Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1/*
2 * Linux Security plug
3 *
4 * Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com>
5 * Copyright (C) 2001 Greg Kroah-Hartman <greg@kroah.com>
6 * Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com>
7 * Copyright (C) 2001 James Morris <jmorris@intercode.com.au>
8 * Copyright (C) 2001 Silicon Graphics, Inc. (Trust Technology Group)
9 * Copyright (C) 2016 Mellanox Techonologies
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
15 *
16 * Due to this file being licensed under the GPL there is controversy over
17 * whether this permits you to write a module that #includes this file
18 * without placing your module under the GPL. Please consult a lawyer for
19 * advice before doing this.
20 *
21 */
22
23#ifndef __LINUX_SECURITY_H
24#define __LINUX_SECURITY_H
25
26#include <linux/kernel_read_file.h>
27#include <linux/key.h>
28#include <linux/capability.h>
29#include <linux/fs.h>
30#include <linux/slab.h>
31#include <linux/err.h>
32#include <linux/string.h>
33#include <linux/mm.h>
34#include <linux/sockptr.h>
35#include <linux/bpf.h>
36#include <uapi/linux/lsm.h>
37#include <linux/lsm/selinux.h>
38#include <linux/lsm/smack.h>
39#include <linux/lsm/apparmor.h>
40#include <linux/lsm/bpf.h>
41
42struct linux_binprm;
43struct cred;
44struct rlimit;
45struct kernel_siginfo;
46struct sembuf;
47struct kern_ipc_perm;
48struct audit_context;
49struct super_block;
50struct inode;
51struct dentry;
52struct file;
53struct vfsmount;
54struct path;
55struct qstr;
56struct iattr;
57struct fown_struct;
58struct file_operations;
59struct msg_msg;
60struct xattr;
61struct kernfs_node;
62struct xfrm_sec_ctx;
63struct mm_struct;
64struct fs_context;
65struct fs_parameter;
66enum fs_value_type;
67struct watch;
68struct watch_notification;
69struct lsm_ctx;
70
71/* Default (no) options for the capable function */
72#define CAP_OPT_NONE 0x0
73/* If capable should audit the security request */
74#define CAP_OPT_NOAUDIT BIT(1)
75/* If capable is being called by a setid function */
76#define CAP_OPT_INSETID BIT(2)
77
78/* LSM Agnostic defines for security_sb_set_mnt_opts() flags */
79#define SECURITY_LSM_NATIVE_LABELS 1
80
81struct ctl_table;
82struct audit_krule;
83struct user_namespace;
84struct timezone;
85
86enum lsm_event {
87 LSM_POLICY_CHANGE,
88 LSM_STARTED_ALL,
89};
90
91struct dm_verity_digest {
92 const char *alg;
93 const u8 *digest;
94 size_t digest_len;
95};
96
97enum lsm_integrity_type {
98 LSM_INT_DMVERITY_SIG_VALID,
99 LSM_INT_DMVERITY_ROOTHASH,
100 LSM_INT_FSVERITY_BUILTINSIG_VALID,
101};
102
103/*
104 * These are reasons that can be passed to the security_locked_down()
105 * LSM hook. Lockdown reasons that protect kernel integrity (ie, the
106 * ability for userland to modify kernel code) are placed before
107 * LOCKDOWN_INTEGRITY_MAX. Lockdown reasons that protect kernel
108 * confidentiality (ie, the ability for userland to extract
109 * information from the running kernel that would otherwise be
110 * restricted) are placed before LOCKDOWN_CONFIDENTIALITY_MAX.
111 *
112 * LSM authors should note that the semantics of any given lockdown
113 * reason are not guaranteed to be stable - the same reason may block
114 * one set of features in one kernel release, and a slightly different
115 * set of features in a later kernel release. LSMs that seek to expose
116 * lockdown policy at any level of granularity other than "none",
117 * "integrity" or "confidentiality" are responsible for either
118 * ensuring that they expose a consistent level of functionality to
119 * userland, or ensuring that userland is aware that this is
120 * potentially a moving target. It is easy to misuse this information
121 * in a way that could break userspace. Please be careful not to do
122 * so.
123 *
124 * If you add to this, remember to extend lockdown_reasons in
125 * security/lockdown/lockdown.c.
126 */
127enum lockdown_reason {
128 LOCKDOWN_NONE,
129 LOCKDOWN_MODULE_SIGNATURE,
130 LOCKDOWN_DEV_MEM,
131 LOCKDOWN_EFI_TEST,
132 LOCKDOWN_KEXEC,
133 LOCKDOWN_HIBERNATION,
134 LOCKDOWN_PCI_ACCESS,
135 LOCKDOWN_IOPORT,
136 LOCKDOWN_MSR,
137 LOCKDOWN_ACPI_TABLES,
138 LOCKDOWN_DEVICE_TREE,
139 LOCKDOWN_PCMCIA_CIS,
140 LOCKDOWN_TIOCSSERIAL,
141 LOCKDOWN_MODULE_PARAMETERS,
142 LOCKDOWN_MMIOTRACE,
143 LOCKDOWN_DEBUGFS,
144 LOCKDOWN_XMON_WR,
145 LOCKDOWN_BPF_WRITE_USER,
146 LOCKDOWN_DBG_WRITE_KERNEL,
147 LOCKDOWN_RTAS_ERROR_INJECTION,
148 LOCKDOWN_XEN_USER_ACTIONS,
149 LOCKDOWN_INTEGRITY_MAX,
150 LOCKDOWN_KCORE,
151 LOCKDOWN_KPROBES,
152 LOCKDOWN_BPF_READ_KERNEL,
153 LOCKDOWN_DBG_READ_KERNEL,
154 LOCKDOWN_PERF,
155 LOCKDOWN_TRACEFS,
156 LOCKDOWN_XMON_RW,
157 LOCKDOWN_XFRM_SECRET,
158 LOCKDOWN_CONFIDENTIALITY_MAX,
159};
160
161/*
162 * Data exported by the security modules
163 */
164struct lsm_prop {
165 struct lsm_prop_selinux selinux;
166 struct lsm_prop_smack smack;
167 struct lsm_prop_apparmor apparmor;
168 struct lsm_prop_bpf bpf;
169};
170
171extern const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1];
172
173/* These functions are in security/commoncap.c */
174extern int cap_capable(const struct cred *cred, struct user_namespace *ns,
175 int cap, unsigned int opts);
176extern int cap_settime(const struct timespec64 *ts, const struct timezone *tz);
177extern int cap_ptrace_access_check(struct task_struct *child, unsigned int mode);
178extern int cap_ptrace_traceme(struct task_struct *parent);
179extern int cap_capget(const struct task_struct *target, kernel_cap_t *effective,
180 kernel_cap_t *inheritable, kernel_cap_t *permitted);
181extern int cap_capset(struct cred *new, const struct cred *old,
182 const kernel_cap_t *effective,
183 const kernel_cap_t *inheritable,
184 const kernel_cap_t *permitted);
185extern int cap_bprm_creds_from_file(struct linux_binprm *bprm, const struct file *file);
186int cap_inode_setxattr(struct dentry *dentry, const char *name,
187 const void *value, size_t size, int flags);
188int cap_inode_removexattr(struct mnt_idmap *idmap,
189 struct dentry *dentry, const char *name);
190int cap_inode_need_killpriv(struct dentry *dentry);
191int cap_inode_killpriv(struct mnt_idmap *idmap, struct dentry *dentry);
192int cap_inode_getsecurity(struct mnt_idmap *idmap,
193 struct inode *inode, const char *name, void **buffer,
194 bool alloc);
195extern int cap_mmap_addr(unsigned long addr);
196extern int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags);
197extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
198 unsigned long arg4, unsigned long arg5);
199extern int cap_task_setscheduler(struct task_struct *p);
200extern int cap_task_setioprio(struct task_struct *p, int ioprio);
201extern int cap_task_setnice(struct task_struct *p, int nice);
202extern int cap_vm_enough_memory(struct mm_struct *mm, long pages);
203
204struct msghdr;
205struct sk_buff;
206struct sock;
207struct sockaddr;
208struct socket;
209struct flowi_common;
210struct dst_entry;
211struct xfrm_selector;
212struct xfrm_policy;
213struct xfrm_state;
214struct xfrm_user_sec_ctx;
215struct seq_file;
216struct sctp_association;
217
218#ifdef CONFIG_MMU
219extern unsigned long mmap_min_addr;
220extern unsigned long dac_mmap_min_addr;
221#else
222#define mmap_min_addr 0UL
223#define dac_mmap_min_addr 0UL
224#endif
225
226/*
227 * A "security context" is the text representation of
228 * the information used by LSMs.
229 * This structure contains the string, its length, and which LSM
230 * it is useful for.
231 */
232struct lsm_context {
233 char *context; /* Provided by the module */
234 u32 len;
235 int id; /* Identifies the module */
236};
237
238/*
239 * Values used in the task_security_ops calls
240 */
241/* setuid or setgid, id0 == uid or gid */
242#define LSM_SETID_ID 1
243
244/* setreuid or setregid, id0 == real, id1 == eff */
245#define LSM_SETID_RE 2
246
247/* setresuid or setresgid, id0 == real, id1 == eff, uid2 == saved */
248#define LSM_SETID_RES 4
249
250/* setfsuid or setfsgid, id0 == fsuid or fsgid */
251#define LSM_SETID_FS 8
252
253/* Flags for security_task_prlimit(). */
254#define LSM_PRLIMIT_READ 1
255#define LSM_PRLIMIT_WRITE 2
256
257/* forward declares to avoid warnings */
258struct sched_param;
259struct request_sock;
260
261/* bprm->unsafe reasons */
262#define LSM_UNSAFE_SHARE 1
263#define LSM_UNSAFE_PTRACE 2
264#define LSM_UNSAFE_NO_NEW_PRIVS 4
265
266#ifdef CONFIG_MMU
267extern int mmap_min_addr_handler(const struct ctl_table *table, int write,
268 void *buffer, size_t *lenp, loff_t *ppos);
269#endif
270
271/* security_inode_init_security callback function to write xattrs */
272typedef int (*initxattrs) (struct inode *inode,
273 const struct xattr *xattr_array, void *fs_data);
274
275
276/* Keep the kernel_load_data_id enum in sync with kernel_read_file_id */
277#define __data_id_enumify(ENUM, dummy) LOADING_ ## ENUM,
278#define __data_id_stringify(dummy, str) #str,
279
280enum kernel_load_data_id {
281 __kernel_read_file_id(__data_id_enumify)
282};
283
284static const char * const kernel_load_data_str[] = {
285 __kernel_read_file_id(__data_id_stringify)
286};
287
288static inline const char *kernel_load_data_id_str(enum kernel_load_data_id id)
289{
290 if ((unsigned)id >= LOADING_MAX_ID)
291 return kernel_load_data_str[LOADING_UNKNOWN];
292
293 return kernel_load_data_str[id];
294}
295
296/**
297 * lsmprop_init - initialize a lsm_prop structure
298 * @prop: Pointer to the data to initialize
299 *
300 * Set all secid for all modules to the specified value.
301 */
302static inline void lsmprop_init(struct lsm_prop *prop)
303{
304 memset(prop, 0, sizeof(*prop));
305}
306
307#ifdef CONFIG_SECURITY
308
309/**
310 * lsmprop_is_set - report if there is a value in the lsm_prop
311 * @prop: Pointer to the exported LSM data
312 *
313 * Returns true if there is a value set, false otherwise
314 */
315static inline bool lsmprop_is_set(struct lsm_prop *prop)
316{
317 const struct lsm_prop empty = {};
318
319 return !!memcmp(prop, &empty, sizeof(*prop));
320}
321
322int call_blocking_lsm_notifier(enum lsm_event event, void *data);
323int register_blocking_lsm_notifier(struct notifier_block *nb);
324int unregister_blocking_lsm_notifier(struct notifier_block *nb);
325
326/* prototypes */
327extern int security_init(void);
328extern int early_security_init(void);
329extern u64 lsm_name_to_attr(const char *name);
330
331/* Security operations */
332int security_binder_set_context_mgr(const struct cred *mgr);
333int security_binder_transaction(const struct cred *from,
334 const struct cred *to);
335int security_binder_transfer_binder(const struct cred *from,
336 const struct cred *to);
337int security_binder_transfer_file(const struct cred *from,
338 const struct cred *to, const struct file *file);
339int security_ptrace_access_check(struct task_struct *child, unsigned int mode);
340int security_ptrace_traceme(struct task_struct *parent);
341int security_capget(const struct task_struct *target,
342 kernel_cap_t *effective,
343 kernel_cap_t *inheritable,
344 kernel_cap_t *permitted);
345int security_capset(struct cred *new, const struct cred *old,
346 const kernel_cap_t *effective,
347 const kernel_cap_t *inheritable,
348 const kernel_cap_t *permitted);
349int security_capable(const struct cred *cred,
350 struct user_namespace *ns,
351 int cap,
352 unsigned int opts);
353int security_quotactl(int cmds, int type, int id, const struct super_block *sb);
354int security_quota_on(struct dentry *dentry);
355int security_syslog(int type);
356int security_settime64(const struct timespec64 *ts, const struct timezone *tz);
357int security_vm_enough_memory_mm(struct mm_struct *mm, long pages);
358int security_bprm_creds_for_exec(struct linux_binprm *bprm);
359int security_bprm_creds_from_file(struct linux_binprm *bprm, const struct file *file);
360int security_bprm_check(struct linux_binprm *bprm);
361void security_bprm_committing_creds(const struct linux_binprm *bprm);
362void security_bprm_committed_creds(const struct linux_binprm *bprm);
363int security_fs_context_submount(struct fs_context *fc, struct super_block *reference);
364int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc);
365int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param);
366int security_sb_alloc(struct super_block *sb);
367void security_sb_delete(struct super_block *sb);
368void security_sb_free(struct super_block *sb);
369void security_free_mnt_opts(void **mnt_opts);
370int security_sb_eat_lsm_opts(char *options, void **mnt_opts);
371int security_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts);
372int security_sb_remount(struct super_block *sb, void *mnt_opts);
373int security_sb_kern_mount(const struct super_block *sb);
374int security_sb_show_options(struct seq_file *m, struct super_block *sb);
375int security_sb_statfs(struct dentry *dentry);
376int security_sb_mount(const char *dev_name, const struct path *path,
377 const char *type, unsigned long flags, void *data);
378int security_sb_umount(struct vfsmount *mnt, int flags);
379int security_sb_pivotroot(const struct path *old_path, const struct path *new_path);
380int security_sb_set_mnt_opts(struct super_block *sb,
381 void *mnt_opts,
382 unsigned long kern_flags,
383 unsigned long *set_kern_flags);
384int security_sb_clone_mnt_opts(const struct super_block *oldsb,
385 struct super_block *newsb,
386 unsigned long kern_flags,
387 unsigned long *set_kern_flags);
388int security_move_mount(const struct path *from_path, const struct path *to_path);
389int security_dentry_init_security(struct dentry *dentry, int mode,
390 const struct qstr *name,
391 const char **xattr_name,
392 struct lsm_context *lsmcxt);
393int security_dentry_create_files_as(struct dentry *dentry, int mode,
394 const struct qstr *name,
395 const struct cred *old,
396 struct cred *new);
397int security_path_notify(const struct path *path, u64 mask,
398 unsigned int obj_type);
399int security_inode_alloc(struct inode *inode, gfp_t gfp);
400void security_inode_free(struct inode *inode);
401int security_inode_init_security(struct inode *inode, struct inode *dir,
402 const struct qstr *qstr,
403 initxattrs initxattrs, void *fs_data);
404int security_inode_init_security_anon(struct inode *inode,
405 const struct qstr *name,
406 const struct inode *context_inode);
407int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode);
408void security_inode_post_create_tmpfile(struct mnt_idmap *idmap,
409 struct inode *inode);
410int security_inode_link(struct dentry *old_dentry, struct inode *dir,
411 struct dentry *new_dentry);
412int security_inode_unlink(struct inode *dir, struct dentry *dentry);
413int security_inode_symlink(struct inode *dir, struct dentry *dentry,
414 const char *old_name);
415int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode);
416int security_inode_rmdir(struct inode *dir, struct dentry *dentry);
417int security_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev);
418int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
419 struct inode *new_dir, struct dentry *new_dentry,
420 unsigned int flags);
421int security_inode_readlink(struct dentry *dentry);
422int security_inode_follow_link(struct dentry *dentry, struct inode *inode,
423 bool rcu);
424int security_inode_permission(struct inode *inode, int mask);
425int security_inode_setattr(struct mnt_idmap *idmap,
426 struct dentry *dentry, struct iattr *attr);
427void security_inode_post_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
428 int ia_valid);
429int security_inode_getattr(const struct path *path);
430int security_inode_setxattr(struct mnt_idmap *idmap,
431 struct dentry *dentry, const char *name,
432 const void *value, size_t size, int flags);
433int security_inode_set_acl(struct mnt_idmap *idmap,
434 struct dentry *dentry, const char *acl_name,
435 struct posix_acl *kacl);
436void security_inode_post_set_acl(struct dentry *dentry, const char *acl_name,
437 struct posix_acl *kacl);
438int security_inode_get_acl(struct mnt_idmap *idmap,
439 struct dentry *dentry, const char *acl_name);
440int security_inode_remove_acl(struct mnt_idmap *idmap,
441 struct dentry *dentry, const char *acl_name);
442void security_inode_post_remove_acl(struct mnt_idmap *idmap,
443 struct dentry *dentry,
444 const char *acl_name);
445void security_inode_post_setxattr(struct dentry *dentry, const char *name,
446 const void *value, size_t size, int flags);
447int security_inode_getxattr(struct dentry *dentry, const char *name);
448int security_inode_listxattr(struct dentry *dentry);
449int security_inode_removexattr(struct mnt_idmap *idmap,
450 struct dentry *dentry, const char *name);
451void security_inode_post_removexattr(struct dentry *dentry, const char *name);
452int security_inode_file_setattr(struct dentry *dentry,
453 struct file_kattr *fa);
454int security_inode_file_getattr(struct dentry *dentry,
455 struct file_kattr *fa);
456int security_inode_need_killpriv(struct dentry *dentry);
457int security_inode_killpriv(struct mnt_idmap *idmap, struct dentry *dentry);
458int security_inode_getsecurity(struct mnt_idmap *idmap,
459 struct inode *inode, const char *name,
460 void **buffer, bool alloc);
461int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags);
462int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size);
463void security_inode_getlsmprop(struct inode *inode, struct lsm_prop *prop);
464int security_inode_copy_up(struct dentry *src, struct cred **new);
465int security_inode_copy_up_xattr(struct dentry *src, const char *name);
466int security_inode_setintegrity(const struct inode *inode,
467 enum lsm_integrity_type type, const void *value,
468 size_t size);
469int security_kernfs_init_security(struct kernfs_node *kn_dir,
470 struct kernfs_node *kn);
471int security_file_permission(struct file *file, int mask);
472int security_file_alloc(struct file *file);
473void security_file_release(struct file *file);
474void security_file_free(struct file *file);
475int security_backing_file_alloc(struct file *backing_file,
476 const struct file *user_file);
477void security_backing_file_free(struct file *backing_file);
478int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
479int security_file_ioctl_compat(struct file *file, unsigned int cmd,
480 unsigned long arg);
481int security_mmap_file(struct file *file, unsigned long prot,
482 unsigned long flags);
483int security_mmap_backing_file(struct vm_area_struct *vma,
484 struct file *backing_file,
485 struct file *user_file);
486int security_mmap_addr(unsigned long addr);
487int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
488 unsigned long prot);
489int security_file_lock(struct file *file, unsigned int cmd);
490int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg);
491void security_file_set_fowner(struct file *file);
492int security_file_send_sigiotask(struct task_struct *tsk,
493 struct fown_struct *fown, int sig);
494int security_file_receive(struct file *file);
495int security_file_open(struct file *file);
496int security_file_post_open(struct file *file, int mask);
497int security_file_truncate(struct file *file);
498int security_task_alloc(struct task_struct *task, u64 clone_flags);
499void security_task_free(struct task_struct *task);
500int security_cred_alloc_blank(struct cred *cred, gfp_t gfp);
501void security_cred_free(struct cred *cred);
502int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp);
503void security_transfer_creds(struct cred *new, const struct cred *old);
504void security_cred_getsecid(const struct cred *c, u32 *secid);
505void security_cred_getlsmprop(const struct cred *c, struct lsm_prop *prop);
506int security_kernel_act_as(struct cred *new, u32 secid);
507int security_kernel_create_files_as(struct cred *new, struct inode *inode);
508int security_kernel_module_request(char *kmod_name);
509int security_kernel_load_data(enum kernel_load_data_id id, bool contents);
510int security_kernel_post_load_data(char *buf, loff_t size,
511 enum kernel_load_data_id id,
512 char *description);
513int security_kernel_read_file(struct file *file, enum kernel_read_file_id id,
514 bool contents);
515int security_kernel_post_read_file(struct file *file, char *buf, loff_t size,
516 enum kernel_read_file_id id);
517int security_task_fix_setuid(struct cred *new, const struct cred *old,
518 int flags);
519int security_task_fix_setgid(struct cred *new, const struct cred *old,
520 int flags);
521int security_task_fix_setgroups(struct cred *new, const struct cred *old);
522int security_task_setpgid(struct task_struct *p, pid_t pgid);
523int security_task_getpgid(struct task_struct *p);
524int security_task_getsid(struct task_struct *p);
525void security_current_getlsmprop_subj(struct lsm_prop *prop);
526void security_task_getlsmprop_obj(struct task_struct *p, struct lsm_prop *prop);
527int security_task_setnice(struct task_struct *p, int nice);
528int security_task_setioprio(struct task_struct *p, int ioprio);
529int security_task_getioprio(struct task_struct *p);
530int security_task_prlimit(const struct cred *cred, const struct cred *tcred,
531 unsigned int flags);
532int security_task_setrlimit(struct task_struct *p, unsigned int resource,
533 struct rlimit *new_rlim);
534int security_task_setscheduler(struct task_struct *p);
535int security_task_getscheduler(struct task_struct *p);
536int security_task_movememory(struct task_struct *p);
537int security_task_kill(struct task_struct *p, struct kernel_siginfo *info,
538 int sig, const struct cred *cred);
539int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
540 unsigned long arg4, unsigned long arg5);
541void security_task_to_inode(struct task_struct *p, struct inode *inode);
542int security_create_user_ns(const struct cred *cred);
543int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag);
544void security_ipc_getlsmprop(struct kern_ipc_perm *ipcp, struct lsm_prop *prop);
545int security_msg_msg_alloc(struct msg_msg *msg);
546void security_msg_msg_free(struct msg_msg *msg);
547int security_msg_queue_alloc(struct kern_ipc_perm *msq);
548void security_msg_queue_free(struct kern_ipc_perm *msq);
549int security_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg);
550int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd);
551int security_msg_queue_msgsnd(struct kern_ipc_perm *msq,
552 struct msg_msg *msg, int msqflg);
553int security_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
554 struct task_struct *target, long type, int mode);
555int security_shm_alloc(struct kern_ipc_perm *shp);
556void security_shm_free(struct kern_ipc_perm *shp);
557int security_shm_associate(struct kern_ipc_perm *shp, int shmflg);
558int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd);
559int security_shm_shmat(struct kern_ipc_perm *shp, char __user *shmaddr, int shmflg);
560int security_sem_alloc(struct kern_ipc_perm *sma);
561void security_sem_free(struct kern_ipc_perm *sma);
562int security_sem_associate(struct kern_ipc_perm *sma, int semflg);
563int security_sem_semctl(struct kern_ipc_perm *sma, int cmd);
564int security_sem_semop(struct kern_ipc_perm *sma, struct sembuf *sops,
565 unsigned nsops, int alter);
566void security_d_instantiate(struct dentry *dentry, struct inode *inode);
567int security_getselfattr(unsigned int attr, struct lsm_ctx __user *ctx,
568 u32 __user *size, u32 flags);
569int security_setselfattr(unsigned int attr, struct lsm_ctx __user *ctx,
570 u32 size, u32 flags);
571int security_getprocattr(struct task_struct *p, int lsmid, const char *name,
572 char **value);
573int security_setprocattr(int lsmid, const char *name, void *value, size_t size);
574int security_ismaclabel(const char *name);
575int security_secid_to_secctx(u32 secid, struct lsm_context *cp);
576int security_lsmprop_to_secctx(struct lsm_prop *prop, struct lsm_context *cp,
577 int lsmid);
578int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
579void security_release_secctx(struct lsm_context *cp);
580void security_inode_invalidate_secctx(struct inode *inode);
581int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen);
582int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
583int security_inode_getsecctx(struct inode *inode, struct lsm_context *cp);
584int security_locked_down(enum lockdown_reason what);
585int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 *uctx_len,
586 void *val, size_t val_len, u64 id, u64 flags);
587int security_bdev_alloc(struct block_device *bdev);
588void security_bdev_free(struct block_device *bdev);
589int security_bdev_setintegrity(struct block_device *bdev,
590 enum lsm_integrity_type type, const void *value,
591 size_t size);
592#else /* CONFIG_SECURITY */
593
594/**
595 * lsmprop_is_set - report if there is a value in the lsm_prop
596 * @prop: Pointer to the exported LSM data
597 *
598 * Returns true if there is a value set, false otherwise
599 */
600static inline bool lsmprop_is_set(struct lsm_prop *prop)
601{
602 return false;
603}
604
605static inline int call_blocking_lsm_notifier(enum lsm_event event, void *data)
606{
607 return 0;
608}
609
610static inline int register_blocking_lsm_notifier(struct notifier_block *nb)
611{
612 return 0;
613}
614
615static inline int unregister_blocking_lsm_notifier(struct notifier_block *nb)
616{
617 return 0;
618}
619
620static inline u64 lsm_name_to_attr(const char *name)
621{
622 return LSM_ATTR_UNDEF;
623}
624
625static inline void security_free_mnt_opts(void **mnt_opts)
626{
627}
628
629/*
630 * This is the default capabilities functionality. Most of these functions
631 * are just stubbed out, but a few must call the proper capable code.
632 */
633
634static inline int security_init(void)
635{
636 return 0;
637}
638
639static inline int early_security_init(void)
640{
641 return 0;
642}
643
644static inline int security_binder_set_context_mgr(const struct cred *mgr)
645{
646 return 0;
647}
648
649static inline int security_binder_transaction(const struct cred *from,
650 const struct cred *to)
651{
652 return 0;
653}
654
655static inline int security_binder_transfer_binder(const struct cred *from,
656 const struct cred *to)
657{
658 return 0;
659}
660
661static inline int security_binder_transfer_file(const struct cred *from,
662 const struct cred *to,
663 const struct file *file)
664{
665 return 0;
666}
667
668static inline int security_ptrace_access_check(struct task_struct *child,
669 unsigned int mode)
670{
671 return cap_ptrace_access_check(child, mode);
672}
673
674static inline int security_ptrace_traceme(struct task_struct *parent)
675{
676 return cap_ptrace_traceme(parent);
677}
678
679static inline int security_capget(const struct task_struct *target,
680 kernel_cap_t *effective,
681 kernel_cap_t *inheritable,
682 kernel_cap_t *permitted)
683{
684 return cap_capget(target, effective, inheritable, permitted);
685}
686
687static inline int security_capset(struct cred *new,
688 const struct cred *old,
689 const kernel_cap_t *effective,
690 const kernel_cap_t *inheritable,
691 const kernel_cap_t *permitted)
692{
693 return cap_capset(new, old, effective, inheritable, permitted);
694}
695
696static inline int security_capable(const struct cred *cred,
697 struct user_namespace *ns,
698 int cap,
699 unsigned int opts)
700{
701 return cap_capable(cred, ns, cap, opts);
702}
703
704static inline int security_quotactl(int cmds, int type, int id,
705 const struct super_block *sb)
706{
707 return 0;
708}
709
710static inline int security_quota_on(struct dentry *dentry)
711{
712 return 0;
713}
714
715static inline int security_syslog(int type)
716{
717 return 0;
718}
719
720static inline int security_settime64(const struct timespec64 *ts,
721 const struct timezone *tz)
722{
723 return cap_settime(ts, tz);
724}
725
726static inline int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
727{
728 return __vm_enough_memory(mm, pages, !cap_vm_enough_memory(mm, pages));
729}
730
731static inline int security_bprm_creds_for_exec(struct linux_binprm *bprm)
732{
733 return 0;
734}
735
736static inline int security_bprm_creds_from_file(struct linux_binprm *bprm,
737 const struct file *file)
738{
739 return cap_bprm_creds_from_file(bprm, file);
740}
741
742static inline int security_bprm_check(struct linux_binprm *bprm)
743{
744 return 0;
745}
746
747static inline void security_bprm_committing_creds(const struct linux_binprm *bprm)
748{
749}
750
751static inline void security_bprm_committed_creds(const struct linux_binprm *bprm)
752{
753}
754
755static inline int security_fs_context_submount(struct fs_context *fc,
756 struct super_block *reference)
757{
758 return 0;
759}
760static inline int security_fs_context_dup(struct fs_context *fc,
761 struct fs_context *src_fc)
762{
763 return 0;
764}
765static inline int security_fs_context_parse_param(struct fs_context *fc,
766 struct fs_parameter *param)
767{
768 return -ENOPARAM;
769}
770
771static inline int security_sb_alloc(struct super_block *sb)
772{
773 return 0;
774}
775
776static inline void security_sb_delete(struct super_block *sb)
777{ }
778
779static inline void security_sb_free(struct super_block *sb)
780{ }
781
782static inline int security_sb_eat_lsm_opts(char *options,
783 void **mnt_opts)
784{
785 return 0;
786}
787
788static inline int security_sb_remount(struct super_block *sb,
789 void *mnt_opts)
790{
791 return 0;
792}
793
794static inline int security_sb_mnt_opts_compat(struct super_block *sb,
795 void *mnt_opts)
796{
797 return 0;
798}
799
800
801static inline int security_sb_kern_mount(struct super_block *sb)
802{
803 return 0;
804}
805
806static inline int security_sb_show_options(struct seq_file *m,
807 struct super_block *sb)
808{
809 return 0;
810}
811
812static inline int security_sb_statfs(struct dentry *dentry)
813{
814 return 0;
815}
816
817static inline int security_sb_mount(const char *dev_name, const struct path *path,
818 const char *type, unsigned long flags,
819 void *data)
820{
821 return 0;
822}
823
824static inline int security_sb_umount(struct vfsmount *mnt, int flags)
825{
826 return 0;
827}
828
829static inline int security_sb_pivotroot(const struct path *old_path,
830 const struct path *new_path)
831{
832 return 0;
833}
834
835static inline int security_sb_set_mnt_opts(struct super_block *sb,
836 void *mnt_opts,
837 unsigned long kern_flags,
838 unsigned long *set_kern_flags)
839{
840 return 0;
841}
842
843static inline int security_sb_clone_mnt_opts(const struct super_block *oldsb,
844 struct super_block *newsb,
845 unsigned long kern_flags,
846 unsigned long *set_kern_flags)
847{
848 return 0;
849}
850
851static inline int security_move_mount(const struct path *from_path,
852 const struct path *to_path)
853{
854 return 0;
855}
856
857static inline int security_path_notify(const struct path *path, u64 mask,
858 unsigned int obj_type)
859{
860 return 0;
861}
862
863static inline int security_inode_alloc(struct inode *inode, gfp_t gfp)
864{
865 return 0;
866}
867
868static inline void security_inode_free(struct inode *inode)
869{ }
870
871static inline int security_dentry_init_security(struct dentry *dentry,
872 int mode,
873 const struct qstr *name,
874 const char **xattr_name,
875 struct lsm_context *lsmcxt)
876{
877 return -EOPNOTSUPP;
878}
879
880static inline int security_dentry_create_files_as(struct dentry *dentry,
881 int mode, const struct qstr *name,
882 const struct cred *old,
883 struct cred *new)
884{
885 return 0;
886}
887
888
889static inline int security_inode_init_security(struct inode *inode,
890 struct inode *dir,
891 const struct qstr *qstr,
892 const initxattrs xattrs,
893 void *fs_data)
894{
895 return 0;
896}
897
898static inline int security_inode_init_security_anon(struct inode *inode,
899 const struct qstr *name,
900 const struct inode *context_inode)
901{
902 return 0;
903}
904
905static inline int security_inode_create(struct inode *dir,
906 struct dentry *dentry,
907 umode_t mode)
908{
909 return 0;
910}
911
912static inline void
913security_inode_post_create_tmpfile(struct mnt_idmap *idmap, struct inode *inode)
914{ }
915
916static inline int security_inode_link(struct dentry *old_dentry,
917 struct inode *dir,
918 struct dentry *new_dentry)
919{
920 return 0;
921}
922
923static inline int security_inode_unlink(struct inode *dir,
924 struct dentry *dentry)
925{
926 return 0;
927}
928
929static inline int security_inode_symlink(struct inode *dir,
930 struct dentry *dentry,
931 const char *old_name)
932{
933 return 0;
934}
935
936static inline int security_inode_mkdir(struct inode *dir,
937 struct dentry *dentry,
938 int mode)
939{
940 return 0;
941}
942
943static inline int security_inode_rmdir(struct inode *dir,
944 struct dentry *dentry)
945{
946 return 0;
947}
948
949static inline int security_inode_mknod(struct inode *dir,
950 struct dentry *dentry,
951 int mode, dev_t dev)
952{
953 return 0;
954}
955
956static inline int security_inode_rename(struct inode *old_dir,
957 struct dentry *old_dentry,
958 struct inode *new_dir,
959 struct dentry *new_dentry,
960 unsigned int flags)
961{
962 return 0;
963}
964
965static inline int security_inode_readlink(struct dentry *dentry)
966{
967 return 0;
968}
969
970static inline int security_inode_follow_link(struct dentry *dentry,
971 struct inode *inode,
972 bool rcu)
973{
974 return 0;
975}
976
977static inline int security_inode_permission(struct inode *inode, int mask)
978{
979 return 0;
980}
981
982static inline int security_inode_setattr(struct mnt_idmap *idmap,
983 struct dentry *dentry,
984 struct iattr *attr)
985{
986 return 0;
987}
988
989static inline void
990security_inode_post_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
991 int ia_valid)
992{ }
993
994static inline int security_inode_getattr(const struct path *path)
995{
996 return 0;
997}
998
999static inline int security_inode_setxattr(struct mnt_idmap *idmap,
1000 struct dentry *dentry, const char *name, const void *value,
1001 size_t size, int flags)
1002{
1003 return cap_inode_setxattr(dentry, name, value, size, flags);
1004}
1005
1006static inline int security_inode_set_acl(struct mnt_idmap *idmap,
1007 struct dentry *dentry,
1008 const char *acl_name,
1009 struct posix_acl *kacl)
1010{
1011 return 0;
1012}
1013
1014static inline void security_inode_post_set_acl(struct dentry *dentry,
1015 const char *acl_name,
1016 struct posix_acl *kacl)
1017{ }
1018
1019static inline int security_inode_get_acl(struct mnt_idmap *idmap,
1020 struct dentry *dentry,
1021 const char *acl_name)
1022{
1023 return 0;
1024}
1025
1026static inline int security_inode_remove_acl(struct mnt_idmap *idmap,
1027 struct dentry *dentry,
1028 const char *acl_name)
1029{
1030 return 0;
1031}
1032
1033static inline void security_inode_post_remove_acl(struct mnt_idmap *idmap,
1034 struct dentry *dentry,
1035 const char *acl_name)
1036{ }
1037
1038static inline void security_inode_post_setxattr(struct dentry *dentry,
1039 const char *name, const void *value, size_t size, int flags)
1040{ }
1041
1042static inline int security_inode_getxattr(struct dentry *dentry,
1043 const char *name)
1044{
1045 return 0;
1046}
1047
1048static inline int security_inode_listxattr(struct dentry *dentry)
1049{
1050 return 0;
1051}
1052
1053static inline int security_inode_removexattr(struct mnt_idmap *idmap,
1054 struct dentry *dentry,
1055 const char *name)
1056{
1057 return cap_inode_removexattr(idmap, dentry, name);
1058}
1059
1060static inline void security_inode_post_removexattr(struct dentry *dentry,
1061 const char *name)
1062{ }
1063
1064static inline int security_inode_file_setattr(struct dentry *dentry,
1065 struct file_kattr *fa)
1066{
1067 return 0;
1068}
1069
1070static inline int security_inode_file_getattr(struct dentry *dentry,
1071 struct file_kattr *fa)
1072{
1073 return 0;
1074}
1075
1076static inline int security_inode_need_killpriv(struct dentry *dentry)
1077{
1078 return cap_inode_need_killpriv(dentry);
1079}
1080
1081static inline int security_inode_killpriv(struct mnt_idmap *idmap,
1082 struct dentry *dentry)
1083{
1084 return cap_inode_killpriv(idmap, dentry);
1085}
1086
1087static inline int security_inode_getsecurity(struct mnt_idmap *idmap,
1088 struct inode *inode,
1089 const char *name, void **buffer,
1090 bool alloc)
1091{
1092 return cap_inode_getsecurity(idmap, inode, name, buffer, alloc);
1093}
1094
1095static inline int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
1096{
1097 return -EOPNOTSUPP;
1098}
1099
1100static inline int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
1101{
1102 return 0;
1103}
1104
1105static inline void security_inode_getlsmprop(struct inode *inode,
1106 struct lsm_prop *prop)
1107{
1108 lsmprop_init(prop);
1109}
1110
1111static inline int security_inode_copy_up(struct dentry *src, struct cred **new)
1112{
1113 return 0;
1114}
1115
1116static inline int security_inode_setintegrity(const struct inode *inode,
1117 enum lsm_integrity_type type,
1118 const void *value, size_t size)
1119{
1120 return 0;
1121}
1122
1123static inline int security_kernfs_init_security(struct kernfs_node *kn_dir,
1124 struct kernfs_node *kn)
1125{
1126 return 0;
1127}
1128
1129static inline int security_inode_copy_up_xattr(struct dentry *src, const char *name)
1130{
1131 return -EOPNOTSUPP;
1132}
1133
1134static inline int security_file_permission(struct file *file, int mask)
1135{
1136 return 0;
1137}
1138
1139static inline int security_file_alloc(struct file *file)
1140{
1141 return 0;
1142}
1143
1144static inline void security_file_release(struct file *file)
1145{ }
1146
1147static inline void security_file_free(struct file *file)
1148{ }
1149
1150static inline int security_backing_file_alloc(struct file *backing_file,
1151 const struct file *user_file)
1152{
1153 return 0;
1154}
1155
1156static inline void security_backing_file_free(struct file *backing_file)
1157{ }
1158
1159static inline int security_file_ioctl(struct file *file, unsigned int cmd,
1160 unsigned long arg)
1161{
1162 return 0;
1163}
1164
1165static inline int security_file_ioctl_compat(struct file *file,
1166 unsigned int cmd,
1167 unsigned long arg)
1168{
1169 return 0;
1170}
1171
1172static inline int security_mmap_file(struct file *file, unsigned long prot,
1173 unsigned long flags)
1174{
1175 return 0;
1176}
1177
1178static inline int security_mmap_backing_file(struct vm_area_struct *vma,
1179 struct file *backing_file,
1180 struct file *user_file)
1181{
1182 return 0;
1183}
1184
1185static inline int security_mmap_addr(unsigned long addr)
1186{
1187 return cap_mmap_addr(addr);
1188}
1189
1190static inline int security_file_mprotect(struct vm_area_struct *vma,
1191 unsigned long reqprot,
1192 unsigned long prot)
1193{
1194 return 0;
1195}
1196
1197static inline int security_file_lock(struct file *file, unsigned int cmd)
1198{
1199 return 0;
1200}
1201
1202static inline int security_file_fcntl(struct file *file, unsigned int cmd,
1203 unsigned long arg)
1204{
1205 return 0;
1206}
1207
1208static inline void security_file_set_fowner(struct file *file)
1209{
1210 return;
1211}
1212
1213static inline int security_file_send_sigiotask(struct task_struct *tsk,
1214 struct fown_struct *fown,
1215 int sig)
1216{
1217 return 0;
1218}
1219
1220static inline int security_file_receive(struct file *file)
1221{
1222 return 0;
1223}
1224
1225static inline int security_file_open(struct file *file)
1226{
1227 return 0;
1228}
1229
1230static inline int security_file_post_open(struct file *file, int mask)
1231{
1232 return 0;
1233}
1234
1235static inline int security_file_truncate(struct file *file)
1236{
1237 return 0;
1238}
1239
1240static inline int security_task_alloc(struct task_struct *task,
1241 u64 clone_flags)
1242{
1243 return 0;
1244}
1245
1246static inline void security_task_free(struct task_struct *task)
1247{ }
1248
1249static inline int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)
1250{
1251 return 0;
1252}
1253
1254static inline void security_cred_free(struct cred *cred)
1255{ }
1256
1257static inline int security_prepare_creds(struct cred *new,
1258 const struct cred *old,
1259 gfp_t gfp)
1260{
1261 return 0;
1262}
1263
1264static inline void security_transfer_creds(struct cred *new,
1265 const struct cred *old)
1266{
1267}
1268
1269static inline void security_cred_getsecid(const struct cred *c, u32 *secid)
1270{
1271 *secid = 0;
1272}
1273
1274static inline void security_cred_getlsmprop(const struct cred *c,
1275 struct lsm_prop *prop)
1276{ }
1277
1278static inline int security_kernel_act_as(struct cred *cred, u32 secid)
1279{
1280 return 0;
1281}
1282
1283static inline int security_kernel_create_files_as(struct cred *cred,
1284 struct inode *inode)
1285{
1286 return 0;
1287}
1288
1289static inline int security_kernel_module_request(char *kmod_name)
1290{
1291 return 0;
1292}
1293
1294static inline int security_kernel_load_data(enum kernel_load_data_id id, bool contents)
1295{
1296 return 0;
1297}
1298
1299static inline int security_kernel_post_load_data(char *buf, loff_t size,
1300 enum kernel_load_data_id id,
1301 char *description)
1302{
1303 return 0;
1304}
1305
1306static inline int security_kernel_read_file(struct file *file,
1307 enum kernel_read_file_id id,
1308 bool contents)
1309{
1310 return 0;
1311}
1312
1313static inline int security_kernel_post_read_file(struct file *file,
1314 char *buf, loff_t size,
1315 enum kernel_read_file_id id)
1316{
1317 return 0;
1318}
1319
1320static inline int security_task_fix_setuid(struct cred *new,
1321 const struct cred *old,
1322 int flags)
1323{
1324 return cap_task_fix_setuid(new, old, flags);
1325}
1326
1327static inline int security_task_fix_setgid(struct cred *new,
1328 const struct cred *old,
1329 int flags)
1330{
1331 return 0;
1332}
1333
1334static inline int security_task_fix_setgroups(struct cred *new,
1335 const struct cred *old)
1336{
1337 return 0;
1338}
1339
1340static inline int security_task_setpgid(struct task_struct *p, pid_t pgid)
1341{
1342 return 0;
1343}
1344
1345static inline int security_task_getpgid(struct task_struct *p)
1346{
1347 return 0;
1348}
1349
1350static inline int security_task_getsid(struct task_struct *p)
1351{
1352 return 0;
1353}
1354
1355static inline void security_current_getlsmprop_subj(struct lsm_prop *prop)
1356{
1357 lsmprop_init(prop);
1358}
1359
1360static inline void security_task_getlsmprop_obj(struct task_struct *p,
1361 struct lsm_prop *prop)
1362{
1363 lsmprop_init(prop);
1364}
1365
1366static inline int security_task_setnice(struct task_struct *p, int nice)
1367{
1368 return cap_task_setnice(p, nice);
1369}
1370
1371static inline int security_task_setioprio(struct task_struct *p, int ioprio)
1372{
1373 return cap_task_setioprio(p, ioprio);
1374}
1375
1376static inline int security_task_getioprio(struct task_struct *p)
1377{
1378 return 0;
1379}
1380
1381static inline int security_task_prlimit(const struct cred *cred,
1382 const struct cred *tcred,
1383 unsigned int flags)
1384{
1385 return 0;
1386}
1387
1388static inline int security_task_setrlimit(struct task_struct *p,
1389 unsigned int resource,
1390 struct rlimit *new_rlim)
1391{
1392 return 0;
1393}
1394
1395static inline int security_task_setscheduler(struct task_struct *p)
1396{
1397 return cap_task_setscheduler(p);
1398}
1399
1400static inline int security_task_getscheduler(struct task_struct *p)
1401{
1402 return 0;
1403}
1404
1405static inline int security_task_movememory(struct task_struct *p)
1406{
1407 return 0;
1408}
1409
1410static inline int security_task_kill(struct task_struct *p,
1411 struct kernel_siginfo *info, int sig,
1412 const struct cred *cred)
1413{
1414 return 0;
1415}
1416
1417static inline int security_task_prctl(int option, unsigned long arg2,
1418 unsigned long arg3,
1419 unsigned long arg4,
1420 unsigned long arg5)
1421{
1422 return cap_task_prctl(option, arg2, arg3, arg4, arg5);
1423}
1424
1425static inline void security_task_to_inode(struct task_struct *p, struct inode *inode)
1426{ }
1427
1428static inline int security_create_user_ns(const struct cred *cred)
1429{
1430 return 0;
1431}
1432
1433static inline int security_ipc_permission(struct kern_ipc_perm *ipcp,
1434 short flag)
1435{
1436 return 0;
1437}
1438
1439static inline void security_ipc_getlsmprop(struct kern_ipc_perm *ipcp,
1440 struct lsm_prop *prop)
1441{
1442 lsmprop_init(prop);
1443}
1444
1445static inline int security_msg_msg_alloc(struct msg_msg *msg)
1446{
1447 return 0;
1448}
1449
1450static inline void security_msg_msg_free(struct msg_msg *msg)
1451{ }
1452
1453static inline int security_msg_queue_alloc(struct kern_ipc_perm *msq)
1454{
1455 return 0;
1456}
1457
1458static inline void security_msg_queue_free(struct kern_ipc_perm *msq)
1459{ }
1460
1461static inline int security_msg_queue_associate(struct kern_ipc_perm *msq,
1462 int msqflg)
1463{
1464 return 0;
1465}
1466
1467static inline int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
1468{
1469 return 0;
1470}
1471
1472static inline int security_msg_queue_msgsnd(struct kern_ipc_perm *msq,
1473 struct msg_msg *msg, int msqflg)
1474{
1475 return 0;
1476}
1477
1478static inline int security_msg_queue_msgrcv(struct kern_ipc_perm *msq,
1479 struct msg_msg *msg,
1480 struct task_struct *target,
1481 long type, int mode)
1482{
1483 return 0;
1484}
1485
1486static inline int security_shm_alloc(struct kern_ipc_perm *shp)
1487{
1488 return 0;
1489}
1490
1491static inline void security_shm_free(struct kern_ipc_perm *shp)
1492{ }
1493
1494static inline int security_shm_associate(struct kern_ipc_perm *shp,
1495 int shmflg)
1496{
1497 return 0;
1498}
1499
1500static inline int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
1501{
1502 return 0;
1503}
1504
1505static inline int security_shm_shmat(struct kern_ipc_perm *shp,
1506 char __user *shmaddr, int shmflg)
1507{
1508 return 0;
1509}
1510
1511static inline int security_sem_alloc(struct kern_ipc_perm *sma)
1512{
1513 return 0;
1514}
1515
1516static inline void security_sem_free(struct kern_ipc_perm *sma)
1517{ }
1518
1519static inline int security_sem_associate(struct kern_ipc_perm *sma, int semflg)
1520{
1521 return 0;
1522}
1523
1524static inline int security_sem_semctl(struct kern_ipc_perm *sma, int cmd)
1525{
1526 return 0;
1527}
1528
1529static inline int security_sem_semop(struct kern_ipc_perm *sma,
1530 struct sembuf *sops, unsigned nsops,
1531 int alter)
1532{
1533 return 0;
1534}
1535
1536static inline void security_d_instantiate(struct dentry *dentry,
1537 struct inode *inode)
1538{ }
1539
1540static inline int security_getselfattr(unsigned int attr,
1541 struct lsm_ctx __user *ctx,
1542 size_t __user *size, u32 flags)
1543{
1544 return -EOPNOTSUPP;
1545}
1546
1547static inline int security_setselfattr(unsigned int attr,
1548 struct lsm_ctx __user *ctx,
1549 size_t size, u32 flags)
1550{
1551 return -EOPNOTSUPP;
1552}
1553
1554static inline int security_getprocattr(struct task_struct *p, int lsmid,
1555 const char *name, char **value)
1556{
1557 return -EINVAL;
1558}
1559
1560static inline int security_setprocattr(int lsmid, char *name, void *value,
1561 size_t size)
1562{
1563 return -EINVAL;
1564}
1565
1566static inline int security_ismaclabel(const char *name)
1567{
1568 return 0;
1569}
1570
1571static inline int security_secid_to_secctx(u32 secid, struct lsm_context *cp)
1572{
1573 return -EOPNOTSUPP;
1574}
1575
1576static inline int security_lsmprop_to_secctx(struct lsm_prop *prop,
1577 struct lsm_context *cp,
1578 int lsmid)
1579{
1580 return -EOPNOTSUPP;
1581}
1582
1583static inline int security_secctx_to_secid(const char *secdata,
1584 u32 seclen,
1585 u32 *secid)
1586{
1587 return -EOPNOTSUPP;
1588}
1589
1590static inline void security_release_secctx(struct lsm_context *cp)
1591{
1592}
1593
1594static inline void security_inode_invalidate_secctx(struct inode *inode)
1595{
1596}
1597
1598static inline int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
1599{
1600 return -EOPNOTSUPP;
1601}
1602static inline int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
1603{
1604 return -EOPNOTSUPP;
1605}
1606static inline int security_inode_getsecctx(struct inode *inode,
1607 struct lsm_context *cp)
1608{
1609 return -EOPNOTSUPP;
1610}
1611static inline int security_locked_down(enum lockdown_reason what)
1612{
1613 return 0;
1614}
1615static inline int lsm_fill_user_ctx(struct lsm_ctx __user *uctx,
1616 u32 *uctx_len, void *val, size_t val_len,
1617 u64 id, u64 flags)
1618{
1619 return -EOPNOTSUPP;
1620}
1621
1622static inline int security_bdev_alloc(struct block_device *bdev)
1623{
1624 return 0;
1625}
1626
1627static inline void security_bdev_free(struct block_device *bdev)
1628{
1629}
1630
1631static inline int security_bdev_setintegrity(struct block_device *bdev,
1632 enum lsm_integrity_type type,
1633 const void *value, size_t size)
1634{
1635 return 0;
1636}
1637
1638#endif /* CONFIG_SECURITY */
1639
1640#if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE)
1641int security_post_notification(const struct cred *w_cred,
1642 const struct cred *cred,
1643 struct watch_notification *n);
1644#else
1645static inline int security_post_notification(const struct cred *w_cred,
1646 const struct cred *cred,
1647 struct watch_notification *n)
1648{
1649 return 0;
1650}
1651#endif
1652
1653#if defined(CONFIG_SECURITY) && defined(CONFIG_KEY_NOTIFICATIONS)
1654int security_watch_key(struct key *key);
1655#else
1656static inline int security_watch_key(struct key *key)
1657{
1658 return 0;
1659}
1660#endif
1661
1662#ifdef CONFIG_SECURITY_NETWORK
1663
1664int security_netlink_send(struct sock *sk, struct sk_buff *skb);
1665int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk);
1666int security_unix_may_send(struct socket *sock, struct socket *other);
1667int security_socket_create(int family, int type, int protocol, int kern);
1668int security_socket_post_create(struct socket *sock, int family,
1669 int type, int protocol, int kern);
1670int security_socket_socketpair(struct socket *socka, struct socket *sockb);
1671int security_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen);
1672int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen);
1673int security_socket_listen(struct socket *sock, int backlog);
1674int security_socket_accept(struct socket *sock, struct socket *newsock);
1675int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size);
1676int security_socket_recvmsg(struct socket *sock, struct msghdr *msg,
1677 int size, int flags);
1678int security_socket_getsockname(struct socket *sock);
1679int security_socket_getpeername(struct socket *sock);
1680int security_socket_getsockopt(struct socket *sock, int level, int optname);
1681int security_socket_setsockopt(struct socket *sock, int level, int optname);
1682int security_socket_shutdown(struct socket *sock, int how);
1683int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb);
1684int security_socket_getpeersec_stream(struct socket *sock, sockptr_t optval,
1685 sockptr_t optlen, unsigned int len);
1686int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid);
1687int security_sk_alloc(struct sock *sk, int family, gfp_t priority);
1688void security_sk_free(struct sock *sk);
1689void security_sk_clone(const struct sock *sk, struct sock *newsk);
1690void security_sk_classify_flow(const struct sock *sk,
1691 struct flowi_common *flic);
1692void security_req_classify_flow(const struct request_sock *req,
1693 struct flowi_common *flic);
1694void security_sock_graft(struct sock*sk, struct socket *parent);
1695int security_inet_conn_request(const struct sock *sk,
1696 struct sk_buff *skb, struct request_sock *req);
1697void security_inet_csk_clone(struct sock *newsk,
1698 const struct request_sock *req);
1699void security_inet_conn_established(struct sock *sk,
1700 struct sk_buff *skb);
1701int security_secmark_relabel_packet(u32 secid);
1702void security_secmark_refcount_inc(void);
1703void security_secmark_refcount_dec(void);
1704int security_tun_dev_alloc_security(void **security);
1705void security_tun_dev_free_security(void *security);
1706int security_tun_dev_create(void);
1707int security_tun_dev_attach_queue(void *security);
1708int security_tun_dev_attach(struct sock *sk, void *security);
1709int security_tun_dev_open(void *security);
1710int security_sctp_assoc_request(struct sctp_association *asoc, struct sk_buff *skb);
1711int security_sctp_bind_connect(struct sock *sk, int optname,
1712 struct sockaddr *address, int addrlen);
1713void security_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk,
1714 struct sock *newsk);
1715int security_sctp_assoc_established(struct sctp_association *asoc,
1716 struct sk_buff *skb);
1717int security_mptcp_add_subflow(struct sock *sk, struct sock *ssk);
1718
1719#else /* CONFIG_SECURITY_NETWORK */
1720static inline int security_netlink_send(struct sock *sk, struct sk_buff *skb)
1721{
1722 return 0;
1723}
1724
1725static inline int security_unix_stream_connect(struct sock *sock,
1726 struct sock *other,
1727 struct sock *newsk)
1728{
1729 return 0;
1730}
1731
1732static inline int security_unix_may_send(struct socket *sock,
1733 struct socket *other)
1734{
1735 return 0;
1736}
1737
1738static inline int security_socket_create(int family, int type,
1739 int protocol, int kern)
1740{
1741 return 0;
1742}
1743
1744static inline int security_socket_post_create(struct socket *sock,
1745 int family,
1746 int type,
1747 int protocol, int kern)
1748{
1749 return 0;
1750}
1751
1752static inline int security_socket_socketpair(struct socket *socka,
1753 struct socket *sockb)
1754{
1755 return 0;
1756}
1757
1758static inline int security_socket_bind(struct socket *sock,
1759 struct sockaddr *address,
1760 int addrlen)
1761{
1762 return 0;
1763}
1764
1765static inline int security_socket_connect(struct socket *sock,
1766 struct sockaddr *address,
1767 int addrlen)
1768{
1769 return 0;
1770}
1771
1772static inline int security_socket_listen(struct socket *sock, int backlog)
1773{
1774 return 0;
1775}
1776
1777static inline int security_socket_accept(struct socket *sock,
1778 struct socket *newsock)
1779{
1780 return 0;
1781}
1782
1783static inline int security_socket_sendmsg(struct socket *sock,
1784 struct msghdr *msg, int size)
1785{
1786 return 0;
1787}
1788
1789static inline int security_socket_recvmsg(struct socket *sock,
1790 struct msghdr *msg, int size,
1791 int flags)
1792{
1793 return 0;
1794}
1795
1796static inline int security_socket_getsockname(struct socket *sock)
1797{
1798 return 0;
1799}
1800
1801static inline int security_socket_getpeername(struct socket *sock)
1802{
1803 return 0;
1804}
1805
1806static inline int security_socket_getsockopt(struct socket *sock,
1807 int level, int optname)
1808{
1809 return 0;
1810}
1811
1812static inline int security_socket_setsockopt(struct socket *sock,
1813 int level, int optname)
1814{
1815 return 0;
1816}
1817
1818static inline int security_socket_shutdown(struct socket *sock, int how)
1819{
1820 return 0;
1821}
1822static inline int security_sock_rcv_skb(struct sock *sk,
1823 struct sk_buff *skb)
1824{
1825 return 0;
1826}
1827
1828static inline int security_socket_getpeersec_stream(struct socket *sock,
1829 sockptr_t optval,
1830 sockptr_t optlen,
1831 unsigned int len)
1832{
1833 return -ENOPROTOOPT;
1834}
1835
1836static inline int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
1837{
1838 return -ENOPROTOOPT;
1839}
1840
1841static inline int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
1842{
1843 return 0;
1844}
1845
1846static inline void security_sk_free(struct sock *sk)
1847{
1848}
1849
1850static inline void security_sk_clone(const struct sock *sk, struct sock *newsk)
1851{
1852}
1853
1854static inline void security_sk_classify_flow(const struct sock *sk,
1855 struct flowi_common *flic)
1856{
1857}
1858
1859static inline void security_req_classify_flow(const struct request_sock *req,
1860 struct flowi_common *flic)
1861{
1862}
1863
1864static inline void security_sock_graft(struct sock *sk, struct socket *parent)
1865{
1866}
1867
1868static inline int security_inet_conn_request(const struct sock *sk,
1869 struct sk_buff *skb, struct request_sock *req)
1870{
1871 return 0;
1872}
1873
1874static inline void security_inet_csk_clone(struct sock *newsk,
1875 const struct request_sock *req)
1876{
1877}
1878
1879static inline void security_inet_conn_established(struct sock *sk,
1880 struct sk_buff *skb)
1881{
1882}
1883
1884static inline int security_secmark_relabel_packet(u32 secid)
1885{
1886 return 0;
1887}
1888
1889static inline void security_secmark_refcount_inc(void)
1890{
1891}
1892
1893static inline void security_secmark_refcount_dec(void)
1894{
1895}
1896
1897static inline int security_tun_dev_alloc_security(void **security)
1898{
1899 return 0;
1900}
1901
1902static inline void security_tun_dev_free_security(void *security)
1903{
1904}
1905
1906static inline int security_tun_dev_create(void)
1907{
1908 return 0;
1909}
1910
1911static inline int security_tun_dev_attach_queue(void *security)
1912{
1913 return 0;
1914}
1915
1916static inline int security_tun_dev_attach(struct sock *sk, void *security)
1917{
1918 return 0;
1919}
1920
1921static inline int security_tun_dev_open(void *security)
1922{
1923 return 0;
1924}
1925
1926static inline int security_sctp_assoc_request(struct sctp_association *asoc,
1927 struct sk_buff *skb)
1928{
1929 return 0;
1930}
1931
1932static inline int security_sctp_bind_connect(struct sock *sk, int optname,
1933 struct sockaddr *address,
1934 int addrlen)
1935{
1936 return 0;
1937}
1938
1939static inline void security_sctp_sk_clone(struct sctp_association *asoc,
1940 struct sock *sk,
1941 struct sock *newsk)
1942{
1943}
1944
1945static inline int security_sctp_assoc_established(struct sctp_association *asoc,
1946 struct sk_buff *skb)
1947{
1948 return 0;
1949}
1950
1951static inline int security_mptcp_add_subflow(struct sock *sk, struct sock *ssk)
1952{
1953 return 0;
1954}
1955#endif /* CONFIG_SECURITY_NETWORK */
1956
1957#if defined(CONFIG_SECURITY_NETWORK) && defined(CONFIG_SECURITY_PATH)
1958
1959int security_unix_find(const struct path *path, struct sock *other, int flags);
1960
1961#else /* CONFIG_SECURITY_NETWORK && CONFIG_SECURITY_PATH */
1962static inline int security_unix_find(const struct path *path, struct sock *other, int flags)
1963{
1964 return 0;
1965}
1966#endif /* CONFIG_SECURITY_NETWORK && CONFIG_SECURITY_PATH */
1967
1968#ifdef CONFIG_SECURITY_INFINIBAND
1969int security_ib_pkey_access(void *sec, u64 subnet_prefix, u16 pkey);
1970int security_ib_endport_manage_subnet(void *sec, const char *name, u8 port_num);
1971int security_ib_alloc_security(void **sec);
1972void security_ib_free_security(void *sec);
1973#else /* CONFIG_SECURITY_INFINIBAND */
1974static inline int security_ib_pkey_access(void *sec, u64 subnet_prefix, u16 pkey)
1975{
1976 return 0;
1977}
1978
1979static inline int security_ib_endport_manage_subnet(void *sec, const char *dev_name, u8 port_num)
1980{
1981 return 0;
1982}
1983
1984static inline int security_ib_alloc_security(void **sec)
1985{
1986 return 0;
1987}
1988
1989static inline void security_ib_free_security(void *sec)
1990{
1991}
1992#endif /* CONFIG_SECURITY_INFINIBAND */
1993
1994#ifdef CONFIG_SECURITY_NETWORK_XFRM
1995
1996int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
1997 struct xfrm_user_sec_ctx *sec_ctx, gfp_t gfp);
1998int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctxp);
1999void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
2000int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx);
2001int security_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx);
2002int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
2003 struct xfrm_sec_ctx *polsec, u32 secid);
2004int security_xfrm_state_delete(struct xfrm_state *x);
2005void security_xfrm_state_free(struct xfrm_state *x);
2006int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid);
2007int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
2008 struct xfrm_policy *xp,
2009 const struct flowi_common *flic);
2010int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid);
2011void security_skb_classify_flow(struct sk_buff *skb, struct flowi_common *flic);
2012
2013#else /* CONFIG_SECURITY_NETWORK_XFRM */
2014
2015static inline int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
2016 struct xfrm_user_sec_ctx *sec_ctx,
2017 gfp_t gfp)
2018{
2019 return 0;
2020}
2021
2022static inline int security_xfrm_policy_clone(struct xfrm_sec_ctx *old, struct xfrm_sec_ctx **new_ctxp)
2023{
2024 return 0;
2025}
2026
2027static inline void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
2028{
2029}
2030
2031static inline int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
2032{
2033 return 0;
2034}
2035
2036static inline int security_xfrm_state_alloc(struct xfrm_state *x,
2037 struct xfrm_user_sec_ctx *sec_ctx)
2038{
2039 return 0;
2040}
2041
2042static inline int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
2043 struct xfrm_sec_ctx *polsec, u32 secid)
2044{
2045 return 0;
2046}
2047
2048static inline void security_xfrm_state_free(struct xfrm_state *x)
2049{
2050}
2051
2052static inline int security_xfrm_state_delete(struct xfrm_state *x)
2053{
2054 return 0;
2055}
2056
2057static inline int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid)
2058{
2059 return 0;
2060}
2061
2062static inline int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
2063 struct xfrm_policy *xp,
2064 const struct flowi_common *flic)
2065{
2066 return 1;
2067}
2068
2069static inline int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
2070{
2071 return 0;
2072}
2073
2074static inline void security_skb_classify_flow(struct sk_buff *skb,
2075 struct flowi_common *flic)
2076{
2077}
2078
2079#endif /* CONFIG_SECURITY_NETWORK_XFRM */
2080
2081#ifdef CONFIG_SECURITY_PATH
2082int security_path_unlink(const struct path *dir, struct dentry *dentry);
2083int security_path_mkdir(const struct path *dir, struct dentry *dentry, umode_t mode);
2084int security_path_rmdir(const struct path *dir, struct dentry *dentry);
2085int security_path_mknod(const struct path *dir, struct dentry *dentry, umode_t mode,
2086 unsigned int dev);
2087void security_path_post_mknod(struct mnt_idmap *idmap, struct dentry *dentry);
2088int security_path_truncate(const struct path *path);
2089int security_path_symlink(const struct path *dir, struct dentry *dentry,
2090 const char *old_name);
2091int security_path_link(struct dentry *old_dentry, const struct path *new_dir,
2092 struct dentry *new_dentry);
2093int security_path_rename(const struct path *old_dir, struct dentry *old_dentry,
2094 const struct path *new_dir, struct dentry *new_dentry,
2095 unsigned int flags);
2096int security_path_chmod(const struct path *path, umode_t mode);
2097int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid);
2098int security_path_chroot(const struct path *path);
2099#else /* CONFIG_SECURITY_PATH */
2100static inline int security_path_unlink(const struct path *dir, struct dentry *dentry)
2101{
2102 return 0;
2103}
2104
2105static inline int security_path_mkdir(const struct path *dir, struct dentry *dentry,
2106 umode_t mode)
2107{
2108 return 0;
2109}
2110
2111static inline int security_path_rmdir(const struct path *dir, struct dentry *dentry)
2112{
2113 return 0;
2114}
2115
2116static inline int security_path_mknod(const struct path *dir, struct dentry *dentry,
2117 umode_t mode, unsigned int dev)
2118{
2119 return 0;
2120}
2121
2122static inline void security_path_post_mknod(struct mnt_idmap *idmap,
2123 struct dentry *dentry)
2124{ }
2125
2126static inline int security_path_truncate(const struct path *path)
2127{
2128 return 0;
2129}
2130
2131static inline int security_path_symlink(const struct path *dir, struct dentry *dentry,
2132 const char *old_name)
2133{
2134 return 0;
2135}
2136
2137static inline int security_path_link(struct dentry *old_dentry,
2138 const struct path *new_dir,
2139 struct dentry *new_dentry)
2140{
2141 return 0;
2142}
2143
2144static inline int security_path_rename(const struct path *old_dir,
2145 struct dentry *old_dentry,
2146 const struct path *new_dir,
2147 struct dentry *new_dentry,
2148 unsigned int flags)
2149{
2150 return 0;
2151}
2152
2153static inline int security_path_chmod(const struct path *path, umode_t mode)
2154{
2155 return 0;
2156}
2157
2158static inline int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
2159{
2160 return 0;
2161}
2162
2163static inline int security_path_chroot(const struct path *path)
2164{
2165 return 0;
2166}
2167#endif /* CONFIG_SECURITY_PATH */
2168
2169#ifdef CONFIG_KEYS
2170#ifdef CONFIG_SECURITY
2171
2172int security_key_alloc(struct key *key, const struct cred *cred, unsigned long flags);
2173void security_key_free(struct key *key);
2174int security_key_permission(key_ref_t key_ref, const struct cred *cred,
2175 enum key_need_perm need_perm);
2176int security_key_getsecurity(struct key *key, char **_buffer);
2177void security_key_post_create_or_update(struct key *keyring, struct key *key,
2178 const void *payload, size_t payload_len,
2179 unsigned long flags, bool create);
2180
2181#else
2182
2183static inline int security_key_alloc(struct key *key,
2184 const struct cred *cred,
2185 unsigned long flags)
2186{
2187 return 0;
2188}
2189
2190static inline void security_key_free(struct key *key)
2191{
2192}
2193
2194static inline int security_key_permission(key_ref_t key_ref,
2195 const struct cred *cred,
2196 enum key_need_perm need_perm)
2197{
2198 return 0;
2199}
2200
2201static inline int security_key_getsecurity(struct key *key, char **_buffer)
2202{
2203 *_buffer = NULL;
2204 return 0;
2205}
2206
2207static inline void security_key_post_create_or_update(struct key *keyring,
2208 struct key *key,
2209 const void *payload,
2210 size_t payload_len,
2211 unsigned long flags,
2212 bool create)
2213{ }
2214
2215#endif
2216#endif /* CONFIG_KEYS */
2217
2218#ifdef CONFIG_AUDIT
2219#ifdef CONFIG_SECURITY
2220int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule,
2221 gfp_t gfp);
2222int security_audit_rule_known(struct audit_krule *krule);
2223int security_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op,
2224 void *lsmrule);
2225void security_audit_rule_free(void *lsmrule);
2226
2227#else
2228
2229static inline int security_audit_rule_init(u32 field, u32 op, char *rulestr,
2230 void **lsmrule, gfp_t gfp)
2231{
2232 return 0;
2233}
2234
2235static inline int security_audit_rule_known(struct audit_krule *krule)
2236{
2237 return 0;
2238}
2239
2240static inline int security_audit_rule_match(struct lsm_prop *prop, u32 field,
2241 u32 op, void *lsmrule)
2242{
2243 return 0;
2244}
2245
2246static inline void security_audit_rule_free(void *lsmrule)
2247{ }
2248
2249#endif /* CONFIG_SECURITY */
2250#endif /* CONFIG_AUDIT */
2251
2252#ifdef CONFIG_SECURITYFS
2253
2254extern struct dentry *securityfs_create_file(const char *name, umode_t mode,
2255 struct dentry *parent, void *data,
2256 const struct file_operations *fops);
2257extern struct dentry *securityfs_create_dir(const char *name, struct dentry *parent);
2258struct dentry *securityfs_create_symlink(const char *name,
2259 struct dentry *parent,
2260 const char *target,
2261 const struct inode_operations *iops);
2262extern void securityfs_remove(struct dentry *dentry);
2263
2264#else /* CONFIG_SECURITYFS */
2265
2266static inline struct dentry *securityfs_create_dir(const char *name,
2267 struct dentry *parent)
2268{
2269 return ERR_PTR(-ENODEV);
2270}
2271
2272static inline struct dentry *securityfs_create_file(const char *name,
2273 umode_t mode,
2274 struct dentry *parent,
2275 void *data,
2276 const struct file_operations *fops)
2277{
2278 return ERR_PTR(-ENODEV);
2279}
2280
2281static inline struct dentry *securityfs_create_symlink(const char *name,
2282 struct dentry *parent,
2283 const char *target,
2284 const struct inode_operations *iops)
2285{
2286 return ERR_PTR(-ENODEV);
2287}
2288
2289static inline void securityfs_remove(struct dentry *dentry)
2290{}
2291
2292#endif
2293
2294#ifdef CONFIG_BPF_SYSCALL
2295union bpf_attr;
2296struct bpf_map;
2297struct bpf_prog;
2298struct bpf_token;
2299#ifdef CONFIG_SECURITY
2300extern int security_bpf(int cmd, union bpf_attr *attr, unsigned int size, bool kernel);
2301extern int security_bpf_map(struct bpf_map *map, fmode_t fmode);
2302extern int security_bpf_prog(struct bpf_prog *prog);
2303extern int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
2304 struct bpf_token *token, bool kernel);
2305extern void security_bpf_map_free(struct bpf_map *map);
2306extern int security_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,
2307 struct bpf_token *token, bool kernel);
2308extern void security_bpf_prog_free(struct bpf_prog *prog);
2309extern int security_bpf_token_create(struct bpf_token *token, union bpf_attr *attr,
2310 const struct path *path);
2311extern void security_bpf_token_free(struct bpf_token *token);
2312extern int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cmd);
2313extern int security_bpf_token_capable(const struct bpf_token *token, int cap);
2314#else
2315static inline int security_bpf(int cmd, union bpf_attr *attr,
2316 unsigned int size, bool kernel)
2317{
2318 return 0;
2319}
2320
2321static inline int security_bpf_map(struct bpf_map *map, fmode_t fmode)
2322{
2323 return 0;
2324}
2325
2326static inline int security_bpf_prog(struct bpf_prog *prog)
2327{
2328 return 0;
2329}
2330
2331static inline int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
2332 struct bpf_token *token, bool kernel)
2333{
2334 return 0;
2335}
2336
2337static inline void security_bpf_map_free(struct bpf_map *map)
2338{ }
2339
2340static inline int security_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,
2341 struct bpf_token *token, bool kernel)
2342{
2343 return 0;
2344}
2345
2346static inline void security_bpf_prog_free(struct bpf_prog *prog)
2347{ }
2348
2349static inline int security_bpf_token_create(struct bpf_token *token, union bpf_attr *attr,
2350 const struct path *path)
2351{
2352 return 0;
2353}
2354
2355static inline void security_bpf_token_free(struct bpf_token *token)
2356{ }
2357
2358static inline int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cmd)
2359{
2360 return 0;
2361}
2362
2363static inline int security_bpf_token_capable(const struct bpf_token *token, int cap)
2364{
2365 return 0;
2366}
2367#endif /* CONFIG_SECURITY */
2368#endif /* CONFIG_BPF_SYSCALL */
2369
2370#ifdef CONFIG_PERF_EVENTS
2371struct perf_event_attr;
2372struct perf_event;
2373
2374#ifdef CONFIG_SECURITY
2375extern int security_perf_event_open(int type);
2376extern int security_perf_event_alloc(struct perf_event *event);
2377extern void security_perf_event_free(struct perf_event *event);
2378extern int security_perf_event_read(struct perf_event *event);
2379extern int security_perf_event_write(struct perf_event *event);
2380#else
2381static inline int security_perf_event_open(int type)
2382{
2383 return 0;
2384}
2385
2386static inline int security_perf_event_alloc(struct perf_event *event)
2387{
2388 return 0;
2389}
2390
2391static inline void security_perf_event_free(struct perf_event *event)
2392{
2393}
2394
2395static inline int security_perf_event_read(struct perf_event *event)
2396{
2397 return 0;
2398}
2399
2400static inline int security_perf_event_write(struct perf_event *event)
2401{
2402 return 0;
2403}
2404#endif /* CONFIG_SECURITY */
2405#endif /* CONFIG_PERF_EVENTS */
2406
2407#ifdef CONFIG_IO_URING
2408#ifdef CONFIG_SECURITY
2409extern int security_uring_override_creds(const struct cred *new);
2410extern int security_uring_sqpoll(void);
2411extern int security_uring_cmd(struct io_uring_cmd *ioucmd);
2412extern int security_uring_allowed(void);
2413#else
2414static inline int security_uring_override_creds(const struct cred *new)
2415{
2416 return 0;
2417}
2418static inline int security_uring_sqpoll(void)
2419{
2420 return 0;
2421}
2422static inline int security_uring_cmd(struct io_uring_cmd *ioucmd)
2423{
2424 return 0;
2425}
2426static inline int security_uring_allowed(void)
2427{
2428 return 0;
2429}
2430#endif /* CONFIG_SECURITY */
2431#endif /* CONFIG_IO_URING */
2432
2433#ifdef CONFIG_SECURITY
2434extern void security_initramfs_populated(void);
2435#else
2436static inline void security_initramfs_populated(void)
2437{
2438}
2439#endif /* CONFIG_SECURITY */
2440
2441#endif /* ! __LINUX_SECURITY_H */