truncate(struct path *path) |
be6d3e56a introduce new LSM... |
2739 2740 2741 2742 2743 2744 2745 2746 2747 2748 2749 2750 2751 2752 2753 2754 2755 2756 2757 2758 2759 2760 2761 2762 |
{ return 0; } static inline int security_path_symlink(struct path *dir, struct dentry *dentry, const char *old_name) { return 0; } static inline int security_path_link(struct dentry *old_dentry, struct path *new_dir, struct dentry *new_dentry) { return 0; } static inline int security_path_rename(struct path *old_dir, struct dentry *old_dentry, struct path *new_dir, struct dentry *new_dentry) { return 0; } |
89eda0683 LSM: Add security... |
2763 2764 2765 2766 2767 2768 2769 2770 2771 2772 2773 2774 |
static inline int security_path_chmod(struct dentry *dentry, struct vfsmount *mnt, mode_t mode) { return 0; } static inline int security_path_chown(struct path *path, uid_t uid, gid_t gid) { return 0; } |
8b8efb440 LSM: Add security... |
2775 2776 2777 2778 2779 |
static inline int security_path_chroot(struct path *path) { return 0; } |
be6d3e56a introduce new LSM... |
2780 |
#endif /* CONFIG_SECURITY_PATH */ |
29db91906 [PATCH] Keys: Add... |
2781 2782 |
#ifdef CONFIG_KEYS #ifdef CONFIG_SECURITY |
29db91906 [PATCH] Keys: Add... |
2783 |
|
d84f4f992 CRED: Inaugurate ... |
2784 |
int security_key_alloc(struct key *key, const struct cred *cred, unsigned long flags); |
20510f2f4 security: Convert... |
2785 2786 |
void security_key_free(struct key *key); int security_key_permission(key_ref_t key_ref, |
d84f4f992 CRED: Inaugurate ... |
2787 |
const struct cred *cred, key_perm_t perm); |
70a5bb72b keys: add keyctl ... |
2788 |
int security_key_getsecurity(struct key *key, char **_buffer); |
29db91906 [PATCH] Keys: Add... |
2789 2790 |
#else |
d720024e9 [PATCH] selinux: ... |
2791 |
static inline int security_key_alloc(struct key *key, |
d84f4f992 CRED: Inaugurate ... |
2792 |
const struct cred *cred, |
7e047ef5f [PATCH] keys: sor... |
2793 |
unsigned long flags) |
29db91906 [PATCH] Keys: Add... |
2794 2795 2796 2797 2798 2799 2800 2801 2802 |
{ return 0; } static inline void security_key_free(struct key *key) { } static inline int security_key_permission(key_ref_t key_ref, |
d84f4f992 CRED: Inaugurate ... |
2803 |
const struct cred *cred, |
29db91906 [PATCH] Keys: Add... |
2804 2805 2806 2807 |
key_perm_t perm) { return 0; } |
70a5bb72b keys: add keyctl ... |
2808 2809 2810 2811 |
static inline int security_key_getsecurity(struct key *key, char **_buffer) { *_buffer = NULL; return 0; |
be1d6a5f5 KEYS: Fix default... |
2812 |
} |
ee18d64c1 KEYS: Add a keyct... |
2813 |
|
29db91906 [PATCH] Keys: Add... |
2814 2815 |
#endif #endif /* CONFIG_KEYS */ |
03d37d25e LSM/Audit: Introd... |
2816 2817 2818 2819 2820 2821 2822 2823 2824 2825 2826 2827 2828 2829 2830 2831 2832 2833 2834 2835 2836 2837 2838 2839 2840 2841 2842 2843 2844 2845 2846 2847 |
#ifdef CONFIG_AUDIT #ifdef CONFIG_SECURITY int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule); int security_audit_rule_known(struct audit_krule *krule); int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule, struct audit_context *actx); void security_audit_rule_free(void *lsmrule); #else static inline int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule) { return 0; } static inline int security_audit_rule_known(struct audit_krule *krule) { return 0; } static inline int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule, struct audit_context *actx) { return 0; } static inline void security_audit_rule_free(void *lsmrule) { } #endif /* CONFIG_SECURITY */ #endif /* CONFIG_AUDIT */ |
da31894ed securityfs: do no... |
2848 2849 2850 2851 2852 2853 2854 2855 2856 2857 2858 2859 2860 2861 2862 2863 2864 2865 2866 2867 2868 2869 2870 2871 2872 2873 2874 2875 2876 |
#ifdef CONFIG_SECURITYFS extern struct dentry *securityfs_create_file(const char *name, mode_t mode, struct dentry *parent, void *data, const struct file_operations *fops); extern struct dentry *securityfs_create_dir(const char *name, struct dentry *parent); extern void securityfs_remove(struct dentry *dentry); #else /* CONFIG_SECURITYFS */ static inline struct dentry *securityfs_create_dir(const char *name, struct dentry *parent) { return ERR_PTR(-ENODEV); } static inline struct dentry *securityfs_create_file(const char *name, mode_t mode, struct dentry *parent, void *data, const struct file_operations *fops) { return ERR_PTR(-ENODEV); } static inline void securityfs_remove(struct dentry *dentry) {} #endif |
3d544f411 kmemtrace, fs, se... |
2877 2878 2879 2880 2881 2882 2883 2884 2885 2886 2887 2888 2889 2890 2891 2892 2893 2894 2895 2896 2897 2898 |
#ifdef CONFIG_SECURITY static inline char *alloc_secdata(void) { return (char *)get_zeroed_page(GFP_KERNEL); } static inline void free_secdata(void *secdata) { free_page((unsigned long)secdata); } #else static inline char *alloc_secdata(void) { return (char *)1; } static inline void free_secdata(void *secdata) { } #endif /* CONFIG_SECURITY */ |
1da177e4c Linux-2.6.12-rc2 |
2899 |
#endif /* ! __LINUX_SECURITY_H */ |