1 /* 2 * Linux Security Module interfaces 3 * 4 * Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com> 5 * Copyright (C) 2001 Greg Kroah-Hartman <greg@kroah.com> 6 * Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com> 7 * Copyright (C) 2001 James Morris <jmorris@intercode.com.au> 8 * Copyright (C) 2001 Silicon Graphics, Inc. (Trust Technology Group) 9 * Copyright (C) 2015 Intel Corporation. 10 * Copyright (C) 2015 Casey Schaufler <casey@schaufler-ca.com> 11 * Copyright (C) 2016 Mellanox Techonologies 12 * 13 * This program is free software; you can redistribute it and/or modify 14 * it under the terms of the GNU General Public License as published by 15 * the Free Software Foundation; either version 2 of the License, or 16 * (at your option) any later version. 17 * 18 * Due to this file being licensed under the GPL there is controversy over 19 * whether this permits you to write a module that #includes this file 20 * without placing your module under the GPL. Please consult a lawyer for 21 * advice before doing this. 22 * 23 */ 24 25 #ifndef __LINUX_LSM_HOOKS_H 26 #define __LINUX_LSM_HOOKS_H 27 28 #include <linux/security.h> 29 #include <linux/init.h> 30 #include <linux/rculist.h> 31 32 /** 33 * union security_list_options - Linux Security Module hook function list 34 * 35 * Security hooks for program execution operations. 36 * 37 * @bprm_creds_for_exec: 38 * If the setup in prepare_exec_creds did not setup @bprm->cred->security 39 * properly for executing @bprm->file, update the LSM's portion of 40 * @bprm->cred->security to be what commit_creds needs to install for the 41 * new program. This hook may also optionally check permissions 42 * (e.g. for transitions between security domains). 43 * The hook must set @bprm->secureexec to 1 if AT_SECURE should be set to 44 * request libc enable secure mode. 45 * @bprm contains the linux_binprm structure. 46 * Return 0 if the hook is successful and permission is granted. 47 * @bprm_creds_from_file: 48 * If @file is setpcap, suid, sgid or otherwise marked to change 49 * privilege upon exec, update @bprm->cred to reflect that change. 50 * This is called after finding the binary that will be executed. 51 * without an interpreter. This ensures that the credentials will not 52 * be derived from a script that the binary will need to reopen, which 53 * when reopend may end up being a completely different file. This 54 * hook may also optionally check permissions (e.g. for transitions 55 * between security domains). 56 * The hook must set @bprm->secureexec to 1 if AT_SECURE should be set to 57 * request libc enable secure mode. 58 * The hook must add to @bprm->per_clear any personality flags that 59 * should be cleared from current->personality. 60 * @bprm contains the linux_binprm structure. 61 * Return 0 if the hook is successful and permission is granted. 62 * @bprm_check_security: 63 * This hook mediates the point when a search for a binary handler will 64 * begin. It allows a check against the @bprm->cred->security value 65 * which was set in the preceding creds_for_exec call. The argv list and 66 * envp list are reliably available in @bprm. This hook may be called 67 * multiple times during a single execve. 68 * @bprm contains the linux_binprm structure. 69 * Return 0 if the hook is successful and permission is granted. 70 * @bprm_committing_creds: 71 * Prepare to install the new security attributes of a process being 72 * transformed by an execve operation, based on the old credentials 73 * pointed to by @current->cred and the information set in @bprm->cred by 74 * the bprm_creds_for_exec hook. @bprm points to the linux_binprm 75 * structure. This hook is a good place to perform state changes on the 76 * process such as closing open file descriptors to which access will no 77 * longer be granted when the attributes are changed. This is called 78 * immediately before commit_creds(). 79 * @bprm_committed_creds: 80 * Tidy up after the installation of the new security attributes of a 81 * process being transformed by an execve operation. The new credentials 82 * have, by this point, been set to @current->cred. @bprm points to the 83 * linux_binprm structure. This hook is a good place to perform state 84 * changes on the process such as clearing out non-inheritable signal 85 * state. This is called immediately after commit_creds(). 86 * 87 * Security hooks for mount using fs_context. 88 * [See also Documentation/filesystems/mount_api.rst] 89 * 90 * @fs_context_dup: 91 * Allocate and attach a security structure to sc->security. This pointer 92 * is initialised to NULL by the caller. 93 * @fc indicates the new filesystem context. 94 * @src_fc indicates the original filesystem context. 95 * @fs_context_parse_param: 96 * Userspace provided a parameter to configure a superblock. The LSM may 97 * reject it with an error and may use it for itself, in which case it 98 * should return 0; otherwise it should return -ENOPARAM to pass it on to 99 * the filesystem. 100 * @fc indicates the filesystem context. 101 * @param The parameter 102 * 103 * Security hooks for filesystem operations. 104 * 105 * @sb_alloc_security: 106 * Allocate and attach a security structure to the sb->s_security field. 107 * The s_security field is initialized to NULL when the structure is 108 * allocated. 109 * @sb contains the super_block structure to be modified. 110 * Return 0 if operation was successful. 111 * @sb_free_security: 112 * Deallocate and clear the sb->s_security field. 113 * @sb contains the super_block structure to be modified. 114 * @sb_free_mnt_opts: 115 * Free memory associated with @mnt_ops. 116 * @sb_eat_lsm_opts: 117 * Eat (scan @orig options) and save them in @mnt_opts. 118 * @sb_statfs: 119 * Check permission before obtaining filesystem statistics for the @mnt 120 * mountpoint. 121 * @dentry is a handle on the superblock for the filesystem. 122 * Return 0 if permission is granted. 123 * @sb_mount: 124 * Check permission before an object specified by @dev_name is mounted on 125 * the mount point named by @nd. For an ordinary mount, @dev_name 126 * identifies a device if the file system type requires a device. For a 127 * remount (@flags & MS_REMOUNT), @dev_name is irrelevant. For a 128 * loopback/bind mount (@flags & MS_BIND), @dev_name identifies the 129 * pathname of the object being mounted. 130 * @dev_name contains the name for object being mounted. 131 * @path contains the path for mount point object. 132 * @type contains the filesystem type. 133 * @flags contains the mount flags. 134 * @data contains the filesystem-specific data. 135 * Return 0 if permission is granted. 136 * @sb_copy_data: 137 * Allow mount option data to be copied prior to parsing by the filesystem, 138 * so that the security module can extract security-specific mount 139 * options cleanly (a filesystem may modify the data e.g. with strsep()). 140 * This also allows the original mount data to be stripped of security- 141 * specific options to avoid having to make filesystems aware of them. 142 * @orig the original mount data copied from userspace. 143 * @copy copied data which will be passed to the security module. 144 * Returns 0 if the copy was successful. 145 * @sb_remount: 146 * Extracts security system specific mount options and verifies no changes 147 * are being made to those options. 148 * @sb superblock being remounted 149 * @data contains the filesystem-specific data. 150 * Return 0 if permission is granted. 151 * @sb_kern_mount: 152 * Mount this @sb if allowed by permissions. 153 * @sb_show_options: 154 * Show (print on @m) mount options for this @sb. 155 * @sb_umount: 156 * Check permission before the @mnt file system is unmounted. 157 * @mnt contains the mounted file system. 158 * @flags contains the unmount flags, e.g. MNT_FORCE. 159 * Return 0 if permission is granted. 160 * @sb_pivotroot: 161 * Check permission before pivoting the root filesystem. 162 * @old_path contains the path for the new location of the 163 * current root (put_old). 164 * @new_path contains the path for the new root (new_root). 165 * Return 0 if permission is granted. 166 * @sb_set_mnt_opts: 167 * Set the security relevant mount options used for a superblock 168 * @sb the superblock to set security mount options for 169 * @opts binary data structure containing all lsm mount data 170 * @sb_clone_mnt_opts: 171 * Copy all security options from a given superblock to another 172 * @oldsb old superblock which contain information to clone 173 * @newsb new superblock which needs filled in 174 * @sb_add_mnt_opt: 175 * Add one mount @option to @mnt_opts. 176 * @sb_parse_opts_str: 177 * Parse a string of security data filling in the opts structure 178 * @options string containing all mount options known by the LSM 179 * @opts binary data structure usable by the LSM 180 * @move_mount: 181 * Check permission before a mount is moved. 182 * @from_path indicates the mount that is going to be moved. 183 * @to_path indicates the mountpoint that will be mounted upon. 184 * @dentry_init_security: 185 * Compute a context for a dentry as the inode is not yet available 186 * since NFSv4 has no label backed by an EA anyway. 187 * @dentry dentry to use in calculating the context. 188 * @mode mode used to determine resource type. 189 * @name name of the last path component used to create file 190 * @ctx pointer to place the pointer to the resulting context in. 191 * @ctxlen point to place the length of the resulting context. 192 * @dentry_create_files_as: 193 * Compute a context for a dentry as the inode is not yet available 194 * and set that context in passed in creds so that new files are 195 * created using that context. Context is calculated using the 196 * passed in creds and not the creds of the caller. 197 * @dentry dentry to use in calculating the context. 198 * @mode mode used to determine resource type. 199 * @name name of the last path component used to create file 200 * @old creds which should be used for context calculation 201 * @new creds to modify 202 * 203 * 204 * Security hooks for inode operations. 205 * 206 * @inode_alloc_security: 207 * Allocate and attach a security structure to @inode->i_security. The 208 * i_security field is initialized to NULL when the inode structure is 209 * allocated. 210 * @inode contains the inode structure. 211 * Return 0 if operation was successful. 212 * @inode_free_security: 213 * @inode contains the inode structure. 214 * Deallocate the inode security structure and set @inode->i_security to 215 * NULL. 216 * @inode_init_security: 217 * Obtain the security attribute name suffix and value to set on a newly 218 * created inode and set up the incore security field for the new inode. 219 * This hook is called by the fs code as part of the inode creation 220 * transaction and provides for atomic labeling of the inode, unlike 221 * the post_create/mkdir/... hooks called by the VFS. The hook function 222 * is expected to allocate the name and value via kmalloc, with the caller 223 * being responsible for calling kfree after using them. 224 * If the security module does not use security attributes or does 225 * not wish to put a security attribute on this particular inode, 226 * then it should return -EOPNOTSUPP to skip this processing. 227 * @inode contains the inode structure of the newly created inode. 228 * @dir contains the inode structure of the parent directory. 229 * @qstr contains the last path component of the new object 230 * @name will be set to the allocated name suffix (e.g. selinux). 231 * @value will be set to the allocated attribute value. 232 * @len will be set to the length of the value. 233 * Returns 0 if @name and @value have been successfully set, 234 * -EOPNOTSUPP if no security attribute is needed, or 235 * -ENOMEM on memory allocation failure. 236 * @inode_init_security_anon: 237 * Set up the incore security field for the new anonymous inode 238 * and return whether the inode creation is permitted by the security 239 * module or not. 240 * @inode contains the inode structure 241 * @name name of the anonymous inode class 242 * @context_inode optional related inode 243 * Returns 0 on success, -EACCES if the security module denies the 244 * creation of this inode, or another -errno upon other errors. 245 * @inode_create: 246 * Check permission to create a regular file. 247 * @dir contains inode structure of the parent of the new file. 248 * @dentry contains the dentry structure for the file to be created. 249 * @mode contains the file mode of the file to be created. 250 * Return 0 if permission is granted. 251 * @inode_link: 252 * Check permission before creating a new hard link to a file. 253 * @old_dentry contains the dentry structure for an existing 254 * link to the file. 255 * @dir contains the inode structure of the parent directory 256 * of the new link. 257 * @new_dentry contains the dentry structure for the new link. 258 * Return 0 if permission is granted. 259 * @path_link: 260 * Check permission before creating a new hard link to a file. 261 * @old_dentry contains the dentry structure for an existing link 262 * to the file. 263 * @new_dir contains the path structure of the parent directory of 264 * the new link. 265 * @new_dentry contains the dentry structure for the new link. 266 * Return 0 if permission is granted. 267 * @inode_unlink: 268 * Check the permission to remove a hard link to a file. 269 * @dir contains the inode structure of parent directory of the file. 270 * @dentry contains the dentry structure for file to be unlinked. 271 * Return 0 if permission is granted. 272 * @path_unlink: 273 * Check the permission to remove a hard link to a file. 274 * @dir contains the path structure of parent directory of the file. 275 * @dentry contains the dentry structure for file to be unlinked. 276 * Return 0 if permission is granted. 277 * @inode_symlink: 278 * Check the permission to create a symbolic link to a file. 279 * @dir contains the inode structure of parent directory of 280 * the symbolic link. 281 * @dentry contains the dentry structure of the symbolic link. 282 * @old_name contains the pathname of file. 283 * Return 0 if permission is granted. 284 * @path_symlink: 285 * Check the permission to create a symbolic link to a file. 286 * @dir contains the path structure of parent directory of 287 * the symbolic link. 288 * @dentry contains the dentry structure of the symbolic link. 289 * @old_name contains the pathname of file. 290 * Return 0 if permission is granted. 291 * @inode_mkdir: 292 * Check permissions to create a new directory in the existing directory 293 * associated with inode structure @dir. 294 * @dir contains the inode structure of parent of the directory 295 * to be created. 296 * @dentry contains the dentry structure of new directory. 297 * @mode contains the mode of new directory. 298 * Return 0 if permission is granted. 299 * @path_mkdir: 300 * Check permissions to create a new directory in the existing directory 301 * associated with path structure @path. 302 * @dir contains the path structure of parent of the directory 303 * to be created. 304 * @dentry contains the dentry structure of new directory. 305 * @mode contains the mode of new directory. 306 * Return 0 if permission is granted. 307 * @inode_rmdir: 308 * Check the permission to remove a directory. 309 * @dir contains the inode structure of parent of the directory 310 * to be removed. 311 * @dentry contains the dentry structure of directory to be removed. 312 * Return 0 if permission is granted. 313 * @path_rmdir: 314 * Check the permission to remove a directory. 315 * @dir contains the path structure of parent of the directory to be 316 * removed. 317 * @dentry contains the dentry structure of directory to be removed. 318 * Return 0 if permission is granted. 319 * @inode_mknod: 320 * Check permissions when creating a special file (or a socket or a fifo 321 * file created via the mknod system call). Note that if mknod operation 322 * is being done for a regular file, then the create hook will be called 323 * and not this hook. 324 * @dir contains the inode structure of parent of the new file. 325 * @dentry contains the dentry structure of the new file. 326 * @mode contains the mode of the new file. 327 * @dev contains the device number. 328 * Return 0 if permission is granted. 329 * @path_mknod: 330 * Check permissions when creating a file. Note that this hook is called 331 * even if mknod operation is being done for a regular file. 332 * @dir contains the path structure of parent of the new file. 333 * @dentry contains the dentry structure of the new file. 334 * @mode contains the mode of the new file. 335 * @dev contains the undecoded device number. Use new_decode_dev() to get 336 * the decoded device number. 337 * Return 0 if permission is granted. 338 * @inode_rename: 339 * Check for permission to rename a file or directory. 340 * @old_dir contains the inode structure for parent of the old link. 341 * @old_dentry contains the dentry structure of the old link. 342 * @new_dir contains the inode structure for parent of the new link. 343 * @new_dentry contains the dentry structure of the new link. 344 * Return 0 if permission is granted. 345 * @path_rename: 346 * Check for permission to rename a file or directory. 347 * @old_dir contains the path structure for parent of the old link. 348 * @old_dentry contains the dentry structure of the old link. 349 * @new_dir contains the path structure for parent of the new link. 350 * @new_dentry contains the dentry structure of the new link. 351 * Return 0 if permission is granted. 352 * @path_chmod: 353 * Check for permission to change a mode of the file @path. The new 354 * mode is specified in @mode. 355 * @path contains the path structure of the file to change the mode. 356 * @mode contains the new DAC's permission, which is a bitmask of 357 * constants from <include/uapi/linux/stat.h> 358 * Return 0 if permission is granted. 359 * @path_chown: 360 * Check for permission to change owner/group of a file or directory. 361 * @path contains the path structure. 362 * @uid contains new owner's ID. 363 * @gid contains new group's ID. 364 * Return 0 if permission is granted. 365 * @path_chroot: 366 * Check for permission to change root directory. 367 * @path contains the path structure. 368 * Return 0 if permission is granted. 369 * @path_notify: 370 * Check permissions before setting a watch on events as defined by @mask, 371 * on an object at @path, whose type is defined by @obj_type. 372 * @inode_readlink: 373 * Check the permission to read the symbolic link. 374 * @dentry contains the dentry structure for the file link. 375 * Return 0 if permission is granted. 376 * @inode_follow_link: 377 * Check permission to follow a symbolic link when looking up a pathname. 378 * @dentry contains the dentry structure for the link. 379 * @inode contains the inode, which itself is not stable in RCU-walk 380 * @rcu indicates whether we are in RCU-walk mode. 381 * Return 0 if permission is granted. 382 * @inode_permission: 383 * Check permission before accessing an inode. This hook is called by the 384 * existing Linux permission function, so a security module can use it to 385 * provide additional checking for existing Linux permission checks. 386 * Notice that this hook is called when a file is opened (as well as many 387 * other operations), whereas the file_security_ops permission hook is 388 * called when the actual read/write operations are performed. 389 * @inode contains the inode structure to check. 390 * @mask contains the permission mask. 391 * Return 0 if permission is granted. 392 * @inode_setattr: 393 * Check permission before setting file attributes. Note that the kernel 394 * call to notify_change is performed from several locations, whenever 395 * file attributes change (such as when a file is truncated, chown/chmod 396 * operations, transferring disk quotas, etc). 397 * @dentry contains the dentry structure for the file. 398 * @attr is the iattr structure containing the new file attributes. 399 * Return 0 if permission is granted. 400 * @path_truncate: 401 * Check permission before truncating a file. 402 * @path contains the path structure for the file. 403 * Return 0 if permission is granted. 404 * @inode_getattr: 405 * Check permission before obtaining file attributes. 406 * @path contains the path structure for the file. 407 * Return 0 if permission is granted. 408 * @inode_setxattr: 409 * Check permission before setting the extended attributes 410 * @value identified by @name for @dentry. 411 * Return 0 if permission is granted. 412 * @inode_post_setxattr: 413 * Update inode security field after successful setxattr operation. 414 * @value identified by @name for @dentry. 415 * @inode_getxattr: 416 * Check permission before obtaining the extended attributes 417 * identified by @name for @dentry. 418 * Return 0 if permission is granted. 419 * @inode_listxattr: 420 * Check permission before obtaining the list of extended attribute 421 * names for @dentry. 422 * Return 0 if permission is granted. 423 * @inode_removexattr: 424 * Check permission before removing the extended attribute 425 * identified by @name for @dentry. 426 * Return 0 if permission is granted. 427 * @inode_getsecurity: 428 * Retrieve a copy of the extended attribute representation of the 429 * security label associated with @name for @inode via @buffer. Note that 430 * @name is the remainder of the attribute name after the security prefix 431 * has been removed. @alloc is used to specify of the call should return a 432 * value via the buffer or just the value length Return size of buffer on 433 * success. 434 * @inode_setsecurity: 435 * Set the security label associated with @name for @inode from the 436 * extended attribute value @value. @size indicates the size of the 437 * @value in bytes. @flags may be XATTR_CREATE, XATTR_REPLACE, or 0. 438 * Note that @name is the remainder of the attribute name after the 439 * security. prefix has been removed. 440 * Return 0 on success. 441 * @inode_listsecurity: 442 * Copy the extended attribute names for the security labels 443 * associated with @inode into @buffer. The maximum size of @buffer 444 * is specified by @buffer_size. @buffer may be NULL to request 445 * the size of the buffer required. 446 * Returns number of bytes used/required on success. 447 * @inode_need_killpriv: 448 * Called when an inode has been changed. 449 * @dentry is the dentry being changed. 450 * Return <0 on error to abort the inode change operation. 451 * Return 0 if inode_killpriv does not need to be called. 452 * Return >0 if inode_killpriv does need to be called. 453 * @inode_killpriv: 454 * The setuid bit is being removed. Remove similar security labels. 455 * Called with the dentry->d_inode->i_mutex held. 456 * @mnt_userns: user namespace of the mount 457 * @dentry is the dentry being changed. 458 * Return 0 on success. If error is returned, then the operation 459 * causing setuid bit removal is failed. 460 * @inode_getsecid: 461 * Get the secid associated with the node. 462 * @inode contains a pointer to the inode. 463 * @secid contains a pointer to the location where result will be saved. 464 * In case of failure, @secid will be set to zero. 465 * @inode_copy_up: 466 * A file is about to be copied up from lower layer to upper layer of 467 * overlay filesystem. Security module can prepare a set of new creds 468 * and modify as need be and return new creds. Caller will switch to 469 * new creds temporarily to create new file and release newly allocated 470 * creds. 471 * @src indicates the union dentry of file that is being copied up. 472 * @new pointer to pointer to return newly allocated creds. 473 * Returns 0 on success or a negative error code on error. 474 * @inode_copy_up_xattr: 475 * Filter the xattrs being copied up when a unioned file is copied 476 * up from a lower layer to the union/overlay layer. 477 * @name indicates the name of the xattr. 478 * Returns 0 to accept the xattr, 1 to discard the xattr, -EOPNOTSUPP if 479 * security module does not know about attribute or a negative error code 480 * to abort the copy up. Note that the caller is responsible for reading 481 * and writing the xattrs as this hook is merely a filter. 482 * @d_instantiate: 483 * Fill in @inode security information for a @dentry if allowed. 484 * @getprocattr: 485 * Read attribute @name for process @p and store it into @value if allowed. 486 * @setprocattr: 487 * Write (set) attribute @name to @value, size @size if allowed. 488 * 489 * Security hooks for kernfs node operations 490 * 491 * @kernfs_init_security: 492 * Initialize the security context of a newly created kernfs node based 493 * on its own and its parent's attributes. 494 * 495 * @kn_dir the parent kernfs node 496 * @kn the new child kernfs node 497 * 498 * Security hooks for file operations 499 * 500 * @file_permission: 501 * Check file permissions before accessing an open file. This hook is 502 * called by various operations that read or write files. A security 503 * module can use this hook to perform additional checking on these 504 * operations, e.g. to revalidate permissions on use to support privilege 505 * bracketing or policy changes. Notice that this hook is used when the 506 * actual read/write operations are performed, whereas the 507 * inode_security_ops hook is called when a file is opened (as well as 508 * many other operations). 509 * Caveat: Although this hook can be used to revalidate permissions for 510 * various system call operations that read or write files, it does not 511 * address the revalidation of permissions for memory-mapped files. 512 * Security modules must handle this separately if they need such 513 * revalidation. 514 * @file contains the file structure being accessed. 515 * @mask contains the requested permissions. 516 * Return 0 if permission is granted. 517 * @file_alloc_security: 518 * Allocate and attach a security structure to the file->f_security field. 519 * The security field is initialized to NULL when the structure is first 520 * created. 521 * @file contains the file structure to secure. 522 * Return 0 if the hook is successful and permission is granted. 523 * @file_free_security: 524 * Deallocate and free any security structures stored in file->f_security. 525 * @file contains the file structure being modified. 526 * @file_ioctl: 527 * @file contains the file structure. 528 * @cmd contains the operation to perform. 529 * @arg contains the operational arguments. 530 * Check permission for an ioctl operation on @file. Note that @arg 531 * sometimes represents a user space pointer; in other cases, it may be a 532 * simple integer value. When @arg represents a user space pointer, it 533 * should never be used by the security module. 534 * Return 0 if permission is granted. 535 * @mmap_addr : 536 * Check permissions for a mmap operation at @addr. 537 * @addr contains virtual address that will be used for the operation. 538 * Return 0 if permission is granted. 539 * @mmap_file : 540 * Check permissions for a mmap operation. The @file may be NULL, e.g. 541 * if mapping anonymous memory. 542 * @file contains the file structure for file to map (may be NULL). 543 * @reqprot contains the protection requested by the application. 544 * @prot contains the protection that will be applied by the kernel. 545 * @flags contains the operational flags. 546 * Return 0 if permission is granted. 547 * @file_mprotect: 548 * Check permissions before changing memory access permissions. 549 * @vma contains the memory region to modify. 550 * @reqprot contains the protection requested by the application. 551 * @prot contains the protection that will be applied by the kernel. 552 * Return 0 if permission is granted. 553 * @file_lock: 554 * Check permission before performing file locking operations. 555 * Note the hook mediates both flock and fcntl style locks. 556 * @file contains the file structure. 557 * @cmd contains the posix-translated lock operation to perform 558 * (e.g. F_RDLCK, F_WRLCK). 559 * Return 0 if permission is granted. 560 * @file_fcntl: 561 * Check permission before allowing the file operation specified by @cmd 562 * from being performed on the file @file. Note that @arg sometimes 563 * represents a user space pointer; in other cases, it may be a simple 564 * integer value. When @arg represents a user space pointer, it should 565 * never be used by the security module. 566 * @file contains the file structure. 567 * @cmd contains the operation to be performed. 568 * @arg contains the operational arguments. 569 * Return 0 if permission is granted. 570 * @file_set_fowner: 571 * Save owner security information (typically from current->security) in 572 * file->f_security for later use by the send_sigiotask hook. 573 * @file contains the file structure to update. 574 * Return 0 on success. 575 * @file_send_sigiotask: 576 * Check permission for the file owner @fown to send SIGIO or SIGURG to the 577 * process @tsk. Note that this hook is sometimes called from interrupt. 578 * Note that the fown_struct, @fown, is never outside the context of a 579 * struct file, so the file structure (and associated security information) 580 * can always be obtained: container_of(fown, struct file, f_owner) 581 * @tsk contains the structure of task receiving signal. 582 * @fown contains the file owner information. 583 * @sig is the signal that will be sent. When 0, kernel sends SIGIO. 584 * Return 0 if permission is granted. 585 * @file_receive: 586 * This hook allows security modules to control the ability of a process 587 * to receive an open file descriptor via socket IPC. 588 * @file contains the file structure being received. 589 * Return 0 if permission is granted. 590 * @file_open: 591 * Save open-time permission checking state for later use upon 592 * file_permission, and recheck access if anything has changed 593 * since inode_permission. 594 * 595 * Security hooks for task operations. 596 * 597 * @task_alloc: 598 * @task task being allocated. 599 * @clone_flags contains the flags indicating what should be shared. 600 * Handle allocation of task-related resources. 601 * Returns a zero on success, negative values on failure. 602 * @task_free: 603 * @task task about to be freed. 604 * Handle release of task-related resources. (Note that this can be called 605 * from interrupt context.) 606 * @cred_alloc_blank: 607 * @cred points to the credentials. 608 * @gfp indicates the atomicity of any memory allocations. 609 * Only allocate sufficient memory and attach to @cred such that 610 * cred_transfer() will not get ENOMEM. 611 * @cred_free: 612 * @cred points to the credentials. 613 * Deallocate and clear the cred->security field in a set of credentials. 614 * @cred_prepare: 615 * @new points to the new credentials. 616 * @old points to the original credentials. 617 * @gfp indicates the atomicity of any memory allocations. 618 * Prepare a new set of credentials by copying the data from the old set. 619 * @cred_transfer: 620 * @new points to the new credentials. 621 * @old points to the original credentials. 622 * Transfer data from original creds to new creds 623 * @cred_getsecid: 624 * Retrieve the security identifier of the cred structure @c 625 * @c contains the credentials, secid will be placed into @secid. 626 * In case of failure, @secid will be set to zero. 627 * @kernel_act_as: 628 * Set the credentials for a kernel service to act as (subjective context). 629 * @new points to the credentials to be modified. 630 * @secid specifies the security ID to be set 631 * The current task must be the one that nominated @secid. 632 * Return 0 if successful. 633 * @kernel_create_files_as: 634 * Set the file creation context in a set of credentials to be the same as 635 * the objective context of the specified inode. 636 * @new points to the credentials to be modified. 637 * @inode points to the inode to use as a reference. 638 * The current task must be the one that nominated @inode. 639 * Return 0 if successful. 640 * @kernel_module_request: 641 * Ability to trigger the kernel to automatically upcall to userspace for 642 * userspace to load a kernel module with the given name. 643 * @kmod_name name of the module requested by the kernel 644 * Return 0 if successful. 645 * @kernel_load_data: 646 * Load data provided by userspace. 647 * @id kernel load data identifier 648 * @contents if a subsequent @kernel_post_load_data will be called. 649 * Return 0 if permission is granted. 650 * @kernel_post_load_data: 651 * Load data provided by a non-file source (usually userspace buffer). 652 * @buf pointer to buffer containing the data contents. 653 * @size length of the data contents. 654 * @id kernel load data identifier 655 * @description a text description of what was loaded, @id-specific 656 * Return 0 if permission is granted. 657 * This must be paired with a prior @kernel_load_data call that had 658 * @contents set to true. 659 * @kernel_read_file: 660 * Read a file specified by userspace. 661 * @file contains the file structure pointing to the file being read 662 * by the kernel. 663 * @id kernel read file identifier 664 * @contents if a subsequent @kernel_post_read_file will be called. 665 * Return 0 if permission is granted. 666 * @kernel_post_read_file: 667 * Read a file specified by userspace. 668 * @file contains the file structure pointing to the file being read 669 * by the kernel. 670 * @buf pointer to buffer containing the file contents. 671 * @size length of the file contents. 672 * @id kernel read file identifier 673 * This must be paired with a prior @kernel_read_file call that had 674 * @contents set to true. 675 * Return 0 if permission is granted. 676 * @task_fix_setuid: 677 * Update the module's state after setting one or more of the user 678 * identity attributes of the current process. The @flags parameter 679 * indicates which of the set*uid system calls invoked this hook. If 680 * @new is the set of credentials that will be installed. Modifications 681 * should be made to this rather than to @current->cred. 682 * @old is the set of credentials that are being replaces 683 * @flags contains one of the LSM_SETID_* values. 684 * Return 0 on success. 685 * @task_fix_setgid: 686 * Update the module's state after setting one or more of the group 687 * identity attributes of the current process. The @flags parameter 688 * indicates which of the set*gid system calls invoked this hook. 689 * @new is the set of credentials that will be installed. Modifications 690 * should be made to this rather than to @current->cred. 691 * @old is the set of credentials that are being replaced. 692 * @flags contains one of the LSM_SETID_* values. 693 * Return 0 on success. 694 * @task_setpgid: 695 * Check permission before setting the process group identifier of the 696 * process @p to @pgid. 697 * @p contains the task_struct for process being modified. 698 * @pgid contains the new pgid. 699 * Return 0 if permission is granted. 700 * @task_getpgid: 701 * Check permission before getting the process group identifier of the 702 * process @p. 703 * @p contains the task_struct for the process. 704 * Return 0 if permission is granted. 705 * @task_getsid: 706 * Check permission before getting the session identifier of the process 707 * @p. 708 * @p contains the task_struct for the process. 709 * Return 0 if permission is granted. 710 * @task_getsecid: 711 * Retrieve the security identifier of the process @p. 712 * @p contains the task_struct for the process and place is into @secid. 713 * In case of failure, @secid will be set to zero. 714 * 715 * @task_setnice: 716 * Check permission before setting the nice value of @p to @nice. 717 * @p contains the task_struct of process. 718 * @nice contains the new nice value. 719 * Return 0 if permission is granted. 720 * @task_setioprio: 721 * Check permission before setting the ioprio value of @p to @ioprio. 722 * @p contains the task_struct of process. 723 * @ioprio contains the new ioprio value 724 * Return 0 if permission is granted. 725 * @task_getioprio: 726 * Check permission before getting the ioprio value of @p. 727 * @p contains the task_struct of process. 728 * Return 0 if permission is granted. 729 * @task_prlimit: 730 * Check permission before getting and/or setting the resource limits of 731 * another task. 732 * @cred points to the cred structure for the current task. 733 * @tcred points to the cred structure for the target task. 734 * @flags contains the LSM_PRLIMIT_* flag bits indicating whether the 735 * resource limits are being read, modified, or both. 736 * Return 0 if permission is granted. 737 * @task_setrlimit: 738 * Check permission before setting the resource limits of process @p 739 * for @resource to @new_rlim. The old resource limit values can 740 * be examined by dereferencing (p->signal->rlim + resource). 741 * @p points to the task_struct for the target task's group leader. 742 * @resource contains the resource whose limit is being set. 743 * @new_rlim contains the new limits for @resource. 744 * Return 0 if permission is granted. 745 * @task_setscheduler: 746 * Check permission before setting scheduling policy and/or parameters of 747 * process @p. 748 * @p contains the task_struct for process. 749 * Return 0 if permission is granted. 750 * @task_getscheduler: 751 * Check permission before obtaining scheduling information for process 752 * @p. 753 * @p contains the task_struct for process. 754 * Return 0 if permission is granted. 755 * @task_movememory: 756 * Check permission before moving memory owned by process @p. 757 * @p contains the task_struct for process. 758 * Return 0 if permission is granted. 759 * @task_kill: 760 * Check permission before sending signal @sig to @p. @info can be NULL, 761 * the constant 1, or a pointer to a kernel_siginfo structure. If @info is 1 or 762 * SI_FROMKERNEL(info) is true, then the signal should be viewed as coming 763 * from the kernel and should typically be permitted. 764 * SIGIO signals are handled separately by the send_sigiotask hook in 765 * file_security_ops. 766 * @p contains the task_struct for process. 767 * @info contains the signal information. 768 * @sig contains the signal value. 769 * @cred contains the cred of the process where the signal originated, or 770 * NULL if the current task is the originator. 771 * Return 0 if permission is granted. 772 * @task_prctl: 773 * Check permission before performing a process control operation on the 774 * current process. 775 * @option contains the operation. 776 * @arg2 contains a argument. 777 * @arg3 contains a argument. 778 * @arg4 contains a argument. 779 * @arg5 contains a argument. 780 * Return -ENOSYS if no-one wanted to handle this op, any other value to 781 * cause prctl() to return immediately with that value. 782 * @task_to_inode: 783 * Set the security attributes for an inode based on an associated task's 784 * security attributes, e.g. for /proc/pid inodes. 785 * @p contains the task_struct for the task. 786 * @inode contains the inode structure for the inode. 787 * 788 * Security hooks for Netlink messaging. 789 * 790 * @netlink_send: 791 * Save security information for a netlink message so that permission 792 * checking can be performed when the message is processed. The security 793 * information can be saved using the eff_cap field of the 794 * netlink_skb_parms structure. Also may be used to provide fine 795 * grained control over message transmission. 796 * @sk associated sock of task sending the message. 797 * @skb contains the sk_buff structure for the netlink message. 798 * Return 0 if the information was successfully saved and message 799 * is allowed to be transmitted. 800 * 801 * Security hooks for Unix domain networking. 802 * 803 * @unix_stream_connect: 804 * Check permissions before establishing a Unix domain stream connection 805 * between @sock and @other. 806 * @sock contains the sock structure. 807 * @other contains the peer sock structure. 808 * @newsk contains the new sock structure. 809 * Return 0 if permission is granted. 810 * @unix_may_send: 811 * Check permissions before connecting or sending datagrams from @sock to 812 * @other. 813 * @sock contains the socket structure. 814 * @other contains the peer socket structure. 815 * Return 0 if permission is granted. 816 * 817 * The @unix_stream_connect and @unix_may_send hooks were necessary because 818 * Linux provides an alternative to the conventional file name space for Unix 819 * domain sockets. Whereas binding and connecting to sockets in the file name 820 * space is mediated by the typical file permissions (and caught by the mknod 821 * and permission hooks in inode_security_ops), binding and connecting to 822 * sockets in the abstract name space is completely unmediated. Sufficient 823 * control of Unix domain sockets in the abstract name space isn't possible 824 * using only the socket layer hooks, since we need to know the actual target 825 * socket, which is not looked up until we are inside the af_unix code. 826 * 827 * Security hooks for socket operations. 828 * 829 * @socket_create: 830 * Check permissions prior to creating a new socket. 831 * @family contains the requested protocol family. 832 * @type contains the requested communications type. 833 * @protocol contains the requested protocol. 834 * @kern set to 1 if a kernel socket. 835 * Return 0 if permission is granted. 836 * @socket_post_create: 837 * This hook allows a module to update or allocate a per-socket security 838 * structure. Note that the security field was not added directly to the 839 * socket structure, but rather, the socket security information is stored 840 * in the associated inode. Typically, the inode alloc_security hook will 841 * allocate and attach security information to 842 * SOCK_INODE(sock)->i_security. This hook may be used to update the 843 * SOCK_INODE(sock)->i_security field with additional information that 844 * wasn't available when the inode was allocated. 845 * @sock contains the newly created socket structure. 846 * @family contains the requested protocol family. 847 * @type contains the requested communications type. 848 * @protocol contains the requested protocol. 849 * @kern set to 1 if a kernel socket. 850 * @socket_socketpair: 851 * Check permissions before creating a fresh pair of sockets. 852 * @socka contains the first socket structure. 853 * @sockb contains the second socket structure. 854 * Return 0 if permission is granted and the connection was established. 855 * @socket_bind: 856 * Check permission before socket protocol layer bind operation is 857 * performed and the socket @sock is bound to the address specified in the 858 * @address parameter. 859 * @sock contains the socket structure. 860 * @address contains the address to bind to. 861 * @addrlen contains the length of address. 862 * Return 0 if permission is granted. 863 * @socket_connect: 864 * Check permission before socket protocol layer connect operation 865 * attempts to connect socket @sock to a remote address, @address. 866 * @sock contains the socket structure. 867 * @address contains the address of remote endpoint. 868 * @addrlen contains the length of address. 869 * Return 0 if permission is granted. 870 * @socket_listen: 871 * Check permission before socket protocol layer listen operation. 872 * @sock contains the socket structure. 873 * @backlog contains the maximum length for the pending connection queue. 874 * Return 0 if permission is granted. 875 * @socket_accept: 876 * Check permission before accepting a new connection. Note that the new 877 * socket, @newsock, has been created and some information copied to it, 878 * but the accept operation has not actually been performed. 879 * @sock contains the listening socket structure. 880 * @newsock contains the newly created server socket for connection. 881 * Return 0 if permission is granted. 882 * @socket_sendmsg: 883 * Check permission before transmitting a message to another socket. 884 * @sock contains the socket structure. 885 * @msg contains the message to be transmitted. 886 * @size contains the size of message. 887 * Return 0 if permission is granted. 888 * @socket_recvmsg: 889 * Check permission before receiving a message from a socket. 890 * @sock contains the socket structure. 891 * @msg contains the message structure. 892 * @size contains the size of message structure. 893 * @flags contains the operational flags. 894 * Return 0 if permission is granted. 895 * @socket_getsockname: 896 * Check permission before the local address (name) of the socket object 897 * @sock is retrieved. 898 * @sock contains the socket structure. 899 * Return 0 if permission is granted. 900 * @socket_getpeername: 901 * Check permission before the remote address (name) of a socket object 902 * @sock is retrieved. 903 * @sock contains the socket structure. 904 * Return 0 if permission is granted. 905 * @socket_getsockopt: 906 * Check permissions before retrieving the options associated with socket 907 * @sock. 908 * @sock contains the socket structure. 909 * @level contains the protocol level to retrieve option from. 910 * @optname contains the name of option to retrieve. 911 * Return 0 if permission is granted. 912 * @socket_setsockopt: 913 * Check permissions before setting the options associated with socket 914 * @sock. 915 * @sock contains the socket structure. 916 * @level contains the protocol level to set options for. 917 * @optname contains the name of the option to set. 918 * Return 0 if permission is granted. 919 * @socket_shutdown: 920 * Checks permission before all or part of a connection on the socket 921 * @sock is shut down. 922 * @sock contains the socket structure. 923 * @how contains the flag indicating how future sends and receives 924 * are handled. 925 * Return 0 if permission is granted. 926 * @socket_sock_rcv_skb: 927 * Check permissions on incoming network packets. This hook is distinct 928 * from Netfilter's IP input hooks since it is the first time that the 929 * incoming sk_buff @skb has been associated with a particular socket, @sk. 930 * Must not sleep inside this hook because some callers hold spinlocks. 931 * @sk contains the sock (not socket) associated with the incoming sk_buff. 932 * @skb contains the incoming network data. 933 * @socket_getpeersec_stream: 934 * This hook allows the security module to provide peer socket security 935 * state for unix or connected tcp sockets to userspace via getsockopt 936 * SO_GETPEERSEC. For tcp sockets this can be meaningful if the 937 * socket is associated with an ipsec SA. 938 * @sock is the local socket. 939 * @optval userspace memory where the security state is to be copied. 940 * @optlen userspace int where the module should copy the actual length 941 * of the security state. 942 * @len as input is the maximum length to copy to userspace provided 943 * by the caller. 944 * Return 0 if all is well, otherwise, typical getsockopt return 945 * values. 946 * @socket_getpeersec_dgram: 947 * This hook allows the security module to provide peer socket security 948 * state for udp sockets on a per-packet basis to userspace via 949 * getsockopt SO_GETPEERSEC. The application must first have indicated 950 * the IP_PASSSEC option via getsockopt. It can then retrieve the 951 * security state returned by this hook for a packet via the SCM_SECURITY 952 * ancillary message type. 953 * @sock contains the peer socket. May be NULL. 954 * @skb is the sk_buff for the packet being queried. May be NULL. 955 * @secid pointer to store the secid of the packet. 956 * Return 0 on success, error on failure. 957 * @sk_alloc_security: 958 * Allocate and attach a security structure to the sk->sk_security field, 959 * which is used to copy security attributes between local stream sockets. 960 * @sk_free_security: 961 * Deallocate security structure. 962 * @sk_clone_security: 963 * Clone/copy security structure. 964 * @sk_getsecid: 965 * Retrieve the LSM-specific secid for the sock to enable caching 966 * of network authorizations. 967 * @sock_graft: 968 * Sets the socket's isec sid to the sock's sid. 969 * @inet_conn_request: 970 * Sets the openreq's sid to socket's sid with MLS portion taken 971 * from peer sid. 972 * @inet_csk_clone: 973 * Sets the new child socket's sid to the openreq sid. 974 * @inet_conn_established: 975 * Sets the connection's peersid to the secmark on skb. 976 * @secmark_relabel_packet: 977 * check if the process should be allowed to relabel packets to 978 * the given secid 979 * @secmark_refcount_inc: 980 * tells the LSM to increment the number of secmark labeling rules loaded 981 * @secmark_refcount_dec: 982 * tells the LSM to decrement the number of secmark labeling rules loaded 983 * @req_classify_flow: 984 * Sets the flow's sid to the openreq sid. 985 * @tun_dev_alloc_security: 986 * This hook allows a module to allocate a security structure for a TUN 987 * device. 988 * @security pointer to a security structure pointer. 989 * Returns a zero on success, negative values on failure. 990 * @tun_dev_free_security: 991 * This hook allows a module to free the security structure for a TUN 992 * device. 993 * @security pointer to the TUN device's security structure 994 * @tun_dev_create: 995 * Check permissions prior to creating a new TUN device. 996 * @tun_dev_attach_queue: 997 * Check permissions prior to attaching to a TUN device queue. 998 * @security pointer to the TUN device's security structure. 999 * @tun_dev_attach: 1000 * This hook can be used by the module to update any security state 1001 * associated with the TUN device's sock structure. 1002 * @sk contains the existing sock structure. 1003 * @security pointer to the TUN device's security structure. 1004 * @tun_dev_open: 1005 * This hook can be used by the module to update any security state 1006 * associated with the TUN device's security structure. 1007 * @security pointer to the TUN devices's security structure. 1008 * 1009 * Security hooks for SCTP 1010 * 1011 * @sctp_assoc_request: 1012 * Passes the @ep and @chunk->skb of the association INIT packet to 1013 * the security module. 1014 * @ep pointer to sctp endpoint structure. 1015 * @skb pointer to skbuff of association packet. 1016 * Return 0 on success, error on failure. 1017 * @sctp_bind_connect: 1018 * Validiate permissions required for each address associated with sock 1019 * @sk. Depending on @optname, the addresses will be treated as either 1020 * for a connect or bind service. The @addrlen is calculated on each 1021 * ipv4 and ipv6 address using sizeof(struct sockaddr_in) or 1022 * sizeof(struct sockaddr_in6). 1023 * @sk pointer to sock structure. 1024 * @optname name of the option to validate. 1025 * @address list containing one or more ipv4/ipv6 addresses. 1026 * @addrlen total length of address(s). 1027 * Return 0 on success, error on failure. 1028 * @sctp_sk_clone: 1029 * Called whenever a new socket is created by accept(2) (i.e. a TCP 1030 * style socket) or when a socket is 'peeled off' e.g userspace 1031 * calls sctp_peeloff(3). 1032 * @ep pointer to current sctp endpoint structure. 1033 * @sk pointer to current sock structure. 1034 * @sk pointer to new sock structure. 1035 * 1036 * Security hooks for Infiniband 1037 * 1038 * @ib_pkey_access: 1039 * Check permission to access a pkey when modifing a QP. 1040 * @subnet_prefix the subnet prefix of the port being used. 1041 * @pkey the pkey to be accessed. 1042 * @sec pointer to a security structure. 1043 * @ib_endport_manage_subnet: 1044 * Check permissions to send and receive SMPs on a end port. 1045 * @dev_name the IB device name (i.e. mlx4_0). 1046 * @port_num the port number. 1047 * @sec pointer to a security structure. 1048 * @ib_alloc_security: 1049 * Allocate a security structure for Infiniband objects. 1050 * @sec pointer to a security structure pointer. 1051 * Returns 0 on success, non-zero on failure 1052 * @ib_free_security: 1053 * Deallocate an Infiniband security structure. 1054 * @sec contains the security structure to be freed. 1055 * 1056 * Security hooks for XFRM operations. 1057 * 1058 * @xfrm_policy_alloc_security: 1059 * @ctxp is a pointer to the xfrm_sec_ctx being added to Security Policy 1060 * Database used by the XFRM system. 1061 * @sec_ctx contains the security context information being provided by 1062 * the user-level policy update program (e.g., setkey). 1063 * Allocate a security structure to the xp->security field; the security 1064 * field is initialized to NULL when the xfrm_policy is allocated. 1065 * Return 0 if operation was successful (memory to allocate, legal context) 1066 * @gfp is to specify the context for the allocation 1067 * @xfrm_policy_clone_security: 1068 * @old_ctx contains an existing xfrm_sec_ctx. 1069 * @new_ctxp contains a new xfrm_sec_ctx being cloned from old. 1070 * Allocate a security structure in new_ctxp that contains the 1071 * information from the old_ctx structure. 1072 * Return 0 if operation was successful (memory to allocate). 1073 * @xfrm_policy_free_security: 1074 * @ctx contains the xfrm_sec_ctx 1075 * Deallocate xp->security. 1076 * @xfrm_policy_delete_security: 1077 * @ctx contains the xfrm_sec_ctx. 1078 * Authorize deletion of xp->security. 1079 * @xfrm_state_alloc: 1080 * @x contains the xfrm_state being added to the Security Association 1081 * Database by the XFRM system. 1082 * @sec_ctx contains the security context information being provided by 1083 * the user-level SA generation program (e.g., setkey or racoon). 1084 * Allocate a security structure to the x->security field; the security 1085 * field is initialized to NULL when the xfrm_state is allocated. Set the 1086 * context to correspond to sec_ctx. Return 0 if operation was successful 1087 * (memory to allocate, legal context). 1088 * @xfrm_state_alloc_acquire: 1089 * @x contains the xfrm_state being added to the Security Association 1090 * Database by the XFRM system. 1091 * @polsec contains the policy's security context. 1092 * @secid contains the secid from which to take the mls portion of the 1093 * context. 1094 * Allocate a security structure to the x->security field; the security 1095 * field is initialized to NULL when the xfrm_state is allocated. Set the 1096 * context to correspond to secid. Return 0 if operation was successful 1097 * (memory to allocate, legal context). 1098 * @xfrm_state_free_security: 1099 * @x contains the xfrm_state. 1100 * Deallocate x->security. 1101 * @xfrm_state_delete_security: 1102 * @x contains the xfrm_state. 1103 * Authorize deletion of x->security. 1104 * @xfrm_policy_lookup: 1105 * @ctx contains the xfrm_sec_ctx for which the access control is being 1106 * checked. 1107 * @fl_secid contains the flow security label that is used to authorize 1108 * access to the policy xp. 1109 * @dir contains the direction of the flow (input or output). 1110 * Check permission when a flow selects a xfrm_policy for processing 1111 * XFRMs on a packet. The hook is called when selecting either a 1112 * per-socket policy or a generic xfrm policy. 1113 * Return 0 if permission is granted, -ESRCH otherwise, or -errno 1114 * on other errors. 1115 * @xfrm_state_pol_flow_match: 1116 * @x contains the state to match. 1117 * @xp contains the policy to check for a match. 1118 * @flic contains the flowi_common struct to check for a match. 1119 * Return 1 if there is a match. 1120 * @xfrm_decode_session: 1121 * @skb points to skb to decode. 1122 * @secid points to the flow key secid to set. 1123 * @ckall says if all xfrms used should be checked for same secid. 1124 * Return 0 if ckall is zero or all xfrms used have the same secid. 1125 * 1126 * Security hooks affecting all Key Management operations 1127 * 1128 * @key_alloc: 1129 * Permit allocation of a key and assign security data. Note that key does 1130 * not have a serial number assigned at this point. 1131 * @key points to the key. 1132 * @flags is the allocation flags 1133 * Return 0 if permission is granted, -ve error otherwise. 1134 * @key_free: 1135 * Notification of destruction; free security data. 1136 * @key points to the key. 1137 * No return value. 1138 * @key_permission: 1139 * See whether a specific operational right is granted to a process on a 1140 * key. 1141 * @key_ref refers to the key (key pointer + possession attribute bit). 1142 * @cred points to the credentials to provide the context against which to 1143 * evaluate the security data on the key. 1144 * @perm describes the combination of permissions required of this key. 1145 * Return 0 if permission is granted, -ve error otherwise. 1146 * @key_getsecurity: 1147 * Get a textual representation of the security context attached to a key 1148 * for the purposes of honouring KEYCTL_GETSECURITY. This function 1149 * allocates the storage for the NUL-terminated string and the caller 1150 * should free it. 1151 * @key points to the key to be queried. 1152 * @_buffer points to a pointer that should be set to point to the 1153 * resulting string (if no label or an error occurs). 1154 * Return the length of the string (including terminating NUL) or -ve if 1155 * an error. 1156 * May also return 0 (and a NULL buffer pointer) if there is no label. 1157 * 1158 * Security hooks affecting all System V IPC operations. 1159 * 1160 * @ipc_permission: 1161 * Check permissions for access to IPC 1162 * @ipcp contains the kernel IPC permission structure 1163 * @flag contains the desired (requested) permission set 1164 * Return 0 if permission is granted. 1165 * @ipc_getsecid: 1166 * Get the secid associated with the ipc object. 1167 * @ipcp contains the kernel IPC permission structure. 1168 * @secid contains a pointer to the location where result will be saved. 1169 * In case of failure, @secid will be set to zero. 1170 * 1171 * Security hooks for individual messages held in System V IPC message queues 1172 * 1173 * @msg_msg_alloc_security: 1174 * Allocate and attach a security structure to the msg->security field. 1175 * The security field is initialized to NULL when the structure is first 1176 * created. 1177 * @msg contains the message structure to be modified. 1178 * Return 0 if operation was successful and permission is granted. 1179 * @msg_msg_free_security: 1180 * Deallocate the security structure for this message. 1181 * @msg contains the message structure to be modified. 1182 * 1183 * Security hooks for System V IPC Message Queues 1184 * 1185 * @msg_queue_alloc_security: 1186 * Allocate and attach a security structure to the 1187 * @perm->security field. The security field is initialized to 1188 * NULL when the structure is first created. 1189 * @perm contains the IPC permissions of the message queue. 1190 * Return 0 if operation was successful and permission is granted. 1191 * @msg_queue_free_security: 1192 * Deallocate security field @perm->security for the message queue. 1193 * @perm contains the IPC permissions of the message queue. 1194 * @msg_queue_associate: 1195 * Check permission when a message queue is requested through the 1196 * msgget system call. This hook is only called when returning the 1197 * message queue identifier for an existing message queue, not when a 1198 * new message queue is created. 1199 * @perm contains the IPC permissions of the message queue. 1200 * @msqflg contains the operation control flags. 1201 * Return 0 if permission is granted. 1202 * @msg_queue_msgctl: 1203 * Check permission when a message control operation specified by @cmd 1204 * is to be performed on the message queue with permissions @perm. 1205 * The @perm may be NULL, e.g. for IPC_INFO or MSG_INFO. 1206 * @perm contains the IPC permissions of the msg queue. May be NULL. 1207 * @cmd contains the operation to be performed. 1208 * Return 0 if permission is granted. 1209 * @msg_queue_msgsnd: 1210 * Check permission before a message, @msg, is enqueued on the message 1211 * queue with permissions @perm. 1212 * @perm contains the IPC permissions of the message queue. 1213 * @msg contains the message to be enqueued. 1214 * @msqflg contains operational flags. 1215 * Return 0 if permission is granted. 1216 * @msg_queue_msgrcv: 1217 * Check permission before a message, @msg, is removed from the message 1218 * queue. The @target task structure contains a pointer to the 1219 * process that will be receiving the message (not equal to the current 1220 * process when inline receives are being performed). 1221 * @perm contains the IPC permissions of the message queue. 1222 * @msg contains the message destination. 1223 * @target contains the task structure for recipient process. 1224 * @type contains the type of message requested. 1225 * @mode contains the operational flags. 1226 * Return 0 if permission is granted. 1227 * 1228 * Security hooks for System V Shared Memory Segments 1229 * 1230 * @shm_alloc_security: 1231 * Allocate and attach a security structure to the @perm->security 1232 * field. The security field is initialized to NULL when the structure is 1233 * first created. 1234 * @perm contains the IPC permissions of the shared memory structure. 1235 * Return 0 if operation was successful and permission is granted. 1236 * @shm_free_security: 1237 * Deallocate the security structure @perm->security for the memory segment. 1238 * @perm contains the IPC permissions of the shared memory structure. 1239 * @shm_associate: 1240 * Check permission when a shared memory region is requested through the 1241 * shmget system call. This hook is only called when returning the shared 1242 * memory region identifier for an existing region, not when a new shared 1243 * memory region is created. 1244 * @perm contains the IPC permissions of the shared memory structure. 1245 * @shmflg contains the operation control flags. 1246 * Return 0 if permission is granted. 1247 * @shm_shmctl: 1248 * Check permission when a shared memory control operation specified by 1249 * @cmd is to be performed on the shared memory region with permissions @perm. 1250 * The @perm may be NULL, e.g. for IPC_INFO or SHM_INFO. 1251 * @perm contains the IPC permissions of the shared memory structure. 1252 * @cmd contains the operation to be performed. 1253 * Return 0 if permission is granted. 1254 * @shm_shmat: 1255 * Check permissions prior to allowing the shmat system call to attach the 1256 * shared memory segment with permissions @perm to the data segment of the 1257 * calling process. The attaching address is specified by @shmaddr. 1258 * @perm contains the IPC permissions of the shared memory structure. 1259 * @shmaddr contains the address to attach memory region to. 1260 * @shmflg contains the operational flags. 1261 * Return 0 if permission is granted. 1262 * 1263 * Security hooks for System V Semaphores 1264 * 1265 * @sem_alloc_security: 1266 * Allocate and attach a security structure to the @perm->security 1267 * field. The security field is initialized to NULL when the structure is 1268 * first created. 1269 * @perm contains the IPC permissions of the semaphore. 1270 * Return 0 if operation was successful and permission is granted. 1271 * @sem_free_security: 1272 * Deallocate security structure @perm->security for the semaphore. 1273 * @perm contains the IPC permissions of the semaphore. 1274 * @sem_associate: 1275 * Check permission when a semaphore is requested through the semget 1276 * system call. This hook is only called when returning the semaphore 1277 * identifier for an existing semaphore, not when a new one must be 1278 * created. 1279 * @perm contains the IPC permissions of the semaphore. 1280 * @semflg contains the operation control flags. 1281 * Return 0 if permission is granted. 1282 * @sem_semctl: 1283 * Check permission when a semaphore operation specified by @cmd is to be 1284 * performed on the semaphore. The @perm may be NULL, e.g. for 1285 * IPC_INFO or SEM_INFO. 1286 * @perm contains the IPC permissions of the semaphore. May be NULL. 1287 * @cmd contains the operation to be performed. 1288 * Return 0 if permission is granted. 1289 * @sem_semop: 1290 * Check permissions before performing operations on members of the 1291 * semaphore set. If the @alter flag is nonzero, the semaphore set 1292 * may be modified. 1293 * @perm contains the IPC permissions of the semaphore. 1294 * @sops contains the operations to perform. 1295 * @nsops contains the number of operations to perform. 1296 * @alter contains the flag indicating whether changes are to be made. 1297 * Return 0 if permission is granted. 1298 * 1299 * @binder_set_context_mgr: 1300 * Check whether @mgr is allowed to be the binder context manager. 1301 * @mgr contains the task_struct for the task being registered. 1302 * Return 0 if permission is granted. 1303 * @binder_transaction: 1304 * Check whether @from is allowed to invoke a binder transaction call 1305 * to @to. 1306 * @from contains the task_struct for the sending task. 1307 * @to contains the task_struct for the receiving task. 1308 * @binder_transfer_binder: 1309 * Check whether @from is allowed to transfer a binder reference to @to. 1310 * @from contains the task_struct for the sending task. 1311 * @to contains the task_struct for the receiving task. 1312 * @binder_transfer_file: 1313 * Check whether @from is allowed to transfer @file to @to. 1314 * @from contains the task_struct for the sending task. 1315 * @file contains the struct file being transferred. 1316 * @to contains the task_struct for the receiving task. 1317 * 1318 * @ptrace_access_check: 1319 * Check permission before allowing the current process to trace the 1320 * @child process. 1321 * Security modules may also want to perform a process tracing check 1322 * during an execve in the set_security or apply_creds hooks of 1323 * tracing check during an execve in the bprm_set_creds hook of 1324 * binprm_security_ops if the process is being traced and its security 1325 * attributes would be changed by the execve. 1326 * @child contains the task_struct structure for the target process. 1327 * @mode contains the PTRACE_MODE flags indicating the form of access. 1328 * Return 0 if permission is granted. 1329 * @ptrace_traceme: 1330 * Check that the @parent process has sufficient permission to trace the 1331 * current process before allowing the current process to present itself 1332 * to the @parent process for tracing. 1333 * @parent contains the task_struct structure for debugger process. 1334 * Return 0 if permission is granted. 1335 * @capget: 1336 * Get the @effective, @inheritable, and @permitted capability sets for 1337 * the @target process. The hook may also perform permission checking to 1338 * determine if the current process is allowed to see the capability sets 1339 * of the @target process. 1340 * @target contains the task_struct structure for target process. 1341 * @effective contains the effective capability set. 1342 * @inheritable contains the inheritable capability set. 1343 * @permitted contains the permitted capability set. 1344 * Return 0 if the capability sets were successfully obtained. 1345 * @capset: 1346 * Set the @effective, @inheritable, and @permitted capability sets for 1347 * the current process. 1348 * @new contains the new credentials structure for target process. 1349 * @old contains the current credentials structure for target process. 1350 * @effective contains the effective capability set. 1351 * @inheritable contains the inheritable capability set. 1352 * @permitted contains the permitted capability set. 1353 * Return 0 and update @new if permission is granted. 1354 * @capable: 1355 * Check whether the @tsk process has the @cap capability in the indicated 1356 * credentials. 1357 * @cred contains the credentials to use. 1358 * @ns contains the user namespace we want the capability in 1359 * @cap contains the capability <include/linux/capability.h>. 1360 * @opts contains options for the capable check <include/linux/security.h> 1361 * Return 0 if the capability is granted for @tsk. 1362 * @quotactl: 1363 * Check whether the quotactl syscall is allowed for this @sb. 1364 * @quota_on: 1365 * Check whether QUOTAON is allowed for this @dentry. 1366 * @syslog: 1367 * Check permission before accessing the kernel message ring or changing 1368 * logging to the console. 1369 * See the syslog(2) manual page for an explanation of the @type values. 1370 * @type contains the SYSLOG_ACTION_* constant from <include/linux/syslog.h> 1371 * Return 0 if permission is granted. 1372 * @settime: 1373 * Check permission to change the system time. 1374 * struct timespec64 is defined in <include/linux/time64.h> and timezone 1375 * is defined in <include/linux/time.h> 1376 * @ts contains new time 1377 * @tz contains new timezone 1378 * Return 0 if permission is granted. 1379 * @vm_enough_memory: 1380 * Check permissions for allocating a new virtual mapping. 1381 * @mm contains the mm struct it is being added to. 1382 * @pages contains the number of pages. 1383 * Return 0 if permission is granted. 1384 * 1385 * @ismaclabel: 1386 * Check if the extended attribute specified by @name 1387 * represents a MAC label. Returns 1 if name is a MAC 1388 * attribute otherwise returns 0. 1389 * @name full extended attribute name to check against 1390 * LSM as a MAC label. 1391 * 1392 * @secid_to_secctx: 1393 * Convert secid to security context. If secdata is NULL the length of 1394 * the result will be returned in seclen, but no secdata will be returned. 1395 * This does mean that the length could change between calls to check the 1396 * length and the next call which actually allocates and returns the 1397 * secdata. 1398 * @secid contains the security ID. 1399 * @secdata contains the pointer that stores the converted security 1400 * context. 1401 * @seclen pointer which contains the length of the data 1402 * @secctx_to_secid: 1403 * Convert security context to secid. 1404 * @secid contains the pointer to the generated security ID. 1405 * @secdata contains the security context. 1406 * 1407 * @release_secctx: 1408 * Release the security context. 1409 * @secdata contains the security context. 1410 * @seclen contains the length of the security context. 1411 * 1412 * Security hooks for Audit 1413 * 1414 * @audit_rule_init: 1415 * Allocate and initialize an LSM audit rule structure. 1416 * @field contains the required Audit action. 1417 * Fields flags are defined in <include/linux/audit.h> 1418 * @op contains the operator the rule uses. 1419 * @rulestr contains the context where the rule will be applied to. 1420 * @lsmrule contains a pointer to receive the result. 1421 * Return 0 if @lsmrule has been successfully set, 1422 * -EINVAL in case of an invalid rule. 1423 * 1424 * @audit_rule_known: 1425 * Specifies whether given @krule contains any fields related to 1426 * current LSM. 1427 * @krule contains the audit rule of interest. 1428 * Return 1 in case of relation found, 0 otherwise. 1429 * 1430 * @audit_rule_match: 1431 * Determine if given @secid matches a rule previously approved 1432 * by @audit_rule_known. 1433 * @secid contains the security id in question. 1434 * @field contains the field which relates to current LSM. 1435 * @op contains the operator that will be used for matching. 1436 * @lrule points to the audit rule that will be checked against. 1437 * Return 1 if secid matches the rule, 0 if it does not, -ERRNO on failure. 1438 * 1439 * @audit_rule_free: 1440 * Deallocate the LSM audit rule structure previously allocated by 1441 * audit_rule_init. 1442 * @lsmrule contains the allocated rule 1443 * 1444 * @inode_invalidate_secctx: 1445 * Notify the security module that it must revalidate the security context 1446 * of an inode. 1447 * 1448 * @inode_notifysecctx: 1449 * Notify the security module of what the security context of an inode 1450 * should be. Initializes the incore security context managed by the 1451 * security module for this inode. Example usage: NFS client invokes 1452 * this hook to initialize the security context in its incore inode to the 1453 * value provided by the server for the file when the server returned the 1454 * file's attributes to the client. 1455 * Must be called with inode->i_mutex locked. 1456 * @inode we wish to set the security context of. 1457 * @ctx contains the string which we wish to set in the inode. 1458 * @ctxlen contains the length of @ctx. 1459 * 1460 * @inode_setsecctx: 1461 * Change the security context of an inode. Updates the 1462 * incore security context managed by the security module and invokes the 1463 * fs code as needed (via __vfs_setxattr_noperm) to update any backing 1464 * xattrs that represent the context. Example usage: NFS server invokes 1465 * this hook to change the security context in its incore inode and on the 1466 * backing filesystem to a value provided by the client on a SETATTR 1467 * operation. 1468 * Must be called with inode->i_mutex locked. 1469 * @dentry contains the inode we wish to set the security context of. 1470 * @ctx contains the string which we wish to set in the inode. 1471 * @ctxlen contains the length of @ctx. 1472 * 1473 * @inode_getsecctx: 1474 * On success, returns 0 and fills out @ctx and @ctxlen with the security 1475 * context for the given @inode. 1476 * @inode we wish to get the security context of. 1477 * @ctx is a pointer in which to place the allocated security context. 1478 * @ctxlen points to the place to put the length of @ctx. 1479 * 1480 * Security hooks for the general notification queue: 1481 * 1482 * @post_notification: 1483 * Check to see if a watch notification can be posted to a particular 1484 * queue. 1485 * @w_cred: The credentials of the whoever set the watch. 1486 * @cred: The event-triggerer's credentials 1487 * @n: The notification being posted 1488 * 1489 * @watch_key: 1490 * Check to see if a process is allowed to watch for event notifications 1491 * from a key or keyring. 1492 * @key: The key to watch. 1493 * 1494 * Security hooks for using the eBPF maps and programs functionalities through 1495 * eBPF syscalls. 1496 * 1497 * @bpf: 1498 * Do a initial check for all bpf syscalls after the attribute is copied 1499 * into the kernel. The actual security module can implement their own 1500 * rules to check the specific cmd they need. 1501 * 1502 * @bpf_map: 1503 * Do a check when the kernel generate and return a file descriptor for 1504 * eBPF maps. 1505 * 1506 * @map: bpf map that we want to access 1507 * @mask: the access flags 1508 * 1509 * @bpf_prog: 1510 * Do a check when the kernel generate and return a file descriptor for 1511 * eBPF programs. 1512 * 1513 * @prog: bpf prog that userspace want to use. 1514 * 1515 * @bpf_map_alloc_security: 1516 * Initialize the security field inside bpf map. 1517 * 1518 * @bpf_map_free_security: 1519 * Clean up the security information stored inside bpf map. 1520 * 1521 * @bpf_prog_alloc_security: 1522 * Initialize the security field inside bpf program. 1523 * 1524 * @bpf_prog_free_security: 1525 * Clean up the security information stored inside bpf prog. 1526 * 1527 * @locked_down: 1528 * Determine whether a kernel feature that potentially enables arbitrary 1529 * code execution in kernel space should be permitted. 1530 * 1531 * @what: kernel feature being accessed 1532 * 1533 * Security hooks for perf events 1534 * 1535 * @perf_event_open: 1536 * Check whether the @type of perf_event_open syscall is allowed. 1537 * @perf_event_alloc: 1538 * Allocate and save perf_event security info. 1539 * @perf_event_free: 1540 * Release (free) perf_event security info. 1541 * @perf_event_read: 1542 * Read perf_event security info if allowed. 1543 * @perf_event_write: 1544 * Write perf_event security info if allowed. 1545 */ 1546 union security_list_options { 1547 #define LSM_HOOK(RET, DEFAULT, NAME, ...) RET (*NAME)(__VA_ARGS__); 1548 #include "lsm_hook_defs.h" 1549 #undef LSM_HOOK 1550 }; 1551 1552 struct security_hook_heads { 1553 #define LSM_HOOK(RET, DEFAULT, NAME, ...) struct hlist_head NAME; 1554 #include "lsm_hook_defs.h" 1555 #undef LSM_HOOK 1556 } __randomize_layout; 1557 1558 /* 1559 * Security module hook list structure. 1560 * For use with generic list macros for common operations. 1561 */ 1562 struct security_hook_list { 1563 struct hlist_node list; 1564 struct hlist_head *head; 1565 union security_list_options hook; 1566 char *lsm; 1567 } __randomize_layout; 1568 1569 /* 1570 * Security blob size or offset data. 1571 */ 1572 struct lsm_blob_sizes { 1573 int lbs_cred; 1574 int lbs_file; 1575 int lbs_inode; 1576 int lbs_ipc; 1577 int lbs_msg_msg; 1578 int lbs_task; 1579 }; 1580 1581 /* 1582 * LSM_RET_VOID is used as the default value in LSM_HOOK definitions for void 1583 * LSM hooks (in include/linux/lsm_hook_defs.h). 1584 */ 1585 #define LSM_RET_VOID ((void) 0) 1586 1587 /* 1588 * Initializing a security_hook_list structure takes 1589 * up a lot of space in a source file. This macro takes 1590 * care of the common case and reduces the amount of 1591 * text involved. 1592 */ 1593 #define LSM_HOOK_INIT(HEAD, HOOK) \ 1594 { .head = &security_hook_heads.HEAD, .hook = { .HEAD = HOOK } } 1595 1596 extern struct security_hook_heads security_hook_heads; 1597 extern char *lsm_names; 1598 1599 extern void security_add_hooks(struct security_hook_list *hooks, int count, 1600 char *lsm); 1601 1602 #define LSM_FLAG_LEGACY_MAJOR BIT(0) 1603 #define LSM_FLAG_EXCLUSIVE BIT(1) 1604 1605 enum lsm_order { 1606 LSM_ORDER_FIRST = -1, /* This is only for capabilities. */ 1607 LSM_ORDER_MUTABLE = 0, 1608 }; 1609 1610 struct lsm_info { 1611 const char *name; /* Required. */ 1612 enum lsm_order order; /* Optional: default is LSM_ORDER_MUTABLE */ 1613 unsigned long flags; /* Optional: flags describing LSM */ 1614 int *enabled; /* Optional: controlled by CONFIG_LSM */ 1615 int (*init)(void); /* Required. */ 1616 struct lsm_blob_sizes *blobs; /* Optional: for blob sharing. */ 1617 }; 1618 1619 extern struct lsm_info __start_lsm_info[], __end_lsm_info[]; 1620 extern struct lsm_info __start_early_lsm_info[], __end_early_lsm_info[]; 1621 1622 #define DEFINE_LSM(lsm) \ 1623 static struct lsm_info __lsm_##lsm \ 1624 __used __section(".lsm_info.init") \ 1625 __aligned(sizeof(unsigned long)) 1626 1627 #define DEFINE_EARLY_LSM(lsm) \ 1628 static struct lsm_info __early_lsm_##lsm \ 1629 __used __section(".early_lsm_info.init") \ 1630 __aligned(sizeof(unsigned long)) 1631 1632 #ifdef CONFIG_SECURITY_SELINUX_DISABLE 1633 /* 1634 * Assuring the safety of deleting a security module is up to 1635 * the security module involved. This may entail ordering the 1636 * module's hook list in a particular way, refusing to disable 1637 * the module once a policy is loaded or any number of other 1638 * actions better imagined than described. 1639 * 1640 * The name of the configuration option reflects the only module 1641 * that currently uses the mechanism. Any developer who thinks 1642 * disabling their module is a good idea needs to be at least as 1643 * careful as the SELinux team. 1644 */ 1645 static inline void security_delete_hooks(struct security_hook_list *hooks, 1646 int count) 1647 { 1648 int i; 1649 1650 for (i = 0; i < count; i++) 1651 hlist_del_rcu(&hooks[i].list); 1652 } 1653 #endif /* CONFIG_SECURITY_SELINUX_DISABLE */ 1654 1655 /* Currently required to handle SELinux runtime hook disable. */ 1656 #ifdef CONFIG_SECURITY_WRITABLE_HOOKS 1657 #define __lsm_ro_after_init 1658 #else 1659 #define __lsm_ro_after_init __ro_after_init 1660 #endif /* CONFIG_SECURITY_WRITABLE_HOOKS */ 1661 1662 extern int lsm_inode_alloc(struct inode *inode); 1663 1664 #endif /* ! __LINUX_LSM_HOOKS_H */ 1665