// SPDX-License-Identifier: GPL-2.0-or-later

/*

* Security plug functions

*

* Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com>

* Copyright (C) 2001-2002 Greg Kroah-Hartman <greg@kroah.com>

* Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com>

* Copyright (C) 2016 Mellanox Technologies

*/

#define pr_fmt(fmt) "LSM: " fmt

#include <linux/bpf.h>

#include <linux/capability.h>

#include <linux/dcache.h>

#include <linux/export.h>

#include <linux/init.h>

#include <linux/kernel.h>

#include <linux/kernel_read_file.h>

#include <linux/lsm_hooks.h>

#include <linux/integrity.h>

#include <linux/ima.h>

#include <linux/evm.h>

#include <linux/fsnotify.h>

#include <linux/mman.h>

#include <linux/mount.h>

#include <linux/personality.h>

#include <linux/backing-dev.h>

#include <linux/string.h>

#include <linux/msg.h>

#include <net/flow.h>

#define MAX_LSM_EVM_XATTR 2

/* How many LSMs were built into the kernel? */

#define LSM_COUNT (__end_lsm_info - __start_lsm_info)

/*

* These are descriptions of the reasons that can be passed to the

* security_locked_down() LSM hook. Placing this array here allows

* all security modules to use the same descriptions for auditing

* purposes.

*/

const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = {

[LOCKDOWN_NONE] = "none",

[LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading",

[LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port",

[LOCKDOWN_EFI_TEST] = "/dev/efi_test access",

[LOCKDOWN_KEXEC] = "kexec of unsigned images",

[LOCKDOWN_HIBERNATION] = "hibernation",

[LOCKDOWN_PCI_ACCESS] = "direct PCI access",

[LOCKDOWN_IOPORT] = "raw io port access",

[LOCKDOWN_MSR] = "raw MSR access",

[LOCKDOWN_ACPI_TABLES] = "modifying ACPI tables",

[LOCKDOWN_DEVICE_TREE] = "modifying device tree contents",

[LOCKDOWN_PCMCIA_CIS] = "direct PCMCIA CIS storage",

[LOCKDOWN_TIOCSSERIAL] = "reconfiguration of serial port IO",

[LOCKDOWN_MODULE_PARAMETERS] = "unsafe module parameters",

[LOCKDOWN_MMIOTRACE] = "unsafe mmio",

[LOCKDOWN_DEBUGFS] = "debugfs access",

[LOCKDOWN_XMON_WR] = "xmon write access",

[LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM",

[LOCKDOWN_DBG_WRITE_KERNEL] = "use of kgdb/kdb to write kernel RAM",

[LOCKDOWN_RTAS_ERROR_INJECTION] = "RTAS error injection",

[LOCKDOWN_INTEGRITY_MAX] = "integrity",

[LOCKDOWN_KCORE] = "/proc/kcore access",

[LOCKDOWN_KPROBES] = "use of kprobes",

[LOCKDOWN_BPF_READ_KERNEL] = "use of bpf to read kernel RAM",

[LOCKDOWN_DBG_READ_KERNEL] = "use of kgdb/kdb to read kernel RAM",

[LOCKDOWN_PERF] = "unsafe use of perf",

[LOCKDOWN_TRACEFS] = "use of tracefs",

[LOCKDOWN_XMON_RW] = "xmon read and write access",

[LOCKDOWN_XFRM_SECRET] = "xfrm SA secret",

[LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality",

};

struct security_hook_heads security_hook_heads __lsm_ro_after_init;

static BLOCKING_NOTIFIER_HEAD(blocking_lsm_notifier_chain);

static struct kmem_cache *lsm_file_cache;

static struct kmem_cache *lsm_inode_cache;

char *lsm_names;

static struct lsm_blob_sizes blob_sizes __lsm_ro_after_init;

/* Boot-time LSM user choice */

static __initdata const char *chosen_lsm_order;

static __initdata const char *chosen_major_lsm;

static __initconst const char * const builtin_lsm_order = CONFIG_LSM;

/* Ordered list of LSMs to initialize. */

static __initdata struct lsm_info **ordered_lsms;

static __initdata struct lsm_info *exclusive;

static __initdata bool debug;

#define init_debug(...) \

do { \

if (debug) \

pr_info(__VA_ARGS__); \

} while (0)

static bool __init is_enabled(struct lsm_info *lsm)

{

if (!lsm->enabled)

return false;

return *lsm->enabled;

}

/* Mark an LSM's enabled flag. */

static int lsm_enabled_true __initdata = 1;

static int lsm_enabled_false __initdata = 0;

static void __init set_enabled(struct lsm_info *lsm, bool enabled)

{

/*

* When an LSM hasn't configured an enable variable, we can use

* a hard-coded location for storing the default enabled state.

*/

if (!lsm->enabled) {

if (enabled)

lsm->enabled = &lsm_enabled_true;

else

lsm->enabled = &lsm_enabled_false;

} else if (lsm->enabled == &lsm_enabled_true) {

if (!enabled)

lsm->enabled = &lsm_enabled_false;

} else if (lsm->enabled == &lsm_enabled_false) {

if (enabled)

lsm->enabled = &lsm_enabled_true;

} else {

*lsm->enabled = enabled;

}

}

/* Is an LSM already listed in the ordered LSMs list? */

static bool __init exists_ordered_lsm(struct lsm_info *lsm)

{

struct lsm_info **check;

for (check = ordered_lsms; *check; check++)

if (*check == lsm)

return true;

return false;

}

/* Append an LSM to the list of ordered LSMs to initialize. */

static int last_lsm __initdata;

static void __init append_ordered_lsm(struct lsm_info *lsm, const char *from)

{

/* Ignore duplicate selections. */

if (exists_ordered_lsm(lsm))

return;

if (WARN(last_lsm == LSM_COUNT, "%s: out of LSM slots!?\n", from))

return;

/* Enable this LSM, if it is not already set. */

if (!lsm->enabled)

lsm->enabled = &lsm_enabled_true;

ordered_lsms[last_lsm++] = lsm;

init_debug("%s ordered: %s (%s)\n", from, lsm->name,

is_enabled(lsm) ? "enabled" : "disabled");

}

/* Is an LSM allowed to be initialized? */

static bool __init lsm_allowed(struct lsm_info *lsm)

{

/* Skip if the LSM is disabled. */

if (!is_enabled(lsm))

return false;

/* Not allowed if another exclusive LSM already initialized. */

if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && exclusive) {

init_debug("exclusive disabled: %s\n", lsm->name);

return false;

}

return true;

}

static void __init lsm_set_blob_size(int *need, int *lbs)

{

int offset;

if (*need <= 0)

return;

offset = ALIGN(*lbs, sizeof(void *));

*lbs = offset + *need;

*need = offset;

}

static void __init lsm_set_blob_sizes(struct lsm_blob_sizes *needed)

{

if (!needed)

return;

lsm_set_blob_size(&needed->lbs_cred, &blob_sizes.lbs_cred);

lsm_set_blob_size(&needed->lbs_file, &blob_sizes.lbs_file);

/*

* The inode blob gets an rcu_head in addition to

* what the modules might need.

*/

if (needed->lbs_inode && blob_sizes.lbs_inode == 0)

blob_sizes.lbs_inode = sizeof(struct rcu_head);

lsm_set_blob_size(&needed->lbs_inode, &blob_sizes.lbs_inode);

lsm_set_blob_size(&needed->lbs_ipc, &blob_sizes.lbs_ipc);

lsm_set_blob_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg);

lsm_set_blob_size(&needed->lbs_superblock, &blob_sizes.lbs_superblock);

lsm_set_blob_size(&needed->lbs_task, &blob_sizes.lbs_task);

}

/* Prepare LSM for initialization. */

static void __init prepare_lsm(struct lsm_info *lsm)

{

int enabled = lsm_allowed(lsm);

/* Record enablement (to handle any following exclusive LSMs). */

set_enabled(lsm, enabled);

/* If enabled, do pre-initialization work. */

if (enabled) {

if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && !exclusive) {

exclusive = lsm;

init_debug("exclusive chosen: %s\n", lsm->name);

}

lsm_set_blob_sizes(lsm->blobs);

}

}

/* Initialize a given LSM, if it is enabled. */

static void __init initialize_lsm(struct lsm_info *lsm)

{

if (is_enabled(lsm)) {

int ret;

init_debug("initializing %s\n", lsm->name);

ret = lsm->init();

WARN(ret, "%s failed to initialize: %d\n", lsm->name, ret);

}

}

/* Populate ordered LSMs list from comma-separated LSM name list. */

static void __init ordered_lsm_parse(const char *order, const char *origin)

{

struct lsm_info *lsm;

char *sep, *name, *next;

/* LSM_ORDER_FIRST is always first. */

for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {

if (lsm->order == LSM_ORDER_FIRST)

append_ordered_lsm(lsm, " first");

}

/* Process "security=", if given. */

if (chosen_major_lsm) {

struct lsm_info *major;

/*

* To match the original "security=" behavior, this

* explicitly does NOT fallback to another Legacy Major

* if the selected one was separately disabled: disable

* all non-matching Legacy Major LSMs.

*/

for (major = __start_lsm_info; major < __end_lsm_info;

major++) {

if ((major->flags & LSM_FLAG_LEGACY_MAJOR) &&

strcmp(major->name, chosen_major_lsm) != 0) {

set_enabled(major, false);

init_debug("security=%s disabled: %s (only one legacy major LSM)\n",

chosen_major_lsm, major->name);

}

}

}

sep = kstrdup(order, GFP_KERNEL);

next = sep;

/* Walk the list, looking for matching LSMs. */

while ((name = strsep(&next, ",")) != NULL) {

bool found = false;

for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {

if (lsm->order == LSM_ORDER_MUTABLE &&

strcmp(lsm->name, name) == 0) {

append_ordered_lsm(lsm, origin);

found = true;

}

}

if (!found)

init_debug("%s ignored: %s (not built into kernel)\n",

origin, name);

}

/* Process "security=", if given. */

if (chosen_major_lsm) {

for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {

if (exists_ordered_lsm(lsm))

continue;

if (strcmp(lsm->name, chosen_major_lsm) == 0)

append_ordered_lsm(lsm, "security=");

}

}

/* Disable all LSMs not in the ordered list. */

for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {

if (exists_ordered_lsm(lsm))

continue;

set_enabled(lsm, false);

init_debug("%s skipped: %s (not in requested order)\n",

origin, lsm->name);

}

kfree(sep);

}

static void __init lsm_early_cred(struct cred *cred);

static void __init lsm_early_task(struct task_struct *task);

static int lsm_append(const char *new, char **result);

static void __init report_lsm_order(void)

{

struct lsm_info **lsm, *early;

int first = 0;

pr_info("initializing lsm=");

/* Report each enabled LSM name, comma separated. */

for (early = __start_early_lsm_info; early < __end_early_lsm_info; early++)

if (is_enabled(early))

pr_cont("%s%s", first++ == 0 ? "" : ",", early->name);

for (lsm = ordered_lsms; *lsm; lsm++)

if (is_enabled(*lsm))

pr_cont("%s%s", first++ == 0 ? "" : ",", (*lsm)->name);

pr_cont("\n");

}

static void __init ordered_lsm_init(void)

{

struct lsm_info **lsm;

ordered_lsms = kcalloc(LSM_COUNT + 1, sizeof(*ordered_lsms),

GFP_KERNEL);

if (chosen_lsm_order) {

if (chosen_major_lsm) {

pr_warn("security=%s is ignored because it is superseded by lsm=%s\n",

chosen_major_lsm, chosen_lsm_order);

chosen_major_lsm = NULL;

}

ordered_lsm_parse(chosen_lsm_order, "cmdline");

} else

ordered_lsm_parse(builtin_lsm_order, "builtin");

for (lsm = ordered_lsms; *lsm; lsm++)

prepare_lsm(*lsm);

report_lsm_order();

init_debug("cred blob size = %d\n", blob_sizes.lbs_cred);

init_debug("file blob size = %d\n", blob_sizes.lbs_file);

init_debug("inode blob size = %d\n", blob_sizes.lbs_inode);

init_debug("ipc blob size = %d\n", blob_sizes.lbs_ipc);

init_debug("msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg);

init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock);

init_debug("task blob size = %d\n", blob_sizes.lbs_task);

/*

* Create any kmem_caches needed for blobs

*/

if (blob_sizes.lbs_file)

lsm_file_cache = kmem_cache_create("lsm_file_cache",

blob_sizes.lbs_file, 0,

SLAB_PANIC, NULL);

if (blob_sizes.lbs_inode)

lsm_inode_cache = kmem_cache_create("lsm_inode_cache",

blob_sizes.lbs_inode, 0,

SLAB_PANIC, NULL);

lsm_early_cred((struct cred *) current->cred);

lsm_early_task(current);

for (lsm = ordered_lsms; *lsm; lsm++)

initialize_lsm(*lsm);

kfree(ordered_lsms);

}

int __init early_security_init(void)

{

struct lsm_info *lsm;

#define LSM_HOOK(RET, DEFAULT, NAME, ...) \

INIT_HLIST_HEAD(&security_hook_heads.NAME);

#include "linux/lsm_hook_defs.h"

#undef LSM_HOOK

for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) {

if (!lsm->enabled)

lsm->enabled = &lsm_enabled_true;

prepare_lsm(lsm);

initialize_lsm(lsm);

}

return 0;

}

/**

* security_init - initializes the security framework

*

* This should be called early in the kernel initialization sequence.

*/

int __init security_init(void)

{

struct lsm_info *lsm;

init_debug("legacy security=%s\n", chosen_major_lsm ?: " *unspecified*");

init_debug(" CONFIG_LSM=%s\n", builtin_lsm_order);

init_debug("boot arg lsm=%s\n", chosen_lsm_order ?: " *unspecified*");

/*

* Append the names of the early LSM modules now that kmalloc() is

* available

*/

for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) {

init_debug(" early started: %s (%s)\n", lsm->name,

is_enabled(lsm) ? "enabled" : "disabled");

if (lsm->enabled)

lsm_append(lsm->name, &lsm_names);

}

/* Load LSMs in specified order. */

ordered_lsm_init();

return 0;

}

/* Save user chosen LSM */

static int __init choose_major_lsm(char *str)

{

chosen_major_lsm = str;

return 1;

}

__setup("security=", choose_major_lsm);

/* Explicitly choose LSM initialization order. */

static int __init choose_lsm_order(char *str)

{

chosen_lsm_order = str;

return 1;

}

__setup("lsm=", choose_lsm_order);

/* Enable LSM order debugging. */

static int __init enable_debug(char *str)

{

debug = true;

return 1;

}

__setup("lsm.debug", enable_debug);

static bool match_last_lsm(const char *list, const char *lsm)

{

const char *last;

if (WARN_ON(!list || !lsm))

return false;

last = strrchr(list, ',');

if (last)

/* Pass the comma, strcmp() will check for '\0' */

last++;

else

last = list;

return !strcmp(last, lsm);

}

static int lsm_append(const char *new, char **result)

{

char *cp;

if (*result == NULL) {

*result = kstrdup(new, GFP_KERNEL);

if (*result == NULL)

return -ENOMEM;

} else {

/* Check if it is the last registered name */

if (match_last_lsm(*result, new))

return 0;

cp = kasprintf(GFP_KERNEL, "%s,%s", *result, new);

if (cp == NULL)

return -ENOMEM;

kfree(*result);

*result = cp;

}

return 0;

}

/**

* security_add_hooks - Add a modules hooks to the hook lists.

* @hooks: the hooks to add

* @count: the number of hooks to add

* @lsm: the name of the security module

*

* Each LSM has to register its hooks with the infrastructure.

*/

void __init security_add_hooks(struct security_hook_list *hooks, int count,

const char *lsm)

{

int i;

for (i = 0; i < count; i++) {

hooks[i].lsm = lsm;

hlist_add_tail_rcu(&hooks[i].list, hooks[i].head);

}

/*

* Don't try to append during early_security_init(), we'll come back

* and fix this up afterwards.

*/

if (slab_is_available()) {

if (lsm_append(lsm, &lsm_names) < 0)

panic("%s - Cannot get early memory.\n", __func__);

}

}

int call_blocking_lsm_notifier(enum lsm_event event, void *data)

{

return blocking_notifier_call_chain(&blocking_lsm_notifier_chain,

event, data);

}

EXPORT_SYMBOL(call_blocking_lsm_notifier);

int register_blocking_lsm_notifier(struct notifier_block *nb)

{

return blocking_notifier_chain_register(&blocking_lsm_notifier_chain,

nb);

}

EXPORT_SYMBOL(register_blocking_lsm_notifier);

int unregister_blocking_lsm_notifier(struct notifier_block *nb)

{

return blocking_notifier_chain_unregister(&blocking_lsm_notifier_chain,

nb);

}

EXPORT_SYMBOL(unregister_blocking_lsm_notifier);

/**

* lsm_cred_alloc - allocate a composite cred blob

* @cred: the cred that needs a blob

* @gfp: allocation type

*

* Allocate the cred blob for all the modules

*

* Returns 0, or -ENOMEM if memory can't be allocated.

*/

static int lsm_cred_alloc(struct cred *cred, gfp_t gfp)

{

if (blob_sizes.lbs_cred == 0) {

cred->security = NULL;

return 0;

}

cred->security = kzalloc(blob_sizes.lbs_cred, gfp);

if (cred->security == NULL)

return -ENOMEM;

return 0;

}

/**

* lsm_early_cred - during initialization allocate a composite cred blob

* @cred: the cred that needs a blob

*

* Allocate the cred blob for all the modules

*/

static void __init lsm_early_cred(struct cred *cred)

{

int rc = lsm_cred_alloc(cred, GFP_KERNEL);

if (rc)

panic("%s: Early cred alloc failed.\n", __func__);

}

/**

* lsm_file_alloc - allocate a composite file blob

* @file: the file that needs a blob

*

* Allocate the file blob for all the modules

*

* Returns 0, or -ENOMEM if memory can't be allocated.

*/

static int lsm_file_alloc(struct file *file)

{

if (!lsm_file_cache) {

file->f_security = NULL;

return 0;

}

file->f_security = kmem_cache_zalloc(lsm_file_cache, GFP_KERNEL);

if (file->f_security == NULL)

return -ENOMEM;

return 0;

}

/**

* lsm_inode_alloc - allocate a composite inode blob

* @inode: the inode that needs a blob

*

* Allocate the inode blob for all the modules

*

* Returns 0, or -ENOMEM if memory can't be allocated.

*/

int lsm_inode_alloc(struct inode *inode)

{

if (!lsm_inode_cache) {

inode->i_security = NULL;

return 0;

}

inode->i_security = kmem_cache_zalloc(lsm_inode_cache, GFP_NOFS);

if (inode->i_security == NULL)

return -ENOMEM;

return 0;

}

/**

* lsm_task_alloc - allocate a composite task blob

* @task: the task that needs a blob

*

* Allocate the task blob for all the modules

*

* Returns 0, or -ENOMEM if memory can't be allocated.

*/

static int lsm_task_alloc(struct task_struct *task)

{

if (blob_sizes.lbs_task == 0) {

task->security = NULL;

return 0;

}

task->security = kzalloc(blob_sizes.lbs_task, GFP_KERNEL);

if (task->security == NULL)

return -ENOMEM;

return 0;

}

/**

* lsm_ipc_alloc - allocate a composite ipc blob

* @kip: the ipc that needs a blob

*

* Allocate the ipc blob for all the modules

*

* Returns 0, or -ENOMEM if memory can't be allocated.

*/

static int lsm_ipc_alloc(struct kern_ipc_perm *kip)

{

if (blob_sizes.lbs_ipc == 0) {

kip->security = NULL;

return 0;

}

kip->security = kzalloc(blob_sizes.lbs_ipc, GFP_KERNEL);

if (kip->security == NULL)

return -ENOMEM;

return 0;

}

/**

* lsm_msg_msg_alloc - allocate a composite msg_msg blob

* @mp: the msg_msg that needs a blob

*

* Allocate the ipc blob for all the modules

*

* Returns 0, or -ENOMEM if memory can't be allocated.

*/

static int lsm_msg_msg_alloc(struct msg_msg *mp)

{

if (blob_sizes.lbs_msg_msg == 0) {

mp->security = NULL;

return 0;

}

mp->security = kzalloc(blob_sizes.lbs_msg_msg, GFP_KERNEL);

if (mp->security == NULL)

return -ENOMEM;

return 0;

}

/**

* lsm_early_task - during initialization allocate a composite task blob

* @task: the task that needs a blob

*

* Allocate the task blob for all the modules

*/

static void __init lsm_early_task(struct task_struct *task)

{

int rc = lsm_task_alloc(task);

if (rc)

panic("%s: Early task alloc failed.\n", __func__);

}

/**

* lsm_superblock_alloc - allocate a composite superblock blob

* @sb: the superblock that needs a blob

*

* Allocate the superblock blob for all the modules

*

* Returns 0, or -ENOMEM if memory can't be allocated.

*/

static int lsm_superblock_alloc(struct super_block *sb)

{

if (blob_sizes.lbs_superblock == 0) {

sb->s_security = NULL;

return 0;

}

sb->s_security = kzalloc(blob_sizes.lbs_superblock, GFP_KERNEL);

if (sb->s_security == NULL)

return -ENOMEM;

return 0;

}

/*

* The default value of the LSM hook is defined in linux/lsm_hook_defs.h and

* can be accessed with:

*

* LSM_RET_DEFAULT(<hook_name>)

*

* The macros below define static constants for the default value of each

* LSM hook.

*/

#define LSM_RET_DEFAULT(NAME) (NAME##_default)

#define DECLARE_LSM_RET_DEFAULT_void(DEFAULT, NAME)

#define DECLARE_LSM_RET_DEFAULT_int(DEFAULT, NAME) \

static const int __maybe_unused LSM_RET_DEFAULT(NAME) = (DEFAULT);

#define LSM_HOOK(RET, DEFAULT, NAME, ...) \

DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME)

#include <linux/lsm_hook_defs.h>

#undef LSM_HOOK

/*

* Hook list operation macros.

*

* call_void_hook:

* This is a hook that does not return a value.

*

* call_int_hook:

* This is a hook that returns a value.

*/

#define call_void_hook(FUNC, ...) \

do { \

struct security_hook_list *P; \

\

hlist_for_each_entry(P, &security_hook_heads.FUNC, list) \

P->hook.FUNC(__VA_ARGS__); \

} while (0)

#define call_int_hook(FUNC, IRC, ...) ({ \

int RC = IRC; \

do { \

struct security_hook_list *P; \

\

hlist_for_each_entry(P, &security_hook_heads.FUNC, list) { \

RC = P->hook.FUNC(__VA_ARGS__); \

if (RC != 0) \

break; \

} \

} while (0); \

RC; \

})

/* Security operations */

int security_binder_set_context_mgr(const struct cred *mgr)

{

return call_int_hook(binder_set_context_mgr, 0, mgr);

}

int security_binder_transaction(const struct cred *from,

const struct cred *to)

{

return call_int_hook(binder_transaction, 0, from, to);

}

int security_binder_transfer_binder(const struct cred *from,

const struct cred *to)

{

return call_int_hook(binder_transfer_binder, 0, from, to);

}

int security_binder_transfer_file(const struct cred *from,

const struct cred *to, struct file *file)

{

return call_int_hook(binder_transfer_file, 0, from, to, file);

}

int security_ptrace_access_check(struct task_struct *child, unsigned int mode)

{

return call_int_hook(ptrace_access_check, 0, child, mode);

}

int security_ptrace_traceme(struct task_struct *parent)

{

return call_int_hook(ptrace_traceme, 0, parent);

}

int security_capget(struct task_struct *target,

kernel_cap_t *effective,

kernel_cap_t *inheritable,

kernel_cap_t *permitted)

{

return call_int_hook(capget, 0, target,

effective, inheritable, permitted);

}

int security_capset(struct cred *new, const struct cred *old,

const kernel_cap_t *effective,

const kernel_cap_t *inheritable,

const kernel_cap_t *permitted)

{

return call_int_hook(capset, 0, new, old,

effective, inheritable, permitted);

}

int security_capable(const struct cred *cred,

struct user_namespace *ns,

int cap,

unsigned int opts)

{

return call_int_hook(capable, 0, cred, ns, cap, opts);

}

int security_quotactl(int cmds, int type, int id, struct super_block *sb)

{

return call_int_hook(quotactl, 0, cmds, type, id, sb);

}

int security_quota_on(struct dentry *dentry)

{

return call_int_hook(quota_on, 0, dentry);

}

int security_syslog(int type)

{

return call_int_hook(syslog, 0, type);

}

int security_settime64(const struct timespec64 *ts, const struct timezone *tz)

{

return call_int_hook(settime, 0, ts, tz);

}

int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)

{

struct security_hook_list *hp;

int cap_sys_admin = 1;

int rc;

/*

* The module will respond with a positive value if

* it thinks the __vm_enough_memory() call should be

* made with the cap_sys_admin set. If all of the modules

* agree that it should be set it will. If any module

* thinks it should not be set it won't.

*/

hlist_for_each_entry(hp, &security_hook_heads.vm_enough_memory, list) {

rc = hp->hook.vm_enough_memory(mm, pages);

if (rc <= 0) {

cap_sys_admin = 0;

break;

}

}

return __vm_enough_memory(mm, pages, cap_sys_admin);

}

int security_bprm_creds_for_exec(struct linux_binprm *bprm)

{

return call_int_hook(bprm_creds_for_exec, 0, bprm);

}

int security_bprm_creds_from_file(struct linux_binprm *bprm, struct file *file)

{

return call_int_hook(bprm_creds_from_file, 0, bprm, file);

}

int security_bprm_check(struct linux_binprm *bprm)

{

int ret;

ret = call_int_hook(bprm_check_security, 0, bprm);

if (ret)

return ret;

return ima_bprm_check(bprm);

}

void security_bprm_committing_creds(struct linux_binprm *bprm)

{

call_void_hook(bprm_committing_creds, bprm);

}

void security_bprm_committed_creds(struct linux_binprm *bprm)

{

call_void_hook(bprm_committed_creds, bprm);

}

int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc)

{

return call_int_hook(fs_context_dup, 0, fc, src_fc);

}

int security_fs_context_parse_param(struct fs_context *fc,

struct fs_parameter *param)

{

struct security_hook_list *hp;

int trc;

int rc = -ENOPARAM;

hlist_for_each_entry(hp, &security_hook_heads.fs_context_parse_param,

list) {

trc = hp->hook.fs_context_parse_param(fc, param);

if (trc == 0)

rc = 0;

else if (trc != -ENOPARAM)

return trc;

}

return rc;

}

int security_sb_alloc(struct super_block *sb)

{

int rc = lsm_superblock_alloc(sb);

if (unlikely(rc))

return rc;

rc = call_int_hook(sb_alloc_security, 0, sb);

if (unlikely(rc))

security_sb_free(sb);

return rc;

}

void security_sb_delete(struct super_block *sb)

{

call_void_hook(sb_delete, sb);

}

void security_sb_free(struct super_block *sb)

{

call_void_hook(sb_free_security, sb);

kfree(sb->s_security);

sb->s_security = NULL;

}

void security_free_mnt_opts(void **mnt_opts)

{

if (!*mnt_opts)

return;

call_void_hook(sb_free_mnt_opts, *mnt_opts);

*mnt_opts = NULL;

}

EXPORT_SYMBOL(security_free_mnt_opts);

int security_sb_eat_lsm_opts(char *options, void **mnt_opts)

{

return call_int_hook(sb_eat_lsm_opts, 0, options, mnt_opts);

}

EXPORT_SYMBOL(security_sb_eat_lsm_opts);

int security_sb_mnt_opts_compat(struct super_block *sb,

void *mnt_opts)

{

return call_int_hook(sb_mnt_opts_compat, 0, sb, mnt_opts);

}

EXPORT_SYMBOL(security_sb_mnt_opts_compat);

int security_sb_remount(struct super_block *sb,

void *mnt_opts)

{

return call_int_hook(sb_remount, 0, sb, mnt_opts);

}

EXPORT_SYMBOL(security_sb_remount);

int security_sb_kern_mount(struct super_block *sb)

{

return call_int_hook(sb_kern_mount, 0, sb);

}

int security_sb_show_options(struct seq_file *m, struct super_block *sb)

{

return call_int_hook(sb_show_options, 0, m, sb);

}

int security_sb_statfs(struct dentry *dentry)

{