1/*
2 * Linux Security plug
3 *
4 * Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com>
5 * Copyright (C) 2001 Greg Kroah-Hartman <greg@kroah.com>
6 * Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com>
7 * Copyright (C) 2001 James Morris <jmorris@intercode.com.au>
8 * Copyright (C) 2001 Silicon Graphics, Inc. (Trust Technology Group)
9 * Copyright (C) 2016 Mellanox Techonologies
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
15 *
16 * Due to this file being licensed under the GPL there is controversy over
17 * whether this permits you to write a module that #includes this file
18 * without placing your module under the GPL. Please consult a lawyer for
19 * advice before doing this.
20 *
21 */
22
23#ifndef __LINUX_SECURITY_H
24#define __LINUX_SECURITY_H
25
26#include <linux/kernel_read_file.h>
27#include <linux/key.h>
28#include <linux/capability.h>
29#include <linux/fs.h>
30#include <linux/slab.h>
31#include <linux/err.h>
32#include <linux/string.h>
33#include <linux/mm.h>
34#include <linux/sockptr.h>
35#include <linux/bpf.h>
36#include <uapi/linux/lsm.h>
37#include <linux/lsm/selinux.h>
38#include <linux/lsm/smack.h>
39#include <linux/lsm/apparmor.h>
40#include <linux/lsm/bpf.h>
41
42struct linux_binprm;
43struct cred;
44struct rlimit;
45struct kernel_siginfo;
46struct sembuf;
47struct kern_ipc_perm;
48struct audit_context;
49struct super_block;
50struct inode;
51struct dentry;
52struct file;
53struct vfsmount;
54struct path;
55struct qstr;
56struct iattr;
57struct fown_struct;
58struct file_operations;
59struct msg_msg;
60struct xattr;
61struct kernfs_node;
62struct xfrm_sec_ctx;
63struct mm_struct;
64struct fs_context;
65struct fs_parameter;
66enum fs_value_type;
67struct watch;
68struct watch_notification;
69struct lsm_ctx;
70
71/* Default (no) options for the capable function */
72#define CAP_OPT_NONE 0x0
73/* If capable should audit the security request */
74#define CAP_OPT_NOAUDIT BIT(1)
75/* If capable is being called by a setid function */
76#define CAP_OPT_INSETID BIT(2)
77
78/* LSM Agnostic defines for security_sb_set_mnt_opts() flags */
79#define SECURITY_LSM_NATIVE_LABELS 1
80
81struct ctl_table;
82struct audit_krule;
83struct user_namespace;
84struct timezone;
85
86enum lsm_event {
87 LSM_POLICY_CHANGE,
88};
89
90struct dm_verity_digest {
91 const char *alg;
92 const u8 *digest;
93 size_t digest_len;
94};
95
96enum lsm_integrity_type {
97 LSM_INT_DMVERITY_SIG_VALID,
98 LSM_INT_DMVERITY_ROOTHASH,
99 LSM_INT_FSVERITY_BUILTINSIG_VALID,
100};
101
102/*
103 * These are reasons that can be passed to the security_locked_down()
104 * LSM hook. Lockdown reasons that protect kernel integrity (ie, the
105 * ability for userland to modify kernel code) are placed before
106 * LOCKDOWN_INTEGRITY_MAX. Lockdown reasons that protect kernel
107 * confidentiality (ie, the ability for userland to extract
108 * information from the running kernel that would otherwise be
109 * restricted) are placed before LOCKDOWN_CONFIDENTIALITY_MAX.
110 *
111 * LSM authors should note that the semantics of any given lockdown
112 * reason are not guaranteed to be stable - the same reason may block
113 * one set of features in one kernel release, and a slightly different
114 * set of features in a later kernel release. LSMs that seek to expose
115 * lockdown policy at any level of granularity other than "none",
116 * "integrity" or "confidentiality" are responsible for either
117 * ensuring that they expose a consistent level of functionality to
118 * userland, or ensuring that userland is aware that this is
119 * potentially a moving target. It is easy to misuse this information
120 * in a way that could break userspace. Please be careful not to do
121 * so.
122 *
123 * If you add to this, remember to extend lockdown_reasons in
124 * security/lockdown/lockdown.c.
125 */
126enum lockdown_reason {
127 LOCKDOWN_NONE,
128 LOCKDOWN_MODULE_SIGNATURE,
129 LOCKDOWN_DEV_MEM,
130 LOCKDOWN_EFI_TEST,
131 LOCKDOWN_KEXEC,
132 LOCKDOWN_HIBERNATION,
133 LOCKDOWN_PCI_ACCESS,
134 LOCKDOWN_IOPORT,
135 LOCKDOWN_MSR,
136 LOCKDOWN_ACPI_TABLES,
137 LOCKDOWN_DEVICE_TREE,
138 LOCKDOWN_PCMCIA_CIS,
139 LOCKDOWN_TIOCSSERIAL,
140 LOCKDOWN_MODULE_PARAMETERS,
141 LOCKDOWN_MMIOTRACE,
142 LOCKDOWN_DEBUGFS,
143 LOCKDOWN_XMON_WR,
144 LOCKDOWN_BPF_WRITE_USER,
145 LOCKDOWN_DBG_WRITE_KERNEL,
146 LOCKDOWN_RTAS_ERROR_INJECTION,
147 LOCKDOWN_INTEGRITY_MAX,
148 LOCKDOWN_KCORE,
149 LOCKDOWN_KPROBES,
150 LOCKDOWN_BPF_READ_KERNEL,
151 LOCKDOWN_DBG_READ_KERNEL,
152 LOCKDOWN_PERF,
153 LOCKDOWN_TRACEFS,
154 LOCKDOWN_XMON_RW,
155 LOCKDOWN_XFRM_SECRET,
156 LOCKDOWN_CONFIDENTIALITY_MAX,
157};
158
159/*
160 * Data exported by the security modules
161 */
162struct lsm_prop {
163 struct lsm_prop_selinux selinux;
164 struct lsm_prop_smack smack;
165 struct lsm_prop_apparmor apparmor;
166 struct lsm_prop_bpf bpf;
167};
168
169extern const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1];
170extern u32 lsm_active_cnt;
171extern const struct lsm_id *lsm_idlist[];
172
173/* These functions are in security/commoncap.c */
174extern int cap_capable(const struct cred *cred, struct user_namespace *ns,
175 int cap, unsigned int opts);
176extern int cap_settime(const struct timespec64 *ts, const struct timezone *tz);
177extern int cap_ptrace_access_check(struct task_struct *child, unsigned int mode);
178extern int cap_ptrace_traceme(struct task_struct *parent);
179extern int cap_capget(const struct task_struct *target, kernel_cap_t *effective,
180 kernel_cap_t *inheritable, kernel_cap_t *permitted);
181extern int cap_capset(struct cred *new, const struct cred *old,
182 const kernel_cap_t *effective,
183 const kernel_cap_t *inheritable,
184 const kernel_cap_t *permitted);
185extern int cap_bprm_creds_from_file(struct linux_binprm *bprm, const struct file *file);
186int cap_inode_setxattr(struct dentry *dentry, const char *name,
187 const void *value, size_t size, int flags);
188int cap_inode_removexattr(struct mnt_idmap *idmap,
189 struct dentry *dentry, const char *name);
190int cap_inode_need_killpriv(struct dentry *dentry);
191int cap_inode_killpriv(struct mnt_idmap *idmap, struct dentry *dentry);
192int cap_inode_getsecurity(struct mnt_idmap *idmap,
193 struct inode *inode, const char *name, void **buffer,
194 bool alloc);
195extern int cap_mmap_addr(unsigned long addr);
196extern int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags);
197extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
198 unsigned long arg4, unsigned long arg5);
199extern int cap_task_setscheduler(struct task_struct *p);
200extern int cap_task_setioprio(struct task_struct *p, int ioprio);
201extern int cap_task_setnice(struct task_struct *p, int nice);
202extern int cap_vm_enough_memory(struct mm_struct *mm, long pages);
203
204struct msghdr;
205struct sk_buff;
206struct sock;
207struct sockaddr;
208struct socket;
209struct flowi_common;
210struct dst_entry;
211struct xfrm_selector;
212struct xfrm_policy;
213struct xfrm_state;
214struct xfrm_user_sec_ctx;
215struct seq_file;
216struct sctp_association;
217
218#ifdef CONFIG_MMU
219extern unsigned long mmap_min_addr;
220extern unsigned long dac_mmap_min_addr;
221#else
222#define mmap_min_addr 0UL
223#define dac_mmap_min_addr 0UL
224#endif
225
226/*
227 * A "security context" is the text representation of
228 * the information used by LSMs.
229 * This structure contains the string, its length, and which LSM
230 * it is useful for.
231 */
232struct lsm_context {
233 char *context; /* Provided by the module */
234 u32 len;
235 int id; /* Identifies the module */
236};
237
238/*
239 * Values used in the task_security_ops calls
240 */
241/* setuid or setgid, id0 == uid or gid */
242#define LSM_SETID_ID 1
243
244/* setreuid or setregid, id0 == real, id1 == eff */
245#define LSM_SETID_RE 2
246
247/* setresuid or setresgid, id0 == real, id1 == eff, uid2 == saved */
248#define LSM_SETID_RES 4
249
250/* setfsuid or setfsgid, id0 == fsuid or fsgid */
251#define LSM_SETID_FS 8
252
253/* Flags for security_task_prlimit(). */
254#define LSM_PRLIMIT_READ 1
255#define LSM_PRLIMIT_WRITE 2
256
257/* forward declares to avoid warnings */
258struct sched_param;
259struct request_sock;
260
261/* bprm->unsafe reasons */
262#define LSM_UNSAFE_SHARE 1
263#define LSM_UNSAFE_PTRACE 2
264#define LSM_UNSAFE_NO_NEW_PRIVS 4
265
266#ifdef CONFIG_MMU
267extern int mmap_min_addr_handler(const struct ctl_table *table, int write,
268 void *buffer, size_t *lenp, loff_t *ppos);
269#endif
270
271/* security_inode_init_security callback function to write xattrs */
272typedef int (*initxattrs) (struct inode *inode,
273 const struct xattr *xattr_array, void *fs_data);
274
275
276/* Keep the kernel_load_data_id enum in sync with kernel_read_file_id */
277#define __data_id_enumify(ENUM, dummy) LOADING_ ## ENUM,
278#define __data_id_stringify(dummy, str) #str,
279
280enum kernel_load_data_id {
281 __kernel_read_file_id(__data_id_enumify)
282};
283
284static const char * const kernel_load_data_str[] = {
285 __kernel_read_file_id(__data_id_stringify)
286};
287
288static inline const char *kernel_load_data_id_str(enum kernel_load_data_id id)
289{
290 if ((unsigned)id >= LOADING_MAX_ID)
291 return kernel_load_data_str[LOADING_UNKNOWN];
292
293 return kernel_load_data_str[id];
294}
295
296/**
297 * lsmprop_init - initialize a lsm_prop structure
298 * @prop: Pointer to the data to initialize
299 *
300 * Set all secid for all modules to the specified value.
301 */
302static inline void lsmprop_init(struct lsm_prop *prop)
303{
304 memset(s: prop, c: 0, n: sizeof(*prop));
305}
306
307#ifdef CONFIG_SECURITY
308
309/**
310 * lsmprop_is_set - report if there is a value in the lsm_prop
311 * @prop: Pointer to the exported LSM data
312 *
313 * Returns true if there is a value set, false otherwise
314 */
315static inline bool lsmprop_is_set(struct lsm_prop *prop)
316{
317 const struct lsm_prop empty = {};
318
319 return !!memcmp(prop, &empty, sizeof(*prop));
320}
321
322int call_blocking_lsm_notifier(enum lsm_event event, void *data);
323int register_blocking_lsm_notifier(struct notifier_block *nb);
324int unregister_blocking_lsm_notifier(struct notifier_block *nb);
325
326/* prototypes */
327extern int security_init(void);
328extern int early_security_init(void);
329extern u64 lsm_name_to_attr(const char *name);
330
331/* Security operations */
332int security_binder_set_context_mgr(const struct cred *mgr);
333int security_binder_transaction(const struct cred *from,
334 const struct cred *to);
335int security_binder_transfer_binder(const struct cred *from,
336 const struct cred *to);
337int security_binder_transfer_file(const struct cred *from,
338 const struct cred *to, const struct file *file);
339int security_ptrace_access_check(struct task_struct *child, unsigned int mode);
340int security_ptrace_traceme(struct task_struct *parent);
341int security_capget(const struct task_struct *target,
342 kernel_cap_t *effective,
343 kernel_cap_t *inheritable,
344 kernel_cap_t *permitted);
345int security_capset(struct cred *new, const struct cred *old,
346 const kernel_cap_t *effective,
347 const kernel_cap_t *inheritable,
348 const kernel_cap_t *permitted);
349int security_capable(const struct cred *cred,
350 struct user_namespace *ns,
351 int cap,
352 unsigned int opts);
353int security_quotactl(int cmds, int type, int id, const struct super_block *sb);
354int security_quota_on(struct dentry *dentry);
355int security_syslog(int type);
356int security_settime64(const struct timespec64 *ts, const struct timezone *tz);
357int security_vm_enough_memory_mm(struct mm_struct *mm, long pages);
358int security_bprm_creds_for_exec(struct linux_binprm *bprm);
359int security_bprm_creds_from_file(struct linux_binprm *bprm, const struct file *file);
360int security_bprm_check(struct linux_binprm *bprm);
361void security_bprm_committing_creds(const struct linux_binprm *bprm);
362void security_bprm_committed_creds(const struct linux_binprm *bprm);
363int security_fs_context_submount(struct fs_context *fc, struct super_block *reference);
364int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc);
365int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param);
366int security_sb_alloc(struct super_block *sb);
367void security_sb_delete(struct super_block *sb);
368void security_sb_free(struct super_block *sb);
369void security_free_mnt_opts(void **mnt_opts);
370int security_sb_eat_lsm_opts(char *options, void **mnt_opts);
371int security_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts);
372int security_sb_remount(struct super_block *sb, void *mnt_opts);
373int security_sb_kern_mount(const struct super_block *sb);
374int security_sb_show_options(struct seq_file *m, struct super_block *sb);
375int security_sb_statfs(struct dentry *dentry);
376int security_sb_mount(const char *dev_name, const struct path *path,
377 const char *type, unsigned long flags, void *data);
378int security_sb_umount(struct vfsmount *mnt, int flags);
379int security_sb_pivotroot(const struct path *old_path, const struct path *new_path);
380int security_sb_set_mnt_opts(struct super_block *sb,
381 void *mnt_opts,
382 unsigned long kern_flags,
383 unsigned long *set_kern_flags);
384int security_sb_clone_mnt_opts(const struct super_block *oldsb,
385 struct super_block *newsb,
386 unsigned long kern_flags,
387 unsigned long *set_kern_flags);
388int security_move_mount(const struct path *from_path, const struct path *to_path);
389int security_dentry_init_security(struct dentry *dentry, int mode,
390 const struct qstr *name,
391 const char **xattr_name,
392 struct lsm_context *lsmcxt);
393int security_dentry_create_files_as(struct dentry *dentry, int mode,
394 const struct qstr *name,
395 const struct cred *old,
396 struct cred *new);
397int security_path_notify(const struct path *path, u64 mask,
398 unsigned int obj_type);
399int security_inode_alloc(struct inode *inode, gfp_t gfp);
400void security_inode_free(struct inode *inode);
401int security_inode_init_security(struct inode *inode, struct inode *dir,
402 const struct qstr *qstr,
403 initxattrs initxattrs, void *fs_data);
404int security_inode_init_security_anon(struct inode *inode,
405 const struct qstr *name,
406 const struct inode *context_inode);
407int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode);
408void security_inode_post_create_tmpfile(struct mnt_idmap *idmap,
409 struct inode *inode);
410int security_inode_link(struct dentry *old_dentry, struct inode *dir,
411 struct dentry *new_dentry);
412int security_inode_unlink(struct inode *dir, struct dentry *dentry);
413int security_inode_symlink(struct inode *dir, struct dentry *dentry,
414 const char *old_name);
415int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode);
416int security_inode_rmdir(struct inode *dir, struct dentry *dentry);
417int security_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev);
418int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
419 struct inode *new_dir, struct dentry *new_dentry,
420 unsigned int flags);
421int security_inode_readlink(struct dentry *dentry);
422int security_inode_follow_link(struct dentry *dentry, struct inode *inode,
423 bool rcu);
424int security_inode_permission(struct inode *inode, int mask);
425int security_inode_setattr(struct mnt_idmap *idmap,
426 struct dentry *dentry, struct iattr *attr);
427void security_inode_post_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
428 int ia_valid);
429int security_inode_getattr(const struct path *path);
430int security_inode_setxattr(struct mnt_idmap *idmap,
431 struct dentry *dentry, const char *name,
432 const void *value, size_t size, int flags);
433int security_inode_set_acl(struct mnt_idmap *idmap,
434 struct dentry *dentry, const char *acl_name,
435 struct posix_acl *kacl);
436void security_inode_post_set_acl(struct dentry *dentry, const char *acl_name,
437 struct posix_acl *kacl);
438int security_inode_get_acl(struct mnt_idmap *idmap,
439 struct dentry *dentry, const char *acl_name);
440int security_inode_remove_acl(struct mnt_idmap *idmap,
441 struct dentry *dentry, const char *acl_name);
442void security_inode_post_remove_acl(struct mnt_idmap *idmap,
443 struct dentry *dentry,
444 const char *acl_name);
445void security_inode_post_setxattr(struct dentry *dentry, const char *name,
446 const void *value, size_t size, int flags);
447int security_inode_getxattr(struct dentry *dentry, const char *name);
448int security_inode_listxattr(struct dentry *dentry);
449int security_inode_removexattr(struct mnt_idmap *idmap,
450 struct dentry *dentry, const char *name);
451void security_inode_post_removexattr(struct dentry *dentry, const char *name);
452int security_inode_file_setattr(struct dentry *dentry,
453 struct file_kattr *fa);
454int security_inode_file_getattr(struct dentry *dentry,
455 struct file_kattr *fa);
456int security_inode_need_killpriv(struct dentry *dentry);
457int security_inode_killpriv(struct mnt_idmap *idmap, struct dentry *dentry);
458int security_inode_getsecurity(struct mnt_idmap *idmap,
459 struct inode *inode, const char *name,
460 void **buffer, bool alloc);
461int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags);
462int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size);
463void security_inode_getlsmprop(struct inode *inode, struct lsm_prop *prop);
464int security_inode_copy_up(struct dentry *src, struct cred **new);
465int security_inode_copy_up_xattr(struct dentry *src, const char *name);
466int security_inode_setintegrity(const struct inode *inode,
467 enum lsm_integrity_type type, const void *value,
468 size_t size);
469int security_kernfs_init_security(struct kernfs_node *kn_dir,
470 struct kernfs_node *kn);
471int security_file_permission(struct file *file, int mask);
472int security_file_alloc(struct file *file);
473void security_file_release(struct file *file);
474void security_file_free(struct file *file);
475int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
476int security_file_ioctl_compat(struct file *file, unsigned int cmd,
477 unsigned long arg);
478int security_mmap_file(struct file *file, unsigned long prot,
479 unsigned long flags);
480int security_mmap_addr(unsigned long addr);
481int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
482 unsigned long prot);
483int security_file_lock(struct file *file, unsigned int cmd);
484int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg);
485void security_file_set_fowner(struct file *file);
486int security_file_send_sigiotask(struct task_struct *tsk,
487 struct fown_struct *fown, int sig);
488int security_file_receive(struct file *file);
489int security_file_open(struct file *file);
490int security_file_post_open(struct file *file, int mask);
491int security_file_truncate(struct file *file);
492int security_task_alloc(struct task_struct *task, u64 clone_flags);
493void security_task_free(struct task_struct *task);
494int security_cred_alloc_blank(struct cred *cred, gfp_t gfp);
495void security_cred_free(struct cred *cred);
496int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp);
497void security_transfer_creds(struct cred *new, const struct cred *old);
498void security_cred_getsecid(const struct cred *c, u32 *secid);
499void security_cred_getlsmprop(const struct cred *c, struct lsm_prop *prop);
500int security_kernel_act_as(struct cred *new, u32 secid);
501int security_kernel_create_files_as(struct cred *new, struct inode *inode);
502int security_kernel_module_request(char *kmod_name);
503int security_kernel_load_data(enum kernel_load_data_id id, bool contents);
504int security_kernel_post_load_data(char *buf, loff_t size,
505 enum kernel_load_data_id id,
506 char *description);
507int security_kernel_read_file(struct file *file, enum kernel_read_file_id id,
508 bool contents);
509int security_kernel_post_read_file(struct file *file, char *buf, loff_t size,
510 enum kernel_read_file_id id);
511int security_task_fix_setuid(struct cred *new, const struct cred *old,
512 int flags);
513int security_task_fix_setgid(struct cred *new, const struct cred *old,
514 int flags);
515int security_task_fix_setgroups(struct cred *new, const struct cred *old);
516int security_task_setpgid(struct task_struct *p, pid_t pgid);
517int security_task_getpgid(struct task_struct *p);
518int security_task_getsid(struct task_struct *p);
519void security_current_getlsmprop_subj(struct lsm_prop *prop);
520void security_task_getlsmprop_obj(struct task_struct *p, struct lsm_prop *prop);
521int security_task_setnice(struct task_struct *p, int nice);
522int security_task_setioprio(struct task_struct *p, int ioprio);
523int security_task_getioprio(struct task_struct *p);
524int security_task_prlimit(const struct cred *cred, const struct cred *tcred,
525 unsigned int flags);
526int security_task_setrlimit(struct task_struct *p, unsigned int resource,
527 struct rlimit *new_rlim);
528int security_task_setscheduler(struct task_struct *p);
529int security_task_getscheduler(struct task_struct *p);
530int security_task_movememory(struct task_struct *p);
531int security_task_kill(struct task_struct *p, struct kernel_siginfo *info,
532 int sig, const struct cred *cred);
533int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
534 unsigned long arg4, unsigned long arg5);
535void security_task_to_inode(struct task_struct *p, struct inode *inode);
536int security_create_user_ns(const struct cred *cred);
537int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag);
538void security_ipc_getlsmprop(struct kern_ipc_perm *ipcp, struct lsm_prop *prop);
539int security_msg_msg_alloc(struct msg_msg *msg);
540void security_msg_msg_free(struct msg_msg *msg);
541int security_msg_queue_alloc(struct kern_ipc_perm *msq);
542void security_msg_queue_free(struct kern_ipc_perm *msq);
543int security_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg);
544int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd);
545int security_msg_queue_msgsnd(struct kern_ipc_perm *msq,
546 struct msg_msg *msg, int msqflg);
547int security_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
548 struct task_struct *target, long type, int mode);
549int security_shm_alloc(struct kern_ipc_perm *shp);
550void security_shm_free(struct kern_ipc_perm *shp);
551int security_shm_associate(struct kern_ipc_perm *shp, int shmflg);
552int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd);
553int security_shm_shmat(struct kern_ipc_perm *shp, char __user *shmaddr, int shmflg);
554int security_sem_alloc(struct kern_ipc_perm *sma);
555void security_sem_free(struct kern_ipc_perm *sma);
556int security_sem_associate(struct kern_ipc_perm *sma, int semflg);
557int security_sem_semctl(struct kern_ipc_perm *sma, int cmd);
558int security_sem_semop(struct kern_ipc_perm *sma, struct sembuf *sops,
559 unsigned nsops, int alter);
560void security_d_instantiate(struct dentry *dentry, struct inode *inode);
561int security_getselfattr(unsigned int attr, struct lsm_ctx __user *ctx,
562 u32 __user *size, u32 flags);
563int security_setselfattr(unsigned int attr, struct lsm_ctx __user *ctx,
564 u32 size, u32 flags);
565int security_getprocattr(struct task_struct *p, int lsmid, const char *name,
566 char **value);
567int security_setprocattr(int lsmid, const char *name, void *value, size_t size);
568int security_ismaclabel(const char *name);
569int security_secid_to_secctx(u32 secid, struct lsm_context *cp);
570int security_lsmprop_to_secctx(struct lsm_prop *prop, struct lsm_context *cp,
571 int lsmid);
572int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
573void security_release_secctx(struct lsm_context *cp);
574void security_inode_invalidate_secctx(struct inode *inode);
575int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen);
576int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
577int security_inode_getsecctx(struct inode *inode, struct lsm_context *cp);
578int security_locked_down(enum lockdown_reason what);
579int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 *uctx_len,
580 void *val, size_t val_len, u64 id, u64 flags);
581int security_bdev_alloc(struct block_device *bdev);
582void security_bdev_free(struct block_device *bdev);
583int security_bdev_setintegrity(struct block_device *bdev,
584 enum lsm_integrity_type type, const void *value,
585 size_t size);
586#else /* CONFIG_SECURITY */
587
588/**
589 * lsmprop_is_set - report if there is a value in the lsm_prop
590 * @prop: Pointer to the exported LSM data
591 *
592 * Returns true if there is a value set, false otherwise
593 */
594static inline bool lsmprop_is_set(struct lsm_prop *prop)
595{
596 return false;
597}
598
599static inline int call_blocking_lsm_notifier(enum lsm_event event, void *data)
600{
601 return 0;
602}
603
604static inline int register_blocking_lsm_notifier(struct notifier_block *nb)
605{
606 return 0;
607}
608
609static inline int unregister_blocking_lsm_notifier(struct notifier_block *nb)
610{
611 return 0;
612}
613
614static inline u64 lsm_name_to_attr(const char *name)
615{
616 return LSM_ATTR_UNDEF;
617}
618
619static inline void security_free_mnt_opts(void **mnt_opts)
620{
621}
622
623/*
624 * This is the default capabilities functionality. Most of these functions
625 * are just stubbed out, but a few must call the proper capable code.
626 */
627
628static inline int security_init(void)
629{
630 return 0;
631}
632
633static inline int early_security_init(void)
634{
635 return 0;
636}
637
638static inline int security_binder_set_context_mgr(const struct cred *mgr)
639{
640 return 0;
641}
642
643static inline int security_binder_transaction(const struct cred *from,
644 const struct cred *to)
645{
646 return 0;
647}
648
649static inline int security_binder_transfer_binder(const struct cred *from,
650 const struct cred *to)
651{
652 return 0;
653}
654
655static inline int security_binder_transfer_file(const struct cred *from,
656 const struct cred *to,
657 const struct file *file)
658{
659 return 0;
660}
661
662static inline int security_ptrace_access_check(struct task_struct *child,
663 unsigned int mode)
664{
665 return cap_ptrace_access_check(child, mode);
666}
667
668static inline int security_ptrace_traceme(struct task_struct *parent)
669{
670 return cap_ptrace_traceme(parent);
671}
672
673static inline int security_capget(const struct task_struct *target,
674 kernel_cap_t *effective,
675 kernel_cap_t *inheritable,
676 kernel_cap_t *permitted)
677{
678 return cap_capget(target, effective, inheritable, permitted);
679}
680
681static inline int security_capset(struct cred *new,
682 const struct cred *old,
683 const kernel_cap_t *effective,
684 const kernel_cap_t *inheritable,
685 const kernel_cap_t *permitted)
686{
687 return cap_capset(new, old, effective, inheritable, permitted);
688}
689
690static inline int security_capable(const struct cred *cred,
691 struct user_namespace *ns,
692 int cap,
693 unsigned int opts)
694{
695 return cap_capable(cred, ns, cap, opts);
696}
697
698static inline int security_quotactl(int cmds, int type, int id,
699 const struct super_block *sb)
700{
701 return 0;
702}
703
704static inline int security_quota_on(struct dentry *dentry)
705{
706 return 0;
707}
708
709static inline int security_syslog(int type)
710{
711 return 0;
712}
713
714static inline int security_settime64(const struct timespec64 *ts,
715 const struct timezone *tz)
716{
717 return cap_settime(ts, tz);
718}
719
720static inline int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
721{
722 return __vm_enough_memory(mm, pages, !cap_vm_enough_memory(mm, pages));
723}
724
725static inline int security_bprm_creds_for_exec(struct linux_binprm *bprm)
726{
727 return 0;
728}
729
730static inline int security_bprm_creds_from_file(struct linux_binprm *bprm,
731 const struct file *file)
732{
733 return cap_bprm_creds_from_file(bprm, file);
734}
735
736static inline int security_bprm_check(struct linux_binprm *bprm)
737{
738 return 0;
739}
740
741static inline void security_bprm_committing_creds(const struct linux_binprm *bprm)
742{
743}
744
745static inline void security_bprm_committed_creds(const struct linux_binprm *bprm)
746{
747}
748
749static inline int security_fs_context_submount(struct fs_context *fc,
750 struct super_block *reference)
751{
752 return 0;
753}
754static inline int security_fs_context_dup(struct fs_context *fc,
755 struct fs_context *src_fc)
756{
757 return 0;
758}
759static inline int security_fs_context_parse_param(struct fs_context *fc,
760 struct fs_parameter *param)
761{
762 return -ENOPARAM;
763}
764
765static inline int security_sb_alloc(struct super_block *sb)
766{
767 return 0;
768}
769
770static inline void security_sb_delete(struct super_block *sb)
771{ }
772
773static inline void security_sb_free(struct super_block *sb)
774{ }
775
776static inline int security_sb_eat_lsm_opts(char *options,
777 void **mnt_opts)
778{
779 return 0;
780}
781
782static inline int security_sb_remount(struct super_block *sb,
783 void *mnt_opts)
784{
785 return 0;
786}
787
788static inline int security_sb_mnt_opts_compat(struct super_block *sb,
789 void *mnt_opts)
790{
791 return 0;
792}
793
794
795static inline int security_sb_kern_mount(struct super_block *sb)
796{
797 return 0;
798}
799
800static inline int security_sb_show_options(struct seq_file *m,
801 struct super_block *sb)
802{
803 return 0;
804}
805
806static inline int security_sb_statfs(struct dentry *dentry)
807{
808 return 0;
809}
810
811static inline int security_sb_mount(const char *dev_name, const struct path *path,
812 const char *type, unsigned long flags,
813 void *data)
814{
815 return 0;
816}
817
818static inline int security_sb_umount(struct vfsmount *mnt, int flags)
819{
820 return 0;
821}
822
823static inline int security_sb_pivotroot(const struct path *old_path,
824 const struct path *new_path)
825{
826 return 0;
827}
828
829static inline int security_sb_set_mnt_opts(struct super_block *sb,
830 void *mnt_opts,
831 unsigned long kern_flags,
832 unsigned long *set_kern_flags)
833{
834 return 0;
835}
836
837static inline int security_sb_clone_mnt_opts(const struct super_block *oldsb,
838 struct super_block *newsb,
839 unsigned long kern_flags,
840 unsigned long *set_kern_flags)
841{
842 return 0;
843}
844
845static inline int security_move_mount(const struct path *from_path,
846 const struct path *to_path)
847{
848 return 0;
849}
850
851static inline int security_path_notify(const struct path *path, u64 mask,
852 unsigned int obj_type)
853{
854 return 0;
855}
856
857static inline int security_inode_alloc(struct inode *inode, gfp_t gfp)
858{
859 return 0;
860}
861
862static inline void security_inode_free(struct inode *inode)
863{ }
864
865static inline int security_dentry_init_security(struct dentry *dentry,
866 int mode,
867 const struct qstr *name,
868 const char **xattr_name,
869 struct lsm_context *lsmcxt)
870{
871 return -EOPNOTSUPP;
872}
873
874static inline int security_dentry_create_files_as(struct dentry *dentry,
875 int mode, const struct qstr *name,
876 const struct cred *old,
877 struct cred *new)
878{
879 return 0;
880}
881
882
883static inline int security_inode_init_security(struct inode *inode,
884 struct inode *dir,
885 const struct qstr *qstr,
886 const initxattrs xattrs,
887 void *fs_data)
888{
889 return 0;
890}
891
892static inline int security_inode_init_security_anon(struct inode *inode,
893 const struct qstr *name,
894 const struct inode *context_inode)
895{
896 return 0;
897}
898
899static inline int security_inode_create(struct inode *dir,
900 struct dentry *dentry,
901 umode_t mode)
902{
903 return 0;
904}
905
906static inline void
907security_inode_post_create_tmpfile(struct mnt_idmap *idmap, struct inode *inode)
908{ }
909
910static inline int security_inode_link(struct dentry *old_dentry,
911 struct inode *dir,
912 struct dentry *new_dentry)
913{
914 return 0;
915}
916
917static inline int security_inode_unlink(struct inode *dir,
918 struct dentry *dentry)
919{
920 return 0;
921}
922
923static inline int security_inode_symlink(struct inode *dir,
924 struct dentry *dentry,
925 const char *old_name)
926{
927 return 0;
928}
929
930static inline int security_inode_mkdir(struct inode *dir,
931 struct dentry *dentry,
932 int mode)
933{
934 return 0;
935}
936
937static inline int security_inode_rmdir(struct inode *dir,
938 struct dentry *dentry)
939{
940 return 0;
941}
942
943static inline int security_inode_mknod(struct inode *dir,
944 struct dentry *dentry,
945 int mode, dev_t dev)
946{
947 return 0;
948}
949
950static inline int security_inode_rename(struct inode *old_dir,
951 struct dentry *old_dentry,
952 struct inode *new_dir,
953 struct dentry *new_dentry,
954 unsigned int flags)
955{
956 return 0;
957}
958
959static inline int security_inode_readlink(struct dentry *dentry)
960{
961 return 0;
962}
963
964static inline int security_inode_follow_link(struct dentry *dentry,
965 struct inode *inode,
966 bool rcu)
967{
968 return 0;
969}
970
971static inline int security_inode_permission(struct inode *inode, int mask)
972{
973 return 0;
974}
975
976static inline int security_inode_setattr(struct mnt_idmap *idmap,
977 struct dentry *dentry,
978 struct iattr *attr)
979{
980 return 0;
981}
982
983static inline void
984security_inode_post_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
985 int ia_valid)
986{ }
987
988static inline int security_inode_getattr(const struct path *path)
989{
990 return 0;
991}
992
993static inline int security_inode_setxattr(struct mnt_idmap *idmap,
994 struct dentry *dentry, const char *name, const void *value,
995 size_t size, int flags)
996{
997 return cap_inode_setxattr(dentry, name, value, size, flags);
998}
999
1000static inline int security_inode_set_acl(struct mnt_idmap *idmap,
1001 struct dentry *dentry,
1002 const char *acl_name,
1003 struct posix_acl *kacl)
1004{
1005 return 0;
1006}
1007
1008static inline void security_inode_post_set_acl(struct dentry *dentry,
1009 const char *acl_name,
1010 struct posix_acl *kacl)
1011{ }
1012
1013static inline int security_inode_get_acl(struct mnt_idmap *idmap,
1014 struct dentry *dentry,
1015 const char *acl_name)
1016{
1017 return 0;
1018}
1019
1020static inline int security_inode_remove_acl(struct mnt_idmap *idmap,
1021 struct dentry *dentry,
1022 const char *acl_name)
1023{
1024 return 0;
1025}
1026
1027static inline void security_inode_post_remove_acl(struct mnt_idmap *idmap,
1028 struct dentry *dentry,
1029 const char *acl_name)
1030{ }
1031
1032static inline void security_inode_post_setxattr(struct dentry *dentry,
1033 const char *name, const void *value, size_t size, int flags)
1034{ }
1035
1036static inline int security_inode_getxattr(struct dentry *dentry,
1037 const char *name)
1038{
1039 return 0;
1040}
1041
1042static inline int security_inode_listxattr(struct dentry *dentry)
1043{
1044 return 0;
1045}
1046
1047static inline int security_inode_removexattr(struct mnt_idmap *idmap,
1048 struct dentry *dentry,
1049 const char *name)
1050{
1051 return cap_inode_removexattr(idmap, dentry, name);
1052}
1053
1054static inline void security_inode_post_removexattr(struct dentry *dentry,
1055 const char *name)
1056{ }
1057
1058static inline int security_inode_file_setattr(struct dentry *dentry,
1059 struct file_kattr *fa)
1060{
1061 return 0;
1062}
1063
1064static inline int security_inode_file_getattr(struct dentry *dentry,
1065 struct file_kattr *fa)
1066{
1067 return 0;
1068}
1069
1070static inline int security_inode_need_killpriv(struct dentry *dentry)
1071{
1072 return cap_inode_need_killpriv(dentry);
1073}
1074
1075static inline int security_inode_killpriv(struct mnt_idmap *idmap,
1076 struct dentry *dentry)
1077{
1078 return cap_inode_killpriv(idmap, dentry);
1079}
1080
1081static inline int security_inode_getsecurity(struct mnt_idmap *idmap,
1082 struct inode *inode,
1083 const char *name, void **buffer,
1084 bool alloc)
1085{
1086 return cap_inode_getsecurity(idmap, inode, name, buffer, alloc);
1087}
1088
1089static inline int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
1090{
1091 return -EOPNOTSUPP;
1092}
1093
1094static inline int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
1095{
1096 return 0;
1097}
1098
1099static inline void security_inode_getlsmprop(struct inode *inode,
1100 struct lsm_prop *prop)
1101{
1102 lsmprop_init(prop);
1103}
1104
1105static inline int security_inode_copy_up(struct dentry *src, struct cred **new)
1106{
1107 return 0;
1108}
1109
1110static inline int security_inode_setintegrity(const struct inode *inode,
1111 enum lsm_integrity_type type,
1112 const void *value, size_t size)
1113{
1114 return 0;
1115}
1116
1117static inline int security_kernfs_init_security(struct kernfs_node *kn_dir,
1118 struct kernfs_node *kn)
1119{
1120 return 0;
1121}
1122
1123static inline int security_inode_copy_up_xattr(struct dentry *src, const char *name)
1124{
1125 return -EOPNOTSUPP;
1126}
1127
1128static inline int security_file_permission(struct file *file, int mask)
1129{
1130 return 0;
1131}
1132
1133static inline int security_file_alloc(struct file *file)
1134{
1135 return 0;
1136}
1137
1138static inline void security_file_release(struct file *file)
1139{ }
1140
1141static inline void security_file_free(struct file *file)
1142{ }
1143
1144static inline int security_file_ioctl(struct file *file, unsigned int cmd,
1145 unsigned long arg)
1146{
1147 return 0;
1148}
1149
1150static inline int security_file_ioctl_compat(struct file *file,
1151 unsigned int cmd,
1152 unsigned long arg)
1153{
1154 return 0;
1155}
1156
1157static inline int security_mmap_file(struct file *file, unsigned long prot,
1158 unsigned long flags)
1159{
1160 return 0;
1161}
1162
1163static inline int security_mmap_addr(unsigned long addr)
1164{
1165 return cap_mmap_addr(addr);
1166}
1167
1168static inline int security_file_mprotect(struct vm_area_struct *vma,
1169 unsigned long reqprot,
1170 unsigned long prot)
1171{
1172 return 0;
1173}
1174
1175static inline int security_file_lock(struct file *file, unsigned int cmd)
1176{
1177 return 0;
1178}
1179
1180static inline int security_file_fcntl(struct file *file, unsigned int cmd,
1181 unsigned long arg)
1182{
1183 return 0;
1184}
1185
1186static inline void security_file_set_fowner(struct file *file)
1187{
1188 return;
1189}
1190
1191static inline int security_file_send_sigiotask(struct task_struct *tsk,
1192 struct fown_struct *fown,
1193 int sig)
1194{
1195 return 0;
1196}
1197
1198static inline int security_file_receive(struct file *file)
1199{
1200 return 0;
1201}
1202
1203static inline int security_file_open(struct file *file)
1204{
1205 return 0;
1206}
1207
1208static inline int security_file_post_open(struct file *file, int mask)
1209{
1210 return 0;
1211}
1212
1213static inline int security_file_truncate(struct file *file)
1214{
1215 return 0;
1216}
1217
1218static inline int security_task_alloc(struct task_struct *task,
1219 u64 clone_flags)
1220{
1221 return 0;
1222}
1223
1224static inline void security_task_free(struct task_struct *task)
1225{ }
1226
1227static inline int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)
1228{
1229 return 0;
1230}
1231
1232static inline void security_cred_free(struct cred *cred)
1233{ }
1234
1235static inline int security_prepare_creds(struct cred *new,
1236 const struct cred *old,
1237 gfp_t gfp)
1238{
1239 return 0;
1240}
1241
1242static inline void security_transfer_creds(struct cred *new,
1243 const struct cred *old)
1244{
1245}
1246
1247static inline void security_cred_getsecid(const struct cred *c, u32 *secid)
1248{
1249 *secid = 0;
1250}
1251
1252static inline void security_cred_getlsmprop(const struct cred *c,
1253 struct lsm_prop *prop)
1254{ }
1255
1256static inline int security_kernel_act_as(struct cred *cred, u32 secid)
1257{
1258 return 0;
1259}
1260
1261static inline int security_kernel_create_files_as(struct cred *cred,
1262 struct inode *inode)
1263{
1264 return 0;
1265}
1266
1267static inline int security_kernel_module_request(char *kmod_name)
1268{
1269 return 0;
1270}
1271
1272static inline int security_kernel_load_data(enum kernel_load_data_id id, bool contents)
1273{
1274 return 0;
1275}
1276
1277static inline int security_kernel_post_load_data(char *buf, loff_t size,
1278 enum kernel_load_data_id id,
1279 char *description)
1280{
1281 return 0;
1282}
1283
1284static inline int security_kernel_read_file(struct file *file,
1285 enum kernel_read_file_id id,
1286 bool contents)
1287{
1288 return 0;
1289}
1290
1291static inline int security_kernel_post_read_file(struct file *file,
1292 char *buf, loff_t size,
1293 enum kernel_read_file_id id)
1294{
1295 return 0;
1296}
1297
1298static inline int security_task_fix_setuid(struct cred *new,
1299 const struct cred *old,
1300 int flags)
1301{
1302 return cap_task_fix_setuid(new, old, flags);
1303}
1304
1305static inline int security_task_fix_setgid(struct cred *new,
1306 const struct cred *old,
1307 int flags)
1308{
1309 return 0;
1310}
1311
1312static inline int security_task_fix_setgroups(struct cred *new,
1313 const struct cred *old)
1314{
1315 return 0;
1316}
1317
1318static inline int security_task_setpgid(struct task_struct *p, pid_t pgid)
1319{
1320 return 0;
1321}
1322
1323static inline int security_task_getpgid(struct task_struct *p)
1324{
1325 return 0;
1326}
1327
1328static inline int security_task_getsid(struct task_struct *p)
1329{
1330 return 0;
1331}
1332
1333static inline void security_current_getlsmprop_subj(struct lsm_prop *prop)
1334{
1335 lsmprop_init(prop);
1336}
1337
1338static inline void security_task_getlsmprop_obj(struct task_struct *p,
1339 struct lsm_prop *prop)
1340{
1341 lsmprop_init(prop);
1342}
1343
1344static inline int security_task_setnice(struct task_struct *p, int nice)
1345{
1346 return cap_task_setnice(p, nice);
1347}
1348
1349static inline int security_task_setioprio(struct task_struct *p, int ioprio)
1350{
1351 return cap_task_setioprio(p, ioprio);
1352}
1353
1354static inline int security_task_getioprio(struct task_struct *p)
1355{
1356 return 0;
1357}
1358
1359static inline int security_task_prlimit(const struct cred *cred,
1360 const struct cred *tcred,
1361 unsigned int flags)
1362{
1363 return 0;
1364}
1365
1366static inline int security_task_setrlimit(struct task_struct *p,
1367 unsigned int resource,
1368 struct rlimit *new_rlim)
1369{
1370 return 0;
1371}
1372
1373static inline int security_task_setscheduler(struct task_struct *p)
1374{
1375 return cap_task_setscheduler(p);
1376}
1377
1378static inline int security_task_getscheduler(struct task_struct *p)
1379{
1380 return 0;
1381}
1382
1383static inline int security_task_movememory(struct task_struct *p)
1384{
1385 return 0;
1386}
1387
1388static inline int security_task_kill(struct task_struct *p,
1389 struct kernel_siginfo *info, int sig,
1390 const struct cred *cred)
1391{
1392 return 0;
1393}
1394
1395static inline int security_task_prctl(int option, unsigned long arg2,
1396 unsigned long arg3,
1397 unsigned long arg4,
1398 unsigned long arg5)
1399{
1400 return cap_task_prctl(option, arg2, arg3, arg4, arg5);
1401}
1402
1403static inline void security_task_to_inode(struct task_struct *p, struct inode *inode)
1404{ }
1405
1406static inline int security_create_user_ns(const struct cred *cred)
1407{
1408 return 0;
1409}
1410
1411static inline int security_ipc_permission(struct kern_ipc_perm *ipcp,
1412 short flag)
1413{
1414 return 0;
1415}
1416
1417static inline void security_ipc_getlsmprop(struct kern_ipc_perm *ipcp,
1418 struct lsm_prop *prop)
1419{
1420 lsmprop_init(prop);
1421}
1422
1423static inline int security_msg_msg_alloc(struct msg_msg *msg)
1424{
1425 return 0;
1426}
1427
1428static inline void security_msg_msg_free(struct msg_msg *msg)
1429{ }
1430
1431static inline int security_msg_queue_alloc(struct kern_ipc_perm *msq)
1432{
1433 return 0;
1434}
1435
1436static inline void security_msg_queue_free(struct kern_ipc_perm *msq)
1437{ }
1438
1439static inline int security_msg_queue_associate(struct kern_ipc_perm *msq,
1440 int msqflg)
1441{
1442 return 0;
1443}
1444
1445static inline int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
1446{
1447 return 0;
1448}
1449
1450static inline int security_msg_queue_msgsnd(struct kern_ipc_perm *msq,
1451 struct msg_msg *msg, int msqflg)
1452{
1453 return 0;
1454}
1455
1456static inline int security_msg_queue_msgrcv(struct kern_ipc_perm *msq,
1457 struct msg_msg *msg,
1458 struct task_struct *target,
1459 long type, int mode)
1460{
1461 return 0;
1462}
1463
1464static inline int security_shm_alloc(struct kern_ipc_perm *shp)
1465{
1466 return 0;
1467}
1468
1469static inline void security_shm_free(struct kern_ipc_perm *shp)
1470{ }
1471
1472static inline int security_shm_associate(struct kern_ipc_perm *shp,
1473 int shmflg)
1474{
1475 return 0;
1476}
1477
1478static inline int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
1479{
1480 return 0;
1481}
1482
1483static inline int security_shm_shmat(struct kern_ipc_perm *shp,
1484 char __user *shmaddr, int shmflg)
1485{
1486 return 0;
1487}
1488
1489static inline int security_sem_alloc(struct kern_ipc_perm *sma)
1490{
1491 return 0;
1492}
1493
1494static inline void security_sem_free(struct kern_ipc_perm *sma)
1495{ }
1496
1497static inline int security_sem_associate(struct kern_ipc_perm *sma, int semflg)
1498{
1499 return 0;
1500}
1501
1502static inline int security_sem_semctl(struct kern_ipc_perm *sma, int cmd)
1503{
1504 return 0;
1505}
1506
1507static inline int security_sem_semop(struct kern_ipc_perm *sma,
1508 struct sembuf *sops, unsigned nsops,
1509 int alter)
1510{
1511 return 0;
1512}
1513
1514static inline void security_d_instantiate(struct dentry *dentry,
1515 struct inode *inode)
1516{ }
1517
1518static inline int security_getselfattr(unsigned int attr,
1519 struct lsm_ctx __user *ctx,
1520 size_t __user *size, u32 flags)
1521{
1522 return -EOPNOTSUPP;
1523}
1524
1525static inline int security_setselfattr(unsigned int attr,
1526 struct lsm_ctx __user *ctx,
1527 size_t size, u32 flags)
1528{
1529 return -EOPNOTSUPP;
1530}
1531
1532static inline int security_getprocattr(struct task_struct *p, int lsmid,
1533 const char *name, char **value)
1534{
1535 return -EINVAL;
1536}
1537
1538static inline int security_setprocattr(int lsmid, char *name, void *value,
1539 size_t size)
1540{
1541 return -EINVAL;
1542}
1543
1544static inline int security_ismaclabel(const char *name)
1545{
1546 return 0;
1547}
1548
1549static inline int security_secid_to_secctx(u32 secid, struct lsm_context *cp)
1550{
1551 return -EOPNOTSUPP;
1552}
1553
1554static inline int security_lsmprop_to_secctx(struct lsm_prop *prop,
1555 struct lsm_context *cp,
1556 int lsmid)
1557{
1558 return -EOPNOTSUPP;
1559}
1560
1561static inline int security_secctx_to_secid(const char *secdata,
1562 u32 seclen,
1563 u32 *secid)
1564{
1565 return -EOPNOTSUPP;
1566}
1567
1568static inline void security_release_secctx(struct lsm_context *cp)
1569{
1570}
1571
1572static inline void security_inode_invalidate_secctx(struct inode *inode)
1573{
1574}
1575
1576static inline int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
1577{
1578 return -EOPNOTSUPP;
1579}
1580static inline int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
1581{
1582 return -EOPNOTSUPP;
1583}
1584static inline int security_inode_getsecctx(struct inode *inode,
1585 struct lsm_context *cp)
1586{
1587 return -EOPNOTSUPP;
1588}
1589static inline int security_locked_down(enum lockdown_reason what)
1590{
1591 return 0;
1592}
1593static inline int lsm_fill_user_ctx(struct lsm_ctx __user *uctx,
1594 u32 *uctx_len, void *val, size_t val_len,
1595 u64 id, u64 flags)
1596{
1597 return -EOPNOTSUPP;
1598}
1599
1600static inline int security_bdev_alloc(struct block_device *bdev)
1601{
1602 return 0;
1603}
1604
1605static inline void security_bdev_free(struct block_device *bdev)
1606{
1607}
1608
1609static inline int security_bdev_setintegrity(struct block_device *bdev,
1610 enum lsm_integrity_type type,
1611 const void *value, size_t size)
1612{
1613 return 0;
1614}
1615
1616#endif /* CONFIG_SECURITY */
1617
1618#if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE)
1619int security_post_notification(const struct cred *w_cred,
1620 const struct cred *cred,
1621 struct watch_notification *n);
1622#else
1623static inline int security_post_notification(const struct cred *w_cred,
1624 const struct cred *cred,
1625 struct watch_notification *n)
1626{
1627 return 0;
1628}
1629#endif
1630
1631#if defined(CONFIG_SECURITY) && defined(CONFIG_KEY_NOTIFICATIONS)
1632int security_watch_key(struct key *key);
1633#else
1634static inline int security_watch_key(struct key *key)
1635{
1636 return 0;
1637}
1638#endif
1639
1640#ifdef CONFIG_SECURITY_NETWORK
1641
1642int security_netlink_send(struct sock *sk, struct sk_buff *skb);
1643int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk);
1644int security_unix_may_send(struct socket *sock, struct socket *other);
1645int security_socket_create(int family, int type, int protocol, int kern);
1646int security_socket_post_create(struct socket *sock, int family,
1647 int type, int protocol, int kern);
1648int security_socket_socketpair(struct socket *socka, struct socket *sockb);
1649int security_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen);
1650int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen);
1651int security_socket_listen(struct socket *sock, int backlog);
1652int security_socket_accept(struct socket *sock, struct socket *newsock);
1653int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size);
1654int security_socket_recvmsg(struct socket *sock, struct msghdr *msg,
1655 int size, int flags);
1656int security_socket_getsockname(struct socket *sock);
1657int security_socket_getpeername(struct socket *sock);
1658int security_socket_getsockopt(struct socket *sock, int level, int optname);
1659int security_socket_setsockopt(struct socket *sock, int level, int optname);
1660int security_socket_shutdown(struct socket *sock, int how);
1661int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb);
1662int security_socket_getpeersec_stream(struct socket *sock, sockptr_t optval,
1663 sockptr_t optlen, unsigned int len);
1664int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid);
1665int security_sk_alloc(struct sock *sk, int family, gfp_t priority);
1666void security_sk_free(struct sock *sk);
1667void security_sk_clone(const struct sock *sk, struct sock *newsk);
1668void security_sk_classify_flow(const struct sock *sk,
1669 struct flowi_common *flic);
1670void security_req_classify_flow(const struct request_sock *req,
1671 struct flowi_common *flic);
1672void security_sock_graft(struct sock*sk, struct socket *parent);
1673int security_inet_conn_request(const struct sock *sk,
1674 struct sk_buff *skb, struct request_sock *req);
1675void security_inet_csk_clone(struct sock *newsk,
1676 const struct request_sock *req);
1677void security_inet_conn_established(struct sock *sk,
1678 struct sk_buff *skb);
1679int security_secmark_relabel_packet(u32 secid);
1680void security_secmark_refcount_inc(void);
1681void security_secmark_refcount_dec(void);
1682int security_tun_dev_alloc_security(void **security);
1683void security_tun_dev_free_security(void *security);
1684int security_tun_dev_create(void);
1685int security_tun_dev_attach_queue(void *security);
1686int security_tun_dev_attach(struct sock *sk, void *security);
1687int security_tun_dev_open(void *security);
1688int security_sctp_assoc_request(struct sctp_association *asoc, struct sk_buff *skb);
1689int security_sctp_bind_connect(struct sock *sk, int optname,
1690 struct sockaddr *address, int addrlen);
1691void security_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk,
1692 struct sock *newsk);
1693int security_sctp_assoc_established(struct sctp_association *asoc,
1694 struct sk_buff *skb);
1695int security_mptcp_add_subflow(struct sock *sk, struct sock *ssk);
1696
1697#else /* CONFIG_SECURITY_NETWORK */
1698static inline int security_netlink_send(struct sock *sk, struct sk_buff *skb)
1699{
1700 return 0;
1701}
1702
1703static inline int security_unix_stream_connect(struct sock *sock,
1704 struct sock *other,
1705 struct sock *newsk)
1706{
1707 return 0;
1708}
1709
1710static inline int security_unix_may_send(struct socket *sock,
1711 struct socket *other)
1712{
1713 return 0;
1714}
1715
1716static inline int security_socket_create(int family, int type,
1717 int protocol, int kern)
1718{
1719 return 0;
1720}
1721
1722static inline int security_socket_post_create(struct socket *sock,
1723 int family,
1724 int type,
1725 int protocol, int kern)
1726{
1727 return 0;
1728}
1729
1730static inline int security_socket_socketpair(struct socket *socka,
1731 struct socket *sockb)
1732{
1733 return 0;
1734}
1735
1736static inline int security_socket_bind(struct socket *sock,
1737 struct sockaddr *address,
1738 int addrlen)
1739{
1740 return 0;
1741}
1742
1743static inline int security_socket_connect(struct socket *sock,
1744 struct sockaddr *address,
1745 int addrlen)
1746{
1747 return 0;
1748}
1749
1750static inline int security_socket_listen(struct socket *sock, int backlog)
1751{
1752 return 0;
1753}
1754
1755static inline int security_socket_accept(struct socket *sock,
1756 struct socket *newsock)
1757{
1758 return 0;
1759}
1760
1761static inline int security_socket_sendmsg(struct socket *sock,
1762 struct msghdr *msg, int size)
1763{
1764 return 0;
1765}
1766
1767static inline int security_socket_recvmsg(struct socket *sock,
1768 struct msghdr *msg, int size,
1769 int flags)
1770{
1771 return 0;
1772}
1773
1774static inline int security_socket_getsockname(struct socket *sock)
1775{
1776 return 0;
1777}
1778
1779static inline int security_socket_getpeername(struct socket *sock)
1780{
1781 return 0;
1782}
1783
1784static inline int security_socket_getsockopt(struct socket *sock,
1785 int level, int optname)
1786{
1787 return 0;
1788}
1789
1790static inline int security_socket_setsockopt(struct socket *sock,
1791 int level, int optname)
1792{
1793 return 0;
1794}
1795
1796static inline int security_socket_shutdown(struct socket *sock, int how)
1797{
1798 return 0;
1799}
1800static inline int security_sock_rcv_skb(struct sock *sk,
1801 struct sk_buff *skb)
1802{
1803 return 0;
1804}
1805
1806static inline int security_socket_getpeersec_stream(struct socket *sock,
1807 sockptr_t optval,
1808 sockptr_t optlen,
1809 unsigned int len)
1810{
1811 return -ENOPROTOOPT;
1812}
1813
1814static inline int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
1815{
1816 return -ENOPROTOOPT;
1817}
1818
1819static inline int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
1820{
1821 return 0;
1822}
1823
1824static inline void security_sk_free(struct sock *sk)
1825{
1826}
1827
1828static inline void security_sk_clone(const struct sock *sk, struct sock *newsk)
1829{
1830}
1831
1832static inline void security_sk_classify_flow(const struct sock *sk,
1833 struct flowi_common *flic)
1834{
1835}
1836
1837static inline void security_req_classify_flow(const struct request_sock *req,
1838 struct flowi_common *flic)
1839{
1840}
1841
1842static inline void security_sock_graft(struct sock *sk, struct socket *parent)
1843{
1844}
1845
1846static inline int security_inet_conn_request(const struct sock *sk,
1847 struct sk_buff *skb, struct request_sock *req)
1848{
1849 return 0;
1850}
1851
1852static inline void security_inet_csk_clone(struct sock *newsk,
1853 const struct request_sock *req)
1854{
1855}
1856
1857static inline void security_inet_conn_established(struct sock *sk,
1858 struct sk_buff *skb)
1859{
1860}
1861
1862static inline int security_secmark_relabel_packet(u32 secid)
1863{
1864 return 0;
1865}
1866
1867static inline void security_secmark_refcount_inc(void)
1868{
1869}
1870
1871static inline void security_secmark_refcount_dec(void)
1872{
1873}
1874
1875static inline int security_tun_dev_alloc_security(void **security)
1876{
1877 return 0;
1878}
1879
1880static inline void security_tun_dev_free_security(void *security)
1881{
1882}
1883
1884static inline int security_tun_dev_create(void)
1885{
1886 return 0;
1887}
1888
1889static inline int security_tun_dev_attach_queue(void *security)
1890{
1891 return 0;
1892}
1893
1894static inline int security_tun_dev_attach(struct sock *sk, void *security)
1895{
1896 return 0;
1897}
1898
1899static inline int security_tun_dev_open(void *security)
1900{
1901 return 0;
1902}
1903
1904static inline int security_sctp_assoc_request(struct sctp_association *asoc,
1905 struct sk_buff *skb)
1906{
1907 return 0;
1908}
1909
1910static inline int security_sctp_bind_connect(struct sock *sk, int optname,
1911 struct sockaddr *address,
1912 int addrlen)
1913{
1914 return 0;
1915}
1916
1917static inline void security_sctp_sk_clone(struct sctp_association *asoc,
1918 struct sock *sk,
1919 struct sock *newsk)
1920{
1921}
1922
1923static inline int security_sctp_assoc_established(struct sctp_association *asoc,
1924 struct sk_buff *skb)
1925{
1926 return 0;
1927}
1928
1929static inline int security_mptcp_add_subflow(struct sock *sk, struct sock *ssk)
1930{
1931 return 0;
1932}
1933#endif /* CONFIG_SECURITY_NETWORK */
1934
1935#ifdef CONFIG_SECURITY_INFINIBAND
1936int security_ib_pkey_access(void *sec, u64 subnet_prefix, u16 pkey);
1937int security_ib_endport_manage_subnet(void *sec, const char *name, u8 port_num);
1938int security_ib_alloc_security(void **sec);
1939void security_ib_free_security(void *sec);
1940#else /* CONFIG_SECURITY_INFINIBAND */
1941static inline int security_ib_pkey_access(void *sec, u64 subnet_prefix, u16 pkey)
1942{
1943 return 0;
1944}
1945
1946static inline int security_ib_endport_manage_subnet(void *sec, const char *dev_name, u8 port_num)
1947{
1948 return 0;
1949}
1950
1951static inline int security_ib_alloc_security(void **sec)
1952{
1953 return 0;
1954}
1955
1956static inline void security_ib_free_security(void *sec)
1957{
1958}
1959#endif /* CONFIG_SECURITY_INFINIBAND */
1960
1961#ifdef CONFIG_SECURITY_NETWORK_XFRM
1962
1963int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
1964 struct xfrm_user_sec_ctx *sec_ctx, gfp_t gfp);
1965int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctxp);
1966void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
1967int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx);
1968int security_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx);
1969int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
1970 struct xfrm_sec_ctx *polsec, u32 secid);
1971int security_xfrm_state_delete(struct xfrm_state *x);
1972void security_xfrm_state_free(struct xfrm_state *x);
1973int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid);
1974int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
1975 struct xfrm_policy *xp,
1976 const struct flowi_common *flic);
1977int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid);
1978void security_skb_classify_flow(struct sk_buff *skb, struct flowi_common *flic);
1979
1980#else /* CONFIG_SECURITY_NETWORK_XFRM */
1981
1982static inline int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
1983 struct xfrm_user_sec_ctx *sec_ctx,
1984 gfp_t gfp)
1985{
1986 return 0;
1987}
1988
1989static inline int security_xfrm_policy_clone(struct xfrm_sec_ctx *old, struct xfrm_sec_ctx **new_ctxp)
1990{
1991 return 0;
1992}
1993
1994static inline void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
1995{
1996}
1997
1998static inline int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
1999{
2000 return 0;
2001}
2002
2003static inline int security_xfrm_state_alloc(struct xfrm_state *x,
2004 struct xfrm_user_sec_ctx *sec_ctx)
2005{
2006 return 0;
2007}
2008
2009static inline int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
2010 struct xfrm_sec_ctx *polsec, u32 secid)
2011{
2012 return 0;
2013}
2014
2015static inline void security_xfrm_state_free(struct xfrm_state *x)
2016{
2017}
2018
2019static inline int security_xfrm_state_delete(struct xfrm_state *x)
2020{
2021 return 0;
2022}
2023
2024static inline int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid)
2025{
2026 return 0;
2027}
2028
2029static inline int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
2030 struct xfrm_policy *xp,
2031 const struct flowi_common *flic)
2032{
2033 return 1;
2034}
2035
2036static inline int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
2037{
2038 return 0;
2039}
2040
2041static inline void security_skb_classify_flow(struct sk_buff *skb,
2042 struct flowi_common *flic)
2043{
2044}
2045
2046#endif /* CONFIG_SECURITY_NETWORK_XFRM */
2047
2048#ifdef CONFIG_SECURITY_PATH
2049int security_path_unlink(const struct path *dir, struct dentry *dentry);
2050int security_path_mkdir(const struct path *dir, struct dentry *dentry, umode_t mode);
2051int security_path_rmdir(const struct path *dir, struct dentry *dentry);
2052int security_path_mknod(const struct path *dir, struct dentry *dentry, umode_t mode,
2053 unsigned int dev);
2054void security_path_post_mknod(struct mnt_idmap *idmap, struct dentry *dentry);
2055int security_path_truncate(const struct path *path);
2056int security_path_symlink(const struct path *dir, struct dentry *dentry,
2057 const char *old_name);
2058int security_path_link(struct dentry *old_dentry, const struct path *new_dir,
2059 struct dentry *new_dentry);
2060int security_path_rename(const struct path *old_dir, struct dentry *old_dentry,
2061 const struct path *new_dir, struct dentry *new_dentry,
2062 unsigned int flags);
2063int security_path_chmod(const struct path *path, umode_t mode);
2064int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid);
2065int security_path_chroot(const struct path *path);
2066#else /* CONFIG_SECURITY_PATH */
2067static inline int security_path_unlink(const struct path *dir, struct dentry *dentry)
2068{
2069 return 0;
2070}
2071
2072static inline int security_path_mkdir(const struct path *dir, struct dentry *dentry,
2073 umode_t mode)
2074{
2075 return 0;
2076}
2077
2078static inline int security_path_rmdir(const struct path *dir, struct dentry *dentry)
2079{
2080 return 0;
2081}
2082
2083static inline int security_path_mknod(const struct path *dir, struct dentry *dentry,
2084 umode_t mode, unsigned int dev)
2085{
2086 return 0;
2087}
2088
2089static inline void security_path_post_mknod(struct mnt_idmap *idmap,
2090 struct dentry *dentry)
2091{ }
2092
2093static inline int security_path_truncate(const struct path *path)
2094{
2095 return 0;
2096}
2097
2098static inline int security_path_symlink(const struct path *dir, struct dentry *dentry,
2099 const char *old_name)
2100{
2101 return 0;
2102}
2103
2104static inline int security_path_link(struct dentry *old_dentry,
2105 const struct path *new_dir,
2106 struct dentry *new_dentry)
2107{
2108 return 0;
2109}
2110
2111static inline int security_path_rename(const struct path *old_dir,
2112 struct dentry *old_dentry,
2113 const struct path *new_dir,
2114 struct dentry *new_dentry,
2115 unsigned int flags)
2116{
2117 return 0;
2118}
2119
2120static inline int security_path_chmod(const struct path *path, umode_t mode)
2121{
2122 return 0;
2123}
2124
2125static inline int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
2126{
2127 return 0;
2128}
2129
2130static inline int security_path_chroot(const struct path *path)
2131{
2132 return 0;
2133}
2134#endif /* CONFIG_SECURITY_PATH */
2135
2136#ifdef CONFIG_KEYS
2137#ifdef CONFIG_SECURITY
2138
2139int security_key_alloc(struct key *key, const struct cred *cred, unsigned long flags);
2140void security_key_free(struct key *key);
2141int security_key_permission(key_ref_t key_ref, const struct cred *cred,
2142 enum key_need_perm need_perm);
2143int security_key_getsecurity(struct key *key, char **_buffer);
2144void security_key_post_create_or_update(struct key *keyring, struct key *key,
2145 const void *payload, size_t payload_len,
2146 unsigned long flags, bool create);
2147
2148#else
2149
2150static inline int security_key_alloc(struct key *key,
2151 const struct cred *cred,
2152 unsigned long flags)
2153{
2154 return 0;
2155}
2156
2157static inline void security_key_free(struct key *key)
2158{
2159}
2160
2161static inline int security_key_permission(key_ref_t key_ref,
2162 const struct cred *cred,
2163 enum key_need_perm need_perm)
2164{
2165 return 0;
2166}
2167
2168static inline int security_key_getsecurity(struct key *key, char **_buffer)
2169{
2170 *_buffer = NULL;
2171 return 0;
2172}
2173
2174static inline void security_key_post_create_or_update(struct key *keyring,
2175 struct key *key,
2176 const void *payload,
2177 size_t payload_len,
2178 unsigned long flags,
2179 bool create)
2180{ }
2181
2182#endif
2183#endif /* CONFIG_KEYS */
2184
2185#ifdef CONFIG_AUDIT
2186#ifdef CONFIG_SECURITY
2187int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule,
2188 gfp_t gfp);
2189int security_audit_rule_known(struct audit_krule *krule);
2190int security_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op,
2191 void *lsmrule);
2192void security_audit_rule_free(void *lsmrule);
2193
2194#else
2195
2196static inline int security_audit_rule_init(u32 field, u32 op, char *rulestr,
2197 void **lsmrule, gfp_t gfp)
2198{
2199 return 0;
2200}
2201
2202static inline int security_audit_rule_known(struct audit_krule *krule)
2203{
2204 return 0;
2205}
2206
2207static inline int security_audit_rule_match(struct lsm_prop *prop, u32 field,
2208 u32 op, void *lsmrule)
2209{
2210 return 0;
2211}
2212
2213static inline void security_audit_rule_free(void *lsmrule)
2214{ }
2215
2216#endif /* CONFIG_SECURITY */
2217#endif /* CONFIG_AUDIT */
2218
2219#ifdef CONFIG_SECURITYFS
2220
2221extern struct dentry *securityfs_create_file(const char *name, umode_t mode,
2222 struct dentry *parent, void *data,
2223 const struct file_operations *fops);
2224extern struct dentry *securityfs_create_dir(const char *name, struct dentry *parent);
2225struct dentry *securityfs_create_symlink(const char *name,
2226 struct dentry *parent,
2227 const char *target,
2228 const struct inode_operations *iops);
2229extern void securityfs_remove(struct dentry *dentry);
2230
2231#else /* CONFIG_SECURITYFS */
2232
2233static inline struct dentry *securityfs_create_dir(const char *name,
2234 struct dentry *parent)
2235{
2236 return ERR_PTR(error: -ENODEV);
2237}
2238
2239static inline struct dentry *securityfs_create_file(const char *name,
2240 umode_t mode,
2241 struct dentry *parent,
2242 void *data,
2243 const struct file_operations *fops)
2244{
2245 return ERR_PTR(error: -ENODEV);
2246}
2247
2248static inline struct dentry *securityfs_create_symlink(const char *name,
2249 struct dentry *parent,
2250 const char *target,
2251 const struct inode_operations *iops)
2252{
2253 return ERR_PTR(error: -ENODEV);
2254}
2255
2256static inline void securityfs_remove(struct dentry *dentry)
2257{}
2258
2259#endif
2260
2261#define securityfs_recursive_remove securityfs_remove
2262
2263#ifdef CONFIG_BPF_SYSCALL
2264union bpf_attr;
2265struct bpf_map;
2266struct bpf_prog;
2267struct bpf_token;
2268#ifdef CONFIG_SECURITY
2269extern int security_bpf(int cmd, union bpf_attr *attr, unsigned int size, bool kernel);
2270extern int security_bpf_map(struct bpf_map *map, fmode_t fmode);
2271extern int security_bpf_prog(struct bpf_prog *prog);
2272extern int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
2273 struct bpf_token *token, bool kernel);
2274extern void security_bpf_map_free(struct bpf_map *map);
2275extern int security_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,
2276 struct bpf_token *token, bool kernel);
2277extern void security_bpf_prog_free(struct bpf_prog *prog);
2278extern int security_bpf_token_create(struct bpf_token *token, union bpf_attr *attr,
2279 const struct path *path);
2280extern void security_bpf_token_free(struct bpf_token *token);
2281extern int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cmd);
2282extern int security_bpf_token_capable(const struct bpf_token *token, int cap);
2283#else
2284static inline int security_bpf(int cmd, union bpf_attr *attr,
2285 unsigned int size, bool kernel)
2286{
2287 return 0;
2288}
2289
2290static inline int security_bpf_map(struct bpf_map *map, fmode_t fmode)
2291{
2292 return 0;
2293}
2294
2295static inline int security_bpf_prog(struct bpf_prog *prog)
2296{
2297 return 0;
2298}
2299
2300static inline int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
2301 struct bpf_token *token, bool kernel)
2302{
2303 return 0;
2304}
2305
2306static inline void security_bpf_map_free(struct bpf_map *map)
2307{ }
2308
2309static inline int security_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,
2310 struct bpf_token *token, bool kernel)
2311{
2312 return 0;
2313}
2314
2315static inline void security_bpf_prog_free(struct bpf_prog *prog)
2316{ }
2317
2318static inline int security_bpf_token_create(struct bpf_token *token, union bpf_attr *attr,
2319 const struct path *path)
2320{
2321 return 0;
2322}
2323
2324static inline void security_bpf_token_free(struct bpf_token *token)
2325{ }
2326
2327static inline int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cmd)
2328{
2329 return 0;
2330}
2331
2332static inline int security_bpf_token_capable(const struct bpf_token *token, int cap)
2333{
2334 return 0;
2335}
2336#endif /* CONFIG_SECURITY */
2337#endif /* CONFIG_BPF_SYSCALL */
2338
2339#ifdef CONFIG_PERF_EVENTS
2340struct perf_event_attr;
2341struct perf_event;
2342
2343#ifdef CONFIG_SECURITY
2344extern int security_perf_event_open(int type);
2345extern int security_perf_event_alloc(struct perf_event *event);
2346extern void security_perf_event_free(struct perf_event *event);
2347extern int security_perf_event_read(struct perf_event *event);
2348extern int security_perf_event_write(struct perf_event *event);
2349#else
2350static inline int security_perf_event_open(int type)
2351{
2352 return 0;
2353}
2354
2355static inline int security_perf_event_alloc(struct perf_event *event)
2356{
2357 return 0;
2358}
2359
2360static inline void security_perf_event_free(struct perf_event *event)
2361{
2362}
2363
2364static inline int security_perf_event_read(struct perf_event *event)
2365{
2366 return 0;
2367}
2368
2369static inline int security_perf_event_write(struct perf_event *event)
2370{
2371 return 0;
2372}
2373#endif /* CONFIG_SECURITY */
2374#endif /* CONFIG_PERF_EVENTS */
2375
2376#ifdef CONFIG_IO_URING
2377#ifdef CONFIG_SECURITY
2378extern int security_uring_override_creds(const struct cred *new);
2379extern int security_uring_sqpoll(void);
2380extern int security_uring_cmd(struct io_uring_cmd *ioucmd);
2381extern int security_uring_allowed(void);
2382#else
2383static inline int security_uring_override_creds(const struct cred *new)
2384{
2385 return 0;
2386}
2387static inline int security_uring_sqpoll(void)
2388{
2389 return 0;
2390}
2391static inline int security_uring_cmd(struct io_uring_cmd *ioucmd)
2392{
2393 return 0;
2394}
2395static inline int security_uring_allowed(void)
2396{
2397 return 0;
2398}
2399#endif /* CONFIG_SECURITY */
2400#endif /* CONFIG_IO_URING */
2401
2402#ifdef CONFIG_SECURITY
2403extern void security_initramfs_populated(void);
2404#else
2405static inline void security_initramfs_populated(void)
2406{
2407}
2408#endif /* CONFIG_SECURITY */
2409
2410#endif /* ! __LINUX_SECURITY_H */
2411