aboutsummaryrefslogtreecommitdiffstats
path: root/security/security.c
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2015-06-27 16:26:03 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2015-06-27 16:26:03 -0400
commite22619a29fcdb513b7bc020e84225bb3b5914259 (patch)
tree1d1d72a4c8cebad4f2d2bf738395ca4ececa95ec /security/security.c
parent78c10e556ed904d5bfbd71e9cadd8ce8f25d6982 (diff)
parentb3bddffd35a0b77eee89760eb94cafa18dc431f5 (diff)
Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
Pull security subsystem updates from James Morris: "The main change in this kernel is Casey's generalized LSM stacking work, which removes the hard-coding of Capabilities and Yama stacking, allowing multiple arbitrary "small" LSMs to be stacked with a default monolithic module (e.g. SELinux, Smack, AppArmor). See https://lwn.net/Articles/636056/ This will allow smaller, simpler LSMs to be incorporated into the mainline kernel and arbitrarily stacked by users. Also, this is a useful cleanup of the LSM code in its own right" * 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (38 commits) tpm, tpm_crb: fix le64_to_cpu conversions in crb_acpi_add() vTPM: set virtual device before passing to ibmvtpm_reset_crq tpm_ibmvtpm: remove unneccessary message level. ima: update builtin policies ima: extend "mask" policy matching support ima: add support for new "euid" policy condition ima: fix ima_show_template_data_ascii() Smack: freeing an error pointer in smk_write_revoke_subj() selinux: fix setting of security labels on NFS selinux: Remove unused permission definitions selinux: enable genfscon labeling for sysfs and pstore files selinux: enable per-file labeling for debugfs files. selinux: update netlink socket classes signals: don't abuse __flush_signals() in selinux_bprm_committed_creds() selinux: Print 'sclass' as string when unrecognized netlink message occurs Smack: allow multiple labels in onlycap Smack: fix seq operations in smackfs ima: pass iint to ima_add_violation() ima: wrap event related data to the new ima_event_data structure integrity: add validity checks for 'path' parameter ...
Diffstat (limited to 'security/security.c')
-rw-r--r--security/security.c955
1 files changed, 676 insertions, 279 deletions
diff --git a/security/security.c b/security/security.c
index 04c8feca081a..595fffab48b0 100644
--- a/security/security.c
+++ b/security/security.c
@@ -16,7 +16,7 @@
16#include <linux/module.h> 16#include <linux/module.h>
17#include <linux/init.h> 17#include <linux/init.h>
18#include <linux/kernel.h> 18#include <linux/kernel.h>
19#include <linux/security.h> 19#include <linux/lsm_hooks.h>
20#include <linux/integrity.h> 20#include <linux/integrity.h>
21#include <linux/ima.h> 21#include <linux/ima.h>
22#include <linux/evm.h> 22#include <linux/evm.h>
@@ -29,24 +29,13 @@
29 29
30#define MAX_LSM_EVM_XATTR 2 30#define MAX_LSM_EVM_XATTR 2
31 31
32/* Maximum number of letters for an LSM name string */
33#define SECURITY_NAME_MAX 10
34
32/* Boot-time LSM user choice */ 35/* Boot-time LSM user choice */
33static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] = 36static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] =
34 CONFIG_DEFAULT_SECURITY; 37 CONFIG_DEFAULT_SECURITY;
35 38
36static struct security_operations *security_ops;
37static struct security_operations default_security_ops = {
38 .name = "default",
39};
40
41static inline int __init verify(struct security_operations *ops)
42{
43 /* verify the security_operations structure exists */
44 if (!ops)
45 return -EINVAL;
46 security_fixup_ops(ops);
47 return 0;
48}
49
50static void __init do_security_initcalls(void) 39static void __init do_security_initcalls(void)
51{ 40{
52 initcall_t *call; 41 initcall_t *call;
@@ -64,20 +53,27 @@ static void __init do_security_initcalls(void)
64 */ 53 */
65int __init security_init(void) 54int __init security_init(void)
66{ 55{
67 printk(KERN_INFO "Security Framework initialized\n"); 56 pr_info("Security Framework initialized\n");
68 57
69 security_fixup_ops(&default_security_ops); 58 /*
70 security_ops = &default_security_ops; 59 * Always load the capability module.
60 */
61 capability_add_hooks();
62#ifdef CONFIG_SECURITY_YAMA_STACKED
63 /*
64 * If Yama is configured for stacking load it next.
65 */
66 yama_add_hooks();
67#endif
68 /*
69 * Load the chosen module if there is one.
70 * This will also find yama if it is stacking
71 */
71 do_security_initcalls(); 72 do_security_initcalls();
72 73
73 return 0; 74 return 0;
74} 75}
75 76
76void reset_security_ops(void)
77{
78 security_ops = &default_security_ops;
79}
80
81/* Save user chosen LSM */ 77/* Save user chosen LSM */
82static int __init choose_lsm(char *str) 78static int __init choose_lsm(char *str)
83{ 79{
@@ -88,7 +84,7 @@ __setup("security=", choose_lsm);
88 84
89/** 85/**
90 * security_module_enable - Load given security module on boot ? 86 * security_module_enable - Load given security module on boot ?
91 * @ops: a pointer to the struct security_operations that is to be checked. 87 * @module: the name of the module
92 * 88 *
93 * Each LSM must pass this method before registering its own operations 89 * Each LSM must pass this method before registering its own operations
94 * to avoid security registration races. This method may also be used 90 * to avoid security registration races. This method may also be used
@@ -100,84 +96,76 @@ __setup("security=", choose_lsm);
100 * choose an alternate LSM at boot time. 96 * choose an alternate LSM at boot time.
101 * Otherwise, return false. 97 * Otherwise, return false.
102 */ 98 */
103int __init security_module_enable(struct security_operations *ops) 99int __init security_module_enable(const char *module)
104{ 100{
105 return !strcmp(ops->name, chosen_lsm); 101 return !strcmp(module, chosen_lsm);
106} 102}
107 103
108/** 104/*
109 * register_security - registers a security framework with the kernel 105 * Hook list operation macros.
110 * @ops: a pointer to the struct security_options that is to be registered
111 * 106 *
112 * This function allows a security module to register itself with the 107 * call_void_hook:
113 * kernel security subsystem. Some rudimentary checking is done on the @ops 108 * This is a hook that does not return a value.
114 * value passed to this function. You'll need to check first if your LSM
115 * is allowed to register its @ops by calling security_module_enable(@ops).
116 * 109 *
117 * If there is already a security module registered with the kernel, 110 * call_int_hook:
118 * an error will be returned. Otherwise %0 is returned on success. 111 * This is a hook that returns a value.
119 */ 112 */
120int __init register_security(struct security_operations *ops)
121{
122 if (verify(ops)) {
123 printk(KERN_DEBUG "%s could not verify "
124 "security_operations structure.\n", __func__);
125 return -EINVAL;
126 }
127
128 if (security_ops != &default_security_ops)
129 return -EAGAIN;
130 113
131 security_ops = ops; 114#define call_void_hook(FUNC, ...) \
132 115 do { \
133 return 0; 116 struct security_hook_list *P; \
134} 117 \
118 list_for_each_entry(P, &security_hook_heads.FUNC, list) \
119 P->hook.FUNC(__VA_ARGS__); \
120 } while (0)
121
122#define call_int_hook(FUNC, IRC, ...) ({ \
123 int RC = IRC; \
124 do { \
125 struct security_hook_list *P; \
126 \
127 list_for_each_entry(P, &security_hook_heads.FUNC, list) { \
128 RC = P->hook.FUNC(__VA_ARGS__); \
129 if (RC != 0) \
130 break; \
131 } \
132 } while (0); \
133 RC; \
134})
135 135
136/* Security operations */ 136/* Security operations */
137 137
138int security_binder_set_context_mgr(struct task_struct *mgr) 138int security_binder_set_context_mgr(struct task_struct *mgr)
139{ 139{
140 return security_ops->binder_set_context_mgr(mgr); 140 return call_int_hook(binder_set_context_mgr, 0, mgr);
141} 141}
142 142
143int security_binder_transaction(struct task_struct *from, 143int security_binder_transaction(struct task_struct *from,
144 struct task_struct *to) 144 struct task_struct *to)
145{ 145{
146 return security_ops->binder_transaction(from, to); 146 return call_int_hook(binder_transaction, 0, from, to);
147} 147}
148 148
149int security_binder_transfer_binder(struct task_struct *from, 149int security_binder_transfer_binder(struct task_struct *from,
150 struct task_struct *to) 150 struct task_struct *to)
151{ 151{
152 return security_ops->binder_transfer_binder(from, to); 152 return call_int_hook(binder_transfer_binder, 0, from, to);
153} 153}
154 154
155int security_binder_transfer_file(struct task_struct *from, 155int security_binder_transfer_file(struct task_struct *from,
156 struct task_struct *to, struct file *file) 156 struct task_struct *to, struct file *file)
157{ 157{
158 return security_ops->binder_transfer_file(from, to, file); 158 return call_int_hook(binder_transfer_file, 0, from, to, file);
159} 159}
160 160
161int security_ptrace_access_check(struct task_struct *child, unsigned int mode) 161int security_ptrace_access_check(struct task_struct *child, unsigned int mode)
162{ 162{
163#ifdef CONFIG_SECURITY_YAMA_STACKED 163 return call_int_hook(ptrace_access_check, 0, child, mode);
164 int rc;
165 rc = yama_ptrace_access_check(child, mode);
166 if (rc)
167 return rc;
168#endif
169 return security_ops->ptrace_access_check(child, mode);
170} 164}
171 165
172int security_ptrace_traceme(struct task_struct *parent) 166int security_ptrace_traceme(struct task_struct *parent)
173{ 167{
174#ifdef CONFIG_SECURITY_YAMA_STACKED 168 return call_int_hook(ptrace_traceme, 0, parent);
175 int rc;
176 rc = yama_ptrace_traceme(parent);
177 if (rc)
178 return rc;
179#endif
180 return security_ops->ptrace_traceme(parent);
181} 169}
182 170
183int security_capget(struct task_struct *target, 171int security_capget(struct task_struct *target,
@@ -185,7 +173,8 @@ int security_capget(struct task_struct *target,
185 kernel_cap_t *inheritable, 173 kernel_cap_t *inheritable,
186 kernel_cap_t *permitted) 174 kernel_cap_t *permitted)
187{ 175{
188 return security_ops->capget(target, effective, inheritable, permitted); 176 return call_int_hook(capget, 0, target,
177 effective, inheritable, permitted);
189} 178}
190 179
191int security_capset(struct cred *new, const struct cred *old, 180int security_capset(struct cred *new, const struct cred *old,
@@ -193,57 +182,75 @@ int security_capset(struct cred *new, const struct cred *old,
193 const kernel_cap_t *inheritable, 182 const kernel_cap_t *inheritable,
194 const kernel_cap_t *permitted) 183 const kernel_cap_t *permitted)
195{ 184{
196 return security_ops->capset(new, old, 185 return call_int_hook(capset, 0, new, old,
197 effective, inheritable, permitted); 186 effective, inheritable, permitted);
198} 187}
199 188
200int security_capable(const struct cred *cred, struct user_namespace *ns, 189int security_capable(const struct cred *cred, struct user_namespace *ns,
201 int cap) 190 int cap)
202{ 191{
203 return security_ops->capable(cred, ns, cap, SECURITY_CAP_AUDIT); 192 return call_int_hook(capable, 0, cred, ns, cap, SECURITY_CAP_AUDIT);
204} 193}
205 194
206int security_capable_noaudit(const struct cred *cred, struct user_namespace *ns, 195int security_capable_noaudit(const struct cred *cred, struct user_namespace *ns,
207 int cap) 196 int cap)
208{ 197{
209 return security_ops->capable(cred, ns, cap, SECURITY_CAP_NOAUDIT); 198 return call_int_hook(capable, 0, cred, ns, cap, SECURITY_CAP_NOAUDIT);
210} 199}
211 200
212int security_quotactl(int cmds, int type, int id, struct super_block *sb) 201int security_quotactl(int cmds, int type, int id, struct super_block *sb)
213{ 202{
214 return security_ops->quotactl(cmds, type, id, sb); 203 return call_int_hook(quotactl, 0, cmds, type, id, sb);
215} 204}
216 205
217int security_quota_on(struct dentry *dentry) 206int security_quota_on(struct dentry *dentry)
218{ 207{
219 return security_ops->quota_on(dentry); 208 return call_int_hook(quota_on, 0, dentry);
220} 209}
221 210
222int security_syslog(int type) 211int security_syslog(int type)
223{ 212{
224 return security_ops->syslog(type); 213 return call_int_hook(syslog, 0, type);
225} 214}
226 215
227int security_settime(const struct timespec *ts, const struct timezone *tz) 216int security_settime(const struct timespec *ts, const struct timezone *tz)
228{ 217{
229 return security_ops->settime(ts, tz); 218 return call_int_hook(settime, 0, ts, tz);
230} 219}
231 220
232int security_vm_enough_memory_mm(struct mm_struct *mm, long pages) 221int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
233{ 222{
234 return security_ops->vm_enough_memory(mm, pages); 223 struct security_hook_list *hp;
224 int cap_sys_admin = 1;
225 int rc;
226
227 /*
228 * The module will respond with a positive value if
229 * it thinks the __vm_enough_memory() call should be
230 * made with the cap_sys_admin set. If all of the modules
231 * agree that it should be set it will. If any module
232 * thinks it should not be set it won't.
233 */
234 list_for_each_entry(hp, &security_hook_heads.vm_enough_memory, list) {
235 rc = hp->hook.vm_enough_memory(mm, pages);
236 if (rc <= 0) {
237 cap_sys_admin = 0;
238 break;
239 }
240 }
241 return __vm_enough_memory(mm, pages, cap_sys_admin);
235} 242}
236 243
237int security_bprm_set_creds(struct linux_binprm *bprm) 244int security_bprm_set_creds(struct linux_binprm *bprm)
238{ 245{
239 return security_ops->bprm_set_creds(bprm); 246 return call_int_hook(bprm_set_creds, 0, bprm);
240} 247}
241 248
242int security_bprm_check(struct linux_binprm *bprm) 249int security_bprm_check(struct linux_binprm *bprm)
243{ 250{
244 int ret; 251 int ret;
245 252
246 ret = security_ops->bprm_check_security(bprm); 253 ret = call_int_hook(bprm_check_security, 0, bprm);
247 if (ret) 254 if (ret)
248 return ret; 255 return ret;
249 return ima_bprm_check(bprm); 256 return ima_bprm_check(bprm);
@@ -251,69 +258,69 @@ int security_bprm_check(struct linux_binprm *bprm)
251 258
252void security_bprm_committing_creds(struct linux_binprm *bprm) 259void security_bprm_committing_creds(struct linux_binprm *bprm)
253{ 260{
254 security_ops->bprm_committing_creds(bprm); 261 call_void_hook(bprm_committing_creds, bprm);
255} 262}
256 263
257void security_bprm_committed_creds(struct linux_binprm *bprm) 264void security_bprm_committed_creds(struct linux_binprm *bprm)
258{ 265{
259 security_ops->bprm_committed_creds(bprm); 266 call_void_hook(bprm_committed_creds, bprm);
260} 267}
261 268
262int security_bprm_secureexec(struct linux_binprm *bprm) 269int security_bprm_secureexec(struct linux_binprm *bprm)
263{ 270{
264 return security_ops->bprm_secureexec(bprm); 271 return call_int_hook(bprm_secureexec, 0, bprm);
265} 272}
266 273
267int security_sb_alloc(struct super_block *sb) 274int security_sb_alloc(struct super_block *sb)
268{ 275{
269 return security_ops->sb_alloc_security(sb); 276 return call_int_hook(sb_alloc_security, 0, sb);
270} 277}
271 278
272void security_sb_free(struct super_block *sb) 279void security_sb_free(struct super_block *sb)
273{ 280{
274 security_ops->sb_free_security(sb); 281 call_void_hook(sb_free_security, sb);
275} 282}
276 283
277int security_sb_copy_data(char *orig, char *copy) 284int security_sb_copy_data(char *orig, char *copy)
278{ 285{
279 return security_ops->sb_copy_data(orig, copy); 286 return call_int_hook(sb_copy_data, 0, orig, copy);
280} 287}
281EXPORT_SYMBOL(security_sb_copy_data); 288EXPORT_SYMBOL(security_sb_copy_data);
282 289
283int security_sb_remount(struct super_block *sb, void *data) 290int security_sb_remount(struct super_block *sb, void *data)
284{ 291{
285 return security_ops->sb_remount(sb, data); 292 return call_int_hook(sb_remount, 0, sb, data);
286} 293}
287 294
288int security_sb_kern_mount(struct super_block *sb, int flags, void *data) 295int security_sb_kern_mount(struct super_block *sb, int flags, void *data)
289{ 296{
290 return security_ops->sb_kern_mount(sb, flags, data); 297 return call_int_hook(sb_kern_mount, 0, sb, flags, data);
291} 298}
292 299
293int security_sb_show_options(struct seq_file *m, struct super_block *sb) 300int security_sb_show_options(struct seq_file *m, struct super_block *sb)
294{ 301{
295 return security_ops->sb_show_options(m, sb); 302 return call_int_hook(sb_show_options, 0, m, sb);
296} 303}
297 304
298int security_sb_statfs(struct dentry *dentry) 305int security_sb_statfs(struct dentry *dentry)
299{ 306{
300 return security_ops->sb_statfs(dentry); 307 return call_int_hook(sb_statfs, 0, dentry);
301} 308}
302 309
303int security_sb_mount(const char *dev_name, struct path *path, 310int security_sb_mount(const char *dev_name, struct path *path,
304 const char *type, unsigned long flags, void *data) 311 const char *type, unsigned long flags, void *data)
305{ 312{
306 return security_ops->sb_mount(dev_name, path, type, flags, data); 313 return call_int_hook(sb_mount, 0, dev_name, path, type, flags, data);
307} 314}
308 315
309int security_sb_umount(struct vfsmount *mnt, int flags) 316int security_sb_umount(struct vfsmount *mnt, int flags)
310{ 317{
311 return security_ops->sb_umount(mnt, flags); 318 return call_int_hook(sb_umount, 0, mnt, flags);
312} 319}
313 320
314int security_sb_pivotroot(struct path *old_path, struct path *new_path) 321int security_sb_pivotroot(struct path *old_path, struct path *new_path)
315{ 322{
316 return security_ops->sb_pivotroot(old_path, new_path); 323 return call_int_hook(sb_pivotroot, 0, old_path, new_path);
317} 324}
318 325
319int security_sb_set_mnt_opts(struct super_block *sb, 326int security_sb_set_mnt_opts(struct super_block *sb,
@@ -321,42 +328,43 @@ int security_sb_set_mnt_opts(struct super_block *sb,
321 unsigned long kern_flags, 328 unsigned long kern_flags,
322 unsigned long *set_kern_flags) 329 unsigned long *set_kern_flags)
323{ 330{
324 return security_ops->sb_set_mnt_opts(sb, opts, kern_flags, 331 return call_int_hook(sb_set_mnt_opts,
325 set_kern_flags); 332 opts->num_mnt_opts ? -EOPNOTSUPP : 0, sb,
333 opts, kern_flags, set_kern_flags);
326} 334}
327EXPORT_SYMBOL(security_sb_set_mnt_opts); 335EXPORT_SYMBOL(security_sb_set_mnt_opts);
328 336
329int security_sb_clone_mnt_opts(const struct super_block *oldsb, 337int security_sb_clone_mnt_opts(const struct super_block *oldsb,
330 struct super_block *newsb) 338 struct super_block *newsb)
331{ 339{
332 return security_ops->sb_clone_mnt_opts(oldsb, newsb); 340 return call_int_hook(sb_clone_mnt_opts, 0, oldsb, newsb);
333} 341}
334EXPORT_SYMBOL(security_sb_clone_mnt_opts); 342EXPORT_SYMBOL(security_sb_clone_mnt_opts);
335 343
336int security_sb_parse_opts_str(char *options, struct security_mnt_opts *opts) 344int security_sb_parse_opts_str(char *options, struct security_mnt_opts *opts)
337{ 345{
338 return security_ops->sb_parse_opts_str(options, opts); 346 return call_int_hook(sb_parse_opts_str, 0, options, opts);
339} 347}
340EXPORT_SYMBOL(security_sb_parse_opts_str); 348EXPORT_SYMBOL(security_sb_parse_opts_str);
341 349
342int security_inode_alloc(struct inode *inode) 350int security_inode_alloc(struct inode *inode)
343{ 351{
344 inode->i_security = NULL; 352 inode->i_security = NULL;
345 return security_ops->inode_alloc_security(inode); 353 return call_int_hook(inode_alloc_security, 0, inode);
346} 354}
347 355
348void security_inode_free(struct inode *inode) 356void security_inode_free(struct inode *inode)
349{ 357{
350 integrity_inode_free(inode); 358 integrity_inode_free(inode);
351 security_ops->inode_free_security(inode); 359 call_void_hook(inode_free_security, inode);
352} 360}
353 361
354int security_dentry_init_security(struct dentry *dentry, int mode, 362int security_dentry_init_security(struct dentry *dentry, int mode,
355 struct qstr *name, void **ctx, 363 struct qstr *name, void **ctx,
356 u32 *ctxlen) 364 u32 *ctxlen)
357{ 365{
358 return security_ops->dentry_init_security(dentry, mode, name, 366 return call_int_hook(dentry_init_security, -EOPNOTSUPP, dentry, mode,
359 ctx, ctxlen); 367 name, ctx, ctxlen);
360} 368}
361EXPORT_SYMBOL(security_dentry_init_security); 369EXPORT_SYMBOL(security_dentry_init_security);
362 370
@@ -372,11 +380,11 @@ int security_inode_init_security(struct inode *inode, struct inode *dir,
372 return 0; 380 return 0;
373 381
374 if (!initxattrs) 382 if (!initxattrs)
375 return security_ops->inode_init_security(inode, dir, qstr, 383 return call_int_hook(inode_init_security, 0, inode, dir, qstr,
376 NULL, NULL, NULL); 384 NULL, NULL, NULL);
377 memset(new_xattrs, 0, sizeof(new_xattrs)); 385 memset(new_xattrs, 0, sizeof(new_xattrs));
378 lsm_xattr = new_xattrs; 386 lsm_xattr = new_xattrs;
379 ret = security_ops->inode_init_security(inode, dir, qstr, 387 ret = call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir, qstr,
380 &lsm_xattr->name, 388 &lsm_xattr->name,
381 &lsm_xattr->value, 389 &lsm_xattr->value,
382 &lsm_xattr->value_len); 390 &lsm_xattr->value_len);
@@ -401,8 +409,8 @@ int security_old_inode_init_security(struct inode *inode, struct inode *dir,
401{ 409{
402 if (unlikely(IS_PRIVATE(inode))) 410 if (unlikely(IS_PRIVATE(inode)))
403 return -EOPNOTSUPP; 411 return -EOPNOTSUPP;
404 return security_ops->inode_init_security(inode, dir, qstr, name, value, 412 return call_int_hook(inode_init_security, 0, inode, dir, qstr,
405 len); 413 name, value, len);
406} 414}
407EXPORT_SYMBOL(security_old_inode_init_security); 415EXPORT_SYMBOL(security_old_inode_init_security);
408 416
@@ -412,7 +420,7 @@ int security_path_mknod(struct path *dir, struct dentry *dentry, umode_t mode,
412{ 420{
413 if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry)))) 421 if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
414 return 0; 422 return 0;
415 return security_ops->path_mknod(dir, dentry, mode, dev); 423 return call_int_hook(path_mknod, 0, dir, dentry, mode, dev);
416} 424}
417EXPORT_SYMBOL(security_path_mknod); 425EXPORT_SYMBOL(security_path_mknod);
418 426
@@ -420,7 +428,7 @@ int security_path_mkdir(struct path *dir, struct dentry *dentry, umode_t mode)
420{ 428{
421 if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry)))) 429 if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
422 return 0; 430 return 0;
423 return security_ops->path_mkdir(dir, dentry, mode); 431 return call_int_hook(path_mkdir, 0, dir, dentry, mode);
424} 432}
425EXPORT_SYMBOL(security_path_mkdir); 433EXPORT_SYMBOL(security_path_mkdir);
426 434
@@ -428,14 +436,14 @@ int security_path_rmdir(struct path *dir, struct dentry *dentry)
428{ 436{
429 if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry)))) 437 if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
430 return 0; 438 return 0;
431 return security_ops->path_rmdir(dir, dentry); 439 return call_int_hook(path_rmdir, 0, dir, dentry);
432} 440}
433 441
434int security_path_unlink(struct path *dir, struct dentry *dentry) 442int security_path_unlink(struct path *dir, struct dentry *dentry)
435{ 443{
436 if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry)))) 444 if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
437 return 0; 445 return 0;
438 return security_ops->path_unlink(dir, dentry); 446 return call_int_hook(path_unlink, 0, dir, dentry);
439} 447}
440EXPORT_SYMBOL(security_path_unlink); 448EXPORT_SYMBOL(security_path_unlink);
441 449
@@ -444,7 +452,7 @@ int security_path_symlink(struct path *dir, struct dentry *dentry,
444{ 452{
445 if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry)))) 453 if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
446 return 0; 454 return 0;
447 return security_ops->path_symlink(dir, dentry, old_name); 455 return call_int_hook(path_symlink, 0, dir, dentry, old_name);
448} 456}
449 457
450int security_path_link(struct dentry *old_dentry, struct path *new_dir, 458int security_path_link(struct dentry *old_dentry, struct path *new_dir,
@@ -452,7 +460,7 @@ int security_path_link(struct dentry *old_dentry, struct path *new_dir,
452{ 460{
453 if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry)))) 461 if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))
454 return 0; 462 return 0;
455 return security_ops->path_link(old_dentry, new_dir, new_dentry); 463 return call_int_hook(path_link, 0, old_dentry, new_dir, new_dentry);
456} 464}
457 465
458int security_path_rename(struct path *old_dir, struct dentry *old_dentry, 466int security_path_rename(struct path *old_dir, struct dentry *old_dentry,
@@ -464,14 +472,14 @@ int security_path_rename(struct path *old_dir, struct dentry *old_dentry,
464 return 0; 472 return 0;
465 473
466 if (flags & RENAME_EXCHANGE) { 474 if (flags & RENAME_EXCHANGE) {
467 int err = security_ops->path_rename(new_dir, new_dentry, 475 int err = call_int_hook(path_rename, 0, new_dir, new_dentry,
468 old_dir, old_dentry); 476 old_dir, old_dentry);
469 if (err) 477 if (err)
470 return err; 478 return err;
471 } 479 }
472 480
473 return security_ops->path_rename(old_dir, old_dentry, new_dir, 481 return call_int_hook(path_rename, 0, old_dir, old_dentry, new_dir,
474 new_dentry); 482 new_dentry);
475} 483}
476EXPORT_SYMBOL(security_path_rename); 484EXPORT_SYMBOL(security_path_rename);
477 485
@@ -479,26 +487,26 @@ int security_path_truncate(struct path *path)
479{ 487{
480 if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry)))) 488 if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
481 return 0; 489 return 0;
482 return security_ops->path_truncate(path); 490 return call_int_hook(path_truncate, 0, path);
483} 491}
484 492
485int security_path_chmod(struct path *path, umode_t mode) 493int security_path_chmod(struct path *path, umode_t mode)
486{ 494{
487 if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry)))) 495 if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
488 return 0; 496 return 0;
489 return security_ops->path_chmod(path, mode); 497 return call_int_hook(path_chmod, 0, path, mode);
490} 498}
491 499
492int security_path_chown(struct path *path, kuid_t uid, kgid_t gid) 500int security_path_chown(struct path *path, kuid_t uid, kgid_t gid)
493{ 501{
494 if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry)))) 502 if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
495 return 0; 503 return 0;
496 return security_ops->path_chown(path, uid, gid); 504 return call_int_hook(path_chown, 0, path, uid, gid);
497} 505}
498 506
499int security_path_chroot(struct path *path) 507int security_path_chroot(struct path *path)
500{ 508{
501 return security_ops->path_chroot(path); 509 return call_int_hook(path_chroot, 0, path);
502} 510}
503#endif 511#endif
504 512
@@ -506,7 +514,7 @@ int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode
506{ 514{
507 if (unlikely(IS_PRIVATE(dir))) 515 if (unlikely(IS_PRIVATE(dir)))
508 return 0; 516 return 0;
509 return security_ops->inode_create(dir, dentry, mode); 517 return call_int_hook(inode_create, 0, dir, dentry, mode);
510} 518}
511EXPORT_SYMBOL_GPL(security_inode_create); 519EXPORT_SYMBOL_GPL(security_inode_create);
512 520
@@ -515,14 +523,14 @@ int security_inode_link(struct dentry *old_dentry, struct inode *dir,
515{ 523{
516 if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry)))) 524 if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))
517 return 0; 525 return 0;
518 return security_ops->inode_link(old_dentry, dir, new_dentry); 526 return call_int_hook(inode_link, 0, old_dentry, dir, new_dentry);
519} 527}
520 528
521int security_inode_unlink(struct inode *dir, struct dentry *dentry) 529int security_inode_unlink(struct inode *dir, struct dentry *dentry)
522{ 530{
523 if (unlikely(IS_PRIVATE(d_backing_inode(dentry)))) 531 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
524 return 0; 532 return 0;
525 return security_ops->inode_unlink(dir, dentry); 533 return call_int_hook(inode_unlink, 0, dir, dentry);
526} 534}
527 535
528int security_inode_symlink(struct inode *dir, struct dentry *dentry, 536int security_inode_symlink(struct inode *dir, struct dentry *dentry,
@@ -530,14 +538,14 @@ int security_inode_symlink(struct inode *dir, struct dentry *dentry,
530{ 538{
531 if (unlikely(IS_PRIVATE(dir))) 539 if (unlikely(IS_PRIVATE(dir)))
532 return 0; 540 return 0;
533 return security_ops->inode_symlink(dir, dentry, old_name); 541 return call_int_hook(inode_symlink, 0, dir, dentry, old_name);
534} 542}
535 543
536int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) 544int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
537{ 545{
538 if (unlikely(IS_PRIVATE(dir))) 546 if (unlikely(IS_PRIVATE(dir)))
539 return 0; 547 return 0;
540 return security_ops->inode_mkdir(dir, dentry, mode); 548 return call_int_hook(inode_mkdir, 0, dir, dentry, mode);
541} 549}
542EXPORT_SYMBOL_GPL(security_inode_mkdir); 550EXPORT_SYMBOL_GPL(security_inode_mkdir);
543 551
@@ -545,14 +553,14 @@ int security_inode_rmdir(struct inode *dir, struct dentry *dentry)
545{ 553{
546 if (unlikely(IS_PRIVATE(d_backing_inode(dentry)))) 554 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
547 return 0; 555 return 0;
548 return security_ops->inode_rmdir(dir, dentry); 556 return call_int_hook(inode_rmdir, 0, dir, dentry);
549} 557}
550 558
551int security_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev) 559int security_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
552{ 560{
553 if (unlikely(IS_PRIVATE(dir))) 561 if (unlikely(IS_PRIVATE(dir)))
554 return 0; 562 return 0;
555 return security_ops->inode_mknod(dir, dentry, mode, dev); 563 return call_int_hook(inode_mknod, 0, dir, dentry, mode, dev);
556} 564}
557 565
558int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry, 566int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
@@ -564,13 +572,13 @@ int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
564 return 0; 572 return 0;
565 573
566 if (flags & RENAME_EXCHANGE) { 574 if (flags & RENAME_EXCHANGE) {
567 int err = security_ops->inode_rename(new_dir, new_dentry, 575 int err = call_int_hook(inode_rename, 0, new_dir, new_dentry,
568 old_dir, old_dentry); 576 old_dir, old_dentry);
569 if (err) 577 if (err)
570 return err; 578 return err;
571 } 579 }
572 580
573 return security_ops->inode_rename(old_dir, old_dentry, 581 return call_int_hook(inode_rename, 0, old_dir, old_dentry,
574 new_dir, new_dentry); 582 new_dir, new_dentry);
575} 583}
576 584
@@ -578,7 +586,7 @@ int security_inode_readlink(struct dentry *dentry)
578{ 586{
579 if (unlikely(IS_PRIVATE(d_backing_inode(dentry)))) 587 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
580 return 0; 588 return 0;
581 return security_ops->inode_readlink(dentry); 589 return call_int_hook(inode_readlink, 0, dentry);
582} 590}
583 591
584int security_inode_follow_link(struct dentry *dentry, struct inode *inode, 592int security_inode_follow_link(struct dentry *dentry, struct inode *inode,
@@ -586,14 +594,14 @@ int security_inode_follow_link(struct dentry *dentry, struct inode *inode,
586{ 594{
587 if (unlikely(IS_PRIVATE(inode))) 595 if (unlikely(IS_PRIVATE(inode)))
588 return 0; 596 return 0;
589 return security_ops->inode_follow_link(dentry, inode, rcu); 597 return call_int_hook(inode_follow_link, 0, dentry, inode, rcu);
590} 598}
591 599
592int security_inode_permission(struct inode *inode, int mask) 600int security_inode_permission(struct inode *inode, int mask)
593{ 601{
594 if (unlikely(IS_PRIVATE(inode))) 602 if (unlikely(IS_PRIVATE(inode)))
595 return 0; 603 return 0;
596 return security_ops->inode_permission(inode, mask); 604 return call_int_hook(inode_permission, 0, inode, mask);
597} 605}
598 606
599int security_inode_setattr(struct dentry *dentry, struct iattr *attr) 607int security_inode_setattr(struct dentry *dentry, struct iattr *attr)
@@ -602,7 +610,7 @@ int security_inode_setattr(struct dentry *dentry, struct iattr *attr)
602 610
603 if (unlikely(IS_PRIVATE(d_backing_inode(dentry)))) 611 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
604 return 0; 612 return 0;
605 ret = security_ops->inode_setattr(dentry, attr); 613 ret = call_int_hook(inode_setattr, 0, dentry, attr);
606 if (ret) 614 if (ret)
607 return ret; 615 return ret;
608 return evm_inode_setattr(dentry, attr); 616 return evm_inode_setattr(dentry, attr);
@@ -613,7 +621,7 @@ int security_inode_getattr(const struct path *path)
613{ 621{
614 if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry)))) 622 if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
615 return 0; 623 return 0;
616 return security_ops->inode_getattr(path); 624 return call_int_hook(inode_getattr, 0, path);
617} 625}
618 626
619int security_inode_setxattr(struct dentry *dentry, const char *name, 627int security_inode_setxattr(struct dentry *dentry, const char *name,
@@ -623,7 +631,15 @@ int security_inode_setxattr(struct dentry *dentry, const char *name,
623 631
624 if (unlikely(IS_PRIVATE(d_backing_inode(dentry)))) 632 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
625 return 0; 633 return 0;
626 ret = security_ops->inode_setxattr(dentry, name, value, size, flags); 634 /*
635 * SELinux and Smack integrate the cap call,
636 * so assume that all LSMs supplying this call do so.
637 */
638 ret = call_int_hook(inode_setxattr, 1, dentry, name, value, size,
639 flags);
640
641 if (ret == 1)
642 ret = cap_inode_setxattr(dentry, name, value, size, flags);
627 if (ret) 643 if (ret)
628 return ret; 644 return ret;
629 ret = ima_inode_setxattr(dentry, name, value, size); 645 ret = ima_inode_setxattr(dentry, name, value, size);
@@ -637,7 +653,7 @@ void security_inode_post_setxattr(struct dentry *dentry, const char *name,
637{ 653{
638 if (unlikely(IS_PRIVATE(d_backing_inode(dentry)))) 654 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
639 return; 655 return;
640 security_ops->inode_post_setxattr(dentry, name, value, size, flags); 656 call_void_hook(inode_post_setxattr, dentry, name, value, size, flags);
641 evm_inode_post_setxattr(dentry, name, value, size); 657 evm_inode_post_setxattr(dentry, name, value, size);
642} 658}
643 659
@@ -645,14 +661,14 @@ int security_inode_getxattr(struct dentry *dentry, const char *name)
645{ 661{
646 if (unlikely(IS_PRIVATE(d_backing_inode(dentry)))) 662 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
647 return 0; 663 return 0;
648 return security_ops->inode_getxattr(dentry, name); 664 return call_int_hook(inode_getxattr, 0, dentry, name);
649} 665}
650 666
651int security_inode_listxattr(struct dentry *dentry) 667int security_inode_listxattr(struct dentry *dentry)
652{ 668{
653 if (unlikely(IS_PRIVATE(d_backing_inode(dentry)))) 669 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
654 return 0; 670 return 0;
655 return security_ops->inode_listxattr(dentry); 671 return call_int_hook(inode_listxattr, 0, dentry);
656} 672}
657 673
658int security_inode_removexattr(struct dentry *dentry, const char *name) 674int security_inode_removexattr(struct dentry *dentry, const char *name)
@@ -661,7 +677,13 @@ int security_inode_removexattr(struct dentry *dentry, const char *name)
661 677
662 if (unlikely(IS_PRIVATE(d_backing_inode(dentry)))) 678 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
663 return 0; 679 return 0;
664 ret = security_ops->inode_removexattr(dentry, name); 680 /*
681 * SELinux and Smack integrate the cap call,
682 * so assume that all LSMs supplying this call do so.
683 */
684 ret = call_int_hook(inode_removexattr, 1, dentry, name);
685 if (ret == 1)
686 ret = cap_inode_removexattr(dentry, name);
665 if (ret) 687 if (ret)
666 return ret; 688 return ret;
667 ret = ima_inode_removexattr(dentry, name); 689 ret = ima_inode_removexattr(dentry, name);
@@ -672,46 +694,48 @@ int security_inode_removexattr(struct dentry *dentry, const char *name)
672 694
673int security_inode_need_killpriv(struct dentry *dentry) 695int security_inode_need_killpriv(struct dentry *dentry)
674{ 696{
675 return security_ops->inode_need_killpriv(dentry); 697 return call_int_hook(inode_need_killpriv, 0, dentry);
676} 698}
677 699
678int security_inode_killpriv(struct dentry *dentry) 700int security_inode_killpriv(struct dentry *dentry)
679{ 701{
680 return security_ops->inode_killpriv(dentry); 702 return call_int_hook(inode_killpriv, 0, dentry);
681} 703}
682 704
683int security_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc) 705int security_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
684{ 706{
685 if (unlikely(IS_PRIVATE(inode))) 707 if (unlikely(IS_PRIVATE(inode)))
686 return -EOPNOTSUPP; 708 return -EOPNOTSUPP;
687 return security_ops->inode_getsecurity(inode, name, buffer, alloc); 709 return call_int_hook(inode_getsecurity, -EOPNOTSUPP, inode, name,
710 buffer, alloc);
688} 711}
689 712
690int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags) 713int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
691{ 714{
692 if (unlikely(IS_PRIVATE(inode))) 715 if (unlikely(IS_PRIVATE(inode)))
693 return -EOPNOTSUPP; 716 return -EOPNOTSUPP;
694 return security_ops->inode_setsecurity(inode, name, value, size, flags); 717 return call_int_hook(inode_setsecurity, -EOPNOTSUPP, inode, name,
718 value, size, flags);
695} 719}
696 720
697int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size) 721int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
698{ 722{
699 if (unlikely(IS_PRIVATE(inode))) 723 if (unlikely(IS_PRIVATE(inode)))
700 return 0; 724 return 0;
701 return security_ops->inode_listsecurity(inode, buffer, buffer_size); 725 return call_int_hook(inode_listsecurity, 0, inode, buffer, buffer_size);
702} 726}
703EXPORT_SYMBOL(security_inode_listsecurity); 727EXPORT_SYMBOL(security_inode_listsecurity);
704 728
705void security_inode_getsecid(const struct inode *inode, u32 *secid) 729void security_inode_getsecid(const struct inode *inode, u32 *secid)
706{ 730{
707 security_ops->inode_getsecid(inode, secid); 731 call_void_hook(inode_getsecid, inode, secid);
708} 732}
709 733
710int security_file_permission(struct file *file, int mask) 734int security_file_permission(struct file *file, int mask)
711{ 735{
712 int ret; 736 int ret;
713 737
714 ret = security_ops->file_permission(file, mask); 738 ret = call_int_hook(file_permission, 0, file, mask);
715 if (ret) 739 if (ret)
716 return ret; 740 return ret;
717 741
@@ -720,17 +744,17 @@ int security_file_permission(struct file *file, int mask)
720 744
721int security_file_alloc(struct file *file) 745int security_file_alloc(struct file *file)
722{ 746{
723 return security_ops->file_alloc_security(file); 747 return call_int_hook(file_alloc_security, 0, file);
724} 748}
725 749
726void security_file_free(struct file *file) 750void security_file_free(struct file *file)
727{ 751{
728 security_ops->file_free_security(file); 752 call_void_hook(file_free_security, file);
729} 753}
730 754
731int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 755int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
732{ 756{
733 return security_ops->file_ioctl(file, cmd, arg); 757 return call_int_hook(file_ioctl, 0, file, cmd, arg);
734} 758}
735 759
736static inline unsigned long mmap_prot(struct file *file, unsigned long prot) 760static inline unsigned long mmap_prot(struct file *file, unsigned long prot)
@@ -770,7 +794,7 @@ int security_mmap_file(struct file *file, unsigned long prot,
770 unsigned long flags) 794 unsigned long flags)
771{ 795{
772 int ret; 796 int ret;
773 ret = security_ops->mmap_file(file, prot, 797 ret = call_int_hook(mmap_file, 0, file, prot,
774 mmap_prot(file, prot), flags); 798 mmap_prot(file, prot), flags);
775 if (ret) 799 if (ret)
776 return ret; 800 return ret;
@@ -779,46 +803,46 @@ int security_mmap_file(struct file *file, unsigned long prot,
779 803
780int security_mmap_addr(unsigned long addr) 804int security_mmap_addr(unsigned long addr)
781{ 805{
782 return security_ops->mmap_addr(addr); 806 return call_int_hook(mmap_addr, 0, addr);
783} 807}
784 808
785int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, 809int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
786 unsigned long prot) 810 unsigned long prot)
787{ 811{
788 return security_ops->file_mprotect(vma, reqprot, prot); 812 return call_int_hook(file_mprotect, 0, vma, reqprot, prot);
789} 813}
790 814
791int security_file_lock(struct file *file, unsigned int cmd) 815int security_file_lock(struct file *file, unsigned int cmd)
792{ 816{
793 return security_ops->file_lock(file, cmd); 817 return call_int_hook(file_lock, 0, file, cmd);
794} 818}
795 819
796int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg) 820int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
797{ 821{
798 return security_ops->file_fcntl(file, cmd, arg); 822 return call_int_hook(file_fcntl, 0, file, cmd, arg);
799} 823}
800 824
801void security_file_set_fowner(struct file *file) 825void security_file_set_fowner(struct file *file)
802{ 826{
803 security_ops->file_set_fowner(file); 827 call_void_hook(file_set_fowner, file);
804} 828}
805 829
806int security_file_send_sigiotask(struct task_struct *tsk, 830int security_file_send_sigiotask(struct task_struct *tsk,
807 struct fown_struct *fown, int sig) 831 struct fown_struct *fown, int sig)
808{ 832{
809 return security_ops->file_send_sigiotask(tsk, fown, sig); 833 return call_int_hook(file_send_sigiotask, 0, tsk, fown, sig);
810} 834}
811 835
812int security_file_receive(struct file *file) 836int security_file_receive(struct file *file)
813{ 837{
814 return security_ops->file_receive(file); 838 return call_int_hook(file_receive, 0, file);
815} 839}
816 840
817int security_file_open(struct file *file, const struct cred *cred) 841int security_file_open(struct file *file, const struct cred *cred)
818{ 842{
819 int ret; 843 int ret;
820 844
821 ret = security_ops->file_open(file, cred); 845 ret = call_int_hook(file_open, 0, file, cred);
822 if (ret) 846 if (ret)
823 return ret; 847 return ret;
824 848
@@ -827,52 +851,49 @@ int security_file_open(struct file *file, const struct cred *cred)
827 851
828int security_task_create(unsigned long clone_flags) 852int security_task_create(unsigned long clone_flags)
829{ 853{
830 return security_ops->task_create(clone_flags); 854 return call_int_hook(task_create, 0, clone_flags);
831} 855}
832 856
833void security_task_free(struct task_struct *task) 857void security_task_free(struct task_struct *task)
834{ 858{
835#ifdef CONFIG_SECURITY_YAMA_STACKED 859 call_void_hook(task_free, task);
836 yama_task_free(task);
837#endif
838 security_ops->task_free(task);
839} 860}
840 861
841int security_cred_alloc_blank(struct cred *cred, gfp_t gfp) 862int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)
842{ 863{
843 return security_ops->cred_alloc_blank(cred, gfp); 864 return call_int_hook(cred_alloc_blank, 0, cred, gfp);
844} 865}
845 866
846void security_cred_free(struct cred *cred) 867void security_cred_free(struct cred *cred)
847{ 868{
848 security_ops->cred_free(cred); 869 call_void_hook(cred_free, cred);
849} 870}
850 871
851int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp) 872int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp)
852{ 873{
853 return security_ops->cred_prepare(new, old, gfp); 874 return call_int_hook(cred_prepare, 0, new, old, gfp);
854} 875}
855 876
856void security_transfer_creds(struct cred *new, const struct cred *old) 877void security_transfer_creds(struct cred *new, const struct cred *old)
857{ 878{
858 security_ops->cred_transfer(new, old); 879 call_void_hook(cred_transfer, new, old);
859} 880}
860 881
861int security_kernel_act_as(struct cred *new, u32 secid) 882int security_kernel_act_as(struct cred *new, u32 secid)
862{ 883{
863 return security_ops->kernel_act_as(new, secid); 884 return call_int_hook(kernel_act_as, 0, new, secid);
864} 885}
865 886
866int security_kernel_create_files_as(struct cred *new, struct inode *inode) 887int security_kernel_create_files_as(struct cred *new, struct inode *inode)
867{ 888{
868 return security_ops->kernel_create_files_as(new, inode); 889 return call_int_hook(kernel_create_files_as, 0, new, inode);
869} 890}
870 891
871int security_kernel_fw_from_file(struct file *file, char *buf, size_t size) 892int security_kernel_fw_from_file(struct file *file, char *buf, size_t size)
872{ 893{
873 int ret; 894 int ret;
874 895
875 ret = security_ops->kernel_fw_from_file(file, buf, size); 896 ret = call_int_hook(kernel_fw_from_file, 0, file, buf, size);
876 if (ret) 897 if (ret)
877 return ret; 898 return ret;
878 return ima_fw_from_file(file, buf, size); 899 return ima_fw_from_file(file, buf, size);
@@ -881,14 +902,14 @@ EXPORT_SYMBOL_GPL(security_kernel_fw_from_file);
881 902
882int security_kernel_module_request(char *kmod_name) 903int security_kernel_module_request(char *kmod_name)
883{ 904{
884 return security_ops->kernel_module_request(kmod_name); 905 return call_int_hook(kernel_module_request, 0, kmod_name);
885} 906}
886 907
887int security_kernel_module_from_file(struct file *file) 908int security_kernel_module_from_file(struct file *file)
888{ 909{
889 int ret; 910 int ret;
890 911
891 ret = security_ops->kernel_module_from_file(file); 912 ret = call_int_hook(kernel_module_from_file, 0, file);
892 if (ret) 913 if (ret)
893 return ret; 914 return ret;
894 return ima_module_check(file); 915 return ima_module_check(file);
@@ -897,259 +918,269 @@ int security_kernel_module_from_file(struct file *file)
897int security_task_fix_setuid(struct cred *new, const struct cred *old, 918int security_task_fix_setuid(struct cred *new, const struct cred *old,
898 int flags) 919 int flags)
899{ 920{
900 return security_ops->task_fix_setuid(new, old, flags); 921 return call_int_hook(task_fix_setuid, 0, new, old, flags);
901} 922}
902 923
903int security_task_setpgid(struct task_struct *p, pid_t pgid) 924int security_task_setpgid(struct task_struct *p, pid_t pgid)
904{ 925{
905 return security_ops->task_setpgid(p, pgid); 926 return call_int_hook(task_setpgid, 0, p, pgid);
906} 927}
907 928
908int security_task_getpgid(struct task_struct *p) 929int security_task_getpgid(struct task_struct *p)
909{ 930{
910 return security_ops->task_getpgid(p); 931 return call_int_hook(task_getpgid, 0, p);
911} 932}
912 933
913int security_task_getsid(struct task_struct *p) 934int security_task_getsid(struct task_struct *p)
914{ 935{
915 return security_ops->task_getsid(p); 936 return call_int_hook(task_getsid, 0, p);
916} 937}
917 938
918void security_task_getsecid(struct task_struct *p, u32 *secid) 939void security_task_getsecid(struct task_struct *p, u32 *secid)
919{ 940{
920 security_ops->task_getsecid(p, secid); 941 *secid = 0;
942 call_void_hook(task_getsecid, p, secid);
921} 943}
922EXPORT_SYMBOL(security_task_getsecid); 944EXPORT_SYMBOL(security_task_getsecid);
923 945
924int security_task_setnice(struct task_struct *p, int nice) 946int security_task_setnice(struct task_struct *p, int nice)
925{ 947{
926 return security_ops->task_setnice(p, nice); 948 return call_int_hook(task_setnice, 0, p, nice);
927} 949}
928 950
929int security_task_setioprio(struct task_struct *p, int ioprio) 951int security_task_setioprio(struct task_struct *p, int ioprio)
930{ 952{
931 return security_ops->task_setioprio(p, ioprio); 953 return call_int_hook(task_setioprio, 0, p, ioprio);
932} 954}
933 955
934int security_task_getioprio(struct task_struct *p) 956int security_task_getioprio(struct task_struct *p)
935{ 957{
936 return security_ops->task_getioprio(p); 958 return call_int_hook(task_getioprio, 0, p);
937} 959}
938 960
939int security_task_setrlimit(struct task_struct *p, unsigned int resource, 961int security_task_setrlimit(struct task_struct *p, unsigned int resource,
940 struct rlimit *new_rlim) 962 struct rlimit *new_rlim)
941{ 963{
942 return security_ops->task_setrlimit(p, resource, new_rlim); 964 return call_int_hook(task_setrlimit, 0, p, resource, new_rlim);
943} 965}
944 966
945int security_task_setscheduler(struct task_struct *p) 967int security_task_setscheduler(struct task_struct *p)
946{ 968{
947 return security_ops->task_setscheduler(p); 969 return call_int_hook(task_setscheduler, 0, p);
948} 970}
949 971
950int security_task_getscheduler(struct task_struct *p) 972int security_task_getscheduler(struct task_struct *p)
951{ 973{
952 return security_ops->task_getscheduler(p); 974 return call_int_hook(task_getscheduler, 0, p);
953} 975}
954 976
955int security_task_movememory(struct task_struct *p) 977int security_task_movememory(struct task_struct *p)
956{ 978{
957 return security_ops->task_movememory(p); 979 return call_int_hook(task_movememory, 0, p);
958} 980}
959 981
960int security_task_kill(struct task_struct *p, struct siginfo *info, 982int security_task_kill(struct task_struct *p, struct siginfo *info,
961 int sig, u32 secid) 983 int sig, u32 secid)
962{ 984{
963 return security_ops->task_kill(p, info, sig, secid); 985 return call_int_hook(task_kill, 0, p, info, sig, secid);
964} 986}
965 987
966int security_task_wait(struct task_struct *p) 988int security_task_wait(struct task_struct *p)
967{ 989{
968 return security_ops->task_wait(p); 990 return call_int_hook(task_wait, 0, p);
969} 991}
970 992
971int security_task_prctl(int option, unsigned long arg2, unsigned long arg3, 993int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
972 unsigned long arg4, unsigned long arg5) 994 unsigned long arg4, unsigned long arg5)
973{ 995{
974#ifdef CONFIG_SECURITY_YAMA_STACKED 996 int thisrc;
975 int rc; 997 int rc = -ENOSYS;
976 rc = yama_task_prctl(option, arg2, arg3, arg4, arg5); 998 struct security_hook_list *hp;
977 if (rc != -ENOSYS) 999
978 return rc; 1000 list_for_each_entry(hp, &security_hook_heads.task_prctl, list) {
979#endif 1001 thisrc = hp->hook.task_prctl(option, arg2, arg3, arg4, arg5);
980 return security_ops->task_prctl(option, arg2, arg3, arg4, arg5); 1002 if (thisrc != -ENOSYS) {
1003 rc = thisrc;
1004 if (thisrc != 0)
1005 break;
1006 }
1007 }
1008 return rc;
981} 1009}
982 1010
983void security_task_to_inode(struct task_struct *p, struct inode *inode) 1011void security_task_to_inode(struct task_struct *p, struct inode *inode)
984{ 1012{
985 security_ops->task_to_inode(p, inode); 1013 call_void_hook(task_to_inode, p, inode);
986} 1014}
987 1015
988int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag) 1016int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
989{ 1017{
990 return security_ops->ipc_permission(ipcp, flag); 1018 return call_int_hook(ipc_permission, 0, ipcp, flag);
991} 1019}
992 1020
993void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid) 1021void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
994{ 1022{
995 security_ops->ipc_getsecid(ipcp, secid); 1023 *secid = 0;
1024 call_void_hook(ipc_getsecid, ipcp, secid);
996} 1025}
997 1026
998int security_msg_msg_alloc(struct msg_msg *msg) 1027int security_msg_msg_alloc(struct msg_msg *msg)
999{ 1028{
1000 return security_ops->msg_msg_alloc_security(msg); 1029 return call_int_hook(msg_msg_alloc_security, 0, msg);
1001} 1030}
1002 1031
1003void security_msg_msg_free(struct msg_msg *msg) 1032void security_msg_msg_free(struct msg_msg *msg)
1004{ 1033{
1005 security_ops->msg_msg_free_security(msg); 1034 call_void_hook(msg_msg_free_security, msg);
1006} 1035}
1007 1036
1008int security_msg_queue_alloc(struct msg_queue *msq) 1037int security_msg_queue_alloc(struct msg_queue *msq)
1009{ 1038{
1010 return security_ops->msg_queue_alloc_security(msq); 1039 return call_int_hook(msg_queue_alloc_security, 0, msq);
1011} 1040}
1012 1041
1013void security_msg_queue_free(struct msg_queue *msq) 1042void security_msg_queue_free(struct msg_queue *msq)
1014{ 1043{
1015 security_ops->msg_queue_free_security(msq); 1044 call_void_hook(msg_queue_free_security, msq);
1016} 1045}
1017 1046
1018int security_msg_queue_associate(struct msg_queue *msq, int msqflg) 1047int security_msg_queue_associate(struct msg_queue *msq, int msqflg)
1019{ 1048{
1020 return security_ops->msg_queue_associate(msq, msqflg); 1049 return call_int_hook(msg_queue_associate, 0, msq, msqflg);
1021} 1050}
1022 1051
1023int security_msg_queue_msgctl(struct msg_queue *msq, int cmd) 1052int security_msg_queue_msgctl(struct msg_queue *msq, int cmd)
1024{ 1053{
1025 return security_ops->msg_queue_msgctl(msq, cmd); 1054 return call_int_hook(msg_queue_msgctl, 0, msq, cmd);
1026} 1055}
1027 1056
1028int security_msg_queue_msgsnd(struct msg_queue *msq, 1057int security_msg_queue_msgsnd(struct msg_queue *msq,
1029 struct msg_msg *msg, int msqflg) 1058 struct msg_msg *msg, int msqflg)
1030{ 1059{
1031 return security_ops->msg_queue_msgsnd(msq, msg, msqflg); 1060 return call_int_hook(msg_queue_msgsnd, 0, msq, msg, msqflg);
1032} 1061}
1033 1062
1034int security_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg, 1063int security_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
1035 struct task_struct *target, long type, int mode) 1064 struct task_struct *target, long type, int mode)
1036{ 1065{
1037 return security_ops->msg_queue_msgrcv(msq, msg, target, type, mode); 1066 return call_int_hook(msg_queue_msgrcv, 0, msq, msg, target, type, mode);
1038} 1067}
1039 1068
1040int security_shm_alloc(struct shmid_kernel *shp) 1069int security_shm_alloc(struct shmid_kernel *shp)
1041{ 1070{
1042 return security_ops->shm_alloc_security(shp); 1071 return call_int_hook(shm_alloc_security, 0, shp);
1043} 1072}
1044 1073
1045void security_shm_free(struct shmid_kernel *shp) 1074void security_shm_free(struct shmid_kernel *shp)
1046{ 1075{
1047 security_ops->shm_free_security(shp); 1076 call_void_hook(shm_free_security, shp);
1048} 1077}
1049 1078
1050int security_shm_associate(struct shmid_kernel *shp, int shmflg) 1079int security_shm_associate(struct shmid_kernel *shp, int shmflg)
1051{ 1080{
1052 return security_ops->shm_associate(shp, shmflg); 1081 return call_int_hook(shm_associate, 0, shp, shmflg);
1053} 1082}
1054 1083
1055int security_shm_shmctl(struct shmid_kernel *shp, int cmd) 1084int security_shm_shmctl(struct shmid_kernel *shp, int cmd)
1056{ 1085{
1057 return security_ops->shm_shmctl(shp, cmd); 1086 return call_int_hook(shm_shmctl, 0, shp, cmd);
1058} 1087}
1059 1088
1060int security_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr, int shmflg) 1089int security_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr, int shmflg)
1061{ 1090{
1062 return security_ops->shm_shmat(shp, shmaddr, shmflg); 1091 return call_int_hook(shm_shmat, 0, shp, shmaddr, shmflg);
1063} 1092}
1064 1093
1065int security_sem_alloc(struct sem_array *sma) 1094int security_sem_alloc(struct sem_array *sma)
1066{ 1095{
1067 return security_ops->sem_alloc_security(sma); 1096 return call_int_hook(sem_alloc_security, 0, sma);
1068} 1097}
1069 1098
1070void security_sem_free(struct sem_array *sma) 1099void security_sem_free(struct sem_array *sma)
1071{ 1100{
1072 security_ops->sem_free_security(sma); 1101 call_void_hook(sem_free_security, sma);
1073} 1102}
1074 1103
1075int security_sem_associate(struct sem_array *sma, int semflg) 1104int security_sem_associate(struct sem_array *sma, int semflg)
1076{ 1105{
1077 return security_ops->sem_associate(sma, semflg); 1106 return call_int_hook(sem_associate, 0, sma, semflg);
1078} 1107}
1079 1108
1080int security_sem_semctl(struct sem_array *sma, int cmd) 1109int security_sem_semctl(struct sem_array *sma, int cmd)
1081{ 1110{
1082 return security_ops->sem_semctl(sma, cmd); 1111 return call_int_hook(sem_semctl, 0, sma, cmd);
1083} 1112}
1084 1113
1085int security_sem_semop(struct sem_array *sma, struct sembuf *sops, 1114int security_sem_semop(struct sem_array *sma, struct sembuf *sops,
1086 unsigned nsops, int alter) 1115 unsigned nsops, int alter)
1087{ 1116{
1088 return security_ops->sem_semop(sma, sops, nsops, alter); 1117 return call_int_hook(sem_semop, 0, sma, sops, nsops, alter);
1089} 1118}
1090 1119
1091void security_d_instantiate(struct dentry *dentry, struct inode *inode) 1120void security_d_instantiate(struct dentry *dentry, struct inode *inode)
1092{ 1121{
1093 if (unlikely(inode && IS_PRIVATE(inode))) 1122 if (unlikely(inode && IS_PRIVATE(inode)))
1094 return; 1123 return;
1095 security_ops->d_instantiate(dentry, inode); 1124 call_void_hook(d_instantiate, dentry, inode);
1096} 1125}
1097EXPORT_SYMBOL(security_d_instantiate); 1126EXPORT_SYMBOL(security_d_instantiate);
1098 1127
1099int security_getprocattr(struct task_struct *p, char *name, char **value) 1128int security_getprocattr(struct task_struct *p, char *name, char **value)
1100{ 1129{
1101 return security_ops->getprocattr(p, name, value); 1130 return call_int_hook(getprocattr, -EINVAL, p, name, value);
1102} 1131}
1103 1132
1104int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size) 1133int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size)
1105{ 1134{
1106 return security_ops->setprocattr(p, name, value, size); 1135 return call_int_hook(setprocattr, -EINVAL, p, name, value, size);
1107} 1136}
1108 1137
1109int security_netlink_send(struct sock *sk, struct sk_buff *skb) 1138int security_netlink_send(struct sock *sk, struct sk_buff *skb)
1110{ 1139{
1111 return security_ops->netlink_send(sk, skb); 1140 return call_int_hook(netlink_send, 0, sk, skb);
1112} 1141}
1113 1142
1114int security_ismaclabel(const char *name) 1143int security_ismaclabel(const char *name)
1115{ 1144{
1116 return security_ops->ismaclabel(name); 1145 return call_int_hook(ismaclabel, 0, name);
1117} 1146}
1118EXPORT_SYMBOL(security_ismaclabel); 1147EXPORT_SYMBOL(security_ismaclabel);
1119 1148
1120int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) 1149int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
1121{ 1150{
1122 return security_ops->secid_to_secctx(secid, secdata, seclen); 1151 return call_int_hook(secid_to_secctx, -EOPNOTSUPP, secid, secdata,
1152 seclen);
1123} 1153}
1124EXPORT_SYMBOL(security_secid_to_secctx); 1154EXPORT_SYMBOL(security_secid_to_secctx);
1125 1155
1126int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) 1156int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
1127{ 1157{
1128 return security_ops->secctx_to_secid(secdata, seclen, secid); 1158 *secid = 0;
1159 return call_int_hook(secctx_to_secid, 0, secdata, seclen, secid);
1129} 1160}
1130EXPORT_SYMBOL(security_secctx_to_secid); 1161EXPORT_SYMBOL(security_secctx_to_secid);
1131 1162
1132void security_release_secctx(char *secdata, u32 seclen) 1163void security_release_secctx(char *secdata, u32 seclen)
1133{ 1164{
1134 security_ops->release_secctx(secdata, seclen); 1165 call_void_hook(release_secctx, secdata, seclen);
1135} 1166}
1136EXPORT_SYMBOL(security_release_secctx); 1167EXPORT_SYMBOL(security_release_secctx);
1137 1168
1138int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen) 1169int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
1139{ 1170{
1140 return security_ops->inode_notifysecctx(inode, ctx, ctxlen); 1171 return call_int_hook(inode_notifysecctx, 0, inode, ctx, ctxlen);
1141} 1172}
1142EXPORT_SYMBOL(security_inode_notifysecctx); 1173EXPORT_SYMBOL(security_inode_notifysecctx);
1143 1174
1144int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen) 1175int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
1145{ 1176{
1146 return security_ops->inode_setsecctx(dentry, ctx, ctxlen); 1177 return call_int_hook(inode_setsecctx, 0, dentry, ctx, ctxlen);
1147} 1178}
1148EXPORT_SYMBOL(security_inode_setsecctx); 1179EXPORT_SYMBOL(security_inode_setsecctx);
1149 1180
1150int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen) 1181int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
1151{ 1182{
1152 return security_ops->inode_getsecctx(inode, ctx, ctxlen); 1183 return call_int_hook(inode_getsecctx, -EOPNOTSUPP, inode, ctx, ctxlen);
1153} 1184}
1154EXPORT_SYMBOL(security_inode_getsecctx); 1185EXPORT_SYMBOL(security_inode_getsecctx);
1155 1186
@@ -1157,206 +1188,207 @@ EXPORT_SYMBOL(security_inode_getsecctx);
1157 1188
1158int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk) 1189int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk)
1159{ 1190{
1160 return security_ops->unix_stream_connect(sock, other, newsk); 1191 return call_int_hook(unix_stream_connect, 0, sock, other, newsk);
1161} 1192}
1162EXPORT_SYMBOL(security_unix_stream_connect); 1193EXPORT_SYMBOL(security_unix_stream_connect);
1163 1194
1164int security_unix_may_send(struct socket *sock, struct socket *other) 1195int security_unix_may_send(struct socket *sock, struct socket *other)
1165{ 1196{
1166 return security_ops->unix_may_send(sock, other); 1197 return call_int_hook(unix_may_send, 0, sock, other);
1167} 1198}
1168EXPORT_SYMBOL(security_unix_may_send); 1199EXPORT_SYMBOL(security_unix_may_send);
1169 1200
1170int security_socket_create(int family, int type, int protocol, int kern) 1201int security_socket_create(int family, int type, int protocol, int kern)
1171{ 1202{
1172 return security_ops->socket_create(family, type, protocol, kern); 1203 return call_int_hook(socket_create, 0, family, type, protocol, kern);
1173} 1204}
1174 1205
1175int security_socket_post_create(struct socket *sock, int family, 1206int security_socket_post_create(struct socket *sock, int family,
1176 int type, int protocol, int kern) 1207 int type, int protocol, int kern)
1177{ 1208{
1178 return security_ops->socket_post_create(sock, family, type, 1209 return call_int_hook(socket_post_create, 0, sock, family, type,
1179 protocol, kern); 1210 protocol, kern);
1180} 1211}
1181 1212
1182int security_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen) 1213int security_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
1183{ 1214{
1184 return security_ops->socket_bind(sock, address, addrlen); 1215 return call_int_hook(socket_bind, 0, sock, address, addrlen);
1185} 1216}
1186 1217
1187int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen) 1218int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
1188{ 1219{
1189 return security_ops->socket_connect(sock, address, addrlen); 1220 return call_int_hook(socket_connect, 0, sock, address, addrlen);
1190} 1221}
1191 1222
1192int security_socket_listen(struct socket *sock, int backlog) 1223int security_socket_listen(struct socket *sock, int backlog)
1193{ 1224{
1194 return security_ops->socket_listen(sock, backlog); 1225 return call_int_hook(socket_listen, 0, sock, backlog);
1195} 1226}
1196 1227
1197int security_socket_accept(struct socket *sock, struct socket *newsock) 1228int security_socket_accept(struct socket *sock, struct socket *newsock)
1198{ 1229{
1199 return security_ops->socket_accept(sock, newsock); 1230 return call_int_hook(socket_accept, 0, sock, newsock);
1200} 1231}
1201 1232
1202int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size) 1233int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size)
1203{ 1234{
1204 return security_ops->socket_sendmsg(sock, msg, size); 1235 return call_int_hook(socket_sendmsg, 0, sock, msg, size);
1205} 1236}
1206 1237
1207int security_socket_recvmsg(struct socket *sock, struct msghdr *msg, 1238int security_socket_recvmsg(struct socket *sock, struct msghdr *msg,
1208 int size, int flags) 1239 int size, int flags)
1209{ 1240{
1210 return security_ops->socket_recvmsg(sock, msg, size, flags); 1241 return call_int_hook(socket_recvmsg, 0, sock, msg, size, flags);
1211} 1242}
1212 1243
1213int security_socket_getsockname(struct socket *sock) 1244int security_socket_getsockname(struct socket *sock)
1214{ 1245{
1215 return security_ops->socket_getsockname(sock); 1246 return call_int_hook(socket_getsockname, 0, sock);
1216} 1247}
1217 1248
1218int security_socket_getpeername(struct socket *sock) 1249int security_socket_getpeername(struct socket *sock)
1219{ 1250{
1220 return security_ops->socket_getpeername(sock); 1251 return call_int_hook(socket_getpeername, 0, sock);
1221} 1252}
1222 1253
1223int security_socket_getsockopt(struct socket *sock, int level, int optname) 1254int security_socket_getsockopt(struct socket *sock, int level, int optname)
1224{ 1255{
1225 return security_ops->socket_getsockopt(sock, level, optname); 1256 return call_int_hook(socket_getsockopt, 0, sock, level, optname);
1226} 1257}
1227 1258
1228int security_socket_setsockopt(struct socket *sock, int level, int optname) 1259int security_socket_setsockopt(struct socket *sock, int level, int optname)
1229{ 1260{
1230 return security_ops->socket_setsockopt(sock, level, optname); 1261 return call_int_hook(socket_setsockopt, 0, sock, level, optname);
1231} 1262}
1232 1263
1233int security_socket_shutdown(struct socket *sock, int how) 1264int security_socket_shutdown(struct socket *sock, int how)
1234{ 1265{
1235 return security_ops->socket_shutdown(sock, how); 1266 return call_int_hook(socket_shutdown, 0, sock, how);
1236} 1267}
1237 1268
1238int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) 1269int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
1239{ 1270{
1240 return security_ops->socket_sock_rcv_skb(sk, skb); 1271 return call_int_hook(socket_sock_rcv_skb, 0, sk, skb);
1241} 1272}
1242EXPORT_SYMBOL(security_sock_rcv_skb); 1273EXPORT_SYMBOL(security_sock_rcv_skb);
1243 1274
1244int security_socket_getpeersec_stream(struct socket *sock, char __user *optval, 1275int security_socket_getpeersec_stream(struct socket *sock, char __user *optval,
1245 int __user *optlen, unsigned len) 1276 int __user *optlen, unsigned len)
1246{ 1277{
1247 return security_ops->socket_getpeersec_stream(sock, optval, optlen, len); 1278 return call_int_hook(socket_getpeersec_stream, -ENOPROTOOPT, sock,
1279 optval, optlen, len);
1248} 1280}
1249 1281
1250int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid) 1282int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
1251{ 1283{
1252 return security_ops->socket_getpeersec_dgram(sock, skb, secid); 1284 return call_int_hook(socket_getpeersec_dgram, 0, sock, skb, secid);
1253} 1285}
1254EXPORT_SYMBOL(security_socket_getpeersec_dgram); 1286EXPORT_SYMBOL(security_socket_getpeersec_dgram);
1255 1287
1256int security_sk_alloc(struct sock *sk, int family, gfp_t priority) 1288int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
1257{ 1289{
1258 return security_ops->sk_alloc_security(sk, family, priority); 1290 return call_int_hook(sk_alloc_security, 0, sk, family, priority);
1259} 1291}
1260 1292
1261void security_sk_free(struct sock *sk) 1293void security_sk_free(struct sock *sk)
1262{ 1294{
1263 security_ops->sk_free_security(sk); 1295 call_void_hook(sk_free_security, sk);
1264} 1296}
1265 1297
1266void security_sk_clone(const struct sock *sk, struct sock *newsk) 1298void security_sk_clone(const struct sock *sk, struct sock *newsk)
1267{ 1299{
1268 security_ops->sk_clone_security(sk, newsk); 1300 call_void_hook(sk_clone_security, sk, newsk);
1269} 1301}
1270EXPORT_SYMBOL(security_sk_clone); 1302EXPORT_SYMBOL(security_sk_clone);
1271 1303
1272void security_sk_classify_flow(struct sock *sk, struct flowi *fl) 1304void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
1273{ 1305{
1274 security_ops->sk_getsecid(sk, &fl->flowi_secid); 1306 call_void_hook(sk_getsecid, sk, &fl->flowi_secid);
1275} 1307}
1276EXPORT_SYMBOL(security_sk_classify_flow); 1308EXPORT_SYMBOL(security_sk_classify_flow);
1277 1309
1278void security_req_classify_flow(const struct request_sock *req, struct flowi *fl) 1310void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
1279{ 1311{
1280 security_ops->req_classify_flow(req, fl); 1312 call_void_hook(req_classify_flow, req, fl);
1281} 1313}
1282EXPORT_SYMBOL(security_req_classify_flow); 1314EXPORT_SYMBOL(security_req_classify_flow);
1283 1315
1284void security_sock_graft(struct sock *sk, struct socket *parent) 1316void security_sock_graft(struct sock *sk, struct socket *parent)
1285{ 1317{
1286 security_ops->sock_graft(sk, parent); 1318 call_void_hook(sock_graft, sk, parent);
1287} 1319}
1288EXPORT_SYMBOL(security_sock_graft); 1320EXPORT_SYMBOL(security_sock_graft);
1289 1321
1290int security_inet_conn_request(struct sock *sk, 1322int security_inet_conn_request(struct sock *sk,
1291 struct sk_buff *skb, struct request_sock *req) 1323 struct sk_buff *skb, struct request_sock *req)
1292{ 1324{
1293 return security_ops->inet_conn_request(sk, skb, req); 1325 return call_int_hook(inet_conn_request, 0, sk, skb, req);
1294} 1326}
1295EXPORT_SYMBOL(security_inet_conn_request); 1327EXPORT_SYMBOL(security_inet_conn_request);
1296 1328
1297void security_inet_csk_clone(struct sock *newsk, 1329void security_inet_csk_clone(struct sock *newsk,
1298 const struct request_sock *req) 1330 const struct request_sock *req)
1299{ 1331{
1300 security_ops->inet_csk_clone(newsk, req); 1332 call_void_hook(inet_csk_clone, newsk, req);
1301} 1333}
1302 1334
1303void security_inet_conn_established(struct sock *sk, 1335void security_inet_conn_established(struct sock *sk,
1304 struct sk_buff *skb) 1336 struct sk_buff *skb)
1305{ 1337{
1306 security_ops->inet_conn_established(sk, skb); 1338 call_void_hook(inet_conn_established, sk, skb);
1307} 1339}
1308 1340
1309int security_secmark_relabel_packet(u32 secid) 1341int security_secmark_relabel_packet(u32 secid)
1310{ 1342{
1311 return security_ops->secmark_relabel_packet(secid); 1343 return call_int_hook(secmark_relabel_packet, 0, secid);
1312} 1344}
1313EXPORT_SYMBOL(security_secmark_relabel_packet); 1345EXPORT_SYMBOL(security_secmark_relabel_packet);
1314 1346
1315void security_secmark_refcount_inc(void) 1347void security_secmark_refcount_inc(void)
1316{ 1348{
1317 security_ops->secmark_refcount_inc(); 1349 call_void_hook(secmark_refcount_inc);
1318} 1350}
1319EXPORT_SYMBOL(security_secmark_refcount_inc); 1351EXPORT_SYMBOL(security_secmark_refcount_inc);
1320 1352
1321void security_secmark_refcount_dec(void) 1353void security_secmark_refcount_dec(void)
1322{ 1354{
1323 security_ops->secmark_refcount_dec(); 1355 call_void_hook(secmark_refcount_dec);
1324} 1356}
1325EXPORT_SYMBOL(security_secmark_refcount_dec); 1357EXPORT_SYMBOL(security_secmark_refcount_dec);
1326 1358
1327int security_tun_dev_alloc_security(void **security) 1359int security_tun_dev_alloc_security(void **security)
1328{ 1360{
1329 return security_ops->tun_dev_alloc_security(security); 1361 return call_int_hook(tun_dev_alloc_security, 0, security);
1330} 1362}
1331EXPORT_SYMBOL(security_tun_dev_alloc_security); 1363EXPORT_SYMBOL(security_tun_dev_alloc_security);
1332 1364
1333void security_tun_dev_free_security(void *security) 1365void security_tun_dev_free_security(void *security)
1334{ 1366{
1335 security_ops->tun_dev_free_security(security); 1367 call_void_hook(tun_dev_free_security, security);
1336} 1368}
1337EXPORT_SYMBOL(security_tun_dev_free_security); 1369EXPORT_SYMBOL(security_tun_dev_free_security);
1338 1370
1339int security_tun_dev_create(void) 1371int security_tun_dev_create(void)
1340{ 1372{
1341 return security_ops->tun_dev_create(); 1373 return call_int_hook(tun_dev_create, 0);
1342} 1374}
1343EXPORT_SYMBOL(security_tun_dev_create); 1375EXPORT_SYMBOL(security_tun_dev_create);
1344 1376
1345int security_tun_dev_attach_queue(void *security) 1377int security_tun_dev_attach_queue(void *security)
1346{ 1378{
1347 return security_ops->tun_dev_attach_queue(security); 1379 return call_int_hook(tun_dev_attach_queue, 0, security);
1348} 1380}
1349EXPORT_SYMBOL(security_tun_dev_attach_queue); 1381EXPORT_SYMBOL(security_tun_dev_attach_queue);
1350 1382
1351int security_tun_dev_attach(struct sock *sk, void *security) 1383int security_tun_dev_attach(struct sock *sk, void *security)
1352{ 1384{
1353 return security_ops->tun_dev_attach(sk, security); 1385 return call_int_hook(tun_dev_attach, 0, sk, security);
1354} 1386}
1355EXPORT_SYMBOL(security_tun_dev_attach); 1387EXPORT_SYMBOL(security_tun_dev_attach);
1356 1388
1357int security_tun_dev_open(void *security) 1389int security_tun_dev_open(void *security)
1358{ 1390{
1359 return security_ops->tun_dev_open(security); 1391 return call_int_hook(tun_dev_open, 0, security);
1360} 1392}
1361EXPORT_SYMBOL(security_tun_dev_open); 1393EXPORT_SYMBOL(security_tun_dev_open);
1362 1394
@@ -1368,71 +1400,89 @@ int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
1368 struct xfrm_user_sec_ctx *sec_ctx, 1400 struct xfrm_user_sec_ctx *sec_ctx,
1369 gfp_t gfp) 1401 gfp_t gfp)
1370{ 1402{
1371 return security_ops->xfrm_policy_alloc_security(ctxp, sec_ctx, gfp); 1403 return call_int_hook(xfrm_policy_alloc_security, 0, ctxp, sec_ctx, gfp);
1372} 1404}
1373EXPORT_SYMBOL(security_xfrm_policy_alloc); 1405EXPORT_SYMBOL(security_xfrm_policy_alloc);
1374 1406
1375int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx, 1407int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
1376 struct xfrm_sec_ctx **new_ctxp) 1408 struct xfrm_sec_ctx **new_ctxp)
1377{ 1409{
1378 return security_ops->xfrm_policy_clone_security(old_ctx, new_ctxp); 1410 return call_int_hook(xfrm_policy_clone_security, 0, old_ctx, new_ctxp);
1379} 1411}
1380 1412
1381void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx) 1413void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
1382{ 1414{
1383 security_ops->xfrm_policy_free_security(ctx); 1415 call_void_hook(xfrm_policy_free_security, ctx);
1384} 1416}
1385EXPORT_SYMBOL(security_xfrm_policy_free); 1417EXPORT_SYMBOL(security_xfrm_policy_free);
1386 1418
1387int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx) 1419int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
1388{ 1420{
1389 return security_ops->xfrm_policy_delete_security(ctx); 1421 return call_int_hook(xfrm_policy_delete_security, 0, ctx);
1390} 1422}
1391 1423
1392int security_xfrm_state_alloc(struct xfrm_state *x, 1424int security_xfrm_state_alloc(struct xfrm_state *x,
1393 struct xfrm_user_sec_ctx *sec_ctx) 1425 struct xfrm_user_sec_ctx *sec_ctx)
1394{ 1426{
1395 return security_ops->xfrm_state_alloc(x, sec_ctx); 1427 return call_int_hook(xfrm_state_alloc, 0, x, sec_ctx);
1396} 1428}
1397EXPORT_SYMBOL(security_xfrm_state_alloc); 1429EXPORT_SYMBOL(security_xfrm_state_alloc);
1398 1430
1399int security_xfrm_state_alloc_acquire(struct xfrm_state *x, 1431int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
1400 struct xfrm_sec_ctx *polsec, u32 secid) 1432 struct xfrm_sec_ctx *polsec, u32 secid)
1401{ 1433{
1402 return security_ops->xfrm_state_alloc_acquire(x, polsec, secid); 1434 return call_int_hook(xfrm_state_alloc_acquire, 0, x, polsec, secid);
1403} 1435}
1404 1436
1405int security_xfrm_state_delete(struct xfrm_state *x) 1437int security_xfrm_state_delete(struct xfrm_state *x)
1406{ 1438{
1407 return security_ops->xfrm_state_delete_security(x); 1439 return call_int_hook(xfrm_state_delete_security, 0, x);
1408} 1440}
1409EXPORT_SYMBOL(security_xfrm_state_delete); 1441EXPORT_SYMBOL(security_xfrm_state_delete);
1410 1442
1411void security_xfrm_state_free(struct xfrm_state *x) 1443void security_xfrm_state_free(struct xfrm_state *x)
1412{ 1444{
1413 security_ops->xfrm_state_free_security(x); 1445 call_void_hook(xfrm_state_free_security, x);
1414} 1446}
1415 1447
1416int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir) 1448int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
1417{ 1449{
1418 return security_ops->xfrm_policy_lookup(ctx, fl_secid, dir); 1450 return call_int_hook(xfrm_policy_lookup, 0, ctx, fl_secid, dir);
1419} 1451}
1420 1452
1421int security_xfrm_state_pol_flow_match(struct xfrm_state *x, 1453int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
1422 struct xfrm_policy *xp, 1454 struct xfrm_policy *xp,
1423 const struct flowi *fl) 1455 const struct flowi *fl)
1424{ 1456{
1425 return security_ops->xfrm_state_pol_flow_match(x, xp, fl); 1457 struct security_hook_list *hp;
1458 int rc = 1;
1459
1460 /*
1461 * Since this function is expected to return 0 or 1, the judgment
1462 * becomes difficult if multiple LSMs supply this call. Fortunately,
1463 * we can use the first LSM's judgment because currently only SELinux
1464 * supplies this call.
1465 *
1466 * For speed optimization, we explicitly break the loop rather than
1467 * using the macro
1468 */
1469 list_for_each_entry(hp, &security_hook_heads.xfrm_state_pol_flow_match,
1470 list) {
1471 rc = hp->hook.xfrm_state_pol_flow_match(x, xp, fl);
1472 break;
1473 }
1474 return rc;
1426} 1475}
1427 1476
1428int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid) 1477int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
1429{ 1478{
1430 return security_ops->xfrm_decode_session(skb, secid, 1); 1479 return call_int_hook(xfrm_decode_session, 0, skb, secid, 1);
1431} 1480}
1432 1481
1433void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl) 1482void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl)
1434{ 1483{
1435 int rc = security_ops->xfrm_decode_session(skb, &fl->flowi_secid, 0); 1484 int rc = call_int_hook(xfrm_decode_session, 0, skb, &fl->flowi_secid,
1485 0);
1436 1486
1437 BUG_ON(rc); 1487 BUG_ON(rc);
1438} 1488}
@@ -1445,23 +1495,24 @@ EXPORT_SYMBOL(security_skb_classify_flow);
1445int security_key_alloc(struct key *key, const struct cred *cred, 1495int security_key_alloc(struct key *key, const struct cred *cred,
1446 unsigned long flags) 1496 unsigned long flags)
1447{ 1497{
1448 return security_ops->key_alloc(key, cred, flags); 1498 return call_int_hook(key_alloc, 0, key, cred, flags);
1449} 1499}
1450 1500
1451void security_key_free(struct key *key) 1501void security_key_free(struct key *key)
1452{ 1502{
1453 security_ops->key_free(key); 1503 call_void_hook(key_free, key);
1454} 1504}
1455 1505
1456int security_key_permission(key_ref_t key_ref, 1506int security_key_permission(key_ref_t key_ref,
1457 const struct cred *cred, unsigned perm) 1507 const struct cred *cred, unsigned perm)
1458{ 1508{
1459 return security_ops->key_permission(key_ref, cred, perm); 1509 return call_int_hook(key_permission, 0, key_ref, cred, perm);
1460} 1510}
1461 1511
1462int security_key_getsecurity(struct key *key, char **_buffer) 1512int security_key_getsecurity(struct key *key, char **_buffer)
1463{ 1513{
1464 return security_ops->key_getsecurity(key, _buffer); 1514 *_buffer = NULL;
1515 return call_int_hook(key_getsecurity, 0, key, _buffer);
1465} 1516}
1466 1517
1467#endif /* CONFIG_KEYS */ 1518#endif /* CONFIG_KEYS */
@@ -1470,23 +1521,369 @@ int security_key_getsecurity(struct key *key, char **_buffer)
1470 1521
1471int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule) 1522int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule)
1472{ 1523{
1473 return security_ops->audit_rule_init(field, op, rulestr, lsmrule); 1524 return call_int_hook(audit_rule_init, 0, field, op, rulestr, lsmrule);
1474} 1525}
1475 1526
1476int security_audit_rule_known(struct audit_krule *krule) 1527int security_audit_rule_known(struct audit_krule *krule)
1477{ 1528{
1478 return security_ops->audit_rule_known(krule); 1529 return call_int_hook(audit_rule_known, 0, krule);
1479} 1530}
1480 1531
1481void security_audit_rule_free(void *lsmrule) 1532void security_audit_rule_free(void *lsmrule)
1482{ 1533{
1483 security_ops->audit_rule_free(lsmrule); 1534 call_void_hook(audit_rule_free, lsmrule);
1484} 1535}
1485 1536
1486int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule, 1537int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule,
1487 struct audit_context *actx) 1538 struct audit_context *actx)
1488{ 1539{
1489 return security_ops->audit_rule_match(secid, field, op, lsmrule, actx); 1540 return call_int_hook(audit_rule_match, 0, secid, field, op, lsmrule,
1541 actx);
1490} 1542}
1543#endif /* CONFIG_AUDIT */
1491 1544
1545struct security_hook_heads security_hook_heads = {
1546 .binder_set_context_mgr =
1547 LIST_HEAD_INIT(security_hook_heads.binder_set_context_mgr),
1548 .binder_transaction =
1549 LIST_HEAD_INIT(security_hook_heads.binder_transaction),
1550 .binder_transfer_binder =
1551 LIST_HEAD_INIT(security_hook_heads.binder_transfer_binder),
1552 .binder_transfer_file =
1553 LIST_HEAD_INIT(security_hook_heads.binder_transfer_file),
1554
1555 .ptrace_access_check =
1556 LIST_HEAD_INIT(security_hook_heads.ptrace_access_check),
1557 .ptrace_traceme =
1558 LIST_HEAD_INIT(security_hook_heads.ptrace_traceme),
1559 .capget = LIST_HEAD_INIT(security_hook_heads.capget),
1560 .capset = LIST_HEAD_INIT(security_hook_heads.capset),
1561 .capable = LIST_HEAD_INIT(security_hook_heads.capable),
1562 .quotactl = LIST_HEAD_INIT(security_hook_heads.quotactl),
1563 .quota_on = LIST_HEAD_INIT(security_hook_heads.quota_on),
1564 .syslog = LIST_HEAD_INIT(security_hook_heads.syslog),
1565 .settime = LIST_HEAD_INIT(security_hook_heads.settime),
1566 .vm_enough_memory =
1567 LIST_HEAD_INIT(security_hook_heads.vm_enough_memory),
1568 .bprm_set_creds =
1569 LIST_HEAD_INIT(security_hook_heads.bprm_set_creds),
1570 .bprm_check_security =
1571 LIST_HEAD_INIT(security_hook_heads.bprm_check_security),
1572 .bprm_secureexec =
1573 LIST_HEAD_INIT(security_hook_heads.bprm_secureexec),
1574 .bprm_committing_creds =
1575 LIST_HEAD_INIT(security_hook_heads.bprm_committing_creds),
1576 .bprm_committed_creds =
1577 LIST_HEAD_INIT(security_hook_heads.bprm_committed_creds),
1578 .sb_alloc_security =
1579 LIST_HEAD_INIT(security_hook_heads.sb_alloc_security),
1580 .sb_free_security =
1581 LIST_HEAD_INIT(security_hook_heads.sb_free_security),
1582 .sb_copy_data = LIST_HEAD_INIT(security_hook_heads.sb_copy_data),
1583 .sb_remount = LIST_HEAD_INIT(security_hook_heads.sb_remount),
1584 .sb_kern_mount =
1585 LIST_HEAD_INIT(security_hook_heads.sb_kern_mount),
1586 .sb_show_options =
1587 LIST_HEAD_INIT(security_hook_heads.sb_show_options),
1588 .sb_statfs = LIST_HEAD_INIT(security_hook_heads.sb_statfs),
1589 .sb_mount = LIST_HEAD_INIT(security_hook_heads.sb_mount),
1590 .sb_umount = LIST_HEAD_INIT(security_hook_heads.sb_umount),
1591 .sb_pivotroot = LIST_HEAD_INIT(security_hook_heads.sb_pivotroot),
1592 .sb_set_mnt_opts =
1593 LIST_HEAD_INIT(security_hook_heads.sb_set_mnt_opts),
1594 .sb_clone_mnt_opts =
1595 LIST_HEAD_INIT(security_hook_heads.sb_clone_mnt_opts),
1596 .sb_parse_opts_str =
1597 LIST_HEAD_INIT(security_hook_heads.sb_parse_opts_str),
1598 .dentry_init_security =
1599 LIST_HEAD_INIT(security_hook_heads.dentry_init_security),
1600#ifdef CONFIG_SECURITY_PATH
1601 .path_unlink = LIST_HEAD_INIT(security_hook_heads.path_unlink),
1602 .path_mkdir = LIST_HEAD_INIT(security_hook_heads.path_mkdir),
1603 .path_rmdir = LIST_HEAD_INIT(security_hook_heads.path_rmdir),
1604 .path_mknod = LIST_HEAD_INIT(security_hook_heads.path_mknod),
1605 .path_truncate =
1606 LIST_HEAD_INIT(security_hook_heads.path_truncate),
1607 .path_symlink = LIST_HEAD_INIT(security_hook_heads.path_symlink),
1608 .path_link = LIST_HEAD_INIT(security_hook_heads.path_link),
1609 .path_rename = LIST_HEAD_INIT(security_hook_heads.path_rename),
1610 .path_chmod = LIST_HEAD_INIT(security_hook_heads.path_chmod),
1611 .path_chown = LIST_HEAD_INIT(security_hook_heads.path_chown),
1612 .path_chroot = LIST_HEAD_INIT(security_hook_heads.path_chroot),
1613#endif
1614 .inode_alloc_security =
1615 LIST_HEAD_INIT(security_hook_heads.inode_alloc_security),
1616 .inode_free_security =
1617 LIST_HEAD_INIT(security_hook_heads.inode_free_security),
1618 .inode_init_security =
1619 LIST_HEAD_INIT(security_hook_heads.inode_init_security),
1620 .inode_create = LIST_HEAD_INIT(security_hook_heads.inode_create),
1621 .inode_link = LIST_HEAD_INIT(security_hook_heads.inode_link),
1622 .inode_unlink = LIST_HEAD_INIT(security_hook_heads.inode_unlink),
1623 .inode_symlink =
1624 LIST_HEAD_INIT(security_hook_heads.inode_symlink),
1625 .inode_mkdir = LIST_HEAD_INIT(security_hook_heads.inode_mkdir),
1626 .inode_rmdir = LIST_HEAD_INIT(security_hook_heads.inode_rmdir),
1627 .inode_mknod = LIST_HEAD_INIT(security_hook_heads.inode_mknod),
1628 .inode_rename = LIST_HEAD_INIT(security_hook_heads.inode_rename),
1629 .inode_readlink =
1630 LIST_HEAD_INIT(security_hook_heads.inode_readlink),
1631 .inode_follow_link =
1632 LIST_HEAD_INIT(security_hook_heads.inode_follow_link),
1633 .inode_permission =
1634 LIST_HEAD_INIT(security_hook_heads.inode_permission),
1635 .inode_setattr =
1636 LIST_HEAD_INIT(security_hook_heads.inode_setattr),
1637 .inode_getattr =
1638 LIST_HEAD_INIT(security_hook_heads.inode_getattr),
1639 .inode_setxattr =
1640 LIST_HEAD_INIT(security_hook_heads.inode_setxattr),
1641 .inode_post_setxattr =
1642 LIST_HEAD_INIT(security_hook_heads.inode_post_setxattr),
1643 .inode_getxattr =
1644 LIST_HEAD_INIT(security_hook_heads.inode_getxattr),
1645 .inode_listxattr =
1646 LIST_HEAD_INIT(security_hook_heads.inode_listxattr),
1647 .inode_removexattr =
1648 LIST_HEAD_INIT(security_hook_heads.inode_removexattr),
1649 .inode_need_killpriv =
1650 LIST_HEAD_INIT(security_hook_heads.inode_need_killpriv),
1651 .inode_killpriv =
1652 LIST_HEAD_INIT(security_hook_heads.inode_killpriv),
1653 .inode_getsecurity =
1654 LIST_HEAD_INIT(security_hook_heads.inode_getsecurity),
1655 .inode_setsecurity =
1656 LIST_HEAD_INIT(security_hook_heads.inode_setsecurity),
1657 .inode_listsecurity =
1658 LIST_HEAD_INIT(security_hook_heads.inode_listsecurity),
1659 .inode_getsecid =
1660 LIST_HEAD_INIT(security_hook_heads.inode_getsecid),
1661 .file_permission =
1662 LIST_HEAD_INIT(security_hook_heads.file_permission),
1663 .file_alloc_security =
1664 LIST_HEAD_INIT(security_hook_heads.file_alloc_security),
1665 .file_free_security =
1666 LIST_HEAD_INIT(security_hook_heads.file_free_security),
1667 .file_ioctl = LIST_HEAD_INIT(security_hook_heads.file_ioctl),
1668 .mmap_addr = LIST_HEAD_INIT(security_hook_heads.mmap_addr),
1669 .mmap_file = LIST_HEAD_INIT(security_hook_heads.mmap_file),
1670 .file_mprotect =
1671 LIST_HEAD_INIT(security_hook_heads.file_mprotect),
1672 .file_lock = LIST_HEAD_INIT(security_hook_heads.file_lock),
1673 .file_fcntl = LIST_HEAD_INIT(security_hook_heads.file_fcntl),
1674 .file_set_fowner =
1675 LIST_HEAD_INIT(security_hook_heads.file_set_fowner),
1676 .file_send_sigiotask =
1677 LIST_HEAD_INIT(security_hook_heads.file_send_sigiotask),
1678 .file_receive = LIST_HEAD_INIT(security_hook_heads.file_receive),
1679 .file_open = LIST_HEAD_INIT(security_hook_heads.file_open),
1680 .task_create = LIST_HEAD_INIT(security_hook_heads.task_create),
1681 .task_free = LIST_HEAD_INIT(security_hook_heads.task_free),
1682 .cred_alloc_blank =
1683 LIST_HEAD_INIT(security_hook_heads.cred_alloc_blank),
1684 .cred_free = LIST_HEAD_INIT(security_hook_heads.cred_free),
1685 .cred_prepare = LIST_HEAD_INIT(security_hook_heads.cred_prepare),
1686 .cred_transfer =
1687 LIST_HEAD_INIT(security_hook_heads.cred_transfer),
1688 .kernel_act_as =
1689 LIST_HEAD_INIT(security_hook_heads.kernel_act_as),
1690 .kernel_create_files_as =
1691 LIST_HEAD_INIT(security_hook_heads.kernel_create_files_as),
1692 .kernel_fw_from_file =
1693 LIST_HEAD_INIT(security_hook_heads.kernel_fw_from_file),
1694 .kernel_module_request =
1695 LIST_HEAD_INIT(security_hook_heads.kernel_module_request),
1696 .kernel_module_from_file =
1697 LIST_HEAD_INIT(security_hook_heads.kernel_module_from_file),
1698 .task_fix_setuid =
1699 LIST_HEAD_INIT(security_hook_heads.task_fix_setuid),
1700 .task_setpgid = LIST_HEAD_INIT(security_hook_heads.task_setpgid),
1701 .task_getpgid = LIST_HEAD_INIT(security_hook_heads.task_getpgid),
1702 .task_getsid = LIST_HEAD_INIT(security_hook_heads.task_getsid),
1703 .task_getsecid =
1704 LIST_HEAD_INIT(security_hook_heads.task_getsecid),
1705 .task_setnice = LIST_HEAD_INIT(security_hook_heads.task_setnice),
1706 .task_setioprio =
1707 LIST_HEAD_INIT(security_hook_heads.task_setioprio),
1708 .task_getioprio =
1709 LIST_HEAD_INIT(security_hook_heads.task_getioprio),
1710 .task_setrlimit =
1711 LIST_HEAD_INIT(security_hook_heads.task_setrlimit),
1712 .task_setscheduler =
1713 LIST_HEAD_INIT(security_hook_heads.task_setscheduler),
1714 .task_getscheduler =
1715 LIST_HEAD_INIT(security_hook_heads.task_getscheduler),
1716 .task_movememory =
1717 LIST_HEAD_INIT(security_hook_heads.task_movememory),
1718 .task_kill = LIST_HEAD_INIT(security_hook_heads.task_kill),
1719 .task_wait = LIST_HEAD_INIT(security_hook_heads.task_wait),
1720 .task_prctl = LIST_HEAD_INIT(security_hook_heads.task_prctl),
1721 .task_to_inode =
1722 LIST_HEAD_INIT(security_hook_heads.task_to_inode),
1723 .ipc_permission =
1724 LIST_HEAD_INIT(security_hook_heads.ipc_permission),
1725 .ipc_getsecid = LIST_HEAD_INIT(security_hook_heads.ipc_getsecid),
1726 .msg_msg_alloc_security =
1727 LIST_HEAD_INIT(security_hook_heads.msg_msg_alloc_security),
1728 .msg_msg_free_security =
1729 LIST_HEAD_INIT(security_hook_heads.msg_msg_free_security),
1730 .msg_queue_alloc_security =
1731 LIST_HEAD_INIT(security_hook_heads.msg_queue_alloc_security),
1732 .msg_queue_free_security =
1733 LIST_HEAD_INIT(security_hook_heads.msg_queue_free_security),
1734 .msg_queue_associate =
1735 LIST_HEAD_INIT(security_hook_heads.msg_queue_associate),
1736 .msg_queue_msgctl =
1737 LIST_HEAD_INIT(security_hook_heads.msg_queue_msgctl),
1738 .msg_queue_msgsnd =
1739 LIST_HEAD_INIT(security_hook_heads.msg_queue_msgsnd),
1740 .msg_queue_msgrcv =
1741 LIST_HEAD_INIT(security_hook_heads.msg_queue_msgrcv),
1742 .shm_alloc_security =
1743 LIST_HEAD_INIT(security_hook_heads.shm_alloc_security),
1744 .shm_free_security =
1745 LIST_HEAD_INIT(security_hook_heads.shm_free_security),
1746 .shm_associate =
1747 LIST_HEAD_INIT(security_hook_heads.shm_associate),
1748 .shm_shmctl = LIST_HEAD_INIT(security_hook_heads.shm_shmctl),
1749 .shm_shmat = LIST_HEAD_INIT(security_hook_heads.shm_shmat),
1750 .sem_alloc_security =
1751 LIST_HEAD_INIT(security_hook_heads.sem_alloc_security),
1752 .sem_free_security =
1753 LIST_HEAD_INIT(security_hook_heads.sem_free_security),
1754 .sem_associate =
1755 LIST_HEAD_INIT(security_hook_heads.sem_associate),
1756 .sem_semctl = LIST_HEAD_INIT(security_hook_heads.sem_semctl),
1757 .sem_semop = LIST_HEAD_INIT(security_hook_heads.sem_semop),
1758 .netlink_send = LIST_HEAD_INIT(security_hook_heads.netlink_send),
1759 .d_instantiate =
1760 LIST_HEAD_INIT(security_hook_heads.d_instantiate),
1761 .getprocattr = LIST_HEAD_INIT(security_hook_heads.getprocattr),
1762 .setprocattr = LIST_HEAD_INIT(security_hook_heads.setprocattr),
1763 .ismaclabel = LIST_HEAD_INIT(security_hook_heads.ismaclabel),
1764 .secid_to_secctx =
1765 LIST_HEAD_INIT(security_hook_heads.secid_to_secctx),
1766 .secctx_to_secid =
1767 LIST_HEAD_INIT(security_hook_heads.secctx_to_secid),
1768 .release_secctx =
1769 LIST_HEAD_INIT(security_hook_heads.release_secctx),
1770 .inode_notifysecctx =
1771 LIST_HEAD_INIT(security_hook_heads.inode_notifysecctx),
1772 .inode_setsecctx =
1773 LIST_HEAD_INIT(security_hook_heads.inode_setsecctx),
1774 .inode_getsecctx =
1775 LIST_HEAD_INIT(security_hook_heads.inode_getsecctx),
1776#ifdef CONFIG_SECURITY_NETWORK
1777 .unix_stream_connect =
1778 LIST_HEAD_INIT(security_hook_heads.unix_stream_connect),
1779 .unix_may_send =
1780 LIST_HEAD_INIT(security_hook_heads.unix_may_send),
1781 .socket_create =
1782 LIST_HEAD_INIT(security_hook_heads.socket_create),
1783 .socket_post_create =
1784 LIST_HEAD_INIT(security_hook_heads.socket_post_create),
1785 .socket_bind = LIST_HEAD_INIT(security_hook_heads.socket_bind),
1786 .socket_connect =
1787 LIST_HEAD_INIT(security_hook_heads.socket_connect),
1788 .socket_listen =
1789 LIST_HEAD_INIT(security_hook_heads.socket_listen),
1790 .socket_accept =
1791 LIST_HEAD_INIT(security_hook_heads.socket_accept),
1792 .socket_sendmsg =
1793 LIST_HEAD_INIT(security_hook_heads.socket_sendmsg),
1794 .socket_recvmsg =
1795 LIST_HEAD_INIT(security_hook_heads.socket_recvmsg),
1796 .socket_getsockname =
1797 LIST_HEAD_INIT(security_hook_heads.socket_getsockname),
1798 .socket_getpeername =
1799 LIST_HEAD_INIT(security_hook_heads.socket_getpeername),
1800 .socket_getsockopt =
1801 LIST_HEAD_INIT(security_hook_heads.socket_getsockopt),
1802 .socket_setsockopt =
1803 LIST_HEAD_INIT(security_hook_heads.socket_setsockopt),
1804 .socket_shutdown =
1805 LIST_HEAD_INIT(security_hook_heads.socket_shutdown),
1806 .socket_sock_rcv_skb =
1807 LIST_HEAD_INIT(security_hook_heads.socket_sock_rcv_skb),
1808 .socket_getpeersec_stream =
1809 LIST_HEAD_INIT(security_hook_heads.socket_getpeersec_stream),
1810 .socket_getpeersec_dgram =
1811 LIST_HEAD_INIT(security_hook_heads.socket_getpeersec_dgram),
1812 .sk_alloc_security =
1813 LIST_HEAD_INIT(security_hook_heads.sk_alloc_security),
1814 .sk_free_security =
1815 LIST_HEAD_INIT(security_hook_heads.sk_free_security),
1816 .sk_clone_security =
1817 LIST_HEAD_INIT(security_hook_heads.sk_clone_security),
1818 .sk_getsecid = LIST_HEAD_INIT(security_hook_heads.sk_getsecid),
1819 .sock_graft = LIST_HEAD_INIT(security_hook_heads.sock_graft),
1820 .inet_conn_request =
1821 LIST_HEAD_INIT(security_hook_heads.inet_conn_request),
1822 .inet_csk_clone =
1823 LIST_HEAD_INIT(security_hook_heads.inet_csk_clone),
1824 .inet_conn_established =
1825 LIST_HEAD_INIT(security_hook_heads.inet_conn_established),
1826 .secmark_relabel_packet =
1827 LIST_HEAD_INIT(security_hook_heads.secmark_relabel_packet),
1828 .secmark_refcount_inc =
1829 LIST_HEAD_INIT(security_hook_heads.secmark_refcount_inc),
1830 .secmark_refcount_dec =
1831 LIST_HEAD_INIT(security_hook_heads.secmark_refcount_dec),
1832 .req_classify_flow =
1833 LIST_HEAD_INIT(security_hook_heads.req_classify_flow),
1834 .tun_dev_alloc_security =
1835 LIST_HEAD_INIT(security_hook_heads.tun_dev_alloc_security),
1836 .tun_dev_free_security =
1837 LIST_HEAD_INIT(security_hook_heads.tun_dev_free_security),
1838 .tun_dev_create =
1839 LIST_HEAD_INIT(security_hook_heads.tun_dev_create),
1840 .tun_dev_attach_queue =
1841 LIST_HEAD_INIT(security_hook_heads.tun_dev_attach_queue),
1842 .tun_dev_attach =
1843 LIST_HEAD_INIT(security_hook_heads.tun_dev_attach),
1844 .tun_dev_open = LIST_HEAD_INIT(security_hook_heads.tun_dev_open),
1845 .skb_owned_by = LIST_HEAD_INIT(security_hook_heads.skb_owned_by),
1846#endif /* CONFIG_SECURITY_NETWORK */
1847#ifdef CONFIG_SECURITY_NETWORK_XFRM
1848 .xfrm_policy_alloc_security =
1849 LIST_HEAD_INIT(security_hook_heads.xfrm_policy_alloc_security),
1850 .xfrm_policy_clone_security =
1851 LIST_HEAD_INIT(security_hook_heads.xfrm_policy_clone_security),
1852 .xfrm_policy_free_security =
1853 LIST_HEAD_INIT(security_hook_heads.xfrm_policy_free_security),
1854 .xfrm_policy_delete_security =
1855 LIST_HEAD_INIT(security_hook_heads.xfrm_policy_delete_security),
1856 .xfrm_state_alloc =
1857 LIST_HEAD_INIT(security_hook_heads.xfrm_state_alloc),
1858 .xfrm_state_alloc_acquire =
1859 LIST_HEAD_INIT(security_hook_heads.xfrm_state_alloc_acquire),
1860 .xfrm_state_free_security =
1861 LIST_HEAD_INIT(security_hook_heads.xfrm_state_free_security),
1862 .xfrm_state_delete_security =
1863 LIST_HEAD_INIT(security_hook_heads.xfrm_state_delete_security),
1864 .xfrm_policy_lookup =
1865 LIST_HEAD_INIT(security_hook_heads.xfrm_policy_lookup),
1866 .xfrm_state_pol_flow_match =
1867 LIST_HEAD_INIT(security_hook_heads.xfrm_state_pol_flow_match),
1868 .xfrm_decode_session =
1869 LIST_HEAD_INIT(security_hook_heads.xfrm_decode_session),
1870#endif /* CONFIG_SECURITY_NETWORK_XFRM */
1871#ifdef CONFIG_KEYS
1872 .key_alloc = LIST_HEAD_INIT(security_hook_heads.key_alloc),
1873 .key_free = LIST_HEAD_INIT(security_hook_heads.key_free),
1874 .key_permission =
1875 LIST_HEAD_INIT(security_hook_heads.key_permission),
1876 .key_getsecurity =
1877 LIST_HEAD_INIT(security_hook_heads.key_getsecurity),
1878#endif /* CONFIG_KEYS */
1879#ifdef CONFIG_AUDIT
1880 .audit_rule_init =
1881 LIST_HEAD_INIT(security_hook_heads.audit_rule_init),
1882 .audit_rule_known =
1883 LIST_HEAD_INIT(security_hook_heads.audit_rule_known),
1884 .audit_rule_match =
1885 LIST_HEAD_INIT(security_hook_heads.audit_rule_match),
1886 .audit_rule_free =
1887 LIST_HEAD_INIT(security_hook_heads.audit_rule_free),
1492#endif /* CONFIG_AUDIT */ 1888#endif /* CONFIG_AUDIT */
1889};
generated by cgit v1.2.2 (git 2.25.0) at 2025-02-21 07:02:54 -0500