Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751653AbbEGUlj (ORCPT ); Thu, 7 May 2015 16:41:39 -0400 Received: from mail-qk0-f180.google.com ([209.85.220.180]:36240 "EHLO mail-qk0-f180.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750876AbbEGUlg (ORCPT ); Thu, 7 May 2015 16:41:36 -0400 From: Paul Moore To: Casey Schaufler Cc: James Morris , James Morris , LSM , LKLM , John Johansen , Tetsuo Handa , Stephen Smalley , Eric Paris , Kees Cook Subject: Re: [PATCH 1/7 v22] LSM: Split security.h Date: Thu, 07 May 2015 16:41:33 -0400 Message-ID: <8137490.K0VkyVAhJQ@sifl> User-Agent: KMail/4.14.6 (Linux/3.16.7-gentoo; KDE/4.14.7; x86_64; ; ) In-Reply-To: <55454B66.2090605@schaufler-ca.com> References: <55454539.9020204@schaufler-ca.com> <55454B66.2090605@schaufler-ca.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 36866 Lines: 821 On Saturday, May 02, 2015 03:10:46 PM Casey Schaufler wrote: > Subject: [PATCH 1/7 v22] LSM: Split security.h > > The security.h header file serves two purposes, > interfaces for users of the security modules and > interfaces for security modules. Users of the > security modules don't need to know about what's > in the security_operations structure, so pull it > out into it's own header, lsm_hooks.h > > Signed-off-by: Casey Schaufler Acked-by: Paul Moore > diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h > new file mode 100644 > index 0000000..b2f447e > --- /dev/null > +++ b/include/linux/lsm_hooks.h > @@ -0,0 +1,359 @@ > +/* > + * Linux Security Module interfaces > + * > + * Copyright (C) 2001 WireX Communications, Inc > + * Copyright (C) 2001 Greg Kroah-Hartman > + * Copyright (C) 2001 Networks Associates Technology, Inc > + * Copyright (C) 2001 James Morris > > + * Copyright (C) 2001 Silicon Graphics, Inc. (Trust Technology Group) > + * Copyright (C) 2015 Intel Corporation. > + * Copyright (C) 2015 Casey Schaufler > + * > + * This program is free software; you can redistribute it and/or modify > + * it under the terms of the GNU General Public License as published by > + * the Free Software Foundation; either version 2 of the License, or > + * (at your option) any later version. > + * > + * Due to this file being licensed under the GPL there is controversy over > + * whether this permits you to write a module that #includes this file > + * without placing your module under the GPL. Please consult a lawyer for > + * advice before doing this. > + * > + */ > + > +#ifndef __LINUX_LSM_HOOKS_H > +#define __LINUX_LSM_HOOKS_H > + > +#include > + > +/* Maximum number of letters for an LSM name string */ > +#define SECURITY_NAME_MAX 10 > + > +#ifdef CONFIG_SECURITY > + > +struct security_operations { > + char name[SECURITY_NAME_MAX + 1]; > + > + int (*binder_set_context_mgr)(struct task_struct *mgr); > + int (*binder_transaction)(struct task_struct *from, > + struct task_struct *to); > + int (*binder_transfer_binder)(struct task_struct *from, > + struct task_struct *to); > + int (*binder_transfer_file)(struct task_struct *from, > + struct task_struct *to, > + struct file *file); > + > + int (*ptrace_access_check)(struct task_struct *child, > + unsigned int mode); > + int (*ptrace_traceme)(struct task_struct *parent); > + int (*capget)(struct task_struct *target, kernel_cap_t *effective, > + kernel_cap_t *inheritable, kernel_cap_t *permitted); > + int (*capset)(struct cred *new, const struct cred *old, > + const kernel_cap_t *effective, > + const kernel_cap_t *inheritable, > + const kernel_cap_t *permitted); > + int (*capable)(const struct cred *cred, struct user_namespace *ns, > + int cap, int audit); > + int (*quotactl)(int cmds, int type, int id, struct super_block *sb); > + int (*quota_on)(struct dentry *dentry); > + int (*syslog)(int type); > + int (*settime)(const struct timespec *ts, const struct timezone *tz); > + int (*vm_enough_memory)(struct mm_struct *mm, long pages); > + > + int (*bprm_set_creds)(struct linux_binprm *bprm); > + int (*bprm_check_security)(struct linux_binprm *bprm); > + int (*bprm_secureexec)(struct linux_binprm *bprm); > + void (*bprm_committing_creds)(struct linux_binprm *bprm); > + void (*bprm_committed_creds)(struct linux_binprm *bprm); > + > + int (*sb_alloc_security)(struct super_block *sb); > + void (*sb_free_security)(struct super_block *sb); > + int (*sb_copy_data)(char *orig, char *copy); > + int (*sb_remount)(struct super_block *sb, void *data); > + int (*sb_kern_mount)(struct super_block *sb, int flags, void *data); > + int (*sb_show_options)(struct seq_file *m, struct super_block *sb); > + int (*sb_statfs)(struct dentry *dentry); > + int (*sb_mount)(const char *dev_name, struct path *path, > + const char *type, unsigned long flags, void *data); > + int (*sb_umount)(struct vfsmount *mnt, int flags); > + int (*sb_pivotroot)(struct path *old_path, struct path *new_path); > + int (*sb_set_mnt_opts)(struct super_block *sb, > + struct security_mnt_opts *opts, > + unsigned long kern_flags, > + unsigned long *set_kern_flags); > + int (*sb_clone_mnt_opts)(const struct super_block *oldsb, > + struct super_block *newsb); > + int (*sb_parse_opts_str)(char *options, struct security_mnt_opts *opts); > + int (*dentry_init_security)(struct dentry *dentry, int mode, > + struct qstr *name, void **ctx, > + u32 *ctxlen); > + > + > +#ifdef CONFIG_SECURITY_PATH > + int (*path_unlink)(struct path *dir, struct dentry *dentry); > + int (*path_mkdir)(struct path *dir, struct dentry *dentry, > + umode_t mode); > + int (*path_rmdir)(struct path *dir, struct dentry *dentry); > + int (*path_mknod)(struct path *dir, struct dentry *dentry, > + umode_t mode, unsigned int dev); > + int (*path_truncate)(struct path *path); > + int (*path_symlink)(struct path *dir, struct dentry *dentry, > + const char *old_name); > + int (*path_link)(struct dentry *old_dentry, struct path *new_dir, > + struct dentry *new_dentry); > + int (*path_rename)(struct path *old_dir, struct dentry *old_dentry, > + struct path *new_dir, > + struct dentry *new_dentry); > + int (*path_chmod)(struct path *path, umode_t mode); > + int (*path_chown)(struct path *path, kuid_t uid, kgid_t gid); > + int (*path_chroot)(struct path *path); > +#endif > + > + int (*inode_alloc_security)(struct inode *inode); > + void (*inode_free_security)(struct inode *inode); > + int (*inode_init_security)(struct inode *inode, struct inode *dir, > + const struct qstr *qstr, > + const char **name, void **value, > + size_t *len); > + int (*inode_create)(struct inode *dir, struct dentry *dentry, > + umode_t mode); > + int (*inode_link)(struct dentry *old_dentry, struct inode *dir, > + struct dentry *new_dentry); > + int (*inode_unlink)(struct inode *dir, struct dentry *dentry); > + int (*inode_symlink)(struct inode *dir, struct dentry *dentry, > + const char *old_name); > + int (*inode_mkdir)(struct inode *dir, struct dentry *dentry, > + umode_t mode); > + int (*inode_rmdir)(struct inode *dir, struct dentry *dentry); > + int (*inode_mknod)(struct inode *dir, struct dentry *dentry, > + umode_t mode, dev_t dev); > + int (*inode_rename)(struct inode *old_dir, struct dentry *old_dentry, > + struct inode *new_dir, > + struct dentry *new_dentry); > + int (*inode_readlink)(struct dentry *dentry); > + int (*inode_follow_link)(struct dentry *dentry, struct nameidata *nd); > + int (*inode_permission)(struct inode *inode, int mask); > + int (*inode_setattr)(struct dentry *dentry, struct iattr *attr); > + int (*inode_getattr)(const struct path *path); > + int (*inode_setxattr)(struct dentry *dentry, const char *name, > + const void *value, size_t size, int flags); > + void (*inode_post_setxattr)(struct dentry *dentry, const char *name, > + const void *value, size_t size, > + int flags); > + int (*inode_getxattr)(struct dentry *dentry, const char *name); > + int (*inode_listxattr)(struct dentry *dentry); > + int (*inode_removexattr)(struct dentry *dentry, const char *name); > + int (*inode_need_killpriv)(struct dentry *dentry); > + int (*inode_killpriv)(struct dentry *dentry); > + int (*inode_getsecurity)(const struct inode *inode, const char *name, > + void **buffer, bool alloc); > + int (*inode_setsecurity)(struct inode *inode, const char *name, > + const void *value, size_t size, > + int flags); > + int (*inode_listsecurity)(struct inode *inode, char *buffer, > + size_t buffer_size); > + void (*inode_getsecid)(const struct inode *inode, u32 *secid); > + > + int (*file_permission)(struct file *file, int mask); > + int (*file_alloc_security)(struct file *file); > + void (*file_free_security)(struct file *file); > + int (*file_ioctl)(struct file *file, unsigned int cmd, > + unsigned long arg); > + int (*mmap_addr)(unsigned long addr); > + int (*mmap_file)(struct file *file, unsigned long reqprot, > + unsigned long prot, unsigned long flags); > + int (*file_mprotect)(struct vm_area_struct *vma, unsigned long reqprot, > + unsigned long prot); > + int (*file_lock)(struct file *file, unsigned int cmd); > + int (*file_fcntl)(struct file *file, unsigned int cmd, > + unsigned long arg); > + void (*file_set_fowner)(struct file *file); > + int (*file_send_sigiotask)(struct task_struct *tsk, > + struct fown_struct *fown, int sig); > + int (*file_receive)(struct file *file); > + int (*file_open)(struct file *file, const struct cred *cred); > + > + int (*task_create)(unsigned long clone_flags); > + void (*task_free)(struct task_struct *task); > + int (*cred_alloc_blank)(struct cred *cred, gfp_t gfp); > + void (*cred_free)(struct cred *cred); > + int (*cred_prepare)(struct cred *new, const struct cred *old, > + gfp_t gfp); > + void (*cred_transfer)(struct cred *new, const struct cred *old); > + int (*kernel_act_as)(struct cred *new, u32 secid); > + int (*kernel_create_files_as)(struct cred *new, struct inode *inode); > + int (*kernel_fw_from_file)(struct file *file, char *buf, size_t size); > + int (*kernel_module_request)(char *kmod_name); > + int (*kernel_module_from_file)(struct file *file); > + int (*task_fix_setuid)(struct cred *new, const struct cred *old, > + int flags); > + int (*task_setpgid)(struct task_struct *p, pid_t pgid); > + int (*task_getpgid)(struct task_struct *p); > + int (*task_getsid)(struct task_struct *p); > + void (*task_getsecid)(struct task_struct *p, u32 *secid); > + int (*task_setnice)(struct task_struct *p, int nice); > + int (*task_setioprio)(struct task_struct *p, int ioprio); > + int (*task_getioprio)(struct task_struct *p); > + int (*task_setrlimit)(struct task_struct *p, unsigned int resource, > + struct rlimit *new_rlim); > + int (*task_setscheduler)(struct task_struct *p); > + int (*task_getscheduler)(struct task_struct *p); > + int (*task_movememory)(struct task_struct *p); > + int (*task_kill)(struct task_struct *p, struct siginfo *info, > + int sig, u32 secid); > + int (*task_wait)(struct task_struct *p); > + int (*task_prctl)(int option, unsigned long arg2, unsigned long arg3, > + unsigned long arg4, unsigned long arg5); > + void (*task_to_inode)(struct task_struct *p, struct inode *inode); > + > + int (*ipc_permission)(struct kern_ipc_perm *ipcp, short flag); > + void (*ipc_getsecid)(struct kern_ipc_perm *ipcp, u32 *secid); > + > + int (*msg_msg_alloc_security)(struct msg_msg *msg); > + void (*msg_msg_free_security)(struct msg_msg *msg); > + > + int (*msg_queue_alloc_security)(struct msg_queue *msq); > + void (*msg_queue_free_security)(struct msg_queue *msq); > + int (*msg_queue_associate)(struct msg_queue *msq, int msqflg); > + int (*msg_queue_msgctl)(struct msg_queue *msq, int cmd); > + int (*msg_queue_msgsnd)(struct msg_queue *msq, struct msg_msg *msg, > + int msqflg); > + int (*msg_queue_msgrcv)(struct msg_queue *msq, struct msg_msg *msg, > + struct task_struct *target, long type, > + int mode); > + > + int (*shm_alloc_security)(struct shmid_kernel *shp); > + void (*shm_free_security)(struct shmid_kernel *shp); > + int (*shm_associate)(struct shmid_kernel *shp, int shmflg); > + int (*shm_shmctl)(struct shmid_kernel *shp, int cmd); > + int (*shm_shmat)(struct shmid_kernel *shp, char __user *shmaddr, > + int shmflg); > + > + int (*sem_alloc_security)(struct sem_array *sma); > + void (*sem_free_security)(struct sem_array *sma); > + int (*sem_associate)(struct sem_array *sma, int semflg); > + int (*sem_semctl)(struct sem_array *sma, int cmd); > + int (*sem_semop)(struct sem_array *sma, struct sembuf *sops, > + unsigned nsops, int alter); > + > + int (*netlink_send)(struct sock *sk, struct sk_buff *skb); > + > + void (*d_instantiate)(struct dentry *dentry, struct inode *inode); > + > + int (*getprocattr)(struct task_struct *p, char *name, char **value); > + int (*setprocattr)(struct task_struct *p, char *name, void *value, > + size_t size); > + int (*ismaclabel)(const char *name); > + int (*secid_to_secctx)(u32 secid, char **secdata, u32 *seclen); > + int (*secctx_to_secid)(const char *secdata, u32 seclen, u32 *secid); > + void (*release_secctx)(char *secdata, u32 seclen); > + > + int (*inode_notifysecctx)(struct inode *inode, void *ctx, u32 ctxlen); > + int (*inode_setsecctx)(struct dentry *dentry, void *ctx, u32 ctxlen); > + int (*inode_getsecctx)(struct inode *inode, void **ctx, u32 *ctxlen); > + > +#ifdef CONFIG_SECURITY_NETWORK > + int (*unix_stream_connect)(struct sock *sock, struct sock *other, > + struct sock *newsk); > + int (*unix_may_send)(struct socket *sock, struct socket *other); > + > + int (*socket_create)(int family, int type, int protocol, int kern); > + int (*socket_post_create)(struct socket *sock, int family, int type, > + int protocol, int kern); > + int (*socket_bind)(struct socket *sock, struct sockaddr *address, > + int addrlen); > + int (*socket_connect)(struct socket *sock, struct sockaddr *address, > + int addrlen); > + int (*socket_listen)(struct socket *sock, int backlog); > + int (*socket_accept)(struct socket *sock, struct socket *newsock); > + int (*socket_sendmsg)(struct socket *sock, struct msghdr *msg, > + int size); > + int (*socket_recvmsg)(struct socket *sock, struct msghdr *msg, > + int size, int flags); > + int (*socket_getsockname)(struct socket *sock); > + int (*socket_getpeername)(struct socket *sock); > + int (*socket_getsockopt)(struct socket *sock, int level, int optname); > + int (*socket_setsockopt)(struct socket *sock, int level, int optname); > + int (*socket_shutdown)(struct socket *sock, int how); > + int (*socket_sock_rcv_skb)(struct sock *sk, struct sk_buff *skb); > + int (*socket_getpeersec_stream)(struct socket *sock, > + char __user *optval, > + int __user *optlen, unsigned len); > + int (*socket_getpeersec_dgram)(struct socket *sock, > + struct sk_buff *skb, u32 *secid); > + int (*sk_alloc_security)(struct sock *sk, int family, gfp_t priority); > + void (*sk_free_security)(struct sock *sk); > + void (*sk_clone_security)(const struct sock *sk, struct sock *newsk); > + void (*sk_getsecid)(struct sock *sk, u32 *secid); > + void (*sock_graft)(struct sock *sk, struct socket *parent); > + int (*inet_conn_request)(struct sock *sk, struct sk_buff *skb, > + struct request_sock *req); > + void (*inet_csk_clone)(struct sock *newsk, > + const struct request_sock *req); > + void (*inet_conn_established)(struct sock *sk, struct sk_buff *skb); > + int (*secmark_relabel_packet)(u32 secid); > + void (*secmark_refcount_inc)(void); > + void (*secmark_refcount_dec)(void); > + void (*req_classify_flow)(const struct request_sock *req, > + struct flowi *fl); > + int (*tun_dev_alloc_security)(void **security); > + void (*tun_dev_free_security)(void *security); > + int (*tun_dev_create)(void); > + int (*tun_dev_attach_queue)(void *security); > + int (*tun_dev_attach)(struct sock *sk, void *security); > + int (*tun_dev_open)(void *security); > +#endif /* CONFIG_SECURITY_NETWORK */ > + > +#ifdef CONFIG_SECURITY_NETWORK_XFRM > + int (*xfrm_policy_alloc_security)(struct xfrm_sec_ctx **ctxp, > + struct xfrm_user_sec_ctx *sec_ctx, > + gfp_t gfp); > + int (*xfrm_policy_clone_security)(struct xfrm_sec_ctx *old_ctx, > + struct xfrm_sec_ctx **new_ctx); > + void (*xfrm_policy_free_security)(struct xfrm_sec_ctx *ctx); > + int (*xfrm_policy_delete_security)(struct xfrm_sec_ctx *ctx); > + int (*xfrm_state_alloc)(struct xfrm_state *x, > + struct xfrm_user_sec_ctx *sec_ctx); > + int (*xfrm_state_alloc_acquire)(struct xfrm_state *x, > + struct xfrm_sec_ctx *polsec, > + u32 secid); > + void (*xfrm_state_free_security)(struct xfrm_state *x); > + int (*xfrm_state_delete_security)(struct xfrm_state *x); > + int (*xfrm_policy_lookup)(struct xfrm_sec_ctx *ctx, u32 fl_secid, > + u8 dir); > + int (*xfrm_state_pol_flow_match)(struct xfrm_state *x, > + struct xfrm_policy *xp, > + const struct flowi *fl); > + int (*xfrm_decode_session)(struct sk_buff *skb, u32 *secid, int ckall); > +#endif /* CONFIG_SECURITY_NETWORK_XFRM */ > + > + /* key management security hooks */ > +#ifdef CONFIG_KEYS > + int (*key_alloc)(struct key *key, const struct cred *cred, > + unsigned long flags); > + void (*key_free)(struct key *key); > + int (*key_permission)(key_ref_t key_ref, const struct cred *cred, > + unsigned perm); > + int (*key_getsecurity)(struct key *key, char **_buffer); > +#endif /* CONFIG_KEYS */ > + > +#ifdef CONFIG_AUDIT > + int (*audit_rule_init)(u32 field, u32 op, char *rulestr, > + void **lsmrule); > + int (*audit_rule_known)(struct audit_krule *krule); > + int (*audit_rule_match)(u32 secid, u32 field, u32 op, void *lsmrule, > + struct audit_context *actx); > + void (*audit_rule_free)(void *lsmrule); > +#endif /* CONFIG_AUDIT */ > +}; > + > +/* prototypes */ > +extern int security_module_enable(struct security_operations *ops); > +extern int register_security(struct security_operations *ops); > +extern void __init security_fixup_ops(struct security_operations *ops); > +extern void reset_security_ops(void); > + > +#endif /* CONFIG_SECURITY */ > + > +#endif /* ! __LINUX_LSM_HOOKS_H */ > + > diff --git a/include/linux/security.h b/include/linux/security.h > index 18264ea..f3d42c6 100644 > --- a/include/linux/security.h > +++ b/include/linux/security.h > @@ -116,8 +116,6 @@ struct seq_file; > > extern int cap_netlink_send(struct sock *sk, struct sk_buff *skb); > > -void reset_security_ops(void); > - > #ifdef CONFIG_MMU > extern unsigned long mmap_min_addr; > extern unsigned long dac_mmap_min_addr; > @@ -1457,312 +1455,9 @@ static inline void security_free_mnt_opts(struct > security_mnt_opts *opts) * @ctxlen points to the place to put the length of > @ctx. > * This is the main security structure. > */ > -struct security_operations { > - char name[SECURITY_NAME_MAX + 1]; > - > - int (*binder_set_context_mgr) (struct task_struct *mgr); > - int (*binder_transaction) (struct task_struct *from, > - struct task_struct *to); > - int (*binder_transfer_binder) (struct task_struct *from, > - struct task_struct *to); > - int (*binder_transfer_file) (struct task_struct *from, > - struct task_struct *to, struct file *file); > - > - int (*ptrace_access_check) (struct task_struct *child, unsigned int mode); > - int (*ptrace_traceme) (struct task_struct *parent); > - int (*capget) (struct task_struct *target, > - kernel_cap_t *effective, > - kernel_cap_t *inheritable, kernel_cap_t *permitted); > - int (*capset) (struct cred *new, > - const struct cred *old, > - const kernel_cap_t *effective, > - const kernel_cap_t *inheritable, > - const kernel_cap_t *permitted); > - int (*capable) (const struct cred *cred, struct user_namespace *ns, > - int cap, int audit); > - int (*quotactl) (int cmds, int type, int id, struct super_block *sb); > - int (*quota_on) (struct dentry *dentry); > - int (*syslog) (int type); > - int (*settime) (const struct timespec *ts, const struct timezone *tz); > - int (*vm_enough_memory) (struct mm_struct *mm, long pages); > - > - int (*bprm_set_creds) (struct linux_binprm *bprm); > - int (*bprm_check_security) (struct linux_binprm *bprm); > - int (*bprm_secureexec) (struct linux_binprm *bprm); > - void (*bprm_committing_creds) (struct linux_binprm *bprm); > - void (*bprm_committed_creds) (struct linux_binprm *bprm); > - > - int (*sb_alloc_security) (struct super_block *sb); > - void (*sb_free_security) (struct super_block *sb); > - int (*sb_copy_data) (char *orig, char *copy); > - int (*sb_remount) (struct super_block *sb, void *data); > - int (*sb_kern_mount) (struct super_block *sb, int flags, void *data); > - int (*sb_show_options) (struct seq_file *m, struct super_block *sb); > - int (*sb_statfs) (struct dentry *dentry); > - int (*sb_mount) (const char *dev_name, struct path *path, > - const char *type, unsigned long flags, void *data); > - int (*sb_umount) (struct vfsmount *mnt, int flags); > - int (*sb_pivotroot) (struct path *old_path, > - struct path *new_path); > - int (*sb_set_mnt_opts) (struct super_block *sb, > - struct security_mnt_opts *opts, > - unsigned long kern_flags, > - unsigned long *set_kern_flags); > - int (*sb_clone_mnt_opts) (const struct super_block *oldsb, > - struct super_block *newsb); > - int (*sb_parse_opts_str) (char *options, struct security_mnt_opts *opts); > - int (*dentry_init_security) (struct dentry *dentry, int mode, > - struct qstr *name, void **ctx, > - u32 *ctxlen); > - > - > -#ifdef CONFIG_SECURITY_PATH > - int (*path_unlink) (struct path *dir, struct dentry *dentry); > - int (*path_mkdir) (struct path *dir, struct dentry *dentry, umode_t mode); > - int (*path_rmdir) (struct path *dir, struct dentry *dentry); > - int (*path_mknod) (struct path *dir, struct dentry *dentry, umode_t mode, > - unsigned int dev); > - int (*path_truncate) (struct path *path); > - int (*path_symlink) (struct path *dir, struct dentry *dentry, > - const char *old_name); > - int (*path_link) (struct dentry *old_dentry, struct path *new_dir, > - struct dentry *new_dentry); > - int (*path_rename) (struct path *old_dir, struct dentry *old_dentry, > - struct path *new_dir, struct dentry *new_dentry); > - int (*path_chmod) (struct path *path, umode_t mode); > - int (*path_chown) (struct path *path, kuid_t uid, kgid_t gid); > - int (*path_chroot) (struct path *path); > -#endif > - > - int (*inode_alloc_security) (struct inode *inode); > - void (*inode_free_security) (struct inode *inode); > - int (*inode_init_security) (struct inode *inode, struct inode *dir, > - const struct qstr *qstr, const char **name, > - void **value, size_t *len); > - int (*inode_create) (struct inode *dir, > - struct dentry *dentry, umode_t mode); > - int (*inode_link) (struct dentry *old_dentry, > - struct inode *dir, struct dentry *new_dentry); > - int (*inode_unlink) (struct inode *dir, struct dentry *dentry); > - int (*inode_symlink) (struct inode *dir, > - struct dentry *dentry, const char *old_name); > - int (*inode_mkdir) (struct inode *dir, struct dentry *dentry, umode_t > mode); - int (*inode_rmdir) (struct inode *dir, struct dentry *dentry); > - int (*inode_mknod) (struct inode *dir, struct dentry *dentry, > - umode_t mode, dev_t dev); > - int (*inode_rename) (struct inode *old_dir, struct dentry *old_dentry, > - struct inode *new_dir, struct dentry *new_dentry); > - int (*inode_readlink) (struct dentry *dentry); > - int (*inode_follow_link) (struct dentry *dentry, struct nameidata *nd); > - int (*inode_permission) (struct inode *inode, int mask); > - int (*inode_setattr) (struct dentry *dentry, struct iattr *attr); > - int (*inode_getattr) (const struct path *path); > - int (*inode_setxattr) (struct dentry *dentry, const char *name, > - const void *value, size_t size, int flags); > - void (*inode_post_setxattr) (struct dentry *dentry, const char *name, > - const void *value, size_t size, int flags); > - int (*inode_getxattr) (struct dentry *dentry, const char *name); > - int (*inode_listxattr) (struct dentry *dentry); > - int (*inode_removexattr) (struct dentry *dentry, const char *name); > - int (*inode_need_killpriv) (struct dentry *dentry); > - int (*inode_killpriv) (struct dentry *dentry); > - int (*inode_getsecurity) (const struct inode *inode, const char *name, > void **buffer, bool alloc); - int (*inode_setsecurity) (struct inode > *inode, const char *name, const void *value, size_t size, int flags); - int > (*inode_listsecurity) (struct inode *inode, char *buffer, size_t > buffer_size); - void (*inode_getsecid) (const struct inode *inode, u32 > *secid); > - > - int (*file_permission) (struct file *file, int mask); > - int (*file_alloc_security) (struct file *file); > - void (*file_free_security) (struct file *file); > - int (*file_ioctl) (struct file *file, unsigned int cmd, > - unsigned long arg); > - int (*mmap_addr) (unsigned long addr); > - int (*mmap_file) (struct file *file, > - unsigned long reqprot, unsigned long prot, > - unsigned long flags); > - int (*file_mprotect) (struct vm_area_struct *vma, > - unsigned long reqprot, > - unsigned long prot); > - int (*file_lock) (struct file *file, unsigned int cmd); > - int (*file_fcntl) (struct file *file, unsigned int cmd, > - unsigned long arg); > - void (*file_set_fowner) (struct file *file); > - int (*file_send_sigiotask) (struct task_struct *tsk, > - struct fown_struct *fown, int sig); > - int (*file_receive) (struct file *file); > - int (*file_open) (struct file *file, const struct cred *cred); > - > - int (*task_create) (unsigned long clone_flags); > - void (*task_free) (struct task_struct *task); > - int (*cred_alloc_blank) (struct cred *cred, gfp_t gfp); > - void (*cred_free) (struct cred *cred); > - int (*cred_prepare)(struct cred *new, const struct cred *old, > - gfp_t gfp); > - void (*cred_transfer)(struct cred *new, const struct cred *old); > - int (*kernel_act_as)(struct cred *new, u32 secid); > - int (*kernel_create_files_as)(struct cred *new, struct inode *inode); > - int (*kernel_fw_from_file)(struct file *file, char *buf, size_t size); > - int (*kernel_module_request)(char *kmod_name); > - int (*kernel_module_from_file)(struct file *file); > - int (*task_fix_setuid) (struct cred *new, const struct cred *old, > - int flags); > - int (*task_setpgid) (struct task_struct *p, pid_t pgid); > - int (*task_getpgid) (struct task_struct *p); > - int (*task_getsid) (struct task_struct *p); > - void (*task_getsecid) (struct task_struct *p, u32 *secid); > - int (*task_setnice) (struct task_struct *p, int nice); > - int (*task_setioprio) (struct task_struct *p, int ioprio); > - int (*task_getioprio) (struct task_struct *p); > - int (*task_setrlimit) (struct task_struct *p, unsigned int resource, > - struct rlimit *new_rlim); > - int (*task_setscheduler) (struct task_struct *p); > - int (*task_getscheduler) (struct task_struct *p); > - int (*task_movememory) (struct task_struct *p); > - int (*task_kill) (struct task_struct *p, > - struct siginfo *info, int sig, u32 secid); > - int (*task_wait) (struct task_struct *p); > - int (*task_prctl) (int option, unsigned long arg2, > - unsigned long arg3, unsigned long arg4, > - unsigned long arg5); > - void (*task_to_inode) (struct task_struct *p, struct inode *inode); > - > - int (*ipc_permission) (struct kern_ipc_perm *ipcp, short flag); > - void (*ipc_getsecid) (struct kern_ipc_perm *ipcp, u32 *secid); > - > - int (*msg_msg_alloc_security) (struct msg_msg *msg); > - void (*msg_msg_free_security) (struct msg_msg *msg); > - > - int (*msg_queue_alloc_security) (struct msg_queue *msq); > - void (*msg_queue_free_security) (struct msg_queue *msq); > - int (*msg_queue_associate) (struct msg_queue *msq, int msqflg); > - int (*msg_queue_msgctl) (struct msg_queue *msq, int cmd); > - int (*msg_queue_msgsnd) (struct msg_queue *msq, > - struct msg_msg *msg, int msqflg); > - int (*msg_queue_msgrcv) (struct msg_queue *msq, > - struct msg_msg *msg, > - struct task_struct *target, > - long type, int mode); > - > - int (*shm_alloc_security) (struct shmid_kernel *shp); > - void (*shm_free_security) (struct shmid_kernel *shp); > - int (*shm_associate) (struct shmid_kernel *shp, int shmflg); > - int (*shm_shmctl) (struct shmid_kernel *shp, int cmd); > - int (*shm_shmat) (struct shmid_kernel *shp, > - char __user *shmaddr, int shmflg); > - > - int (*sem_alloc_security) (struct sem_array *sma); > - void (*sem_free_security) (struct sem_array *sma); > - int (*sem_associate) (struct sem_array *sma, int semflg); > - int (*sem_semctl) (struct sem_array *sma, int cmd); > - int (*sem_semop) (struct sem_array *sma, > - struct sembuf *sops, unsigned nsops, int alter); > - > - int (*netlink_send) (struct sock *sk, struct sk_buff *skb); > - > - void (*d_instantiate) (struct dentry *dentry, struct inode *inode); > - > - int (*getprocattr) (struct task_struct *p, char *name, char **value); > - int (*setprocattr) (struct task_struct *p, char *name, void *value, size_t > size); - int (*ismaclabel) (const char *name); > - int (*secid_to_secctx) (u32 secid, char **secdata, u32 *seclen); > - int (*secctx_to_secid) (const char *secdata, u32 seclen, u32 *secid); > - void (*release_secctx) (char *secdata, u32 seclen); > - > - int (*inode_notifysecctx)(struct inode *inode, void *ctx, u32 ctxlen); > - int (*inode_setsecctx)(struct dentry *dentry, void *ctx, u32 ctxlen); > - int (*inode_getsecctx)(struct inode *inode, void **ctx, u32 *ctxlen); > - > -#ifdef CONFIG_SECURITY_NETWORK > - int (*unix_stream_connect) (struct sock *sock, struct sock *other, struct > sock *newsk); - int (*unix_may_send) (struct socket *sock, struct socket > *other); - > - int (*socket_create) (int family, int type, int protocol, int kern); > - int (*socket_post_create) (struct socket *sock, int family, > - int type, int protocol, int kern); > - int (*socket_bind) (struct socket *sock, > - struct sockaddr *address, int addrlen); > - int (*socket_connect) (struct socket *sock, > - struct sockaddr *address, int addrlen); > - int (*socket_listen) (struct socket *sock, int backlog); > - int (*socket_accept) (struct socket *sock, struct socket *newsock); > - int (*socket_sendmsg) (struct socket *sock, > - struct msghdr *msg, int size); > - int (*socket_recvmsg) (struct socket *sock, > - struct msghdr *msg, int size, int flags); > - int (*socket_getsockname) (struct socket *sock); > - int (*socket_getpeername) (struct socket *sock); > - int (*socket_getsockopt) (struct socket *sock, int level, int optname); > - int (*socket_setsockopt) (struct socket *sock, int level, int optname); > - int (*socket_shutdown) (struct socket *sock, int how); > - int (*socket_sock_rcv_skb) (struct sock *sk, struct sk_buff *skb); > - int (*socket_getpeersec_stream) (struct socket *sock, char __user *optval, > int __user *optlen, unsigned len); - int (*socket_getpeersec_dgram) (struct > socket *sock, struct sk_buff *skb, u32 *secid); - int (*sk_alloc_security) > (struct sock *sk, int family, gfp_t priority); - void (*sk_free_security) > (struct sock *sk); > - void (*sk_clone_security) (const struct sock *sk, struct sock *newsk); > - void (*sk_getsecid) (struct sock *sk, u32 *secid); > - void (*sock_graft) (struct sock *sk, struct socket *parent); > - int (*inet_conn_request) (struct sock *sk, struct sk_buff *skb, > - struct request_sock *req); > - void (*inet_csk_clone) (struct sock *newsk, const struct request_sock > *req); - void (*inet_conn_established) (struct sock *sk, struct sk_buff > *skb); - int (*secmark_relabel_packet) (u32 secid); > - void (*secmark_refcount_inc) (void); > - void (*secmark_refcount_dec) (void); > - void (*req_classify_flow) (const struct request_sock *req, struct flowi > *fl); - int (*tun_dev_alloc_security) (void **security); > - void (*tun_dev_free_security) (void *security); > - int (*tun_dev_create) (void); > - int (*tun_dev_attach_queue) (void *security); > - int (*tun_dev_attach) (struct sock *sk, void *security); > - int (*tun_dev_open) (void *security); > -#endif /* CONFIG_SECURITY_NETWORK */ > - > -#ifdef CONFIG_SECURITY_NETWORK_XFRM > - int (*xfrm_policy_alloc_security) (struct xfrm_sec_ctx **ctxp, > - struct xfrm_user_sec_ctx *sec_ctx, gfp_t gfp); > - int (*xfrm_policy_clone_security) (struct xfrm_sec_ctx *old_ctx, struct > xfrm_sec_ctx **new_ctx); - void (*xfrm_policy_free_security) (struct > xfrm_sec_ctx *ctx); > - int (*xfrm_policy_delete_security) (struct xfrm_sec_ctx *ctx); > - int (*xfrm_state_alloc) (struct xfrm_state *x, > - struct xfrm_user_sec_ctx *sec_ctx); > - int (*xfrm_state_alloc_acquire) (struct xfrm_state *x, > - struct xfrm_sec_ctx *polsec, > - u32 secid); > - void (*xfrm_state_free_security) (struct xfrm_state *x); > - int (*xfrm_state_delete_security) (struct xfrm_state *x); > - int (*xfrm_policy_lookup) (struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 > dir); - int (*xfrm_state_pol_flow_match) (struct xfrm_state *x, > - struct xfrm_policy *xp, > - const struct flowi *fl); > - int (*xfrm_decode_session) (struct sk_buff *skb, u32 *secid, int ckall); > -#endif /* CONFIG_SECURITY_NETWORK_XFRM */ > - > - /* key management security hooks */ > -#ifdef CONFIG_KEYS > - int (*key_alloc) (struct key *key, const struct cred *cred, unsigned long > flags); - void (*key_free) (struct key *key); > - int (*key_permission) (key_ref_t key_ref, > - const struct cred *cred, > - unsigned perm); > - int (*key_getsecurity)(struct key *key, char **_buffer); > -#endif /* CONFIG_KEYS */ > - > -#ifdef CONFIG_AUDIT > - int (*audit_rule_init) (u32 field, u32 op, char *rulestr, void **lsmrule); > - int (*audit_rule_known) (struct audit_krule *krule); > - int (*audit_rule_match) (u32 secid, u32 field, u32 op, void *lsmrule, > - struct audit_context *actx); > - void (*audit_rule_free) (void *lsmrule); > -#endif /* CONFIG_AUDIT */ > -}; > > /* prototypes */ > extern int security_init(void); > -extern int security_module_enable(struct security_operations *ops); > -extern int register_security(struct security_operations *ops); > -extern void __init security_fixup_ops(struct security_operations *ops); > - > > /* Security operations */ > int security_binder_set_context_mgr(struct task_struct *mgr); > diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c > index e5f1561..fead41b 100644 > --- a/security/apparmor/lsm.c > +++ b/security/apparmor/lsm.c > @@ -12,7 +12,7 @@ > * License. > */ > > -#include > +#include > #include > #include > #include > diff --git a/security/capability.c b/security/capability.c > index 0d03fcc..513015f 100644 > --- a/security/capability.c > +++ b/security/capability.c > @@ -10,7 +10,7 @@ > * > */ > > -#include > +#include > > static int cap_binder_set_context_mgr(struct task_struct *mgr) > { > diff --git a/security/security.c b/security/security.c > index 8e9b1f4..9c95fe0 100644 > --- a/security/security.c > +++ b/security/security.c > @@ -16,7 +16,7 @@ > #include > #include > #include > -#include > +#include > #include > #include > #include > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c > index 7dade28..40e3f77 100644 > --- a/security/selinux/hooks.c > +++ b/security/selinux/hooks.c > @@ -29,7 +29,7 @@ > #include > #include > #include > -#include > +#include > #include > #include > #include > diff --git a/security/smack/smack.h b/security/smack/smack.h > index 49eada6..262dad8 100644 > --- a/security/smack/smack.h > +++ b/security/smack/smack.h > @@ -15,7 +15,7 @@ > > #include > #include > -#include > +#include > #include > #include > #include > diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c > index 57c88d5..2f7b468 100644 > --- a/security/tomoyo/tomoyo.c > +++ b/security/tomoyo/tomoyo.c > @@ -4,7 +4,7 @@ > * Copyright (C) 2005-2011 NTT DATA CORPORATION > */ > > -#include > +#include > #include "common.h" > > /** > diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c > index 24aae2a..14557ff 100644 > --- a/security/yama/yama_lsm.c > +++ b/security/yama/yama_lsm.c > @@ -12,7 +12,7 @@ > * > */ > > -#include > +#include > #include > #include > #include > > -- > To unsubscribe from this list: send the line "unsubscribe > linux-security-module" in the body of a message to > majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- paul moore www.paul-moore.com -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/