The attached patch contains a back port of several LSM changes from the lsm-2.5
tree to the lsm-2.4 tree, namely:
1) Make LSM configurable (Greg, remaining hooks converted by me),
2) Allow security modules to only set the hooks that they want to use,
defaulting to the dummy hook functions otherwise (Greg),
3) Add hooks for the *xattr operations (Chris),
4) Drop the file_llseek hook (hch),
5) Rework the System V IPC hooks (me).
Two other potential candidates for back porting are removing sys_security and
removing the module hooks. However, I wasn't sure whether we wanted those
changes in the 2.4 tree yet, particularly the former. A third candidate would
be the owlsm changes. Module authors may also want to do a thorough purging of
unused hooks in both the 2.4 and 2.5 trees; I only removed file_llseek and the
System V IPC hooks from the other modules since they were affected by the above
changes and were not used by the other modules.
In addition to sys_security and the module hooks, there are a few other
differences in the 2.4 and 2.5 LSM interfaces, e.g. inode_revalidate (2.4 only),
inode_permission_lite (2.5 only at the moment, but might appear in 2.4 later),
inode_stat vs. inode_getattr (inode vs. mnt/dentry pair), nfsservctl and bdflush
(2.4 only, obsolete in 2.5), and sem_semop (2.4 only, but I plan on restoring it
to 2.5 if it is accepted into the mainline kernel).
Any objections to committing this patch to the lsm-2.4 tree?
--
Stephen Smalley, NSA
sdsat_private
===== Documentation/Configure.help 1.55 vs edited =====
--- 1.55/Documentation/Configure.help Tue Oct 15 20:26:03 2002
+++ edited/Documentation/Configure.help Tue Dec 31 11:24:40 2002
@@ -26241,6 +26241,15 @@
This is experimental code, not yet tested on many boards.
If unsure, say N.
+Different Security Model Support
+CONFIG_SECURITY
+ This allows you to choose different security modules to be
+ configured into your kernel.
+
+ If this option is not selected, the default Linux security
+ model will be used.
+
+ If you are unsure how to answer this question, answer N.
Capabilities Support
CONFIG_SECURITY_CAPABILITIES
This enables the "default" Linux capabilities functionality.
===== arch/i386/kernel/ioport.c 1.6 vs edited =====
--- 1.6/arch/i386/kernel/ioport.c Mon Jun 18 09:22:04 2001
+++ edited/arch/i386/kernel/ioport.c Tue Dec 31 11:24:41 2002
@@ -64,7 +64,7 @@
if (turn_on && !capable(CAP_SYS_RAWIO))
return -EPERM;
- retval = security_ops->ioperm(from, num, turn_on);
+ retval = security_ioperm(from, num, turn_on);
if (retval) {
return retval;
}
@@ -120,7 +120,7 @@
if (!capable(CAP_SYS_RAWIO))
return -EPERM;
}
- retval = security_ops->iopl(old, level);
+ retval = security_iopl(old, level);
if (retval) {
return retval;
}
===== arch/i386/kernel/ptrace.c 1.15 vs edited =====
--- 1.15/arch/i386/kernel/ptrace.c Wed Jul 31 23:36:50 2002
+++ edited/arch/i386/kernel/ptrace.c Tue Dec 31 11:24:42 2002
@@ -160,7 +160,7 @@
/* are we already being traced? */
if (current->ptrace & PT_PTRACED)
goto out;
- ret = security_ops->ptrace(current->p_pptr, current);
+ ret = security_ptrace(current->p_pptr, current);
if (ret)
goto out;
/* set the ptrace bit in the process flags. */
===== arch/ia64/ia32/sys_ia32.c 1.11 vs edited =====
--- 1.11/arch/ia64/ia32/sys_ia32.c Fri Mar 1 02:01:03 2002
+++ edited/arch/ia64/ia32/sys_ia32.c Tue Dec 31 11:24:43 2002
@@ -3202,7 +3202,7 @@
if (!capable(CAP_SYS_RAWIO))
return -EPERM;
}
- retval = security_ops->iopl(old,level);
+ retval = security_iopl(old,level);
if (retval) {
return retval;
}
===== arch/ia64/kernel/ptrace.c 1.11 vs edited =====
--- 1.11/arch/ia64/kernel/ptrace.c Fri Mar 1 02:01:03 2002
+++ edited/arch/ia64/kernel/ptrace.c Tue Dec 31 11:24:43 2002
@@ -1100,7 +1100,7 @@
/* are we already being traced? */
if (current->ptrace & PT_PTRACED)
goto out;
- ret = security_ops->ptrace(current->p_pptr, current);
+ ret = security_ptrace(current->p_pptr, current);
if (ret)
goto out;
current->ptrace |= PT_PTRACED;
===== drivers/char/tty_io.c 1.18 vs edited =====
--- 1.18/drivers/char/tty_io.c Tue Aug 6 12:50:46 2002
+++ edited/drivers/char/tty_io.c Tue Dec 31 11:24:44 2002
@@ -90,6 +90,7 @@
#include <linux/init.h>
#include <linux/module.h>
#include <linux/smp_lock.h>
+#include <linux/security.h>
#include <asm/uaccess.h>
#include <asm/system.h>
@@ -1467,7 +1468,7 @@
if (!waitqueue_active(&tty->read_wait))
tty->minimum_to_wake = 1;
if (filp->f_owner.pid == 0) {
- retval = security_ops->file_set_fowner(filp);
+ retval = security_file_set_fowner(filp);
if (retval)
return retval;
===== fs/attr.c 1.11 vs edited =====
--- 1.11/fs/attr.c Fri Jul 5 12:57:11 2002
+++ edited/fs/attr.c Tue Dec 31 11:24:44 2002
@@ -130,13 +130,13 @@
lock_kernel();
if (inode->i_op && inode->i_op->setattr) {
- error = security_ops->inode_setattr(dentry, attr);
+ error = security_inode_setattr(dentry, attr);
if (!error)
error = inode->i_op->setattr(dentry, attr);
} else {
error = inode_change_ok(inode, attr);
if (!error)
- error = security_ops->inode_setattr(dentry, attr);
+ error = security_inode_setattr(dentry, attr);
if (!error) {
if ((ia_valid & ATTR_UID && attr->ia_uid != inode->i_uid) ||
(ia_valid & ATTR_GID && attr->ia_gid != inode->i_gid))
===== fs/buffer.c 1.31 vs edited =====
--- 1.31/fs/buffer.c Mon Nov 25 15:56:33 2002
+++ edited/fs/buffer.c Tue Dec 31 11:24:46 2002
@@ -47,6 +47,7 @@
#include <linux/highmem.h>
#include <linux/module.h>
#include <linux/completion.h>
+#include <linux/security.h>
#include <asm/uaccess.h>
#include <asm/io.h>
@@ -2869,7 +2870,7 @@
if (!capable(CAP_SYS_ADMIN))
return -EPERM;
- error = security_ops->bdflush(func, data);
+ error = security_bdflush(func, data);
if( error )
return error;
===== fs/dnotify.c 1.9 vs edited =====
--- 1.9/fs/dnotify.c Wed Aug 28 16:23:17 2002
+++ edited/fs/dnotify.c Tue Dec 31 11:24:47 2002
@@ -19,6 +19,7 @@
#include <linux/init.h>
#include <linux/spinlock.h>
#include <linux/slab.h>
+#include <linux/security.h>
extern void send_sigio(struct fown_struct *fown, int fd, int band);
@@ -94,7 +95,7 @@
prev = &odn->dn_next;
}
- error = security_ops->file_set_fowner(filp);
+ error = security_file_set_fowner(filp);
if (error)
goto out_free;
===== fs/dquot.c 1.13 vs edited =====
--- 1.13/fs/dquot.c Mon Jun 10 17:41:19 2002
+++ edited/fs/dquot.c Tue Dec 31 11:24:47 2002
@@ -1340,7 +1340,7 @@
error = -EIO;
if (!f->f_op || !f->f_op->read || !f->f_op->write)
goto out_f;
- error = security_ops->quota_on(f);
+ error = security_quota_on(f);
if (error)
goto out_f;
inode = f->f_dentry->d_inode;
@@ -1437,7 +1437,7 @@
goto out;
}
- ret = security_ops->quotactl (cmds, type, id, sb);
+ ret = security_quotactl (cmds, type, id, sb);
if (ret)
goto out;
===== fs/exec.c 1.29 vs edited =====
--- 1.29/fs/exec.c Thu Aug 29 15:41:47 2002
+++ edited/fs/exec.c Tue Dec 31 11:24:48 2002
@@ -35,6 +35,7 @@
#include <linux/highmem.h>
#include <linux/spinlock.h>
#include <linux/personality.h>
+#include <linux/security.h>
#define __NO_VERSION__
#include <linux/module.h>
@@ -661,7 +662,7 @@
}
/* fill in binprm security blob */
- retval = security_ops->bprm_set_security(bprm);
+ retval = security_bprm_set(bprm);
if (retval)
return retval;
@@ -710,7 +711,7 @@
if(do_unlock)
unlock_kernel();
- security_ops->bprm_compute_creds(bprm);
+ security_bprm_compute_creds(bprm);
}
@@ -780,7 +781,7 @@
}
}
#endif
- retval = security_ops->bprm_check_security(bprm);
+ retval = security_bprm_check(bprm);
if (retval)
return retval;
@@ -873,7 +874,7 @@
return bprm.envc;
}
- retval = security_ops->bprm_alloc_security(&bprm);
+ retval = security_bprm_alloc(&bprm);
if (retval)
goto out;
@@ -897,7 +898,7 @@
retval = search_binary_handler(&bprm,regs);
if (retval >= 0) {
/* execve success */
- security_ops->bprm_free_security(&bprm);
+ security_bprm_free(&bprm);
return retval;
}
@@ -914,7 +915,7 @@
}
if (bprm.security)
- security_ops->bprm_free_security(&bprm);
+ security_bprm_free(&bprm);
return retval;
}
===== fs/fcntl.c 1.11 vs edited =====
--- 1.11/fs/fcntl.c Wed Aug 28 16:23:17 2002
+++ edited/fs/fcntl.c Tue Dec 31 11:24:48 2002
@@ -298,7 +298,7 @@
case F_SETOWN:
lock_kernel();
- err = security_ops->file_set_fowner(filp);
+ err = security_file_set_fowner(filp);
if (err) {
unlock_kernel();
break;
@@ -352,7 +352,7 @@
if (!filp)
goto out;
- err = security_ops->file_fcntl(filp, cmd, arg);
+ err = security_file_fcntl(filp, cmd, arg);
if (err) {
fput(filp);
return err;
@@ -376,7 +376,7 @@
if (!filp)
goto out;
- err = security_ops->file_fcntl(filp, cmd, arg);
+ err = security_file_fcntl(filp, cmd, arg);
if (err) {
fput(filp);
return err;
@@ -422,7 +422,7 @@
(fown->uid ^ p->suid) && (fown->uid ^ p->uid))
return;
- if (security_ops->file_send_sigiotask(p, fown, fd, reason))
+ if (security_file_send_sigiotask(p, fown, fd, reason))
return;
switch (fown->signum) {
===== fs/file_table.c 1.13 vs edited =====
--- 1.13/fs/file_table.c Fri Nov 15 10:35:22 2002
+++ edited/fs/file_table.c Tue Dec 31 11:24:48 2002
@@ -43,7 +43,7 @@
files_stat.nr_free_files--;
new_one:
memset(f, 0, sizeof(*f));
- if (security_ops->file_alloc_security(f)) {
+ if (security_file_alloc(f)) {
list_add(&f->f_list, &free_list);
files_stat.nr_free_files++;
file_list_unlock();
@@ -99,12 +99,12 @@
filp->f_uid = current->fsuid;
filp->f_gid = current->fsgid;
filp->f_op = dentry->d_inode->i_fop;
- error = security_ops->file_alloc_security(filp);
+ error = security_file_alloc(filp);
if (!error)
if (filp->f_op->open) {
error = filp->f_op->open(dentry->d_inode, filp);
if (error)
- security_ops->file_free_security(filp);
+ security_file_free(filp);
}
return error;
}
@@ -115,7 +115,7 @@
if (file->f_op && file->f_op->release)
file->f_op->release(inode, file);
- security_ops->file_free_security(file);
+ security_file_free(file);
}
void fput(struct file * file)
@@ -132,7 +132,7 @@
if (file->f_op && file->f_op->release)
file->f_op->release(inode, file);
- security_ops->file_free_security (file);
+ security_file_free (file);
fops_put(file->f_op);
if (file->f_mode & FMODE_WRITE)
@@ -167,7 +167,7 @@
void put_filp(struct file *file)
{
if(atomic_dec_and_test(&file->f_count)) {
- security_ops->file_free_security(file);
+ security_file_free(file);
file_list_lock();
list_del(&file->f_list);
list_add(&file->f_list, &free_list);
===== fs/inode.c 1.24 vs edited =====
--- 1.24/fs/inode.c Tue Jul 16 19:43:03 2002
+++ edited/fs/inode.c Tue Dec 31 11:24:49 2002
@@ -84,7 +84,7 @@
if (!inode)
return NULL;
inode->i_security = NULL;
- if (security_ops->inode_alloc_security(inode)) {
+ if (security_inode_alloc(inode)) {
kmem_cache_free(inode_cachep, (inode));
return NULL;
}
@@ -95,7 +95,7 @@
{
if (inode_has_buffers(inode))
BUG();
- security_ops->inode_free_security(inode);
+ security_inode_free(inode);
kmem_cache_free(inode_cachep, (inode));
}
@@ -1068,7 +1068,7 @@
if (inode->i_data.nrpages)
truncate_inode_pages(&inode->i_data, 0);
- security_ops->inode_delete(inode);
+ security_inode_delete(inode);
if (op && op->delete_inode) {
void (*delete)(struct inode *) = op->delete_inode;
===== fs/ioctl.c 1.4 vs edited =====
--- 1.4/fs/ioctl.c Fri Jul 5 12:57:11 2002
+++ edited/fs/ioctl.c Tue Dec 31 11:24:49 2002
@@ -59,7 +59,7 @@
error = 0;
/* Call the Linux Security Module to perform its checks. */
- error = security_ops->file_ioctl(filp, cmd, arg);
+ error = security_file_ioctl(filp, cmd, arg);
if (error) {
fput(filp);
goto out;
===== fs/locks.c 1.14 vs edited =====
--- 1.14/fs/locks.c Wed Aug 28 16:26:25 2002
+++ edited/fs/locks.c Tue Dec 31 11:24:49 2002
@@ -122,6 +122,7 @@
#include <linux/capability.h>
#include <linux/sched.h>
#include <linux/timer.h>
+#include <linux/security.h>
#include <asm/semaphore.h>
#include <asm/uaccess.h>
@@ -1275,7 +1276,7 @@
return -EACCES;
if (!S_ISREG(inode->i_mode))
return -EINVAL;
- error = security_ops->file_lock(filp, arg);
+ error = security_file_lock(filp, arg);
if (error)
return error;
@@ -1346,7 +1347,7 @@
*before = fl;
list_add(&fl->fl_link, &file_lock_list);
- error = security_ops->file_set_fowner(filp);
+ error = security_file_set_fowner(filp);
if (error)
goto out_unlock;
@@ -1400,7 +1401,7 @@
&& !(filp->f_mode & 3))
goto out_putf;
- error = security_ops->file_lock(filp, type);
+ error = security_file_lock(filp, type);
if (error)
goto out_putf;
@@ -1550,7 +1551,7 @@
goto out;
}
- error = security_ops->file_lock(filp, file_lock->fl_type);
+ error = security_file_lock(filp, file_lock->fl_type);
if (error)
goto out;
@@ -1677,7 +1678,7 @@
goto out;
}
- error = security_ops->file_lock(filp, file_lock->fl_type);
+ error = security_file_lock(filp, file_lock->fl_type);
if (error)
goto out;
===== fs/namei.c 1.27 vs edited =====
--- 1.27/fs/namei.c Thu Aug 29 15:41:47 2002
+++ edited/fs/namei.c Tue Dec 31 11:24:50 2002
@@ -215,7 +215,7 @@
if (retval)
return retval;
- return security_ops->inode_permission(inode, mask);
+ return security_inode_permission(inode, mask);
}
/*
@@ -316,7 +316,7 @@
dput(dentry);
else {
result = dentry;
- security_ops->inode_post_lookup(dir, result);
+ security_inode_post_lookup(dir, result);
}
}
up(&dir->i_sem);
@@ -355,7 +355,7 @@
current->state = TASK_RUNNING;
schedule();
}
- err = security_ops->inode_follow_link(dentry, nd);
+ err = security_inode_follow_link(dentry, nd);
if (err)
goto loop;
current->link_count++;
@@ -816,7 +816,7 @@
unlock_kernel();
if (!dentry) {
dentry = new;
- security_ops->inode_post_lookup(inode, dentry);
+ security_inode_post_lookup(inode, dentry);
} else
dput(new);
}
@@ -987,7 +987,7 @@
if (!dir->i_op || !dir->i_op->create)
goto exit_lock;
- error = security_ops->inode_create(dir, dentry, mode);
+ error = security_inode_create(dir, dentry, mode);
if (error)
goto exit_lock;
@@ -999,7 +999,7 @@
up(&dir->i_zombie);
if (!error) {
inode_dir_notify(dir, DN_CREATE);
- security_ops->inode_post_create(dir, dentry, mode);
+ security_inode_post_create(dir, dentry, mode);
}
return error;
}
@@ -1209,7 +1209,7 @@
* stored in nd->last.name and we will have to putname() it when we
* are done. Procfs-like symlinks just set LAST_BIND.
*/
- error = security_ops->inode_follow_link(dentry, nd);
+ error = security_inode_follow_link(dentry, nd);
if (error)
goto exit_dput;
UPDATE_ATIME(dentry->d_inode);
@@ -1278,7 +1278,7 @@
if (!dir->i_op || !dir->i_op->mknod)
goto exit_lock;
- error = security_ops->inode_mknod(dir, dentry, mode, dev);
+ error = security_inode_mknod(dir, dentry, mode, dev);
if (error)
goto exit_lock;
@@ -1290,7 +1290,7 @@
up(&dir->i_zombie);
if (!error) {
inode_dir_notify(dir, DN_CREATE);
- security_ops->inode_post_mknod(dir, dentry, mode, dev);
+ security_inode_post_mknod(dir, dentry, mode, dev);
}
return error;
}
@@ -1353,7 +1353,7 @@
goto exit_lock;
mode &= (S_IRWXUGO|S_ISVTX);
- error = security_ops->inode_mkdir(dir, dentry, mode);
+ error = security_inode_mkdir(dir, dentry, mode);
if (error)
goto exit_lock;
@@ -1366,7 +1366,7 @@
up(&dir->i_zombie);
if (!error) {
inode_dir_notify(dir, DN_CREATE);
- security_ops->inode_post_mkdir(dir,dentry, mode);
+ security_inode_post_mkdir(dir,dentry, mode);
}
return error;
}
@@ -1451,7 +1451,7 @@
if (d_mountpoint(dentry))
error = -EBUSY;
else {
- error = security_ops->inode_rmdir(dir, dentry);
+ error = security_inode_rmdir(dir, dentry);
if (!error) {
lock_kernel();
error = dir->i_op->rmdir(dir, dentry);
@@ -1524,7 +1524,7 @@
if (d_mountpoint(dentry))
error = -EBUSY;
else {
- error = security_ops->inode_unlink(dir, dentry);
+ error = security_inode_unlink(dir, dentry);
if (!error) {
lock_kernel();
error = dir->i_op->unlink(dir, dentry);
@@ -1596,7 +1596,7 @@
if (!dir->i_op || !dir->i_op->symlink)
goto exit_lock;
- error = security_ops->inode_symlink(dir, dentry, oldname);
+ error = security_inode_symlink(dir, dentry, oldname);
if (error)
goto exit_lock;
@@ -1609,7 +1609,7 @@
up(&dir->i_zombie);
if (!error) {
inode_dir_notify(dir, DN_CREATE);
- security_ops->inode_post_symlink(dir, dentry, oldname);
+ security_inode_post_symlink(dir, dentry, oldname);
}
return error;
}
@@ -1675,7 +1675,7 @@
if (!dir->i_op || !dir->i_op->link)
goto exit_lock;
- error = security_ops->inode_link(old_dentry, dir, new_dentry);
+ error = security_inode_link(old_dentry, dir, new_dentry);
if (error)
goto exit_lock;
@@ -1688,7 +1688,7 @@
up(&dir->i_zombie);
if (!error) {
inode_dir_notify(dir, DN_CREATE);
- security_ops->inode_post_link(old_dentry, dir, new_dentry);
+ security_inode_post_link(old_dentry, dir, new_dentry);
}
return error;
}
@@ -1801,7 +1801,7 @@
if (error)
return error;
- error = security_ops->inode_rename(old_dir, old_dentry, new_dir, new_dentry);
+ error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
if (error)
return error;
@@ -1843,7 +1843,7 @@
if (!error) {
d_move(old_dentry,new_dentry);
- security_ops->inode_post_rename(old_dir, old_dentry,
+ security_inode_post_rename(old_dir, old_dentry,
new_dir, new_dentry);
}
out_unlock:
@@ -1876,7 +1876,7 @@
if (!old_dir->i_op || !old_dir->i_op->rename)
return -EPERM;
- error = security_ops->inode_rename(old_dir, old_dentry, new_dir, new_dentry);
+ error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
if (error)
return error;
@@ -1894,7 +1894,7 @@
if (!(old_dir->i_sb->s_type->fs_flags & FS_ODD_RENAME)) {
d_move(old_dentry, new_dentry);
}
- security_ops->inode_post_rename(old_dir, old_dentry, new_dir, new_dentry);
+ security_inode_post_rename(old_dir, old_dentry, new_dir, new_dentry);
return 0;
}
===== fs/namespace.c 1.17 vs edited =====
--- 1.17/fs/namespace.c Thu Aug 29 15:41:47 2002
+++ edited/fs/namespace.c Tue Dec 31 11:24:50 2002
@@ -15,6 +15,7 @@
#include <linux/quotaops.h>
#include <linux/acct.h>
#include <linux/module.h>
+#include <linux/security.h>
#include <asm/uaccess.h>
@@ -288,7 +289,7 @@
struct super_block * sb = mnt->mnt_sb;
int retval = 0;
- retval = security_ops->sb_umount(mnt, flags);
+ retval = security_sb_umount(mnt, flags);
if (retval)
return retval;
@@ -341,7 +342,7 @@
DQUOT_OFF(sb);
acct_auto_close(sb->s_dev);
unlock_kernel();
- security_ops->sb_umount_close(mnt);
+ security_sb_umount_close(mnt);
spin_lock(&dcache_lock);
}
retval = -EBUSY;
@@ -352,7 +353,7 @@
}
spin_unlock(&dcache_lock);
if (retval)
- security_ops->sb_umount_busy(mnt);
+ security_sb_umount_busy(mnt);
up_write(¤t->namespace->sem);
return retval;
}
@@ -470,7 +471,7 @@
if (IS_DEADDIR(nd->dentry->d_inode))
goto out_unlock;
- err = security_ops->sb_check_sb(mnt, nd);
+ err = security_sb_check_sb(mnt, nd);
if (err)
goto out_unlock;
@@ -487,7 +488,7 @@
out_unlock:
up(&nd->dentry->d_inode->i_zombie);
if (!err)
- security_ops->sb_post_addmount(mnt, nd);
+ security_sb_post_addmount(mnt, nd);
return err;
}
@@ -558,7 +559,7 @@
nd->mnt->mnt_flags=mnt_flags;
up_write(&sb->s_umount);
if (!err)
- security_ops->sb_post_remount(nd->mnt, flags, data);
+ security_sb_post_remount(nd->mnt, flags, data);
return err;
}
@@ -741,7 +742,7 @@
if (retval)
return retval;
- retval = security_ops->sb_mount(dev_name, &nd, type_page, flags, data_page);
+ retval = security_sb_mount(dev_name, &nd, type_page, flags, data_page);
if (retval)
goto dput_out;
@@ -939,7 +940,7 @@
if (error)
goto out1;
- error = security_ops->sb_pivotroot(&old_nd, &new_nd);
+ error = security_sb_pivotroot(&old_nd, &new_nd);
if (error) {
path_release(&old_nd);
goto out1;
@@ -989,7 +990,7 @@
attach_mnt(new_nd.mnt, &root_parent);
spin_unlock(&dcache_lock);
chroot_fs_refs(&user_nd, &new_nd);
- security_ops->sb_post_pivotroot(&user_nd, &new_nd);
+ security_sb_post_pivotroot(&user_nd, &new_nd);
error = 0;
path_release(&root_parent);
path_release(&parent_nd);
===== fs/open.c 1.19 vs edited =====
--- 1.19/fs/open.c Thu Aug 29 15:41:47 2002
+++ edited/fs/open.c Tue Dec 31 11:24:50 2002
@@ -29,7 +29,7 @@
retval = -ENOSYS;
if (sb->s_op && sb->s_op->statfs) {
memset(buf, 0, sizeof(struct statfs));
- retval = security_ops->sb_statfs(sb);
+ retval = security_sb_statfs(sb);
if (retval)
return retval;
lock_kernel();
===== fs/read_write.c 1.13 vs edited =====
--- 1.13/fs/read_write.c Tue Jul 16 19:43:03 2002
+++ edited/fs/read_write.c Tue Dec 31 11:24:50 2002
@@ -116,12 +116,6 @@
if (!file)
goto bad;
- retval = security_ops->file_llseek(file);
- if (retval) {
- fput(file);
- goto bad;
- }
-
retval = -EINVAL;
if (origin <= 2) {
loff_t res = llseek(file, offset, origin);
@@ -148,10 +142,6 @@
if (!file)
goto bad;
- retval = security_ops->file_llseek(file);
- if (retval)
- goto out_putf;
-
retval = -EINVAL;
if (origin > 2)
goto out_putf;
@@ -187,7 +177,7 @@
ssize_t (*read)(struct file *, char *, size_t, loff_t *);
ret = -EINVAL;
if (file->f_op && (read = file->f_op->read) != NULL) {
- ret = security_ops->file_permission (file, MAY_READ);
+ ret = security_file_permission (file, MAY_READ);
if (!ret)
ret = read(file, buf, count, &file->f_pos);
}
@@ -216,7 +206,7 @@
ssize_t (*write)(struct file *, const char *, size_t, loff_t *);
ret = -EINVAL;
if (file->f_op && (write = file->f_op->write) != NULL) {
- ret = security_ops->file_permission (file, MAY_WRITE);
+ ret = security_file_permission (file, MAY_WRITE);
if (!ret)
ret = write(file, buf, count, &file->f_pos);
}
@@ -351,7 +341,7 @@
goto bad_file;
if (file->f_op && (file->f_mode & FMODE_READ) &&
(file->f_op->readv || file->f_op->read)) {
- ret = security_ops->file_permission (file, MAY_READ);
+ ret = security_file_permission (file, MAY_READ);
if (!ret)
ret = do_readv_writev(VERIFY_WRITE, file, vector, count);
}
@@ -374,7 +364,7 @@
goto bad_file;
if (file->f_op && (file->f_mode & FMODE_WRITE) &&
(file->f_op->writev || file->f_op->write)) {
- ret = security_ops->file_permission (file, MAY_WRITE);
+ ret = security_file_permission (file, MAY_WRITE);
if (!ret)
ret = do_readv_writev(VERIFY_READ, file, vector, count);
}
@@ -411,7 +401,7 @@
if (pos < 0)
goto out;
- ret = security_ops->file_permission (file, MAY_READ);
+ ret = security_file_permission (file, MAY_READ);
if (ret)
goto out;
@@ -447,7 +437,7 @@
if (pos < 0)
goto out;
- ret = security_ops->file_permission (file, MAY_WRITE);
+ ret = security_file_permission (file, MAY_WRITE);
if (ret)
goto out;
===== fs/readdir.c 1.5 vs edited =====
--- 1.5/fs/readdir.c Tue Jul 16 21:25:34 2002
+++ edited/fs/readdir.c Tue Dec 31 11:24:51 2002
@@ -10,6 +10,7 @@
#include <linux/stat.h>
#include <linux/file.h>
#include <linux/smp_lock.h>
+#include <linux/security.h>
#include <asm/uaccess.h>
@@ -20,7 +21,7 @@
if (!file->f_op || !file->f_op->readdir)
goto out;
- res = security_ops->file_permission(file, MAY_READ);
+ res = security_file_permission(file, MAY_READ);
if (res)
goto out;
===== fs/stat.c 1.7 vs edited =====
--- 1.7/fs/stat.c Fri Jul 5 12:57:12 2002
+++ edited/fs/stat.c Tue Dec 31 11:24:51 2002
@@ -23,7 +23,7 @@
int error;
struct inode * inode = dentry->d_inode;
if (inode->i_op && inode->i_op->revalidate) {
- error = security_ops->inode_revalidate(dentry);
+ error = security_inode_revalidate(dentry);
if (error)
return error;
return inode->i_op->revalidate(dentry);
@@ -44,7 +44,7 @@
struct __old_kernel_stat tmp;
int retval;
- retval = security_ops->inode_stat(inode);
+ retval = security_inode_stat(inode);
if (retval)
return retval;
@@ -83,7 +83,7 @@
unsigned int blocks, indirect;
int retval;
- retval = security_ops->inode_stat(inode);
+ retval = security_inode_stat(inode);
if (retval)
return retval;
@@ -274,7 +274,7 @@
error = -EINVAL;
if (inode->i_op && inode->i_op->readlink &&
!(error = do_revalidate(nd.dentry))) {
- error = security_ops->inode_readlink(nd.dentry);
+ error = security_inode_readlink(nd.dentry);
if (!error) {
UPDATE_ATIME(inode);
error = inode->i_op->readlink(nd.dentry, buf, bufsiz);
@@ -295,7 +295,7 @@
unsigned int blocks, indirect;
int retval;
- retval = security_ops->inode_stat(inode);
+ retval = security_inode_stat(inode);
if (retval)
return retval;
===== fs/super.c 1.52 vs edited =====
--- 1.52/fs/super.c Wed Sep 25 15:09:31 2002
+++ edited/fs/super.c Tue Dec 31 11:24:51 2002
@@ -266,7 +266,7 @@
struct super_block *s = kmalloc(sizeof(struct super_block), GFP_USER);
if (s) {
memset(s, 0, sizeof(struct super_block));
- if (security_ops->sb_alloc_security(s)) {
+ if (security_sb_alloc(s)) {
kfree(s);
s = NULL;
goto out;
@@ -298,7 +298,7 @@
*/
static inline void destroy_super(struct super_block *s)
{
- security_ops->sb_free_security(s);
+ security_sb_free(s);
kfree(s);
}
@@ -812,7 +812,7 @@
goto out_mnt;
if (type->fs_flags & FS_NOMOUNT)
sb->s_flags |= MS_NOUSER;
- error = security_ops->sb_kern_mount(sb);
+ error = security_sb_kern_mount(sb);
if (error) {
up_write(&sb->s_umount);
kill_super(sb);
===== fs/xattr.c 1.1 vs edited =====
--- 1.1/fs/xattr.c Tue Sep 10 16:07:41 2002
+++ edited/fs/xattr.c Tue Dec 31 11:51:30 2002
@@ -12,6 +12,7 @@
#include <linux/smp_lock.h>
#include <linux/file.h>
#include <linux/xattr.h>
+#include <linux/security.h>
#include <asm/uaccess.h>
/*
@@ -84,6 +85,9 @@
error = -EOPNOTSUPP;
if (d->d_inode->i_op && d->d_inode->i_op->setxattr) {
+ error = security_inode_setxattr(d, kname, kvalue, size, flags);
+ if (error)
+ goto out;
down(&d->d_inode->i_sem);
lock_kernel();
error = d->d_inode->i_op->setxattr(d, kname, kvalue, size, flags);
@@ -91,6 +95,7 @@
up(&d->d_inode->i_sem);
}
+out:
xattr_free(kvalue, size);
return error;
}
@@ -159,6 +164,9 @@
error = -EOPNOTSUPP;
if (d->d_inode->i_op && d->d_inode->i_op->getxattr) {
+ error = security_inode_getxattr(d, kname);
+ if (error)
+ goto out;
down(&d->d_inode->i_sem);
lock_kernel();
error = d->d_inode->i_op->getxattr(d, kname, kvalue, size);
@@ -169,6 +177,7 @@
if (kvalue && error > 0)
if (copy_to_user(value, kvalue, error))
error = -EFAULT;
+out:
xattr_free(kvalue, size);
return error;
}
@@ -230,6 +239,9 @@
error = -EOPNOTSUPP;
if (d->d_inode->i_op && d->d_inode->i_op->listxattr) {
+ error = security_inode_listxattr(d);
+ if (error)
+ goto out;
down(&d->d_inode->i_sem);
lock_kernel();
error = d->d_inode->i_op->listxattr(d, klist, size);
@@ -240,6 +252,7 @@
if (klist && error > 0)
if (copy_to_user(list, klist, error))
error = -EFAULT;
+out:
xattr_free(klist, size);
return error;
}
@@ -303,12 +316,16 @@
error = -EOPNOTSUPP;
if (d->d_inode->i_op && d->d_inode->i_op->removexattr) {
+ error = security_inode_removexattr(d, kname);
+ if (error)
+ goto out;
down(&d->d_inode->i_sem);
lock_kernel();
error = d->d_inode->i_op->removexattr(d, kname);
unlock_kernel();
up(&d->d_inode->i_sem);
}
+out:
return error;
}
===== fs/nfsd/nfsctl.c 1.8 vs edited =====
--- 1.8/fs/nfsd/nfsctl.c Mon Jun 10 17:41:19 2002
+++ edited/fs/nfsd/nfsctl.c Tue Dec 31 11:24:51 2002
@@ -21,6 +21,7 @@
#include <linux/slab.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
+#include <linux/security.h>
#include <linux/nfs.h>
#include <linux/sunrpc/svc.h>
@@ -251,7 +252,7 @@
goto done;
}
- err = security_ops->nfsservctl(cmd, arg);
+ err = security_nfsservctl(cmd, arg);
if (err)
goto done;
===== fs/proc/base.c 1.10 vs edited =====
--- 1.10/fs/proc/base.c Thu Jun 6 00:07:08 2002
+++ edited/fs/proc/base.c Tue Dec 31 11:24:52 2002
@@ -25,6 +25,7 @@
#include <linux/string.h>
#include <linux/seq_file.h>
#include <linux/namespace.h>
+#include <linux/security.h>
/*
* For hysterical raisins we keep the same inumbers as in the old procfs.
@@ -329,7 +330,7 @@
};
#define MAY_PTRACE(p) \
-(p==current||(p->p_pptr==current&&(p->ptrace & PT_PTRACED)&&p->state==TASK_STOPPED&&security_ops->ptrace(current,p)==0))
+(p==current||(p->p_pptr==current&&(p->ptrace & PT_PTRACED)&&p->state==TASK_STOPPED&&security_ptrace(current,p)==0))
static int mem_open(struct inode* inode, struct file* file)
===== include/linux/sched.h 1.22 vs edited =====
--- 1.22/include/linux/sched.h Tue Aug 13 17:47:04 2002
+++ edited/include/linux/sched.h Tue Dec 31 11:45:53 2002
@@ -740,23 +740,19 @@
* New privilege checks should use this interface, rather than suser() or
* fsuser(). See include/linux/capability.h for defined capabilities.
*/
-/* capable prototype and code moved to security.[hc] */
-#include <linux/security.h>
-#if 0
+#ifdef CONFIG_SECURITY
+/* code is in security.c */
+extern int capable(int cap);
+#else
static inline int capable(int cap)
{
-#if 1 /* ok now */
- if (cap_raised(current->cap_effective, cap))
-#else
- if (cap_is_fs_cap(cap) ? current->fsuid == 0 : current->euid == 0)
-#endif
- {
+ if (cap_raised(current->cap_effective, cap)) {
current->flags |= PF_SUPERPRIV;
return 1;
}
return 0;
}
-#endif /* if 0 */
+#endif
/*
* Routines for handling mm_structs
===== include/linux/security.h 1.132 vs edited =====
--- 1.132/include/linux/security.h Mon Oct 21 09:25:19 2002
+++ edited/include/linux/security.h Tue Dec 31 11:45:53 2002
@@ -23,8 +23,6 @@
#ifndef __LINUX_SECURITY_H
#define __LINUX_SECURITY_H
-#ifdef __KERNEL__
-
#include <linux/fs.h>
#include <linux/binfmts.h>
#include <linux/signal.h>
@@ -34,6 +32,27 @@
#include <linux/shm.h>
#include <linux/msg.h>
#include <linux/time.h>
+#include <linux/sched.h>
+
+/*
+ * These functions are in security/capability.c and are used
+ * as the default capabilities functions
+ */
+extern int cap_capable (struct task_struct *tsk, int cap);
+struct sk_buff;
+extern int cap_netlink_send (struct sk_buff *skb);
+extern int cap_netlink_recv (struct sk_buff *skb);
+extern int cap_ip_decode_options (struct sk_buff *skb, const char *optptr,
+ unsigned char **pp_ptr);
+extern int cap_ptrace (struct task_struct *parent, struct task_struct *child);
+extern int cap_capget (struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);
+extern int cap_capset_check (struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);
+extern void cap_capset_set (struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);
+extern int cap_bprm_set_security (struct linux_binprm *bprm);
+extern void cap_bprm_compute_creds (struct linux_binprm *bprm);
+extern int cap_task_post_setuid (uid_t old_ruid, uid_t old_euid, uid_t old_suid, int flags);
+extern void cap_task_kmod_set_label (void);
+extern void cap_task_reparent_to_init (struct task_struct *p);
/*
* Values used in the task_security_ops calls
@@ -51,13 +70,18 @@
#define LSM_SETID_FS 8
/* forward declares to avoid warnings */
-struct sk_buff;
+struct socket;
+struct sock;
+struct sockaddr;
+struct msghdr;
struct net_device;
struct nfsctl_arg;
struct sched_param;
struct swap_info_struct;
struct open_request;
+#ifdef CONFIG_SECURITY
+
/**
* struct security_operations - main security structure
* Security hooks for program execution operations.
@@ -328,6 +352,22 @@
* with no hard links has its use count drop to zero). A security module
* can use this hook to release any persistent label associated with the
* inode.
+ * @inode_setxattr:
+ * Check permission before setting the extended attributes
+ * @value identified by @name for @dentry.
+ * Return 0 if permission is granted.
+ * @inode_getxattr:
+ * Check permission before obtaining the extended attributes
+ * identified by @name for @dentry.
+ * Return 0 if permission is granted.
+ * @inode_listxattr:
+ * Check permission before obtaining the list of extended attribute
+ * names for @dentry.
+ * Return 0 if permission is granted.
+ * @inode_removexattr:
+ * Check permission before removing the extended attribute
+ * identified by @name for @dentry.
+ * Return 0 if permission is granted.
*
* Security hooks for file operations
*
@@ -357,10 +397,6 @@
* @file_free_security:
* Deallocate and free any security structures stored in file->f_security.
* @file contains the file structure being modified.
- * @file_llseek:
- * Check permission before re-positioning the file offset in @file.
- * @file contains the file structure being modified.
- * Return 0 if permission is granted.
* @file_ioctl:
* @file contains the file structure.
* @cmd contains the operation to perform.
@@ -650,15 +686,15 @@
* @how contains the flag indicating how future sends and receives are handled.
* Return 0 if permission is granted.
* @socket_sock_alloc_security:
- * @sk contains the sock structure.
+ * @sk contains the sock structure.
* @gfp_mask contains the kernel allocation gfp_mask value.
- * Allocate and attach a security structure to @sk->security. The
- * security field is initialized to NULL when the sock structure is
- * allocated.
- * Return 0 if operation was successful.
+ * Allocate and attach a security structure to @sk->security. The
+ * security field is initialized to NULL when the sock structure is
+ * allocated.
+ * Return 0 if operation was successful.
* @socket_sock_free_security:
- * @sk contains the sock structure.
- * Deallocate and clear the sk->security field.
+ * @sk contains the sock structure.
+ * Deallocate and clear the sk->security field.
* @socket_sock_rcv_skb:
* Check permissions on incoming network packets. This hook is distinct
* from the network input hooks of ip_security_ops since it is the first
@@ -677,21 +713,21 @@
* req->security field is initialized to NULL when the structure is
* allocated.
* @req Pointer to the open_request structure.
- * Return 0 if successful, or -ENOMEM on out of memory condition.
+ * Return 0 if successful, or -ENOMEM on out of memory condition.
* @open_request_free_security:
* Free the security blob for an open_request structure.
* @req Pointer to the open_request structure.
* @tcp_connection_request:
- * A new connection is being requested on a server. This hook allows
+ * A new connection is being requested on a server. This hook allows
* security information to be attached to the new connection request.
* @sk contains the listening sock.
- * @skb contains the incoming network packet.
+ * @skb contains the incoming network packet.
* @req contains the open_request structure.
* @tcp_synack:
* A TCP SYN-ACK packet is being sent out, the second part of the TCP
* three-way handshake for a new connection.
* @sk contains the listening sock.
- * @skb contains the outgoing network packet.
+ * @skb contains the outgoing network packet.
* @req contains the open_request structure.
* @tcp_create_openreq_child:
* A new connection is being established on a TCP sock. This hook allows
@@ -828,14 +864,6 @@
* @ipcp contains the IPC permission set
* @flag contains the desired (requested) permission set
* Return 0 if permission is granted.
- * @ipc_getinfo:
- * Check permission to retrieve information on previously allocated IPC
- * resources. Called by the IPC resource control syscalls, shmctl,
- * msgctl, semctl with a @cmd argument of: IPC_INFO, SEM_INFO, MSG_INFO,
- * or SHM_INFO as appropriate.
- * @id contains the resource identifier
- * @cmd contains the operation to be performed
- * Return 0 if permission is granted.
*
* Security hooks for individual messages held in System V IPC message queues
* @msg_msg_alloc_security:
@@ -866,31 +894,27 @@
* message queue identifier for an existing message queue, not when a
* new message queue is created.
* @msq contains the message queue to act upon.
- * @msqid contains the resource identifier.
* @msqflg contains the operation control flags.
* Return 0 if permission is granted.
* @msg_queue_msgctl:
* Check permission when a message control operation specified by @cmd
- * is to be performed on the message queue @msq, with identifier
- * @msqid.
- * @msq contains the message queue to act upon.
- * @msqid contains the resource identifier.
+ * is to be performed on the message queue @msq.
+ * The @msq may be NULL, e.g. for IPC_INFO or MSG_INFO.
+ * @msq contains the message queue to act upon. May be NULL.
* @cmd contains the operation to be performed.
* Return 0 if permission is granted.
* @msg_queue_msgsnd:
* Check permission before a message, @msg, is enqueued on the message
- * queue, @msq, whose identifier is specified by the value of @msqid.
+ * queue, @msq.
* @msq contains the message queue to send message to.
* @msg contains the message to be enqueued.
- * @msqid contains resource identifier.
* @msqflg contains operational flags.
* Return 0 if permission is granted.
* @msg_queue_msgrcv:
* Check permission before a message, @msg, is removed from the message
- * queue, @msq, whose identifier is specified by the value of @msqid. The
- * @target task structure contains a pointer to the process that will be
- * receiving the message (not equal to the current process when inline
- * receives are being performed).
+ * queue, @msq. The @target task structure contains a pointer to the
+ * process that will be receiving the message (not equal to the current
+ * process when inline receives are being performed).
* @msq contains the message queue to retrieve message from.
* @msg contains the message destination.
* @target contains the task structure for recipient process.
@@ -915,23 +939,20 @@
* memory region identifier for an existing region, not when a new shared
* memory region is created.
* @shp contains the shared memory structure to be modified.
- * @shmid contains the resource identifier.
* @shmflg contains the operation control flags.
* Return 0 if permission is granted.
* @shm_shmctl:
* Check permission when a shared memory control operation specified by
- * @cmd is to be performed on the shared memory region @shp, with
- * identifier @shmid.
+ * @cmd is to be performed on the shared memory region @shp.
+ * The @shp may be NULL, e.g. for IPC_INFO or SHM_INFO.
* @shp contains shared memory structure to be modified.
- * @shmid contains the resource identifier.
* @cmd contains the operation to be performed.
* Return 0 if permission is granted.
* @shm_shmat:
* Check permissions prior to allowing the shmat system call to attach the
- * shared memory segment @shp, identified by @shmid, to the data segment
- * of the calling process. The attaching address is specified by @shmaddr.
+ * shared memory segment @shp to the data segment of the calling process.
+ * The attaching address is specified by @shmaddr.
* @shp contains the shared memory structure to be modified.
- * @shmid contains the resource identifier.
* @shmaddr contains the address to attach memory region to.
* @shmflg contains the operational flags.
* Return 0 if permission is granted.
@@ -953,27 +974,57 @@
* identifier for an existing semaphore, not when a new one must be
* created.
* @sma contains the semaphore structure.
- * @semid contains the resource identifier.
* @semflg contains the operation control flags.
* Return 0 if permission is granted.
* @sem_semctl:
* Check permission when a semaphore operation specified by @cmd is to be
- * performed on the semaphore @sma, with identifier @semid.
- * @sma contains the semaphore structure.
- * @semid contains the resource identifier.
+ * performed on the semaphore @sma. The @sma may be NULL, e.g. for
+ * IPC_INFO or SEM_INFO.
+ * @sma contains the semaphore structure. May be NULL.
* @cmd contains the operation to be performed.
* Return 0 if permission is granted.
* @sem_semop
* Check permissions before performing operations on members of the
- * semaphore set @sma, identified by @semid. If the @alter flag is
- * nonzero, the semaphore set may be modified.
+ * semaphore set @sma. If the @alter flag is nonzero, the semaphore
+ * set may be modified.
* @sma contains the semaphore structure.
- * @semid contains the resource identifier.
* @sops contains the operations to perform.
* @nsops contains the number of operations to perform.
* @alter contains the flag indicating whether changes are to be made.
* Return 0 if permission is granted.
*
+ * @sys_security:
+ * Security modules may use this hook to implement new system calls for
+ * security-aware applications. The interface is similar to socketcall,
+ * but with an @id parameter to help identify the security module whose
+ * call is being invoked. The module is responsible for interpreting the
+ * parameters, and must copy in the @args array from user space if it is
+ * used.
+ * The recommended convention for creating the hexadecimal @id value is
+ * echo "Name_of_module" | md5sum | cut -c -8; by using this convention,
+ * there is no need for a central registry.
+ * @id contains the security module identifier.
+ * @call contains the call value.
+ * @args contains the call arguments (user space pointer).
+ * The module should return -ENOSYS if it does not implement any new
+ * system calls.
+ * @nfsservctl:
+ * Check permission before having the kernel NFS daemon perform command
+ * @cmd with arguments @arg.
+ * See the nfsservctl(2) manual page for an explanation of @cmd and @arg
+ * values.
+ * @cmd contains the command value.
+ * @arg contains the command arguments.
+ * Return 0 if permission is granted.
+ * @bdflush:
+ * Check permission before tuning the bdflush parameter.
+ * See the bdflush(2) manual page for an explanation of the @func and
+ * @data parameters. The @data parameter should only be used by the
+ * module if it is an input value.
+ * @func contains the tuning function.
+ * @data contains the tuning parameter pointer (user space pointer) or value.
+ * Return 0 if permission is granted.
+ *
* @sethostname:
* Check permission before the hostname is set to @hostname.
* @hostname contains the new hostname
@@ -1063,21 +1114,6 @@
* @tsk contains the task_struct for the process.
* @cap contains the capability <include/linux/capability.h>.
* Return 0 if the capability is granted for @tsk.
- * @sys_security:
- * Security modules may use this hook to implement new system calls for
- * security-aware applications. The interface is similar to socketcall,
- * but with an @id parameter to help identify the security module whose
- * call is being invoked. The module is responsible for interpreting the
- * parameters, and must copy in the @args array from user space if it is
- * used.
- * The recommended convention for creating the hexadecimal @id value is
- * echo "Name_of_module" | md5sum | cut -c -8; by using this convention,
- * there is no need for a central registry.
- * @id contains the security module identifier.
- * @call contains the call value.
- * @args contains the call arguments (user space pointer).
- * The module should return -ENOSYS if it does not implement any new
- * system calls.
* @swapon:
* Check permission before enabling swapping to the file or block device
* identified by @swap.
@@ -1088,14 +1124,6 @@
* identified by @swap.
* @swap contains the swap_info_struct structure for the swap file and device.
* Return 0 if permission is granted.
- * @nfsservctl:
- * Check permission before having the kernel NFS daemon perform command
- * @cmd with arguments @arg.
- * See the nfsservctl(2) manual page for an explanation of @cmd and @arg
- * values.
- * @cmd contains the command value.
- * @arg contains the command arguments.
- * Return 0 if permission is granted.
* @quotactl:
* Check permission before performing the quota operation identified by
* @cmd for the specified @type, @id, and @sb. The @sb parameter may be
@@ -1110,14 +1138,6 @@
* the quota file.
* @f contains the open file for storing quotas.
* Return 0 if permission is granted.
- * @bdflush:
- * Check permission before tuning the bdflush parameter.
- * See the bdflush(2) manual page for an explanation of the @func and
- * @data parameters. The @data parameter should only be used by the
- * module if it is an input value.
- * @func contains the tuning function.
- * @data contains the tuning parameter pointer (user space pointer) or value.
- * Return 0 if permission is granted.
* @syslog:
* Check permission before accessing the kernel message ring or changing
* logging to the console.
@@ -1178,8 +1198,17 @@
*
* This is the main security structure.
*/
-
struct security_operations {
+ int (*sys_security) (unsigned int id, unsigned call,
+ unsigned long *args);
+ int (*nfsservctl) (int cmd, struct nfsctl_arg * arg);
+
+ int (*bdflush) (int func, long data);
+
+ int (*module_create) (const char *name, size_t size);
+ int (*module_initialize) (struct module * mod);
+ int (*module_delete) (const struct module * mod);
+
int (*sethostname) (char *hostname);
int (*setdomainname) (char *domainname);
int (*reboot) (unsigned int cmd);
@@ -1200,14 +1229,10 @@
int (*acct) (struct file * file);
int (*sysctl) (ctl_table * table, int op);
int (*capable) (struct task_struct * tsk, int cap);
- int (*sys_security) (unsigned int id, unsigned call,
- unsigned long *args);
int (*swapon) (struct swap_info_struct * swap);
int (*swapoff) (struct swap_info_struct * swap);
- int (*nfsservctl) (int cmd, struct nfsctl_arg * arg);
int (*quotactl) (int cmds, int type, int id, struct super_block * sb);
int (*quota_on) (struct file * f);
- int (*bdflush) (int func, long data);
int (*syslog) (int type);
int (*settime) (struct timeval *tv, struct timezone *tz);
@@ -1244,54 +1269,53 @@
void (*sb_post_pivotroot) (struct nameidata * old_nd,
struct nameidata * new_nd);
- int (*inode_alloc_security) (struct inode * inode);
- void (*inode_free_security) (struct inode * inode);
- int (*inode_create) (struct inode * dir,
- struct dentry * dentry, int mode);
- void (*inode_post_create) (struct inode * dir,
- struct dentry * dentry, int mode);
- int (*inode_link) (struct dentry * old_dentry,
- struct inode * dir, struct dentry * new_dentry);
- void (*inode_post_link) (struct dentry * old_dentry,
- struct inode * dir,
- struct dentry * new_dentry);
- int (*inode_unlink) (struct inode * dir, struct dentry * dentry);
- int (*inode_symlink) (struct inode * dir,
- struct dentry * dentry, const char *old_name);
- void (*inode_post_symlink) (struct inode * dir,
- struct dentry * dentry,
- const char *old_name);
- int (*inode_mkdir) (struct inode * dir,
- struct dentry * dentry, int mode);
- void (*inode_post_mkdir) (struct inode * dir,
- struct dentry * dentry, int mode);
- int (*inode_rmdir) (struct inode * dir, struct dentry * dentry);
- int (*inode_mknod) (struct inode * dir,
- struct dentry * dentry, int mode, dev_t dev);
- void (*inode_post_mknod) (struct inode * dir,
- struct dentry * dentry, int mode, dev_t dev);
- int (*inode_rename) (struct inode * old_dir,
- struct dentry * old_dentry,
- struct inode * new_dir,
- struct dentry * new_dentry);
- void (*inode_post_rename) (struct inode * old_dir,
- struct dentry * old_dentry,
- struct inode * new_dir,
- struct dentry * new_dentry);
- int (*inode_readlink) (struct dentry * dentry);
- int (*inode_follow_link) (struct dentry * dentry,
- struct nameidata * nd);
- int (*inode_permission) (struct inode * inode, int mask);
- int (*inode_revalidate) (struct dentry * dentry);
- int (*inode_setattr) (struct dentry * dentry, struct iattr * attr);
- int (*inode_stat) (struct inode * inode);
- void (*inode_post_lookup) (struct inode * inode, struct dentry * d);
- void (*inode_delete) (struct inode * inode);
+ int (*inode_alloc_security) (struct inode *inode);
+ void (*inode_free_security) (struct inode *inode);
+ int (*inode_create) (struct inode *dir,
+ struct dentry *dentry, int mode);
+ void (*inode_post_create) (struct inode *dir,
+ struct dentry *dentry, int mode);
+ int (*inode_link) (struct dentry *old_dentry,
+ struct inode *dir, struct dentry *new_dentry);
+ void (*inode_post_link) (struct dentry *old_dentry,
+ struct inode *dir, struct dentry *new_dentry);
+ int (*inode_unlink) (struct inode *dir, struct dentry *dentry);
+ int (*inode_symlink) (struct inode *dir,
+ struct dentry *dentry, const char *old_name);
+ void (*inode_post_symlink) (struct inode *dir,
+ struct dentry *dentry,
+ const char *old_name);
+ int (*inode_mkdir) (struct inode *dir, struct dentry *dentry, int mode);
+ void (*inode_post_mkdir) (struct inode *dir, struct dentry *dentry,
+ int mode);
+ int (*inode_rmdir) (struct inode *dir, struct dentry *dentry);
+ int (*inode_mknod) (struct inode *dir, struct dentry *dentry,
+ int mode, dev_t dev);
+ void (*inode_post_mknod) (struct inode *dir, struct dentry *dentry,
+ int mode, dev_t dev);
+ int (*inode_rename) (struct inode *old_dir, struct dentry *old_dentry,
+ struct inode *new_dir, struct dentry *new_dentry);
+ void (*inode_post_rename) (struct inode *old_dir,
+ struct dentry *old_dentry,
+ struct inode *new_dir,
+ struct dentry *new_dentry);
+ int (*inode_readlink) (struct dentry *dentry);
+ int (*inode_follow_link) (struct dentry *dentry, struct nameidata *nd);
+ int (*inode_permission) (struct inode *inode, int mask);
+ int (*inode_revalidate) (struct dentry *dentry);
+ int (*inode_setattr) (struct dentry *dentry, struct iattr *attr);
+ int (*inode_stat) (struct inode *inode);
+ void (*inode_post_lookup) (struct inode *inode, struct dentry *d);
+ void (*inode_delete) (struct inode *inode);
+ int (*inode_setxattr) (struct dentry *dentry, char *name, void *value,
+ size_t size, int flags);
+ int (*inode_getxattr) (struct dentry *dentry, char *name);
+ int (*inode_listxattr) (struct dentry *dentry);
+ int (*inode_removexattr) (struct dentry *dentry, char *name);
int (*file_permission) (struct file * file, int mask);
int (*file_alloc_security) (struct file * file);
void (*file_free_security) (struct file * file);
- int (*file_llseek) (struct file * file);
int (*file_ioctl) (struct file * file, unsigned int cmd,
unsigned long arg);
int (*file_mmap) (struct file * file,
@@ -1356,9 +1380,9 @@
int (*socket_sock_rcv_skb) (struct sock * sk, struct sk_buff * skb);
int (*open_request_alloc_security) (struct open_request * req);
void (*open_request_free_security) (struct open_request * req);
- void (*tcp_connection_request) (struct sock * sk, struct sk_buff * skb,
+ void (*tcp_connection_request) (struct sock * sk, struct sk_buff * skb,
struct open_request * req);
- void (*tcp_synack) (struct sock * sk, struct sk_buff * skb,
+ void (*tcp_synack) (struct sock * sk, struct sk_buff * skb,
struct open_request * req);
void (*tcp_create_openreq_child) (struct sock * sk, struct sock * newsk,
struct sk_buff * skb,
@@ -1384,23 +1408,17 @@
void (*netdev_unregister) (struct net_device * dev);
- int (*module_create) (const char *name, size_t size);
- int (*module_initialize) (struct module * mod);
- int (*module_delete) (const struct module * mod);
-
int (*ipc_permission) (struct kern_ipc_perm * ipcp, short flag);
- int (*ipc_getinfo) (int id, int cmd);
int (*msg_msg_alloc_security) (struct msg_msg * msg);
void (*msg_msg_free_security) (struct msg_msg * msg);
int (*msg_queue_alloc_security) (struct msg_queue * msq);
void (*msg_queue_free_security) (struct msg_queue * msq);
- int (*msg_queue_associate) (struct msg_queue * msq, int msqid,
- int msqflg);
- int (*msg_queue_msgctl) (struct msg_queue * msq, int msqid, int cmd);
+ int (*msg_queue_associate) (struct msg_queue * msq, int msqflg);
+ int (*msg_queue_msgctl) (struct msg_queue * msq, int cmd);
int (*msg_queue_msgsnd) (struct msg_queue * msq,
- struct msg_msg * msg, int msqid, int msqflg);
+ struct msg_msg * msg, int msqflg);
int (*msg_queue_msgrcv) (struct msg_queue * msq,
struct msg_msg * msg,
struct task_struct * target,
@@ -1408,37 +1426,1787 @@
int (*shm_alloc_security) (struct shmid_kernel * shp);
void (*shm_free_security) (struct shmid_kernel * shp);
- int (*shm_associate) (struct shmid_kernel * shp, int shmid, int shmflg);
- int (*shm_shmctl) (struct shmid_kernel * shp, int shmid, int cmd);
- int (*shm_shmat) (struct shmid_kernel * shp, int shmid,
+ int (*shm_associate) (struct shmid_kernel * shp, int shmflg);
+ int (*shm_shmctl) (struct shmid_kernel * shp, int cmd);
+ int (*shm_shmat) (struct shmid_kernel * shp,
char *shmaddr, int shmflg);
int (*sem_alloc_security) (struct sem_array * sma);
void (*sem_free_security) (struct sem_array * sma);
- int (*sem_associate) (struct sem_array * sma, int semid, int semflg);
- int (*sem_semctl) (struct sem_array * sma, int semid, int cmd);
- int (*sem_semop) (struct sem_array * sma, int semid,
+ int (*sem_associate) (struct sem_array * sma, int semflg);
+ int (*sem_semctl) (struct sem_array * sma, int cmd);
+ int (*sem_semop) (struct sem_array * sma,
struct sembuf * sops, unsigned nsops, int alter);
/* allow module stacking */
int (*register_security) (const char *name,
- struct security_operations * ops);
+ struct security_operations *ops);
int (*unregister_security) (const char *name,
- struct security_operations * ops);
+ struct security_operations *ops);
};
-/* prototypes */
-extern int security_scaffolding_startup(void);
-extern int register_security(struct security_operations *ops);
-extern int unregister_security(struct security_operations *ops);
-extern int mod_reg_security(const char *name, struct security_operations *ops);
-extern int mod_unreg_security(const char *name,
- struct security_operations *ops);
-extern int capable(int cap);
-
/* global variables */
extern struct security_operations *security_ops;
-#endif /* __KERNEL__ */
+/* inline stuff */
+static inline int security_syscall(unsigned int id, unsigned call,
+ unsigned long *args)
+{
+ return security_ops->sys_security(id, call, args);
+}
+
+static inline int security_nfsservctl(int cmd, struct nfsctl_arg * arg)
+{
+ return security_ops->nfsservctl(cmd, arg);
+}
+
+static inline int security_bdflush(int func, long data)
+{
+ return security_ops->bdflush(func, data);
+}
+
+static inline int security_module_create(const char *name, size_t size)
+{
+ return security_ops->module_create(name, size);
+}
+
+static inline int security_module_initialize(struct module * mod)
+{
+ return security_ops->module_initialize(mod);
+}
+
+static inline int security_module_delete(const struct module * mod)
+{
+ return security_ops->module_delete(mod);
+}
+
+static inline int security_sethostname (char *hostname)
+{
+ return security_ops->sethostname (hostname);
+}
+
+static inline int security_setdomainname (char *domainname)
+{
+ return security_ops->setdomainname (domainname);
+}
+
+static inline int security_reboot (unsigned int cmd)
+{
+ return security_ops->reboot (cmd);
+}
+
+static inline int security_ioperm (unsigned long from, unsigned long num, int turn_on)
+{
+ return security_ops->ioperm (from, num, turn_on);
+}
+
+static inline int security_iopl (unsigned int old, unsigned int level)
+{
+ return security_ops->iopl (old, level);
+}
+
+static inline int security_ptrace (struct task_struct * parent, struct task_struct * child)
+{
+ return security_ops->ptrace (parent, child);
+}
+
+static inline int security_capget (struct task_struct *target,
+ kernel_cap_t *effective,
+ kernel_cap_t *inheritable,
+ kernel_cap_t *permitted)
+{
+ return security_ops->capget (target, effective, inheritable, permitted);
+}
+
+static inline int security_capset_check (struct task_struct *target,
+ kernel_cap_t *effective,
+ kernel_cap_t *inheritable,
+ kernel_cap_t *permitted)
+{
+ return security_ops->capset_check (target, effective, inheritable, permitted);
+}
+
+static inline void security_capset_set (struct task_struct *target,
+ kernel_cap_t *effective,
+ kernel_cap_t *inheritable,
+ kernel_cap_t *permitted)
+{
+ security_ops->capset_set (target, effective, inheritable, permitted);
+}
+
+static inline int security_acct (struct file *file)
+{
+ return security_ops->acct (file);
+}
+
+static inline int security_sysctl(ctl_table * table, int op)
+{
+ return security_ops->sysctl(table, op);
+}
+
+static inline int security_capable(struct task_struct * tsk, int cap)
+{
+ return security_ops->capable(tsk, cap);
+}
+
+static inline int security_swapon(struct swap_info_struct * swap)
+{
+ return security_ops->swapon(swap);
+}
+
+static inline int security_swapoff(struct swap_info_struct * swap)
+{
+ return security_ops->swapoff(swap);
+}
+
+static inline int security_quotactl (int cmds, int type, int id,
+ struct super_block *sb)
+{
+ return security_ops->quotactl (cmds, type, id, sb);
+}
+
+static inline int security_quota_on (struct file * file)
+{
+ return security_ops->quota_on (file);
+}
+
+static inline int security_syslog(int type)
+{
+ return security_ops->syslog(type);
+}
+
+static inline int security_settime(struct timeval *tv, struct timezone *tz)
+{
+ return security_ops->settime(tv, tz);
+}
+
+static inline int security_netlink_send(struct sk_buff * skb)
+{
+ return security_ops->netlink_send(skb);
+}
+
+static inline int security_netlink_recv(struct sk_buff * skb)
+{
+ return security_ops->netlink_recv(skb);
+}
+
+
+static inline int security_unix_stream_connect(struct socket * sock,
+ struct socket * other,
+ struct sock * newsk)
+{
+ return security_ops->unix_stream_connect(sock, other, newsk);
+}
+
+
+static inline int security_unix_may_send(struct socket * sock,
+ struct socket * other)
+{
+ return security_ops->unix_may_send(sock, other);
+}
+
+static inline int security_bprm_alloc (struct linux_binprm *bprm)
+{
+ return security_ops->bprm_alloc_security (bprm);
+}
+static inline void security_bprm_free (struct linux_binprm *bprm)
+{
+ security_ops->bprm_free_security (bprm);
+}
+static inline void security_bprm_compute_creds (struct linux_binprm *bprm)
+{
+ security_ops->bprm_compute_creds (bprm);
+}
+static inline int security_bprm_set (struct linux_binprm *bprm)
+{
+ return security_ops->bprm_set_security (bprm);
+}
+static inline int security_bprm_check (struct linux_binprm *bprm)
+{
+ return security_ops->bprm_check_security (bprm);
+}
+
+static inline int security_sb_alloc (struct super_block *sb)
+{
+ return security_ops->sb_alloc_security (sb);
+}
+
+static inline void security_sb_free (struct super_block *sb)
+{
+ security_ops->sb_free_security (sb);
+}
+
+static inline int security_sb_kern_mount (struct super_block *sb)
+{
+ return security_ops->sb_kern_mount (sb);
+}
+
+static inline int security_sb_statfs (struct super_block *sb)
+{
+ return security_ops->sb_statfs (sb);
+}
+
+static inline int security_sb_mount (char *dev_name, struct nameidata *nd,
+ char *type, unsigned long flags,
+ void *data)
+{
+ return security_ops->sb_mount (dev_name, nd, type, flags, data);
+}
+
+static inline int security_sb_check_sb (struct vfsmount *mnt,
+ struct nameidata *nd)
+{
+ return security_ops->sb_check_sb (mnt, nd);
+}
+
+static inline int security_sb_umount (struct vfsmount *mnt, int flags)
+{
+ return security_ops->sb_umount (mnt, flags);
+}
+
+static inline void security_sb_umount_close (struct vfsmount *mnt)
+{
+ security_ops->sb_umount_close (mnt);
+}
+
+static inline void security_sb_umount_busy (struct vfsmount *mnt)
+{
+ security_ops->sb_umount_busy (mnt);
+}
+
+static inline void security_sb_post_remount (struct vfsmount *mnt,
+ unsigned long flags, void *data)
+{
+ security_ops->sb_post_remount (mnt, flags, data);
+}
+
+static inline void security_sb_post_mountroot (void)
+{
+ security_ops->sb_post_mountroot ();
+}
+
+static inline void security_sb_post_addmount (struct vfsmount *mnt,
+ struct nameidata *mountpoint_nd)
+{
+ security_ops->sb_post_addmount (mnt, mountpoint_nd);
+}
+
+static inline int security_sb_pivotroot (struct nameidata *old_nd,
+ struct nameidata *new_nd)
+{
+ return security_ops->sb_pivotroot (old_nd, new_nd);
+}
+
+static inline void security_sb_post_pivotroot (struct nameidata *old_nd,
+ struct nameidata *new_nd)
+{
+ security_ops->sb_post_pivotroot (old_nd, new_nd);
+}
+
+static inline int security_inode_alloc (struct inode *inode)
+{
+ return security_ops->inode_alloc_security (inode);
+}
+
+static inline void security_inode_free (struct inode *inode)
+{
+ security_ops->inode_free_security (inode);
+}
+
+static inline int security_inode_create (struct inode *dir,
+ struct dentry *dentry,
+ int mode)
+{
+ return security_ops->inode_create (dir, dentry, mode);
+}
+
+static inline void security_inode_post_create (struct inode *dir,
+ struct dentry *dentry,
+ int mode)
+{
+ security_ops->inode_post_create (dir, dentry, mode);
+}
+
+static inline int security_inode_link (struct dentry *old_dentry,
+ struct inode *dir,
+ struct dentry *new_dentry)
+{
+ return security_ops->inode_link (old_dentry, dir, new_dentry);
+}
+
+static inline void security_inode_post_link (struct dentry *old_dentry,
+ struct inode *dir,
+ struct dentry *new_dentry)
+{
+ security_ops->inode_post_link (old_dentry, dir, new_dentry);
+}
+
+static inline int security_inode_unlink (struct inode *dir,
+ struct dentry *dentry)
+{
+ return security_ops->inode_unlink (dir, dentry);
+}
+
+static inline int security_inode_symlink (struct inode *dir,
+ struct dentry *dentry,
+ const char *old_name)
+{
+ return security_ops->inode_symlink (dir, dentry, old_name);
+}
+
+static inline void security_inode_post_symlink (struct inode *dir,
+ struct dentry *dentry,
+ const char *old_name)
+{
+ security_ops->inode_post_symlink (dir, dentry, old_name);
+}
+
+static inline int security_inode_mkdir (struct inode *dir,
+ struct dentry *dentry,
+ int mode)
+{
+ return security_ops->inode_mkdir (dir, dentry, mode);
+}
+
+static inline void security_inode_post_mkdir (struct inode *dir,
+ struct dentry *dentry,
+ int mode)
+{
+ security_ops->inode_post_mkdir (dir, dentry, mode);
+}
+
+static inline int security_inode_rmdir (struct inode *dir,
+ struct dentry *dentry)
+{
+ return security_ops->inode_rmdir (dir, dentry);
+}
+
+static inline int security_inode_mknod (struct inode *dir,
+ struct dentry *dentry,
+ int mode, dev_t dev)
+{
+ return security_ops->inode_mknod (dir, dentry, mode, dev);
+}
+
+static inline void security_inode_post_mknod (struct inode *dir,
+ struct dentry *dentry,
+ int mode, dev_t dev)
+{
+ security_ops->inode_post_mknod (dir, dentry, mode, dev);
+}
+
+static inline int security_inode_rename (struct inode *old_dir,
+ struct dentry *old_dentry,
+ struct inode *new_dir,
+ struct dentry *new_dentry)
+{
+ return security_ops->inode_rename (old_dir, old_dentry,
+ new_dir, new_dentry);
+}
+
+static inline void security_inode_post_rename (struct inode *old_dir,
+ struct dentry *old_dentry,
+ struct inode *new_dir,
+ struct dentry *new_dentry)
+{
+ security_ops->inode_post_rename (old_dir, old_dentry,
+ new_dir, new_dentry);
+}
+
+static inline int security_inode_readlink (struct dentry *dentry)
+{
+ return security_ops->inode_readlink (dentry);
+}
+
+static inline int security_inode_follow_link (struct dentry *dentry,
+ struct nameidata *nd)
+{
+ return security_ops->inode_follow_link (dentry, nd);
+}
+
+static inline int security_inode_permission (struct inode *inode, int mask)
+{
+ return security_ops->inode_permission (inode, mask);
+}
+
+static inline int security_inode_revalidate (struct dentry *dentry)
+{
+ return security_ops->inode_revalidate (dentry);
+}
+
+static inline int security_inode_setattr (struct dentry *dentry,
+ struct iattr *attr)
+{
+ return security_ops->inode_setattr (dentry, attr);
+}
+
+static inline int security_inode_stat (struct inode *inode)
+{
+ return security_ops->inode_stat (inode);
+}
+
+static inline void security_inode_post_lookup (struct inode *inode,
+ struct dentry *dentry)
+{
+ security_ops->inode_post_lookup (inode, dentry);
+}
+
+static inline void security_inode_delete (struct inode *inode)
+{
+ security_ops->inode_delete (inode);
+}
+
+static inline int security_inode_setxattr (struct dentry *dentry, char *name,
+ void *value, size_t size, int flags)
+{
+ return security_ops->inode_setxattr (dentry, name, value, size, flags);
+}
+
+static inline int security_inode_getxattr (struct dentry *dentry, char *name)
+{
+ return security_ops->inode_getxattr (dentry, name);
+}
+
+static inline int security_inode_listxattr (struct dentry *dentry)
+{
+ return security_ops->inode_listxattr (dentry);
+}
+
+static inline int security_inode_removexattr (struct dentry *dentry, char *name)
+{
+ return security_ops->inode_removexattr (dentry, name);
+}
+
+static inline int security_file_permission (struct file *file, int mask)
+{
+ return security_ops->file_permission (file, mask);
+}
+
+static inline int security_file_alloc (struct file *file)
+{
+ return security_ops->file_alloc_security (file);
+}
+
+static inline void security_file_free (struct file *file)
+{
+ security_ops->file_free_security (file);
+}
+
+static inline int security_file_ioctl (struct file *file, unsigned int cmd,
+ unsigned long arg)
+{
+ return security_ops->file_ioctl (file, cmd, arg);
+}
+
+static inline int security_file_mmap (struct file *file, unsigned long prot,
+ unsigned long flags)
+{
+ return security_ops->file_mmap (file, prot, flags);
+}
+
+static inline int security_file_mprotect (struct vm_area_struct *vma,
+ unsigned long prot)
+{
+ return security_ops->file_mprotect (vma, prot);
+}
+
+static inline int security_file_lock (struct file *file, unsigned int cmd)
+{
+ return security_ops->file_lock (file, cmd);
+}
+
+static inline int security_file_fcntl (struct file *file, unsigned int cmd,
+ unsigned long arg)
+{
+ return security_ops->file_fcntl (file, cmd, arg);
+}
+
+static inline int security_file_set_fowner (struct file *file)
+{
+ return security_ops->file_set_fowner (file);
+}
+
+static inline int security_file_send_sigiotask (struct task_struct *tsk,
+ struct fown_struct *fown,
+ int fd, int reason)
+{
+ return security_ops->file_send_sigiotask (tsk, fown, fd, reason);
+}
+
+static inline int security_file_receive (struct file *file)
+{
+ return security_ops->file_receive (file);
+}
+
+static inline int security_task_create (unsigned long clone_flags)
+{
+ return security_ops->task_create (clone_flags);
+}
+
+static inline int security_task_alloc (struct task_struct *p)
+{
+ return security_ops->task_alloc_security (p);
+}
+
+static inline void security_task_free (struct task_struct *p)
+{
+ security_ops->task_free_security (p);
+}
+
+static inline int security_task_setuid (uid_t id0, uid_t id1, uid_t id2,
+ int flags)
+{
+ return security_ops->task_setuid (id0, id1, id2, flags);
+}
+
+static inline int security_task_post_setuid (uid_t old_ruid, uid_t old_euid,
+ uid_t old_suid, int flags)
+{
+ return security_ops->task_post_setuid (old_ruid, old_euid, old_suid, flags);
+}
+
+static inline int security_task_setgid (gid_t id0, gid_t id1, gid_t id2,
+ int flags)
+{
+ return security_ops->task_setgid (id0, id1, id2, flags);
+}
+
+static inline int security_task_setpgid (struct task_struct *p, pid_t pgid)
+{
+ return security_ops->task_setpgid (p, pgid);
+}
+
+static inline int security_task_getpgid (struct task_struct *p)
+{
+ return security_ops->task_getpgid (p);
+}
+
+static inline int security_task_getsid (struct task_struct *p)
+{
+ return security_ops->task_getsid (p);
+}
+
+static inline int security_task_setgroups (int gidsetsize, gid_t *grouplist)
+{
+ return security_ops->task_setgroups (gidsetsize, grouplist);
+}
+
+static inline int security_task_setnice (struct task_struct *p, int nice)
+{
+ return security_ops->task_setnice (p, nice);
+}
+
+static inline int security_task_setrlimit (unsigned int resource,
+ struct rlimit *new_rlim)
+{
+ return security_ops->task_setrlimit (resource, new_rlim);
+}
+
+static inline int security_task_setscheduler (struct task_struct *p,
+ int policy,
+ struct sched_param *lp)
+{
+ return security_ops->task_setscheduler (p, policy, lp);
+}
+
+static inline int security_task_getscheduler (struct task_struct *p)
+{
+ return security_ops->task_getscheduler (p);
+}
+
+static inline int security_task_kill (struct task_struct *p,
+ struct siginfo *info, int sig)
+{
+ return security_ops->task_kill (p, info, sig);
+}
+
+static inline int security_task_wait (struct task_struct *p)
+{
+ return security_ops->task_wait (p);
+}
+
+static inline int security_task_prctl (int option, unsigned long arg2,
+ unsigned long arg3,
+ unsigned long arg4,
+ unsigned long arg5)
+{
+ return security_ops->task_prctl (option, arg2, arg3, arg4, arg5);
+}
+
+static inline void security_task_kmod_set_label (void)
+{
+ security_ops->task_kmod_set_label ();
+}
+
+static inline void security_task_reparent_to_init (struct task_struct *p)
+{
+ security_ops->task_reparent_to_init (p);
+}
+
+static inline int security_socket_create (int family, int type, int protocol)
+{
+ return security_ops->socket_create(family, type, protocol);
+}
+
+static inline void security_socket_post_create(struct socket * sock,
+ int family,
+ int type,
+ int protocol)
+{
+ security_ops->socket_post_create(sock, family, type, protocol);
+}
+
+static inline int security_socket_bind(struct socket * sock,
+ struct sockaddr * address,
+ int addrlen)
+{
+ return security_ops->socket_bind(sock, address, addrlen);
+}
+
+static inline int security_socket_connect(struct socket * sock,
+ struct sockaddr * address,
+ int addrlen)
+{
+ return security_ops->socket_connect(sock, address, addrlen);
+}
+
+static inline int security_socket_listen(struct socket * sock, int backlog)
+{
+ return security_ops->socket_listen(sock, backlog);
+}
+
+static inline int security_socket_accept(struct socket * sock,
+ struct socket * newsock)
+{
+ return security_ops->socket_accept(sock, newsock);
+}
+
+static inline void security_socket_post_accept(struct socket * sock,
+ struct socket * newsock)
+{
+ security_ops->socket_post_accept(sock, newsock);
+}
+
+static inline int security_socket_sendmsg(struct socket * sock,
+ struct msghdr * msg, int size)
+{
+ return security_ops->socket_sendmsg(sock, msg, size);
+}
+
+static inline int security_socket_recvmsg(struct socket * sock,
+ struct msghdr * msg, int size,
+ int flags)
+{
+ return security_ops->socket_recvmsg(sock, msg, size, flags);
+}
+
+static inline int security_socket_getsockname(struct socket * sock)
+{
+ return security_ops->socket_getsockname(sock);
+}
+
+static inline int security_socket_getpeername(struct socket * sock)
+{
+ return security_ops->socket_getpeername(sock);
+}
+
+static inline int security_socket_getsockopt(struct socket * sock,
+ int level, int optname)
+{
+ return security_ops->socket_getsockopt(sock, level, optname);
+}
+
+static inline int security_socket_setsockopt(struct socket * sock,
+ int level, int optname)
+{
+ return security_ops->socket_setsockopt(sock, level, optname);
+}
+
+static inline int security_socket_shutdown(struct socket * sock, int how)
+{
+ return security_ops->socket_shutdown(sock, how);
+}
+
+static inline int security_sock_alloc(struct sock * sk,
+ int gfp_mask)
+{
+ return security_ops->socket_sock_alloc_security(sk, gfp_mask);
+}
+
+static inline void security_sock_free(struct sock * sk)
+{
+ security_ops->socket_sock_free_security(sk);
+}
+
+static inline int security_sock_rcv_skb (struct sock * sk,
+ struct sk_buff * skb)
+{
+ return security_ops->socket_sock_rcv_skb (sk, skb);
+}
+
+static inline int security_open_request_alloc (struct open_request * req)
+{
+ return security_ops->open_request_alloc_security (req);
+}
+
+static inline void security_open_request_free (struct open_request * req)
+{
+ security_ops->open_request_free_security (req);
+}
+
+static inline void security_tcp_connection_request(struct sock * sk,
+ struct sk_buff * skb,
+ struct open_request * req)
+{
+ security_ops->tcp_connection_request(sk, skb, req);
+}
+
+static inline void security_tcp_synack(struct sock * sk,
+ struct sk_buff * skb,
+ struct open_request * req)
+{
+ security_ops->tcp_synack(sk, skb, req);
+}
+
+static inline void security_tcp_create_openreq_child(struct sock * sk,
+ struct sock * newsk,
+ struct sk_buff * skb,
+ struct open_request * req)
+{
+ security_ops->tcp_create_openreq_child(sk, newsk, skb, req);
+}
+
+static inline int security_skb_alloc(struct sk_buff * skb, int gfp_mask)
+{
+ return security_ops->skb_alloc_security(skb, gfp_mask);
+}
+
+static inline int security_skb_clone(struct sk_buff * newskb,
+ const struct sk_buff * oldskb)
+{
+ return security_ops->skb_clone(newskb, oldskb);
+}
+
+static inline void security_skb_copy(struct sk_buff * newskb,
+ const struct sk_buff * oldskb)
+{
+ security_ops->skb_copy(newskb, oldskb);
+}
+
+static inline void security_skb_set_owner_w (struct sk_buff * skb,
+ struct sock * sk)
+{
+ security_ops->skb_set_owner_w (skb, sk);
+}
+
+static inline void security_skb_recv_datagram(struct sk_buff * skb,
+ struct sock * sk, unsigned flags)
+{
+ security_ops->skb_recv_datagram(skb, sk, flags);
+}
+
+static inline void security_skb_free(struct sk_buff * skb)
+{
+ security_ops->skb_free_security(skb);
+}
+
+static inline void security_ip_fragment(struct sk_buff * newskb,
+ const struct sk_buff * oldskb)
+{
+ security_ops->ip_fragment(newskb, oldskb);
+}
+
+static inline int security_ip_defragment(struct sk_buff * skb)
+{
+ return security_ops->ip_defragment(skb);
+}
+
+static inline void security_ip_encapsulate(struct sk_buff * skb)
+{
+ security_ops->ip_encapsulate(skb);
+}
+
+static inline void security_ip_decapsulate(struct sk_buff * skb)
+{
+ security_ops->ip_decapsulate(skb);
+}
+
+static inline int security_ip_decode_options(struct sk_buff * skb,
+ const char *optptr,
+ unsigned char **pp_ptr)
+{
+ return security_ops->ip_decode_options(skb, optptr, pp_ptr);
+}
+
+static inline void security_netdev_unregister(struct net_device * dev)
+{
+ security_ops->netdev_unregister(dev);
+}
+
+static inline int security_ipc_permission (struct kern_ipc_perm *ipcp,
+ short flag)
+{
+ return security_ops->ipc_permission (ipcp, flag);
+}
+
+static inline int security_msg_msg_alloc (struct msg_msg * msg)
+{
+ return security_ops->msg_msg_alloc_security (msg);
+}
+
+static inline void security_msg_msg_free (struct msg_msg * msg)
+{
+ security_ops->msg_msg_free_security(msg);
+}
+
+static inline int security_msg_queue_alloc (struct msg_queue *msq)
+{
+ return security_ops->msg_queue_alloc_security (msq);
+}
+
+static inline void security_msg_queue_free (struct msg_queue *msq)
+{
+ security_ops->msg_queue_free_security (msq);
+}
+
+static inline int security_msg_queue_associate (struct msg_queue * msq,
+ int msqflg)
+{
+ return security_ops->msg_queue_associate (msq, msqflg);
+}
+
+static inline int security_msg_queue_msgctl (struct msg_queue * msq, int cmd)
+{
+ return security_ops->msg_queue_msgctl (msq, cmd);
+}
+
+static inline int security_msg_queue_msgsnd (struct msg_queue * msq,
+ struct msg_msg * msg, int msqflg)
+{
+ return security_ops->msg_queue_msgsnd (msq, msg, msqflg);
+}
+
+static inline int security_msg_queue_msgrcv (struct msg_queue * msq,
+ struct msg_msg * msg,
+ struct task_struct * target,
+ long type, int mode)
+{
+ return security_ops->msg_queue_msgrcv (msq, msg, target, type, mode);
+}
+
+static inline int security_shm_alloc (struct shmid_kernel *shp)
+{
+ return security_ops->shm_alloc_security (shp);
+}
+
+static inline void security_shm_free (struct shmid_kernel *shp)
+{
+ security_ops->shm_free_security (shp);
+}
+
+static inline int security_shm_associate (struct shmid_kernel * shp,
+ int shmflg)
+{
+ return security_ops->shm_associate(shp, shmflg);
+}
+
+static inline int security_shm_shmctl (struct shmid_kernel * shp, int cmd)
+{
+ return security_ops->shm_shmctl (shp, cmd);
+}
+
+static inline int security_shm_shmat (struct shmid_kernel * shp,
+ char *shmaddr, int shmflg)
+{
+ return security_ops->shm_shmat(shp, shmaddr, shmflg);
+}
+
+static inline int security_sem_alloc (struct sem_array *sma)
+{
+ return security_ops->sem_alloc_security (sma);
+}
+
+static inline void security_sem_free (struct sem_array *sma)
+{
+ security_ops->sem_free_security (sma);
+}
+
+static inline int security_sem_associate (struct sem_array * sma, int semflg)
+{
+ return security_ops->sem_associate (sma, semflg);
+}
+
+static inline int security_sem_semctl (struct sem_array * sma, int cmd)
+{
+ return security_ops->sem_semctl(sma, cmd);
+}
+
+static inline int security_sem_semop (struct sem_array * sma,
+ struct sembuf * sops, unsigned nsops,
+ int alter)
+{
+ return security_ops->sem_semop(sma, sops, nsops, alter);
+}
+
+/* prototypes */
+extern int security_scaffolding_startup (void);
+extern int register_security (struct security_operations *ops);
+extern int unregister_security (struct security_operations *ops);
+extern int mod_reg_security (const char *name, struct security_operations *ops);
+extern int mod_unreg_security (const char *name, struct security_operations *ops);
+
+
+#else /* CONFIG_SECURITY */
+
+/*
+ * This is the default capabilities functionality. Most of these functions
+ * are just stubbed out, but a few must call the proper capable code.
+ */
+
+static inline int security_scaffolding_startup (void)
+{
+ return 0;
+}
+
+static inline int security_syscall(unsigned int id, unsigned call,
+ unsigned long *args)
+{
+ return -ENOSYS;
+}
+
+static inline int security_nfsservctl(int cmd, struct nfsctl_arg * arg)
+{
+ return 0;
+}
+
+static inline int security_bdflush(int func, long data)
+{
+ return 0;
+}
+
+static inline int security_module_create(const char *name, size_t size)
+{
+ return 0;
+}
+
+static inline int security_module_initialize(struct module * mod)
+{
+ return 0;
+}
+
+static inline int security_module_delete(const struct module * mod)
+{
+ return 0;
+}
+
+static inline int security_sethostname (char *hostname)
+{
+ return 0;
+}
+
+static inline int security_setdomainname (char *domainname)
+{
+ return 0;
+}
+
+static inline int security_reboot (unsigned int cmd)
+{
+ return 0;
+}
+
+static inline int security_ioperm (unsigned long from, unsigned long num, int turn_on)
+{
+ return 0;
+}
+
+static inline int security_iopl (unsigned int old, unsigned int level)
+{
+ return 0;
+}
+
+static inline int security_ptrace (struct task_struct *parent, struct task_struct * child)
+{
+ return cap_ptrace (parent, child);
+}
+
+static inline int security_capget (struct task_struct *target,
+ kernel_cap_t *effective,
+ kernel_cap_t *inheritable,
+ kernel_cap_t *permitted)
+{
+ return cap_capget (target, effective, inheritable, permitted);
+}
+
+static inline int security_capset_check (struct task_struct *target,
+ kernel_cap_t *effective,
+ kernel_cap_t *inheritable,
+ kernel_cap_t *permitted)
+{
+ return cap_capset_check (target, effective, inheritable, permitted);
+}
+
+static inline void security_capset_set (struct task_struct *target,
+ kernel_cap_t *effective,
+ kernel_cap_t *inheritable,
+ kernel_cap_t *permitted)
+{
+ cap_capset_set (target, effective, inheritable, permitted);
+}
+
+static inline int security_acct (struct file *file)
+{
+ return 0;
+}
+
+static inline int security_sysctl(ctl_table * table, int op)
+{
+ return 0;
+}
+
+static inline int security_capable(struct task_struct * tsk, int cap)
+{
+ return cap_capable(tsk, cap);
+}
+
+static inline int security_swapon(struct swap_info_struct * swap)
+{
+ return 0;
+}
+
+static inline int security_swapoff(struct swap_info_struct * swap)
+{
+ return 0;
+}
+
+static inline int security_quotactl (int cmds, int type, int id,
+ struct super_block * sb)
+{
+ return 0;
+}
+
+static inline int security_quota_on (struct file * file)
+{
+ return 0;
+}
+
+static inline int security_syslog(int type)
+{
+ return 0;
+}
+
+static inline int security_settime(struct timeval *tv, struct timezone *tz)
+{
+ return 0;
+}
+
+static inline int security_netlink_send(struct sk_buff * skb)
+{
+ return cap_netlink_send(skb);
+}
+
+static inline int security_netlink_recv(struct sk_buff * skb)
+{
+ return cap_netlink_recv(skb);
+}
+
+static inline int security_unix_stream_connect(struct socket * sock,
+ struct socket * other,
+ struct sock * newsk)
+{
+ return 0;
+}
+
+static inline int security_unix_may_send(struct socket * sock,
+ struct socket * other)
+{
+ return 0;
+}
+
+static inline int security_bprm_alloc (struct linux_binprm *bprm)
+{
+ return 0;
+}
+
+static inline void security_bprm_free (struct linux_binprm *bprm)
+{ }
+
+static inline void security_bprm_compute_creds (struct linux_binprm *bprm)
+{
+ cap_bprm_compute_creds (bprm);
+}
+
+static inline int security_bprm_set (struct linux_binprm *bprm)
+{
+ return cap_bprm_set_security (bprm);
+}
+
+static inline int security_bprm_check (struct linux_binprm *bprm)
+{
+ return 0;
+}
+
+static inline int security_sb_alloc (struct super_block *sb)
+{
+ return 0;
+}
+
+static inline void security_sb_free (struct super_block *sb)
+{ }
+
+static inline int security_sb_kern_mount (struct super_block *sb)
+{
+ return 0;
+}
+
+static inline int security_sb_statfs (struct super_block *sb)
+{
+ return 0;
+}
+
+static inline int security_sb_mount (char *dev_name, struct nameidata *nd,
+ char *type, unsigned long flags,
+ void *data)
+{
+ return 0;
+}
+
+static inline int security_sb_check_sb (struct vfsmount *mnt,
+ struct nameidata *nd)
+{
+ return 0;
+}
+
+static inline int security_sb_umount (struct vfsmount *mnt, int flags)
+{
+ return 0;
+}
+
+static inline void security_sb_umount_close (struct vfsmount *mnt)
+{ }
+
+static inline void security_sb_umount_busy (struct vfsmount *mnt)
+{ }
+
+static inline void security_sb_post_remount (struct vfsmount *mnt,
+ unsigned long flags, void *data)
+{ }
+
+static inline void security_sb_post_mountroot (void)
+{ }
+
+static inline void security_sb_post_addmount (struct vfsmount *mnt,
+ struct nameidata *mountpoint_nd)
+{ }
+
+static inline int security_sb_pivotroot (struct nameidata *old_nd,
+ struct nameidata *new_nd)
+{
+ return 0;
+}
+
+static inline void security_sb_post_pivotroot (struct nameidata *old_nd,
+ struct nameidata *new_nd)
+{ }
+
+static inline int security_inode_alloc (struct inode *inode)
+{
+ return 0;
+}
+
+static inline void security_inode_free (struct inode *inode)
+{ }
+
+static inline int security_inode_create (struct inode *dir,
+ struct dentry *dentry,
+ int mode)
+{
+ return 0;
+}
+
+static inline void security_inode_post_create (struct inode *dir,
+ struct dentry *dentry,
+ int mode)
+{ }
+
+static inline int security_inode_link (struct dentry *old_dentry,
+ struct inode *dir,
+ struct dentry *new_dentry)
+{
+ return 0;
+}
+
+static inline void security_inode_post_link (struct dentry *old_dentry,
+ struct inode *dir,
+ struct dentry *new_dentry)
+{ }
+
+static inline int security_inode_unlink (struct inode *dir,
+ struct dentry *dentry)
+{
+ return 0;
+}
+
+static inline int security_inode_symlink (struct inode *dir,
+ struct dentry *dentry,
+ const char *old_name)
+{
+ return 0;
+}
+
+static inline void security_inode_post_symlink (struct inode *dir,
+ struct dentry *dentry,
+ const char *old_name)
+{ }
+
+static inline int security_inode_mkdir (struct inode *dir,
+ struct dentry *dentry,
+ int mode)
+{
+ return 0;
+}
+
+static inline void security_inode_post_mkdir (struct inode *dir,
+ struct dentry *dentry,
+ int mode)
+{ }
+
+static inline int security_inode_rmdir (struct inode *dir,
+ struct dentry *dentry)
+{
+ return 0;
+}
+
+static inline int security_inode_mknod (struct inode *dir,
+ struct dentry *dentry,
+ int mode, dev_t dev)
+{
+ return 0;
+}
+
+static inline void security_inode_post_mknod (struct inode *dir,
+ struct dentry *dentry,
+ int mode, dev_t dev)
+{ }
+
+static inline int security_inode_rename (struct inode *old_dir,
+ struct dentry *old_dentry,
+ struct inode *new_dir,
+ struct dentry *new_dentry)
+{
+ return 0;
+}
+
+static inline void security_inode_post_rename (struct inode *old_dir,
+ struct dentry *old_dentry,
+ struct inode *new_dir,
+ struct dentry *new_dentry)
+{ }
+
+static inline int security_inode_readlink (struct dentry *dentry)
+{
+ return 0;
+}
+
+static inline int security_inode_follow_link (struct dentry *dentry,
+ struct nameidata *nd)
+{
+ return 0;
+}
+
+static inline int security_inode_permission (struct inode *inode, int mask)
+{
+ return 0;
+}
+
+static inline int security_inode_revalidate (struct dentry *dentry)
+{
+ return 0;
+}
+
+static inline int security_inode_setattr (struct dentry *dentry,
+ struct iattr *attr)
+{
+ return 0;
+}
+
+static inline int security_inode_stat (struct inode *inode)
+{
+ return 0;
+}
+
+static inline void security_inode_post_lookup (struct inode *inode,
+ struct dentry *dentry)
+{ }
+
+static inline void security_inode_delete (struct inode *inode)
+{ }
+
+static inline int security_inode_setxattr (struct dentry *dentry, char *name,
+ void *value, size_t size, int flags)
+{
+ return 0;
+}
+
+static inline int security_inode_getxattr (struct dentry *dentry, char *name)
+{
+ return 0;
+}
+
+static inline int security_inode_listxattr (struct dentry *dentry)
+{
+ return 0;
+}
+
+static inline int security_inode_removexattr (struct dentry *dentry, char *name)
+{
+ return 0;
+}
+
+static inline int security_file_permission (struct file *file, int mask)
+{
+ return 0;
+}
+
+static inline int security_file_alloc (struct file *file)
+{
+ return 0;
+}
+
+static inline void security_file_free (struct file *file)
+{ }
+
+static inline int security_file_ioctl (struct file *file, unsigned int cmd,
+ unsigned long arg)
+{
+ return 0;
+}
+
+static inline int security_file_mmap (struct file *file, unsigned long prot,
+ unsigned long flags)
+{
+ return 0;
+}
+
+static inline int security_file_mprotect (struct vm_area_struct *vma,
+ unsigned long prot)
+{
+ return 0;
+}
+
+static inline int security_file_lock (struct file *file, unsigned int cmd)
+{
+ return 0;
+}
+
+static inline int security_file_fcntl (struct file *file, unsigned int cmd,
+ unsigned long arg)
+{
+ return 0;
+}
+
+static inline int security_file_set_fowner (struct file *file)
+{
+ return 0;
+}
+
+static inline int security_file_send_sigiotask (struct task_struct *tsk,
+ struct fown_struct *fown,
+ int fd, int reason)
+{
+ return 0;
+}
+
+static inline int security_file_receive (struct file *file)
+{
+ return 0;
+}
+
+static inline int security_task_create (unsigned long clone_flags)
+{
+ return 0;
+}
+
+static inline int security_task_alloc (struct task_struct *p)
+{
+ return 0;
+}
+
+static inline void security_task_free (struct task_struct *p)
+{ }
+
+static inline int security_task_setuid (uid_t id0, uid_t id1, uid_t id2,
+ int flags)
+{
+ return 0;
+}
+
+static inline int security_task_post_setuid (uid_t old_ruid, uid_t old_euid,
+ uid_t old_suid, int flags)
+{
+ return cap_task_post_setuid (old_ruid, old_euid, old_suid, flags);
+}
+
+static inline int security_task_setgid (gid_t id0, gid_t id1, gid_t id2,
+ int flags)
+{
+ return 0;
+}
+
+static inline int security_task_setpgid (struct task_struct *p, pid_t pgid)
+{
+ return 0;
+}
+
+static inline int security_task_getpgid (struct task_struct *p)
+{
+ return 0;
+}
+
+static inline int security_task_getsid (struct task_struct *p)
+{
+ return 0;
+}
+
+static inline int security_task_setgroups (int gidsetsize, gid_t *grouplist)
+{
+ return 0;
+}
+
+static inline int security_task_setnice (struct task_struct *p, int nice)
+{
+ return 0;
+}
+
+static inline int security_task_setrlimit (unsigned int resource,
+ struct rlimit *new_rlim)
+{
+ return 0;
+}
+
+static inline int security_task_setscheduler (struct task_struct *p,
+ int policy,
+ struct sched_param *lp)
+{
+ return 0;
+}
+
+static inline int security_task_getscheduler (struct task_struct *p)
+{
+ return 0;
+}
+
+static inline int security_task_kill (struct task_struct *p,
+ struct siginfo *info, int sig)
+{
+ return 0;
+}
+
+static inline int security_task_wait (struct task_struct *p)
+{
+ return 0;
+}
+
+static inline int security_task_prctl (int option, unsigned long arg2,
+ unsigned long arg3,
+ unsigned long arg4,
+ unsigned long arg5)
+{
+ return 0;
+}
+
+static inline void security_task_kmod_set_label (void)
+{
+ cap_task_kmod_set_label ();
+}
+
+static inline void security_task_reparent_to_init (struct task_struct *p)
+{
+ cap_task_reparent_to_init (p);
+}
+
+static inline int security_socket_create (int family, int type, int protocol)
+{
+ return 0;
+}
+
+static inline void security_socket_post_create(struct socket * sock,
+ int family,
+ int type,
+ int protocol)
+{
+}
+
+static inline int security_socket_bind(struct socket * sock,
+ struct sockaddr * address,
+ int addrlen)
+{
+ return 0;
+}
+
+static inline int security_socket_connect(struct socket * sock,
+ struct sockaddr * address,
+ int addrlen)
+{
+ return 0;
+}
+
+static inline int security_socket_listen(struct socket * sock, int backlog)
+{
+ return 0;
+}
+
+static inline int security_socket_accept(struct socket * sock,
+ struct socket * newsock)
+{
+ return 0;
+}
+
+static inline void security_socket_post_accept(struct socket * sock,
+ struct socket * newsock)
+{
+}
+
+static inline int security_socket_sendmsg(struct socket * sock,
+ struct msghdr * msg, int size)
+{
+ return 0;
+}
+
+static inline int security_socket_recvmsg(struct socket * sock,
+ struct msghdr * msg, int size,
+ int flags)
+{
+ return 0;
+}
+
+static inline int security_socket_getsockname(struct socket * sock)
+{
+ return 0;
+}
+
+static inline int security_socket_getpeername(struct socket * sock)
+{
+ return 0;
+}
+
+static inline int security_socket_getsockopt(struct socket * sock,
+ int level, int optname)
+{
+ return 0;
+}
+
+static inline int security_socket_setsockopt(struct socket * sock,
+ int level, int optname)
+{
+ return 0;
+}
+
+static inline int security_socket_shutdown(struct socket * sock, int how)
+{
+ return 0;
+}
+
+static inline int security_sock_alloc(struct sock * sk,
+ int gfp_mask)
+{
+ return 0;
+}
+
+static inline void security_sock_free(struct sock * sk)
+{
+}
+
+static inline int security_sock_rcv_skb (struct sock * sk,
+ struct sk_buff * skb)
+{
+ return 0;
+}
+
+static inline int security_open_request_alloc (struct open_request * req)
+{
+ return 0;
+}
+
+static inline void security_open_request_free (struct open_request * req)
+{
+}
+
+static inline void security_tcp_connection_request(struct sock * sk,
+ struct sk_buff * skb,
+ struct open_request * req)
+{
+}
+
+static inline void security_tcp_synack(struct sock * sk,
+ struct sk_buff * skb,
+ struct open_request * req)
+{
+}
+
+static inline void security_tcp_create_openreq_child(struct sock * sk,
+ struct sock * newsk,
+ struct sk_buff * skb,
+ struct open_request * req)
+{
+}
+
+static inline int security_skb_alloc(struct sk_buff * skb, int gfp_mask)
+{
+ return 0;
+}
+
+static inline int security_skb_clone(struct sk_buff * newskb,
+ const struct sk_buff * oldskb)
+{
+ return 0;
+}
+
+static inline void security_skb_copy(struct sk_buff * newskb,
+ const struct sk_buff * oldskb)
+{
+}
+
+static inline void security_skb_set_owner_w (struct sk_buff * skb,
+ struct sock * sk)
+{
+}
+
+static inline void security_skb_recv_datagram(struct sk_buff * skb,
+ struct sock * sk, unsigned flags)
+{
+}
+
+static inline void security_skb_free(struct sk_buff * skb)
+{
+}
+
+static inline void security_ip_fragment(struct sk_buff * newskb,
+ const struct sk_buff * oldskb)
+{
+}
+
+static inline int security_ip_defragment(struct sk_buff * skb)
+{
+ return 0;
+}
+
+static inline void security_ip_encapsulate(struct sk_buff * skb)
+{
+}
+
+static inline void security_ip_decapsulate(struct sk_buff * skb)
+{
+}
+
+static inline int security_ip_decode_options(struct sk_buff * skb,
+ const char *optptr,
+ unsigned char **pp_ptr)
+{
+ return cap_ip_decode_options(skb,optptr,pp_ptr);
+}
+
+static inline void security_netdev_unregister(struct net_device * dev)
+{
+}
+
+static inline int security_ipc_permission (struct kern_ipc_perm *ipcp,
+ short flag)
+{
+ return 0;
+}
+
+static inline int security_msg_msg_alloc (struct msg_msg * msg)
+{
+ return 0;
+}
+
+static inline void security_msg_msg_free (struct msg_msg * msg)
+{ }
+
+static inline int security_msg_queue_alloc (struct msg_queue *msq)
+{
+ return 0;
+}
+
+static inline void security_msg_queue_free (struct msg_queue *msq)
+{ }
+
+static inline int security_msg_queue_associate (struct msg_queue * msq,
+ int msqflg)
+{
+ return 0;
+}
+
+static inline int security_msg_queue_msgctl (struct msg_queue * msq, int cmd)
+{
+ return 0;
+}
+
+static inline int security_msg_queue_msgsnd (struct msg_queue * msq,
+ struct msg_msg * msg, int msqflg)
+{
+ return 0;
+}
+
+static inline int security_msg_queue_msgrcv (struct msg_queue * msq,
+ struct msg_msg * msg,
+ struct task_struct * target,
+ long type, int mode)
+{
+ return 0;
+}
+
+static inline int security_shm_alloc (struct shmid_kernel *shp)
+{
+ return 0;
+}
+
+static inline void security_shm_free (struct shmid_kernel *shp)
+{ }
+
+static inline int security_shm_associate (struct shmid_kernel * shp,
+ int shmflg)
+{
+ return 0;
+}
+
+static inline int security_shm_shmctl (struct shmid_kernel * shp, int cmd)
+{
+ return 0;
+}
+
+static inline int security_shm_shmat (struct shmid_kernel * shp,
+ char *shmaddr, int shmflg)
+{
+ return 0;
+}
+
+static inline int security_sem_alloc (struct sem_array *sma)
+{
+ return 0;
+}
+
+static inline void security_sem_free (struct sem_array *sma)
+{ }
+
+static inline int security_sem_associate (struct sem_array * sma, int semflg)
+{
+ return 0;
+}
+
+static inline int security_sem_semctl (struct sem_array * sma, int cmd)
+{
+ return 0;
+}
+
+static inline int security_sem_semop (struct sem_array * sma,
+ struct sembuf * sops, unsigned nsops,
+ int alter)
+{
+ return 0;
+}
+
+#endif /* CONFIG_SECURITY */
#endif /* ! __LINUX_SECURITY_H */
+
===== include/net/sock.h 1.13 vs edited =====
--- 1.13/include/net/sock.h Fri Aug 16 03:57:33 2002
+++ edited/include/net/sock.h Tue Dec 31 11:47:39 2002
@@ -52,6 +52,7 @@
#include <linux/netdevice.h>
#include <linux/skbuff.h> /* struct sk_buff */
+#include <linux/security.h>
#include <net/protocol.h> /* struct inet_protocol */
#if defined(CONFIG_X25) || defined(CONFIG_X25_MODULE)
#include <net/x25.h>
@@ -1148,7 +1149,7 @@
skb->sk = sk;
skb->destructor = sock_wfree;
atomic_add(skb->truesize, &sk->wmem_alloc);
- security_ops->skb_set_owner_w(skb, sk);
+ security_skb_set_owner_w(skb, sk);
}
static inline void skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
@@ -1168,7 +1169,7 @@
if (atomic_read(&sk->rmem_alloc) + skb->truesize >= (unsigned)sk->rcvbuf)
return -ENOMEM;
- err = security_ops->socket_sock_rcv_skb(sk, skb);
+ err = security_sock_rcv_skb(sk, skb);
if (err)
return err;
===== include/net/tcp.h 1.10 vs edited =====
--- 1.10/include/net/tcp.h Mon Oct 21 09:43:12 2002
+++ edited/include/net/tcp.h Tue Dec 31 11:55:02 2002
@@ -533,7 +533,7 @@
if (req != NULL) {
req->security = NULL;
- if (security_ops->open_request_alloc_security(req)) {
+ if (security_open_request_alloc(req)) {
kmem_cache_free(tcp_openreq_cachep, req);
return NULL;
}
@@ -543,7 +543,7 @@
static inline void tcp_openreq_fastfree(struct open_request *req)
{
- security_ops->open_request_free_security(req);
+ security_open_request_free(req);
kmem_cache_free(tcp_openreq_cachep, req);
}
===== init/do_mounts.c 1.16 vs edited =====
--- 1.16/init/do_mounts.c Tue Nov 26 14:53:09 2002
+++ edited/init/do_mounts.c Tue Dec 31 11:30:27 2002
@@ -8,6 +8,7 @@
#include <linux/fd.h>
#include <linux/tty.h>
#include <linux/init.h>
+#include <linux/security.h>
#include <linux/nfs_fs.h>
#include <linux/nfs_fs_sb.h>
@@ -888,7 +889,7 @@
sys_umount("/dev", 0);
sys_mount(".", "/", NULL, MS_MOVE, NULL);
sys_chroot(".");
- security_ops->sb_post_mountroot();
+ security_sb_post_mountroot();
mount_devfs_fs ();
}
===== ipc/msg.c 1.11 vs edited =====
--- 1.11/ipc/msg.c Tue Aug 13 17:47:04 2002
+++ edited/ipc/msg.c Tue Dec 31 11:24:53 2002
@@ -22,6 +22,7 @@
#include <linux/init.h>
#include <linux/proc_fs.h>
#include <linux/list.h>
+#include <linux/security.h>
#include <asm/uaccess.h>
#include "util.h"
@@ -100,7 +101,7 @@
msq->q_perm.key = key;
msq->q_perm.security = NULL;
- retval = security_ops->msg_queue_alloc_security(msq);
+ retval = security_msg_queue_alloc(msq);
if (retval) {
kfree(msq);
return retval;
@@ -108,7 +109,7 @@
id = ipc_addid(&msg_ids, &msq->q_perm, msg_ctlmni);
if(id == -1) {
- security_ops->msg_queue_free_security(msq);
+ security_msg_queue_free(msq);
kfree(msq);
return -ENOSPC;
}
@@ -130,7 +131,7 @@
{
struct msg_msgseg* seg;
- security_ops->msg_msg_free_security(msg);
+ security_msg_msg_free(msg);
seg = msg->next;
kfree(msg);
@@ -188,7 +189,7 @@
src = ((char*)src)+alen;
}
- err = security_ops->msg_msg_alloc_security(msg);
+ err = security_msg_msg_alloc(msg);
if (err)
goto out_err;
@@ -277,8 +278,6 @@
msq = msg_rmid(id);
- security_ops->msg_queue_free_security(msq);
-
expunge_all(msq,-EIDRM);
ss_wakeup(&msq->q_senders,1);
msg_unlock(id);
@@ -291,6 +290,7 @@
free_msg(msg);
}
atomic_sub(msq->q_cbytes, &msg_bytes);
+ security_msg_queue_free(msq);
kfree(msq);
}
@@ -317,7 +317,7 @@
ret = -EACCES;
else {
int qid = msg_buildid(id, msq->q_perm.seq);
- ret = security_ops->msg_queue_associate(msq, qid, msgflg);
+ ret = security_msg_queue_associate(msq, msgflg);
if (!ret)
ret = qid;
}
@@ -443,7 +443,7 @@
* to set all member fields.
*/
- err = security_ops->ipc_getinfo(msqid, cmd);
+ err = security_msg_queue_msgctl(NULL, cmd);
if (err)
return err;
@@ -497,7 +497,7 @@
if (ipcperms (&msq->q_perm, S_IRUGO))
goto out_unlock;
- err = security_ops->msg_queue_msgctl(msq, msqid, cmd);
+ err = security_msg_queue_msgctl(msq, cmd);
if (err)
goto out_unlock;
@@ -543,15 +543,15 @@
/* We _could_ check for CAP_CHOWN above, but we don't */
goto out_unlock_up;
+ err = security_msg_queue_msgctl(msq, cmd);
+ if (err)
+ goto out_unlock_up;
+
switch (cmd) {
case IPC_SET:
{
if (setbuf.qbytes > msg_ctlmnb && !capable(CAP_SYS_RESOURCE))
goto out_unlock_up;
-
- err = security_ops->msg_queue_msgctl(msq, msqid, cmd);
- if (err)
- goto out_unlock_up;
msq->q_qbytes = setbuf.qbytes;
@@ -572,10 +572,6 @@
break;
}
case IPC_RMID:
- err = security_ops->msg_queue_msgctl(msq, msqid, cmd);
- if (err)
- goto out_unlock_up;
-
freeque (msqid);
break;
}
@@ -623,7 +619,7 @@
msr = list_entry(tmp,struct msg_receiver,r_list);
tmp = tmp->next;
if(testmsg(msg,msr->r_msgtype,msr->r_mode) &&
- !security_ops->msg_queue_msgrcv(msq, msg, msr->r_tsk, msr->r_msgtype, msr->r_mode)) {
+ !security_msg_queue_msgrcv(msq, msg, msr->r_tsk, msr->r_msgtype, msr->r_mode)) {
list_del(&msr->r_list);
if(msr->r_maxsize < msg->m_ts) {
msr->r_msg = ERR_PTR(-E2BIG);
@@ -674,7 +670,7 @@
if (ipcperms(&msq->q_perm, S_IWUGO))
goto out_unlock_free;
- err = security_ops->msg_queue_msgsnd(msq, msg, msqid, msgflg);
+ err = security_msg_queue_msgsnd(msq, msg, msgflg);
if (err)
goto out_unlock_free;
@@ -777,7 +773,7 @@
while (tmp != &msq->q_messages) {
msg = list_entry(tmp,struct msg_msg,m_list);
if(testmsg(msg,msgtyp,mode) &&
- !security_ops->msg_queue_msgrcv(msq, msg, current, msgtyp, mode)) {
+ !security_msg_queue_msgrcv(msq, msg, current, msgtyp, mode)) {
found_msg = msg;
if(mode == SEARCH_LESSEQUAL && msg->m_type != 1) {
found_msg=msg;
===== ipc/sem.c 1.11 vs edited =====
--- 1.11/ipc/sem.c Tue Aug 13 17:47:04 2002
+++ edited/ipc/sem.c Tue Dec 31 11:24:53 2002
@@ -135,7 +135,7 @@
sma->sem_perm.key = key;
sma->sem_perm.security = NULL;
- retval = security_ops->sem_alloc_security(sma);
+ retval = security_sem_alloc(sma);
if (retval) {
ipc_free(sma, size);
return retval;
@@ -143,7 +143,7 @@
id = ipc_addid(&sem_ids, &sma->sem_perm, sc_semmni);
if(id == -1) {
- security_ops->sem_free_security(sma);
+ security_sem_free(sma);
ipc_free(sma, size);
return -ENOSPC;
}
@@ -188,7 +188,7 @@
err = -EACCES;
else {
int semid = sem_buildid(id, sma->sem_perm.seq);
- err = security_ops->sem_associate(sma, semid, semflg);
+ err = security_sem_associate(sma, semflg);
if (!err)
err = semid;
}
@@ -412,7 +412,6 @@
int size;
sma = sem_rmid(id);
- security_ops->sem_free_security(sma);
/* Invalidate the existing undo structures for this semaphore set.
* (They will be freed without any further action in sem_exit()
@@ -431,6 +430,7 @@
used_sems -= sma->sem_nsems;
size = sizeof (*sma) + sma->sem_nsems * sizeof (struct sem);
+ security_sem_free(sma);
ipc_free(sma, size);
}
@@ -467,7 +467,7 @@
struct seminfo seminfo;
int max_id;
- err = security_ops->ipc_getinfo(semid, cmd);
+ err = security_sem_semctl(NULL, cmd);
if (err)
return err;
@@ -513,7 +513,7 @@
if (ipcperms (&sma->sem_perm, S_IRUGO))
goto out_unlock;
- err = security_ops->sem_semctl(sma, semid, cmd);
+ err = security_sem_semctl(sma, cmd);
if (err)
goto out_unlock;
@@ -560,7 +560,7 @@
if (ipcperms (&sma->sem_perm, (cmd==SETVAL||cmd==SETALL)?S_IWUGO:S_IRUGO))
goto out_unlock;
- err = security_ops->sem_semctl(sma, semid, cmd);
+ err = security_sem_semctl(sma, cmd);
if (err)
goto out_unlock;
@@ -756,7 +756,7 @@
goto out_unlock;
}
- err = security_ops->sem_semctl(sma, semid, cmd);
+ err = security_sem_semctl(sma, cmd);
if (err)
goto out_unlock;
@@ -918,7 +918,7 @@
if (ipcperms(&sma->sem_perm, alter ? S_IWUGO : S_IRUGO))
goto out_unlock_free;
- error = security_ops->sem_semop(sma, semid, sops, nsops, alter);
+ error = security_sem_semop(sma, sops, nsops, alter);
if (error)
goto out_unlock_free;
error = -EACCES;
===== ipc/shm.c 1.18 vs edited =====
--- 1.18/ipc/shm.c Thu Aug 1 18:22:18 2002
+++ edited/ipc/shm.c Tue Dec 31 11:24:53 2002
@@ -113,10 +113,9 @@
shm_rmid (shp->id);
shm_unlock(shp->id);
- security_ops->shm_free_security(shp);
-
shmem_lock(shp->shm_file, 0);
fput (shp->shm_file);
+ security_shm_free(shp);
kfree (shp);
}
@@ -188,7 +187,7 @@
shp->shm_flags = (shmflg & S_IRWXUGO);
shp->shm_perm.security = NULL;
- error = security_ops->shm_alloc_security(shp);
+ error = security_shm_alloc(shp);
if (error) {
kfree(shp);
return error;
@@ -222,7 +221,7 @@
no_id:
fput(file);
no_file:
- security_ops->shm_free_security(shp);
+ security_shm_free(shp);
kfree(shp);
return error;
}
@@ -252,7 +251,7 @@
err = -EACCES;
else {
int shmid = shm_buildid(id, shp->shm_perm.seq);
- err = security_ops->shm_associate(shp, shmid, shmflg);
+ err = security_shm_associate(shp, shmflg);
if (!err)
err = shmid;
}
@@ -393,7 +392,7 @@
{
struct shminfo64 shminfo;
- err = security_ops->ipc_getinfo(shmid, cmd);
+ err = security_shm_shmctl(NULL, cmd);
if (err)
return err;
@@ -415,7 +414,7 @@
{
struct shm_info shm_info;
- err = security_ops->ipc_getinfo(shmid, cmd);
+ err = security_shm_shmctl(NULL, cmd);
if (err)
return err;
@@ -445,10 +444,6 @@
if(shp==NULL)
return -EINVAL;
- err = security_ops->shm_shmctl(shp, shmid, cmd);
- if (err)
- goto out_unlock;
-
if(cmd==SHM_STAT) {
err = -EINVAL;
if (shmid > shm_ids.max_id)
@@ -463,6 +458,11 @@
err=-EACCES;
if (ipcperms (&shp->shm_perm, S_IRUGO))
goto out_unlock;
+
+ err = security_shm_shmctl(shp, cmd);
+ if (err)
+ goto out_unlock;
+
kernel_to_ipc64_perm(&shp->shm_perm, &tbuf.shm_perm);
tbuf.shm_segsz = shp->shm_segsz;
tbuf.shm_atime = shp->shm_atim;
@@ -492,7 +492,7 @@
if(err)
goto out_unlock;
- err = security_ops->shm_shmctl(shp, shmid, cmd);
+ err = security_shm_shmctl(shp, cmd);
if (err)
goto out_unlock;
@@ -527,16 +527,17 @@
if(err)
goto out_unlock_up;
- err = security_ops->shm_shmctl(shp, shmid, cmd);
- if (err)
- goto out_unlock_up;
-
if (current->euid != shp->shm_perm.uid &&
current->euid != shp->shm_perm.cuid &&
!capable(CAP_SYS_ADMIN)) {
err=-EPERM;
goto out_unlock_up;
}
+
+ err = security_shm_shmctl(shp, cmd);
+ if (err)
+ goto out_unlock_up;
+
if (shp->shm_nattch){
shp->shm_flags |= SHM_DEST;
/* Do not find it any more */
@@ -561,16 +562,16 @@
if(err)
goto out_unlock_up;
- err = security_ops->shm_shmctl(shp, shmid, cmd);
- if (err)
- goto out_unlock_up;
-
err=-EPERM;
if (current->euid != shp->shm_perm.uid &&
current->euid != shp->shm_perm.cuid &&
!capable(CAP_SYS_ADMIN)) {
goto out_unlock_up;
}
+
+ err = security_shm_shmctl(shp, cmd);
+ if (err)
+ goto out_unlock_up;
shp->shm_perm.uid = setbuf.uid;
shp->shm_perm.gid = setbuf.gid;
@@ -656,7 +657,7 @@
return -EACCES;
}
- err = security_ops->shm_shmat(shp, shmid, shmaddr, shmflg);
+ err = security_shm_shmat(shp, shmaddr, shmflg);
if (err) {
shm_unlock(shmid);
return err;
===== ipc/util.c 1.7 vs edited =====
--- 1.7/ipc/util.c Thu Aug 29 15:41:48 2002
+++ edited/ipc/util.c Tue Dec 31 11:24:54 2002
@@ -264,7 +264,7 @@
!capable(CAP_IPC_OWNER))
return -1;
- return security_ops->ipc_permission(ipcp, flag);
+ return security_ipc_permission(ipcp, flag);
}
/*
===== kernel/acct.c 1.9 vs edited =====
--- 1.9/kernel/acct.c Wed Jun 5 23:44:51 2002
+++ edited/kernel/acct.c Tue Dec 31 11:24:54 2002
@@ -182,7 +182,7 @@
goto out_err;
}
- error = security_ops->acct(file);
+ error = security_acct(file);
if (error)
goto out_err;
===== kernel/capability.c 1.3 vs edited =====
--- 1.3/kernel/capability.c Fri Oct 12 02:28:13 2001
+++ edited/kernel/capability.c Tue Dec 31 11:24:54 2002
@@ -6,6 +6,7 @@
*/
#include <linux/mm.h>
+#include <linux/security.h>
#include <asm/uaccess.h>
kernel_cap_t cap_bset = CAP_INIT_EFF_SET;
@@ -57,7 +58,7 @@
}
if (!error) {
- error = security_ops->capget(target, &data.effective, &data.inheritable, &data.permitted);
+ error = security_capget(target, &data.effective, &data.inheritable, &data.permitted);
}
if (target != current)
@@ -86,7 +87,7 @@
for_each_task(target) {
if (target->pgrp != pgrp)
continue;
- security_ops->capset_set(target, effective, inheritable, permitted);
+ security_capset_set(target, effective, inheritable, permitted);
}
read_unlock(&tasklist_lock);
}
@@ -105,7 +106,7 @@
for_each_task(target) {
if (target == current || target->pid == 1)
continue;
- security_ops->capset_set(target, effective, inheritable, permitted);
+ security_capset_set(target, effective, inheritable, permitted);
}
read_unlock(&tasklist_lock);
}
@@ -162,7 +163,7 @@
target = current;
}
- error = security_ops->capset_check(target, &effective, &inheritable, &permitted);
+ error = security_capset_check(target, &effective, &inheritable, &permitted);
if (error)
goto out;
@@ -176,7 +177,7 @@
cap_set_pg(-pid, &effective, &inheritable, &permitted);
goto spin_out;
} else {
- security_ops->capset_set(target, &effective, &inheritable, &permitted);
+ security_capset_set(target, &effective, &inheritable, &permitted);
}
out:
===== kernel/exit.c 1.16 vs edited =====
--- 1.16/kernel/exit.c Tue Oct 8 16:49:09 2002
+++ edited/kernel/exit.c Tue Dec 31 11:24:55 2002
@@ -48,7 +48,7 @@
task_unlock(p);
#endif
atomic_dec(&p->user->processes);
- security_ops->task_free_security(p);
+ security_task_free(p);
free_uid(p->user);
unhash_process(p);
@@ -528,7 +528,7 @@
&& !(options & __WALL))
continue;
- if (security_ops->task_wait(p))
+ if (security_task_wait(p))
continue;
flag = 1;
===== kernel/fork.c 1.25 vs edited =====
--- 1.25/kernel/fork.c Tue Aug 13 17:47:04 2002
+++ edited/kernel/fork.c Tue Dec 31 11:24:55 2002
@@ -596,7 +596,7 @@
goto fork_out;
}
- retval = security_ops->task_create(clone_flags);
+ retval = security_task_create(clone_flags);
if (retval)
goto fork_out;
@@ -685,7 +685,7 @@
INIT_LIST_HEAD(&p->local_pages);
retval = -ENOMEM;
- if (security_ops->task_alloc_security(p))
+ if (security_task_alloc(p))
goto bad_fork_cleanup;
/* copy all the process information */
if (copy_files(clone_flags, p))
@@ -778,7 +778,7 @@
bad_fork_cleanup_files:
exit_files(p); /* blocking */
bad_fork_cleanup_security:
- security_ops->task_free_security(p);
+ security_task_free(p);
bad_fork_cleanup:
put_exec_domain(p->exec_domain);
if (p->binfmt && p->binfmt->module)
===== kernel/kmod.c 1.6 vs edited =====
--- 1.6/kernel/kmod.c Tue Jul 16 19:43:03 2002
+++ edited/kernel/kmod.c Tue Dec 31 11:24:55 2002
@@ -27,6 +27,7 @@
#include <linux/slab.h>
#include <linux/namespace.h>
#include <linux/completion.h>
+#include <linux/security.h>
#include <asm/uaccess.h>
@@ -132,7 +133,7 @@
/* Give kmod all effective privileges.. */
curtask->euid = curtask->fsuid = 0;
curtask->egid = curtask->fsgid = 0;
- security_ops->task_kmod_set_label();
+ security_task_kmod_set_label();
/* Allow execve args to be in kernel space. */
set_fs(KERNEL_DS);
===== kernel/module.c 1.18 vs edited =====
--- 1.18/kernel/module.c Fri Jul 5 12:57:12 2002
+++ edited/kernel/module.c Tue Dec 31 11:24:55 2002
@@ -314,7 +314,7 @@
}
/* check that we have permission to do this */
- error = security_ops->module_create(name, size);
+ error = security_module_create(name, size);
if (error)
goto err1;
@@ -506,7 +506,7 @@
}
/* check that we have permission to do this */
- error = security_ops->module_initialize(mod);
+ error = security_module_initialize(mod);
if (error)
goto err3;
error = -EINVAL;
@@ -632,7 +632,7 @@
spin_lock(&unload_lock);
if (!__MOD_IN_USE(mod)) {
/* check that we have permission to do this */
- error = security_ops->module_delete(mod);
+ error = security_module_delete(mod);
if (error) {
spin_unlock(&unload_lock);
goto out;
@@ -668,7 +668,7 @@
/* check that we have permission to do this
* an error is not propagated if perm fails
*/
- if (security_ops->module_delete(mod)) {
+ if (security_module_delete(mod)) {
spin_unlock(&unload_lock);
continue;
}
===== kernel/printk.c 1.9 vs edited =====
--- 1.9/kernel/printk.c Fri Mar 1 02:01:05 2002
+++ edited/kernel/printk.c Tue Dec 31 11:24:56 2002
@@ -26,6 +26,7 @@
#include <linux/module.h>
#include <linux/interrupt.h> /* For in_interrupt() */
#include <linux/config.h>
+#include <linux/security.h>
#include <asm/uaccess.h>
@@ -172,7 +173,7 @@
char c;
int error = 0;
- error = security_ops->syslog(type);
+ error = security_syslog(type);
if( error )
return error;
===== kernel/ptrace.c 1.10 vs edited =====
--- 1.10/kernel/ptrace.c Wed Jun 5 21:51:16 2002
+++ edited/kernel/ptrace.c Tue Dec 31 11:24:56 2002
@@ -12,6 +12,7 @@
#include <linux/mm.h>
#include <linux/highmem.h>
#include <linux/smp_lock.h>
+#include <linux/security.h>
#include <asm/pgtable.h>
#include <asm/uaccess.h>
@@ -76,7 +77,7 @@
/* the same process cannot be attached many times */
if (task->ptrace & PT_PTRACED)
goto bad;
- retval = security_ops->ptrace(current, task);
+ retval = security_ptrace(current, task);
if (retval)
goto bad;
===== kernel/sched.c 1.24 vs edited =====
--- 1.24/kernel/sched.c Thu Aug 29 15:41:48 2002
+++ edited/kernel/sched.c Tue Dec 31 11:24:56 2002
@@ -884,7 +884,7 @@
if (newprio > 19)
newprio = 19;
- retval = security_ops->task_setnice(current, newprio);
+ retval = security_task_setnice(current, newprio);
if (retval)
return retval;
@@ -957,7 +957,7 @@
!capable(CAP_SYS_NICE))
goto out_unlock;
- retval = security_ops->task_setscheduler(p, policy, &lp);
+ retval = security_task_setscheduler(p, policy, &lp);
if (retval)
goto out_unlock;
@@ -999,7 +999,7 @@
read_lock(&tasklist_lock);
p = find_process_by_pid(pid);
if (p) {
- retval = security_ops->task_getscheduler(p);
+ retval = security_task_getscheduler(p);
if (!retval)
retval = p->policy & ~SCHED_YIELD;
}
@@ -1025,7 +1025,7 @@
if (!p)
goto out_unlock;
- retval = security_ops->task_getscheduler(p);
+ retval = security_task_getscheduler(p);
if (retval)
goto out_unlock;
@@ -1151,7 +1151,7 @@
if (!p)
goto out_unlock;
- retval = security_ops->task_getscheduler(p);
+ retval = security_task_getscheduler(p);
if (retval)
goto out_unlock;
@@ -1295,7 +1295,7 @@
/* cpus_allowed? */
/* rt_priority? */
/* signals? */
- security_ops->task_reparent_to_init(this_task);
+ security_task_reparent_to_init(this_task);
memcpy(this_task->rlim, init_task.rlim, sizeof(*(this_task->rlim)));
this_task->user = INIT_USER;
===== kernel/signal.c 1.12 vs edited =====
--- 1.12/kernel/signal.c Tue Nov 26 14:53:09 2002
+++ edited/kernel/signal.c Tue Dec 31 11:24:56 2002
@@ -13,6 +13,7 @@
#include <linux/smp_lock.h>
#include <linux/init.h>
#include <linux/sched.h>
+#include <linux/security.h>
#include <asm/uaccess.h>
@@ -525,7 +526,7 @@
ret = -EPERM;
if (bad_signal(sig, info, t))
goto out_nolock;
- ret = security_ops->task_kill(t, info, sig);
+ ret = security_task_kill(t, info, sig);
if (ret)
goto out_nolock;
===== kernel/sys.c 1.21 vs edited =====
--- 1.21/kernel/sys.c Tue Jul 16 19:43:03 2002
+++ edited/kernel/sys.c Tue Dec 31 11:24:57 2002
@@ -224,7 +224,7 @@
error = -EACCES;
continue;
}
- no_nice = security_ops->task_setnice(p, niceval);
+ no_nice = security_task_setnice(p, niceval);
if (no_nice) {
error = no_nice;
continue;
@@ -284,7 +284,7 @@
if (!capable(CAP_SYS_BOOT))
return -EPERM;
- retval = security_ops->reboot(cmd);
+ retval = security_reboot(cmd);
if (retval) {
return retval;
}
@@ -395,7 +395,7 @@
int new_egid = old_egid;
int retval = 0;
- retval = security_ops->task_setgid(rgid, egid, (gid_t)-1, LSM_SETID_RE);
+ retval = security_task_setgid(rgid, egid, (gid_t)-1, LSM_SETID_RE);
if (retval)
return retval;
@@ -441,7 +441,7 @@
int old_egid = current->egid;
int retval;
- retval = security_ops->task_setgid(gid, (gid_t)-1, (gid_t)-1, LSM_SETID_ID);
+ retval = security_task_setgid(gid, (gid_t)-1, (gid_t)-1, LSM_SETID_ID);
if (retval)
return retval;
@@ -515,7 +515,7 @@
int old_ruid, old_euid, old_suid, new_ruid, new_euid;
int retval;
- retval = security_ops->task_setuid(ruid, euid, (uid_t)-1, LSM_SETID_RE);
+ retval = security_task_setuid(ruid, euid, (uid_t)-1, LSM_SETID_RE);
if (retval)
return retval;
@@ -554,7 +554,7 @@
current->suid = current->euid;
current->fsuid = current->euid;
- return security_ops->task_post_setuid(old_ruid, old_euid, old_suid, LSM_SETID_RE);
+ return security_task_post_setuid(old_ruid, old_euid, old_suid, LSM_SETID_RE);
}
@@ -576,7 +576,7 @@
int old_ruid, old_suid, new_ruid, new_suid;
int retval;
- retval = security_ops->task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_ID);
+ retval = security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_ID);
if (retval)
return retval;
@@ -599,7 +599,7 @@
current->fsuid = current->euid = uid;
current->suid = new_suid;
- return security_ops->task_post_setuid(old_ruid, old_euid, old_suid, LSM_SETID_ID);
+ return security_task_post_setuid(old_ruid, old_euid, old_suid, LSM_SETID_ID);
}
@@ -614,7 +614,7 @@
int old_suid = current->suid;
int retval;
- retval = security_ops->task_setuid(ruid, euid, suid, LSM_SETID_RES);
+ retval = security_task_setuid(ruid, euid, suid, LSM_SETID_RES);
if (retval)
return retval;
@@ -645,7 +645,7 @@
if (suid != (uid_t) -1)
current->suid = suid;
- return security_ops->task_post_setuid(old_ruid, old_euid, old_suid, LSM_SETID_RES);
+ return security_task_post_setuid(old_ruid, old_euid, old_suid, LSM_SETID_RES);
}
asmlinkage long sys_getresuid(uid_t *ruid, uid_t *euid, uid_t *suid)
@@ -666,7 +666,7 @@
{
int retval;
- retval = security_ops->task_setgid(rgid, egid, sgid, LSM_SETID_RES);
+ retval = security_task_setgid(rgid, egid, sgid, LSM_SETID_RES);
if (retval)
return retval;
@@ -720,7 +720,7 @@
int old_fsuid;
int retval;
- retval = security_ops->task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS);
+ retval = security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS);
if (retval)
return retval;
@@ -737,7 +737,7 @@
current->fsuid = uid;
}
- retval = security_ops->task_post_setuid(old_fsuid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS);
+ retval = security_task_post_setuid(old_fsuid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS);
if (retval)
return retval;
@@ -752,7 +752,7 @@
int old_fsgid;
int retval;
- retval = security_ops->task_setgid(gid, (gid_t)-1, (gid_t)-1, LSM_SETID_FS);
+ retval = security_task_setgid(gid, (gid_t)-1, (gid_t)-1, LSM_SETID_FS);
if (retval)
return retval;
@@ -843,7 +843,7 @@
}
ok_pgid:
- err = security_ops->task_setpgid(p, pgid);
+ err = security_task_setpgid(p, pgid);
if (err)
goto out;
@@ -868,7 +868,7 @@
retval = -ESRCH;
if (p) {
- retval = security_ops->task_getpgid(p);
+ retval = security_task_getpgid(p);
if (!retval)
retval = p->pgrp;
}
@@ -896,7 +896,7 @@
retval = -ESRCH;
if(p) {
- retval = security_ops->task_getsid(p);
+ retval = security_task_getsid(p);
if (!retval)
retval = p->session;
}
@@ -966,7 +966,7 @@
return -EINVAL;
if(copy_from_user(groups, grouplist, gidsetsize * sizeof(gid_t)))
return -EFAULT;
- retval = security_ops->task_setgroups(gidsetsize, groups);
+ retval = security_task_setgroups(gidsetsize, groups);
if (retval)
return retval;
memcpy(current->groups, groups, gidsetsize * sizeof(gid_t));
@@ -1035,7 +1035,7 @@
return -EFAULT;
nodename[len] = 0;
- errno = security_ops->sethostname(nodename);
+ errno = security_sethostname(nodename);
if (errno)
return errno;
@@ -1079,7 +1079,7 @@
return -EFAULT;
domainname[len] = 0;
- errno = security_ops->setdomainname(domainname);
+ errno = security_setdomainname(domainname);
if (errno)
return errno;
@@ -1139,7 +1139,7 @@
return -EPERM;
}
- retval = security_ops->task_setrlimit(resource, &new_rlim);
+ retval = security_task_setrlimit(resource, &new_rlim);
if (retval)
return retval;
@@ -1220,7 +1220,7 @@
int error = 0;
int sig;
- error = security_ops->task_prctl(option, arg2, arg3, arg4, arg5);
+ error = security_task_prctl(option, arg2, arg3, arg4, arg5);
if (error)
return error;
===== kernel/sysctl.c 1.16 vs edited =====
--- 1.16/kernel/sysctl.c Tue Jul 16 21:25:35 2002
+++ edited/kernel/sysctl.c Tue Dec 31 11:24:57 2002
@@ -30,6 +30,7 @@
#include <linux/init.h>
#include <linux/sysrq.h>
#include <linux/highuid.h>
+#include <linux/security.h>
#include <asm/uaccess.h>
@@ -393,7 +394,7 @@
static inline int ctl_perm(ctl_table *table, int op)
{
int error;
- error = security_ops->sysctl(table, op);
+ error = security_sysctl(table, op);
if(error) {
return error;
}
===== kernel/time.c 1.6 vs edited =====
--- 1.6/kernel/time.c Tue Aug 6 12:50:46 2002
+++ edited/kernel/time.c Tue Dec 31 11:24:57 2002
@@ -155,7 +155,7 @@
return -EPERM;
/* Call the Linux Security Module to perform its checks */
- error = security_ops->settime(tv, tz);
+ error = security_settime(tv, tz);
if (error)
return error;
===== kernel/uid16.c 1.3 vs edited =====
--- 1.3/kernel/uid16.c Fri Jul 5 12:57:12 2002
+++ edited/kernel/uid16.c Tue Dec 31 11:24:57 2002
@@ -140,7 +140,7 @@
return -EFAULT;
for (i = 0 ; i < gidsetsize ; i++)
new_groups[i] = (gid_t)groups[i];
- i = security_ops->task_setgroups(gidsetsize, new_groups);
+ i = security_task_setgroups(gidsetsize, new_groups);
if (i)
return i;
memcpy(current->groups, new_groups, gidsetsize * sizeof(gid_t));
===== mm/filemap.c 1.38 vs edited =====
--- 1.38/mm/filemap.c Tue Oct 8 16:49:09 2002
+++ edited/mm/filemap.c Tue Dec 31 11:24:58 2002
@@ -1766,7 +1766,7 @@
if (retval)
goto fput_in;
- retval = security_ops->file_permission (in_file, MAY_READ);
+ retval = security_file_permission (in_file, MAY_READ);
if (retval)
goto fput_in;
@@ -1787,7 +1787,7 @@
if (retval)
goto fput_out;
- retval = security_ops->file_permission (out_file, MAY_WRITE);
+ retval = security_file_permission (out_file, MAY_WRITE);
if (retval)
goto fput_out;
===== mm/mmap.c 1.20 vs edited =====
--- 1.20/mm/mmap.c Tue Oct 15 20:26:03 2002
+++ edited/mm/mmap.c Tue Dec 31 11:24:58 2002
@@ -479,7 +479,7 @@
}
}
- error = security_ops->file_mmap(file, prot, flags);
+ error = security_file_mmap(file, prot, flags);
if (error)
return error;
===== mm/mprotect.c 1.6 vs edited =====
--- 1.6/mm/mprotect.c Tue Jul 16 19:43:03 2002
+++ edited/mm/mprotect.c Tue Dec 31 11:24:58 2002
@@ -301,7 +301,7 @@
goto out;
}
- error = security_ops->file_mprotect(vma, prot);
+ error = security_file_mprotect(vma, prot);
if (error)
goto out;
===== mm/oom_kill.c 1.11 vs edited =====
--- 1.11/mm/oom_kill.c Wed Aug 28 16:23:18 2002
+++ edited/mm/oom_kill.c Tue Dec 31 11:24:58 2002
@@ -20,6 +20,7 @@
#include <linux/swap.h>
#include <linux/swapctl.h>
#include <linux/timex.h>
+#include <linux/security.h>
/* #define DEBUG */
@@ -89,7 +90,7 @@
* Superuser processes are usually more important, so we make it
* less likely that we kill those.
*/
- if (!security_ops->capable(p,CAP_SYS_ADMIN) ||
+ if (!security_capable(p,CAP_SYS_ADMIN) ||
p->uid == 0 || p->euid == 0)
points /= 4;
@@ -99,7 +100,7 @@
* tend to only have this flag set on applications they think
* of as important.
*/
- if (!security_ops->capable(p,CAP_SYS_RAWIO))
+ if (!security_capable(p,CAP_SYS_RAWIO))
points /= 4;
#ifdef DEBUG
printk(KERN_DEBUG "OOMkill: task %d (%s) got %d points\n",
@@ -150,7 +151,7 @@
p->flags |= PF_MEMALLOC | PF_MEMDIE;
/* This process has hardware access, be more careful. */
- if (!security_ops->capable(p,CAP_SYS_RAWIO)) {
+ if (!security_capable(p,CAP_SYS_RAWIO)) {
force_sig(SIGTERM, p);
} else {
force_sig(SIGKILL, p);
===== mm/swapfile.c 1.19 vs edited =====
--- 1.19/mm/swapfile.c Mon Jun 24 16:10:52 2002
+++ edited/mm/swapfile.c Tue Dec 31 11:24:58 2002
@@ -14,6 +14,7 @@
#include <linux/vmalloc.h>
#include <linux/pagemap.h>
#include <linux/shm.h>
+#include <linux/security.h>
#include <asm/pgtable.h>
@@ -731,7 +732,7 @@
prev = type;
}
- err = security_ops->swapoff(p);
+ err = security_swapoff(p);
if (err) {
swap_list_unlock();
goto out_dput;
@@ -916,7 +917,7 @@
p->swap_vfsmnt = nd.mnt;
swap_inode = nd.dentry->d_inode;
- error = security_ops->swapon(p);
+ error = security_swapon(p);
if (error)
goto bad_swap_2;
===== net/socket.c 1.14 vs edited =====
--- 1.14/net/socket.c Wed Aug 28 16:23:18 2002
+++ edited/net/socket.c Tue Dec 31 11:24:59 2002
@@ -502,7 +502,7 @@
int err;
struct scm_cookie scm;
- err = security_ops->socket_sendmsg(sock, msg, size);
+ err = security_socket_sendmsg(sock, msg, size);
if (err)
return err;
@@ -519,7 +519,7 @@
struct scm_cookie scm;
int err;
- err = security_ops->socket_recvmsg(sock, msg, size, flags);
+ err = security_socket_recvmsg(sock, msg, size, flags);
if (err)
return err;
@@ -858,7 +858,7 @@
family = PF_PACKET;
}
- err = security_ops->socket_create(family, type, protocol);
+ err = security_socket_create(family, type, protocol);
if (err)
return err;
@@ -907,7 +907,7 @@
*res = sock;
- security_ops->socket_post_create(sock, family, type, protocol);
+ security_socket_post_create(sock, family, type, protocol);
out:
net_family_read_unlock();
@@ -1019,7 +1019,7 @@
if((sock = sockfd_lookup(fd,&err))!=NULL)
{
if((err=move_addr_to_kernel(umyaddr,addrlen,address))>=0) {
- err = security_ops->socket_bind(sock, (struct sockaddr *)address, addrlen);
+ err = security_socket_bind(sock, (struct sockaddr *)address, addrlen);
if (err) {
sockfd_put(sock);
return err;
@@ -1047,7 +1047,7 @@
if ((unsigned) backlog > SOMAXCONN)
backlog = SOMAXCONN;
- err = security_ops->socket_listen(sock, backlog);
+ err = security_socket_listen(sock, backlog);
if (err) {
sockfd_put(sock);
return err;
@@ -1089,7 +1089,7 @@
newsock->type = sock->type;
newsock->ops = sock->ops;
- err = security_ops->socket_accept(sock, newsock);
+ err = security_socket_accept(sock, newsock);
if (err)
goto out_release;
@@ -1112,7 +1112,7 @@
if ((err = sock_map_fd(newsock)) < 0)
goto out_release;
- security_ops->socket_post_accept(sock, newsock);
+ security_socket_post_accept(sock, newsock);
out_put:
sockfd_put(sock);
@@ -1150,7 +1150,7 @@
if (err < 0)
goto out_put;
- err = security_ops->socket_connect(sock, (struct sockaddr *)address, addrlen);
+ err = security_socket_connect(sock, (struct sockaddr *)address, addrlen);
if (err)
goto out_put;
@@ -1178,7 +1178,7 @@
if (!sock)
goto out;
- err = security_ops->socket_getsockname(sock);
+ err = security_socket_getsockname(sock);
if (err)
goto out_put;
@@ -1206,7 +1206,7 @@
if ((sock = sockfd_lookup(fd, &err))!=NULL)
{
- err = security_ops->socket_getpeername(sock);
+ err = security_socket_getpeername(sock);
if (err) {
sockfd_put(sock);
return err;
@@ -1340,7 +1340,7 @@
if ((sock = sockfd_lookup(fd, &err))!=NULL)
{
- err = security_ops->socket_setsockopt(sock,level,optname);
+ err = security_socket_setsockopt(sock,level,optname);
if (err) {
sockfd_put(sock);
return err;
@@ -1367,7 +1367,7 @@
if ((sock = sockfd_lookup(fd, &err))!=NULL)
{
- err = security_ops->socket_getsockopt(sock, level,
+ err = security_socket_getsockopt(sock, level,
optname);
if (err) {
sockfd_put(sock);
@@ -1395,7 +1395,7 @@
if ((sock = sockfd_lookup(fd, &err))!=NULL)
{
- err = security_ops->socket_shutdown(sock, how);
+ err = security_socket_shutdown(sock, how);
if (err) {
sockfd_put(sock);
return err;
===== net/core/datagram.c 1.6 vs edited =====
--- 1.6/net/core/datagram.c Fri Jul 5 12:57:12 2002
+++ edited/net/core/datagram.c Tue Dec 31 11:24:59 2002
@@ -165,7 +165,7 @@
skb = skb_dequeue(&sk->receive_queue);
if (skb) {
- security_ops->skb_recv_datagram(skb, sk, flags);
+ security_skb_recv_datagram(skb, sk, flags);
return skb;
}
===== net/core/dev.c 1.23 vs edited =====
--- 1.23/net/core/dev.c Tue Oct 29 19:23:41 2002
+++ edited/net/core/dev.c Tue Dec 31 11:24:59 2002
@@ -2581,7 +2581,7 @@
free_divert_blk(dev);
#endif
- security_ops->netdev_unregister(dev);
+ security_netdev_unregister(dev);
if (dev->features & NETIF_F_DYNALLOC) {
#ifdef NET_REFCNT_DEBUG
===== net/core/rtnetlink.c 1.6 vs edited =====
--- 1.6/net/core/rtnetlink.c Tue Aug 6 12:50:46 2002
+++ edited/net/core/rtnetlink.c Tue Dec 31 11:24:59 2002
@@ -316,7 +316,7 @@
sz_idx = type>>2;
kind = type&3;
- if (kind != 2 && security_ops->netlink_recv(skb)) {
+ if (kind != 2 && security_netlink_recv(skb)) {
*errp = -EPERM;
return -1;
}
===== net/core/scm.c 1.4 vs edited =====
--- 1.4/net/core/scm.c Fri Jul 5 12:57:12 2002
+++ edited/net/core/scm.c Tue Dec 31 11:25:00 2002
@@ -217,7 +217,7 @@
for (i=0, cmfptr=(int*)CMSG_DATA(cm); i<fdmax; i++, cmfptr++)
{
int new_fd;
- err = security_ops->file_receive(fp[i]);
+ err = security_file_receive(fp[i]);
if (err)
break;
err = get_unused_fd();
===== net/core/skbuff.c 1.11 vs edited =====
--- 1.11/net/core/skbuff.c Thu Oct 10 09:46:41 2002
+++ edited/net/core/skbuff.c Tue Dec 31 11:25:00 2002
@@ -191,7 +191,7 @@
if (data == NULL)
goto nodata;
- if (security_ops->skb_alloc_security(skb, gfp_mask)) {
+ if (security_skb_alloc(skb, gfp_mask)) {
kfree(data);
goto nodata;
}
@@ -333,7 +333,7 @@
#ifdef CONFIG_NETFILTER
nf_conntrack_put(skb->nfct);
#endif
- security_ops->skb_free_security(skb);
+ security_skb_free(skb);
skb_headerinit(skb, NULL, 0); /* clean state */
kfree_skbmem(skb);
}
@@ -363,7 +363,7 @@
return NULL;
}
- if (security_ops->skb_clone(n, skb)) {
+ if (security_skb_clone(n, skb)) {
skb_head_to_pool(n);
return NULL;
}
@@ -454,7 +454,7 @@
#ifdef CONFIG_NET_SCHED
new->tc_index = old->tc_index;
#endif
- security_ops->skb_copy(new, old);
+ security_skb_copy(new, old);
}
/**
===== net/core/sock.c 1.9 vs edited =====
--- 1.9/net/core/sock.c Fri Aug 16 03:57:33 2002
+++ edited/net/core/sock.c Tue Dec 31 11:25:00 2002
@@ -591,7 +591,7 @@
sock_lock_init(sk);
}
sk->security = NULL;
- if (security_ops->socket_sock_alloc_security(sk, priority)) {
+ if (security_sock_alloc(sk, priority)) {
kmem_cache_free(sk_cachep, sk);
return NULL;
}
@@ -620,7 +620,7 @@
if (atomic_read(&sk->omem_alloc))
printk(KERN_DEBUG "sk_free: optmem leakage (%d bytes) detected.\n", atomic_read(&sk->omem_alloc));
- security_ops->socket_sock_free_security(sk);
+ security_sock_free(sk);
kmem_cache_free(sk_cachep, sk);
}
===== net/ipv4/ip_fragment.c 1.7 vs edited =====
--- 1.7/net/ipv4/ip_fragment.c Fri Jul 5 12:57:12 2002
+++ edited/net/ipv4/ip_fragment.c Tue Dec 31 11:25:00 2002
@@ -375,7 +375,7 @@
int flags, offset;
int ihl, end, ret;
- ret = security_ops->ip_defragment(skb);
+ ret = security_ip_defragment(skb);
if (ret)
goto err;
===== net/ipv4/ip_gre.c 1.9 vs edited =====
--- 1.9/net/ipv4/ip_gre.c Tue Oct 8 16:49:09 2002
+++ edited/net/ipv4/ip_gre.c Tue Dec 31 11:25:00 2002
@@ -651,7 +651,7 @@
skb->nf_debug = 0;
#endif
#endif
- security_ops->ip_decapsulate(skb);
+ security_ip_decapsulate(skb);
ipgre_ecn_decapsulate(iph, skb);
netif_rx(skb);
read_unlock(&ipgre_lock);
@@ -884,7 +884,7 @@
skb->nf_debug = 0;
#endif
#endif
- security_ops->ip_encapsulate(skb);
+ security_ip_encapsulate(skb);
IPTUNNEL_XMIT();
tunnel->recursion--;
===== net/ipv4/ip_options.c 1.6 vs edited =====
--- 1.6/net/ipv4/ip_options.c Thu Sep 26 00:19:02 2002
+++ edited/net/ipv4/ip_options.c Tue Dec 31 11:25:01 2002
@@ -435,7 +435,7 @@
case IPOPT_SEC:
case IPOPT_CIPSO:
case IPOPT_SID:
- if (security_ops->ip_decode_options(skb, optptr, &pp_ptr))
+ if (security_ip_decode_options(skb, optptr, &pp_ptr))
goto error;
break;
default:
===== net/ipv4/ip_output.c 1.14 vs edited =====
--- 1.14/net/ipv4/ip_output.c Tue Oct 8 16:49:09 2002
+++ edited/net/ipv4/ip_output.c Tue Dec 31 11:25:01 2002
@@ -883,7 +883,7 @@
skb2->nf_debug = skb->nf_debug;
#endif
#endif
- security_ops->ip_fragment(skb2, skb);
+ security_ip_fragment(skb2, skb);
/*
* Put this fragment into the sending queue.
===== net/ipv4/ipip.c 1.10 vs edited =====
--- 1.10/net/ipv4/ipip.c Tue Oct 8 16:49:09 2002
+++ edited/net/ipv4/ipip.c Tue Dec 31 11:25:01 2002
@@ -500,7 +500,7 @@
skb->nf_debug = 0;
#endif
#endif
- security_ops->ip_decapsulate(skb);
+ security_ip_decapsulate(skb);
ipip_ecn_decapsulate(iph, skb);
netif_rx(skb);
read_unlock(&ipip_lock);
@@ -653,7 +653,7 @@
#endif
#endif
- security_ops->ip_encapsulate(skb);
+ security_ip_encapsulate(skb);
IPTUNNEL_XMIT();
tunnel->recursion--;
===== net/ipv4/ipmr.c 1.9 vs edited =====
--- 1.9/net/ipv4/ipmr.c Tue Oct 8 16:49:09 2002
+++ edited/net/ipv4/ipmr.c Tue Dec 31 11:25:01 2002
@@ -1100,7 +1100,7 @@
nf_conntrack_put(skb->nfct);
skb->nfct = NULL;
#endif
- security_ops->ip_encapsulate(skb);
+ security_ip_encapsulate(skb);
}
static inline int ipmr_forward_finish(struct sk_buff *skb)
@@ -1446,7 +1446,7 @@
nf_conntrack_put(skb->nfct);
skb->nfct = NULL;
#endif
- security_ops->ip_decapsulate(skb);
+ security_ip_decapsulate(skb);
netif_rx(skb);
dev_put(reg_dev);
return 0;
@@ -1514,7 +1514,7 @@
nf_conntrack_put(skb->nfct);
skb->nfct = NULL;
#endif
- security_ops->ip_decapsulate(skb);
+ security_ip_decapsulate(skb);
netif_rx(skb);
dev_put(reg_dev);
return 0;
===== net/ipv4/syncookies.c 1.8 vs edited =====
--- 1.8/net/ipv4/syncookies.c Mon Oct 21 09:25:19 2002
+++ edited/net/ipv4/syncookies.c Tue Dec 31 11:25:01 2002
@@ -179,7 +179,7 @@
goto out;
}
- security_ops->tcp_connection_request(sk, skb, req);
+ security_tcp_connection_request(sk, skb, req);
/* Try to redo what tcp_v4_send_synack did. */
req->window_clamp = rt->u.dst.window;
===== net/ipv4/tcp_ipv4.c 1.14 vs edited =====
--- 1.14/net/ipv4/tcp_ipv4.c Mon Oct 21 09:43:12 2002
+++ edited/net/ipv4/tcp_ipv4.c Tue Dec 31 11:25:02 2002
@@ -1299,7 +1299,7 @@
if (skb) {
struct tcphdr *th = skb->h.th;
- security_ops->tcp_synack(sk, skb, req);
+ security_tcp_synack(sk, skb, req);
th->check = tcp_v4_check(th, skb->len,
req->af.v4_req.loc_addr, req->af.v4_req.rmt_addr,
@@ -1509,7 +1509,7 @@
}
req->snt_isn = isn;
- security_ops->tcp_connection_request(sk, skb, req);
+ security_tcp_connection_request(sk, skb, req);
if (tcp_v4_send_synack(sk, req, dst))
goto drop_and_free;
@@ -1762,7 +1762,7 @@
if(!ipsec_sk_policy(sk,skb))
goto discard_and_relse;
- if (security_ops->socket_sock_rcv_skb(sk, skb))
+ if (security_sock_rcv_skb(sk, skb))
goto discard_and_relse;
if (sk->state == TCP_TIME_WAIT)
===== net/ipv4/tcp_minisocks.c 1.12 vs edited =====
--- 1.12/net/ipv4/tcp_minisocks.c Mon Oct 21 09:43:12 2002
+++ edited/net/ipv4/tcp_minisocks.c Tue Dec 31 11:25:02 2002
@@ -786,7 +786,7 @@
TCP_INC_STATS_BH(TcpPassiveOpens);
- security_ops->tcp_create_openreq_child(sk, newsk, skb, req);
+ security_tcp_create_openreq_child(sk, newsk, skb, req);
}
return newsk;
}
===== net/ipv4/netfilter/ip_queue.c 1.9 vs edited =====
--- 1.9/net/ipv4/netfilter/ip_queue.c Thu Aug 29 15:45:28 2002
+++ edited/net/ipv4/netfilter/ip_queue.c Tue Dec 31 11:25:02 2002
@@ -496,7 +496,7 @@
if (type <= IPQM_BASE)
return;
- if (security_ops->netlink_recv(skb))
+ if (security_netlink_recv(skb))
RCV_SKB_FAIL(-EPERM);
write_lock_bh(&queue_lock);
===== net/netlink/af_netlink.c 1.7 vs edited =====
--- 1.7/net/netlink/af_netlink.c Tue Aug 6 12:50:46 2002
+++ edited/net/netlink/af_netlink.c Tue Dec 31 11:25:02 2002
@@ -613,7 +613,7 @@
to corresponding kernel module. --ANK (980802)
*/
- err = security_ops->netlink_send(skb);
+ err = security_netlink_send(skb);
if (err) {
kfree_skb(skb);
goto out;
===== net/unix/af_unix.c 1.22 vs edited =====
--- 1.22/net/unix/af_unix.c Thu Aug 29 15:41:48 2002
+++ edited/net/unix/af_unix.c Tue Dec 31 11:25:02 2002
@@ -802,7 +802,7 @@
if (!unix_may_send(sk, other))
goto out_unlock;
- err = security_ops->unix_may_send(sk->socket, other->socket);
+ err = security_unix_may_send(sk->socket, other->socket);
if (err)
goto out_unlock;
@@ -970,7 +970,7 @@
goto restart;
}
- err = security_ops->unix_stream_connect(sock, other->socket, newsk);
+ err = security_unix_stream_connect(sock, other->socket, newsk);
if (err) {
unix_state_wunlock(sk);
goto out_unlock;
@@ -1271,7 +1271,7 @@
if (other->shutdown&RCV_SHUTDOWN)
goto out_unlock;
- err = security_ops->unix_may_send(sk->socket, other->socket);
+ err = security_unix_may_send(sk->socket, other->socket);
if (err)
goto out_unlock;
===== security/Config.in 1.17 vs edited =====
--- 1.17/security/Config.in Fri Jul 12 11:55:09 2002
+++ edited/security/Config.in Tue Dec 31 11:25:03 2002
@@ -3,15 +3,17 @@
#
mainmenu_option next_comment
comment 'Security options'
-tristate 'Capabilities Support' CONFIG_SECURITY_CAPABILITIES
-source security/selinux/Config.in
-dep_tristate 'LSM port of Openwall (EXPERIMENTAL)' CONFIG_SECURITY_OWLSM $CONFIG_EXPERIMENTAL
-if [ "$CONFIG_SECURITY_OWLSM" = "y" -o "$CONFIG_SECURITY_OWLSM" = "m" ]; then
+bool 'Enable different security models' CONFIG_SECURITY
+if [ "$CONFIG_SECURITY" != "n" ]; then
+ tristate 'Capabilities Support' CONFIG_SECURITY_CAPABILITIES
+ source security/selinux/Config.in
+ dep_tristate 'LSM port of Openwall (EXPERIMENTAL)' CONFIG_SECURITY_OWLSM $CONFIG_EXPERIMENTAL
+ if [ "$CONFIG_SECURITY_OWLSM" = "y" -o "$CONFIG_SECURITY_OWLSM" = "m" ]; then
bool ' Add RLIMITS_NPROC check to execve' CONFIG_OWLSM_RLIMIT_NPROC
bool ' Restricted links in /tmp' CONFIG_OWLSM_LINK
bool ' Special handling of fd 0, 1, and 2' CONFIG_OWLSM_FD
+ fi
+ dep_tristate 'Domain and Type Enforcement (EXPERIMENTAL)' CONFIG_SECURITY_DTE $CONFIG_EXPERIMENTAL
+ source security/lids/Config.in
fi
-dep_tristate 'Domain and Type Enforcement (EXPERIMENTAL)' CONFIG_SECURITY_DTE $CONFIG_EXPERIMENTAL
-source security/lids/Config.in
-#dep_tristate 'Linux Intrusion Detection System(EXPERIMENTAL)' CONFIG_LIDS $CONFIG_EXPERIMENTAL
endmenu
===== security/Makefile 1.20 vs edited =====
--- 1.20/security/Makefile Fri Jul 12 11:55:09 2002
+++ edited/security/Makefile Tue Dec 31 11:25:03 2002
@@ -12,10 +12,15 @@
subdir-$(CONFIG_LIDS) += lids
# Objects that export symbols
-export-objs := security.o
+export-objs := security.o capability.o
+
+# if we don't select a security model, use the default capabilities
+ifneq ($(CONFIG_SECURITY),y)
+obj-y += capability.o
+endif
# Object file lists
-obj-y := security.o dummy.o
+obj-$(CONFIG_SECURITY) += security.o dummy.o
# Must precede capabilities in order to stack properly.
ifeq ($(CONFIG_SECURITY_SELINUX),y)
===== security/capability.c 1.92 vs edited =====
--- 1.92/security/capability.c Mon Oct 21 09:25:19 2002
+++ edited/security/capability.c Tue Dec 31 11:25:03 2002
@@ -13,40 +13,21 @@
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/security.h>
+#include <linux/file.h>
#include <linux/mm.h>
#include <linux/smp_lock.h>
#include <linux/skbuff.h>
#include <linux/netlink.h>
-/* flag to keep track of how we were registered */
-static int secondary;
-
-static int cap_sethostname (char *hostname)
-{
- return 0;
-}
-
-static int cap_setdomainname (char *domainname)
-{
- return 0;
-}
-
-static int cap_reboot (unsigned int cmd)
-{
- return 0;
-}
-
-static int cap_ioperm (unsigned long from, unsigned long num, int turn_on)
-{
- return 0;
-}
-
-static int cap_iopl (unsigned int old, unsigned int level)
+#ifndef CONFIG_SECURITY
+asmlinkage long sys_security (unsigned int id, unsigned int call,
+ unsigned long *args)
{
- return 0;
+ return -ENOSYS;
}
+#endif
-static int cap_capable (struct task_struct *tsk, int cap)
+int cap_capable (struct task_struct *tsk, int cap)
{
/* Derived from include/linux/sched.h:capable. */
if (cap_raised (tsk->cap_effective, cap))
@@ -55,66 +36,20 @@
return -EPERM;
}
-static int cap_sys_security (unsigned int id, unsigned int call,
- unsigned long *args)
-{
- return -ENOSYS;
-}
-
-static int cap_swapon (struct swap_info_struct *swap)
-{
- return 0;
-}
-
-static int cap_swapoff (struct swap_info_struct *swap)
-{
- return 0;
-}
-
-static int cap_nfsservctl (int cmd, struct nfsctl_arg *arg)
-{
- return 0;
-}
-
-static int cap_quotactl (int cmds, int type, int id, struct super_block *sb)
-{
- return 0;
-}
-
-static int cap_quota_on (struct file *f)
-{
- return 0;
-}
-
-static int cap_bdflush (int func, long data)
-{
- return 0;
-}
-
-static int cap_syslog (int type)
-{
- return 0;
-}
-
-static int cap_settime (struct timeval *tv, struct timezone *tz)
-{
- return 0;
-}
-
-static int cap_netlink_send (struct sk_buff *skb)
+int cap_netlink_send (struct sk_buff *skb)
{
NETLINK_CB (skb).eff_cap = current->cap_effective;
return 0;
}
-static int cap_netlink_recv (struct sk_buff *skb)
+int cap_netlink_recv (struct sk_buff *skb)
{
if (!cap_raised (NETLINK_CB (skb).eff_cap, CAP_NET_ADMIN))
return -EPERM;
return 0;
}
-static int cap_ptrace (struct task_struct *parent, struct task_struct *child)
+int cap_ptrace (struct task_struct *parent, struct task_struct *child)
{
/* Derived from arch/i386/kernel/ptrace.c:sys_ptrace. */
if (!cap_issubset (child->cap_permitted, current->cap_permitted) &&
@@ -124,8 +59,8 @@
return 0;
}
-static int cap_capget (struct task_struct *target, kernel_cap_t * effective,
- kernel_cap_t * inheritable, kernel_cap_t * permitted)
+int cap_capget (struct task_struct *target, kernel_cap_t *effective,
+ kernel_cap_t *inheritable, kernel_cap_t *permitted)
{
/* Derived from kernel/capability.c:sys_capget. */
*effective = cap_t (target->cap_effective);
@@ -134,10 +69,8 @@
return 0;
}
-static int cap_capset_check (struct task_struct *target,
- kernel_cap_t * effective,
- kernel_cap_t * inheritable,
- kernel_cap_t * permitted)
+int cap_capset_check (struct task_struct *target, kernel_cap_t *effective,
+ kernel_cap_t *inheritable, kernel_cap_t *permitted)
{
/* Derived from kernel/capability.c:sys_capset. */
/* verify restrictions on target's new Inheritable set */
@@ -162,32 +95,15 @@
return 0;
}
-static void cap_capset_set (struct task_struct *target,
- kernel_cap_t * effective,
- kernel_cap_t * inheritable,
- kernel_cap_t * permitted)
+void cap_capset_set (struct task_struct *target, kernel_cap_t *effective,
+ kernel_cap_t *inheritable, kernel_cap_t *permitted)
{
target->cap_effective = *effective;
target->cap_inheritable = *inheritable;
target->cap_permitted = *permitted;
}
-static int cap_acct (struct file *file)
-{
- return 0;
-}
-
-static int cap_sysctl (ctl_table * table, int op)
-{
- return 0;
-}
-
-static int cap_bprm_alloc_security (struct linux_binprm *bprm)
-{
- return 0;
-}
-
-static int cap_bprm_set_security (struct linux_binprm *bprm)
+int cap_bprm_set_security (struct linux_binprm *bprm)
{
/* Copied from fs/exec.c:prepare_binprm. */
@@ -215,23 +131,13 @@
return 0;
}
-static int cap_bprm_check_security (struct linux_binprm *bprm)
-{
- return 0;
-}
-
-static void cap_bprm_free_security (struct linux_binprm *bprm)
-{
- return;
-}
-
/* Copied from fs/exec.c */
static inline int must_not_trace_exec (struct task_struct *p)
{
return (p->ptrace & PT_PTRACED) && !(p->ptrace & PT_PTRACE_CAP);
}
-static void cap_bprm_compute_creds (struct linux_binprm *bprm)
+void cap_bprm_compute_creds (struct linux_binprm *bprm)
{
/* Derived from fs/exec.c:compute_creds. */
kernel_cap_t new_permitted, working;
@@ -276,298 +182,6 @@
current->keep_capabilities = 0;
}
-static int cap_sb_alloc_security (struct super_block *sb)
-{
- return 0;
-}
-
-static void cap_sb_free_security (struct super_block *sb)
-{
- return;
-}
-
-static int cap_sb_kern_mount (struct super_block *sb)
-{
- return 0;
-}
-
-static int cap_sb_statfs (struct super_block *sb)
-{
- return 0;
-}
-
-static int cap_mount (char *dev_name, struct nameidata *nd, char *type,
- unsigned long flags, void *data)
-{
- return 0;
-}
-
-static int cap_check_sb (struct vfsmount *mnt, struct nameidata *nd)
-{
- return 0;
-}
-
-static int cap_umount (struct vfsmount *mnt, int flags)
-{
- return 0;
-}
-
-static void cap_umount_close (struct vfsmount *mnt)
-{
- return;
-}
-
-static void cap_umount_busy (struct vfsmount *mnt)
-{
- return;
-}
-
-static void cap_post_remount (struct vfsmount *mnt, unsigned long flags,
- void *data)
-{
- return;
-}
-
-static void cap_post_mountroot (void)
-{
- return;
-}
-
-static void cap_post_addmount (struct vfsmount *mnt, struct nameidata *nd)
-{
- return;
-}
-
-static int cap_pivotroot (struct nameidata *old_nd, struct nameidata *new_nd)
-{
- return 0;
-}
-
-static void cap_post_pivotroot (struct nameidata *old_nd, struct nameidata *new_nd)
-{
- return;
-}
-
-static int cap_inode_alloc_security (struct inode *inode)
-{
- return 0;
-}
-
-static void cap_inode_free_security (struct inode *inode)
-{
- return;
-}
-
-static int cap_inode_create (struct inode *inode, struct dentry *dentry,
- int mask)
-{
- return 0;
-}
-
-static void cap_inode_post_create (struct inode *inode, struct dentry *dentry,
- int mask)
-{
- return;
-}
-
-static int cap_inode_link (struct dentry *old_dentry, struct inode *inode,
- struct dentry *new_dentry)
-{
- return 0;
-}
-
-static void cap_inode_post_link (struct dentry *old_dentry, struct inode *inode,
- struct dentry *new_dentry)
-{
- return;
-}
-
-static int cap_inode_unlink (struct inode *inode, struct dentry *dentry)
-{
- return 0;
-}
-
-static int cap_inode_symlink (struct inode *inode, struct dentry *dentry,
- const char *name)
-{
- return 0;
-}
-
-static void cap_inode_post_symlink (struct inode *inode, struct dentry *dentry,
- const char *name)
-{
- return;
-}
-
-static int cap_inode_mkdir (struct inode *inode, struct dentry *dentry,
- int mask)
-{
- return 0;
-}
-
-static void cap_inode_post_mkdir (struct inode *inode, struct dentry *dentry,
- int mask)
-{
- return;
-}
-
-static int cap_inode_rmdir (struct inode *inode, struct dentry *dentry)
-{
- return 0;
-}
-
-static int cap_inode_mknod (struct inode *inode, struct dentry *dentry,
- int major, dev_t minor)
-{
- return 0;
-}
-
-static void cap_inode_post_mknod (struct inode *inode, struct dentry *dentry,
- int major, dev_t minor)
-{
- return;
-}
-
-static int cap_inode_rename (struct inode *old_inode, struct dentry *old_dentry,
- struct inode *new_inode, struct dentry *new_dentry)
-{
- return 0;
-}
-
-static void cap_inode_post_rename (struct inode *old_inode,
- struct dentry *old_dentry,
- struct inode *new_inode,
- struct dentry *new_dentry)
-{
- return;
-}
-
-static int cap_inode_readlink (struct dentry *dentry)
-{
- return 0;
-}
-
-static int cap_inode_follow_link (struct dentry *dentry,
- struct nameidata *nameidata)
-{
- return 0;
-}
-
-static int cap_inode_permission (struct inode *inode, int mask)
-{
- return 0;
-}
-
-static int cap_inode_revalidate (struct dentry *inode)
-{
- return 0;
-}
-
-static int cap_inode_setattr (struct dentry *dentry, struct iattr *iattr)
-{
- return 0;
-}
-
-static int cap_inode_stat (struct inode *inode)
-{
- return 0;
-}
-
-static void cap_post_lookup (struct inode *ino, struct dentry *d)
-{
- return;
-}
-
-static void cap_delete (struct inode *ino)
-{
- return;
-}
-
-static int cap_file_permission (struct file *file, int mask)
-{
- return 0;
-}
-
-static int cap_file_alloc_security (struct file *file)
-{
- return 0;
-}
-
-static void cap_file_free_security (struct file *file)
-{
- return;
-}
-
-static int cap_file_llseek (struct file *file)
-{
- return 0;
-}
-
-static int cap_file_ioctl (struct file *file, unsigned int command,
- unsigned long arg)
-{
- return 0;
-}
-
-static int cap_file_mmap (struct file *file, unsigned long prot,
- unsigned long flags)
-{
- return 0;
-}
-
-static int cap_file_mprotect (struct vm_area_struct *vma, unsigned long prot)
-{
- return 0;
-}
-
-static int cap_file_lock (struct file *file, unsigned int cmd)
-{
- return 0;
-}
-
-static int cap_file_fcntl (struct file *file, unsigned int cmd,
- unsigned long arg)
-{
- return 0;
-}
-
-static int cap_file_set_fowner (struct file *file)
-{
- return 0;
-}
-
-static int cap_file_send_sigiotask (struct task_struct *tsk,
- struct fown_struct *fown, int fd,
- int reason)
-{
- return 0;
-}
-
-static int cap_file_receive (struct file *file)
-{
- return 0;
-}
-
-static int cap_task_create (unsigned long clone_flags)
-{
- return 0;
-}
-
-static int cap_task_alloc_security (struct task_struct *p)
-{
- return 0;
-}
-
-static void cap_task_free_security (struct task_struct *p)
-{
- return;
-}
-
-static int cap_task_setuid (uid_t id0, uid_t id1, uid_t id2, int flags)
-{
- return 0;
-}
-
/* moved from kernel/sys.c. */
/*
* cap_emulate_setxuid() fixes the effective / permitted capabilities of
@@ -615,8 +229,8 @@
}
}
-static int cap_task_post_setuid (uid_t old_ruid, uid_t old_euid, uid_t old_suid,
- int flags)
+int cap_task_post_setuid (uid_t old_ruid, uid_t old_euid, uid_t old_suid,
+ int flags)
{
switch (flags) {
case LSM_SETID_RE:
@@ -658,75 +272,13 @@
return 0;
}
-static int cap_task_setgid (gid_t id0, gid_t id1, gid_t id2, int flags)
-{
- return 0;
-}
-
-static int cap_task_setpgid (struct task_struct *p, pid_t pgid)
-{
- return 0;
-}
-
-static int cap_task_getpgid (struct task_struct *p)
-{
- return 0;
-}
-
-static int cap_task_getsid (struct task_struct *p)
-{
- return 0;
-}
-
-static int cap_task_setgroups (int gidsetsize, gid_t * grouplist)
-{
- return 0;
-}
-
-static int cap_task_setnice (struct task_struct *p, int nice)
-{
- return 0;
-}
-
-static int cap_task_setrlimit (unsigned int resource, struct rlimit *new_rlim)
-{
- return 0;
-}
-
-static int cap_task_setscheduler (struct task_struct *p, int policy,
- struct sched_param *lp)
-{
- return 0;
-}
-
-static int cap_task_getscheduler (struct task_struct *p)
-{
- return 0;
-}
-
-static int cap_task_wait (struct task_struct *p)
-{
- return 0;
-}
-
-static int cap_task_kill (struct task_struct *p, struct siginfo *info, int sig)
-{
- return 0;
-}
-
-static int cap_task_prctl (int option, unsigned long arg2, unsigned long arg3,
- unsigned long arg4, unsigned long arg5)
-{
- return 0;
-}
-
-static void cap_task_kmod_set_label (void)
+void cap_task_kmod_set_label (void)
{
cap_set_full (current->cap_effective);
return;
}
-static void cap_task_reparent_to_init (struct task_struct *p)
+void cap_task_reparent_to_init (struct task_struct *p)
{
p->cap_effective = CAP_INIT_EFF_SET;
p->cap_inheritable = CAP_INIT_INH_SET;
@@ -735,29 +287,8 @@
return;
}
-static void cap_ip_fragment (struct sk_buff *newskb,
- const struct sk_buff *oldskb)
-{
- return;
-}
-
-static int cap_ip_defragment (struct sk_buff *skb)
-{
- return 0;
-}
-
-static void cap_ip_encapsulate (struct sk_buff *skb)
-{
- return;
-}
-
-static void cap_ip_decapsulate (struct sk_buff *skb)
-{
- return;
-}
-
-static int cap_ip_decode_options (struct sk_buff *skb, const char *optptr,
- unsigned char **pp_ptr)
+int cap_ip_decode_options (struct sk_buff *skb, const char *optptr,
+ unsigned char **pp_ptr)
{
if (!skb && !capable (CAP_NET_RAW)) {
(const unsigned char *) *pp_ptr = optptr;
@@ -766,482 +297,39 @@
return 0;
}
-static void cap_netdev_unregister (struct net_device *dev)
-{
- return;
-}
-
-static int cap_socket_create (int family, int type, int protocol)
-{
- return 0;
-}
-
-static void cap_socket_post_create (struct socket *sock, int family, int type,
- int protocol)
-{
- return;
-}
-
-static int cap_socket_bind (struct socket *sock, struct sockaddr *address,
- int addrlen)
-{
- return 0;
-}
+EXPORT_SYMBOL(cap_capable);
+EXPORT_SYMBOL(cap_ptrace);
+EXPORT_SYMBOL(cap_capget);
+EXPORT_SYMBOL(cap_capset_check);
+EXPORT_SYMBOL(cap_capset_set);
+EXPORT_SYMBOL(cap_bprm_set_security);
+EXPORT_SYMBOL(cap_bprm_compute_creds);
+EXPORT_SYMBOL(cap_task_post_setuid);
+EXPORT_SYMBOL(cap_task_kmod_set_label);
+EXPORT_SYMBOL(cap_task_reparent_to_init);
+EXPORT_SYMBOL(cap_netlink_send);
+EXPORT_SYMBOL(cap_netlink_recv);
+EXPORT_SYMBOL(cap_ip_decode_options);
-static int cap_socket_connect (struct socket *sock, struct sockaddr *address,
- int addrlen)
-{
- return 0;
-}
-
-static int cap_socket_listen (struct socket *sock, int backlog)
-{
- return 0;
-}
-
-static int cap_socket_accept (struct socket *sock, struct socket *newsock)
-{
- return 0;
-}
-
-static void cap_socket_post_accept (struct socket *sock,
- struct socket *newsock)
-{
- return;
-}
-
-static int cap_socket_sendmsg (struct socket *sock, struct msghdr *msg,
- int size)
-{
- return 0;
-}
-
-static int cap_socket_recvmsg (struct socket *sock, struct msghdr *msg,
- int size, int flags)
-{
- return 0;
-}
-
-static int cap_socket_getsockname (struct socket *sock)
-{
- return 0;
-}
-
-static int cap_socket_getpeername (struct socket *sock)
-{
- return 0;
-}
-
-static int cap_socket_setsockopt (struct socket *sock, int level, int optname)
-{
- return 0;
-}
-
-static int cap_socket_getsockopt (struct socket *sock, int level, int optname)
-{
- return 0;
-}
-
-static int cap_socket_shutdown (struct socket *sock, int how)
-{
- return 0;
-}
-
-static int cap_socket_sock_alloc_security(struct sock *sk, int gfp_mask)
-{
- return 0;
-}
-
-static void cap_socket_sock_free_security(struct sock *sk)
-{
- return;
-}
-
-static int cap_socket_sock_rcv_skb (struct sock *sk, struct sk_buff *skb)
-{
- return 0;
-}
-
-static int cap_open_request_alloc_security(struct open_request * req)
-{
- return 0;
-}
-
-static void cap_open_request_free_security(struct open_request * req)
-{
- return;
-}
-
-static void cap_tcp_connection_request(struct sock *sk, struct sk_buff * skb,
- struct open_request *req)
-{
- return;
-}
-
-static void cap_tcp_synack(struct sock *sk, struct sk_buff * skb,
- struct open_request *req)
-{
- return;
-}
-
-static void cap_tcp_create_openreq_child(struct sock *sk, struct sock *newsk,
- struct sk_buff *skb,
- struct open_request *req)
-{
- return;
-}
-
-static int cap_socket_unix_stream_connect (struct socket *sock,
- struct socket *other,
- struct sock *newsk)
-{
- return 0;
-}
-
-static int cap_socket_unix_may_send (struct socket *sock, struct socket *other)
-{
- return 0;
-}
-
-static int cap_module_create (const char *name_user, size_t size)
-{
- return 0;
-}
-
-static int cap_module_initialize (struct module *mod_user)
-{
- return 0;
-}
-
-static int cap_module_delete (const struct module *mod)
-{
- return 0;
-}
-
-static int cap_ipc_permission (struct kern_ipc_perm *ipcp, short flag)
-{
- return 0;
-}
-
-static int cap_ipc_getinfo (int id, int cmd)
-{
- return 0;
-}
-
-static int cap_msg_msg_alloc_security (struct msg_msg *msg)
-{
- return 0;
-}
-
-static void cap_msg_msg_free_security (struct msg_msg *msg)
-{
- return;
-}
-
-static int cap_msg_queue_alloc_security (struct msg_queue *msq)
-{
- return 0;
-}
-
-static void cap_msg_queue_free_security (struct msg_queue *msq)
-{
- return;
-}
-
-static int cap_msg_queue_associate (struct msg_queue *msq, int msgid,
- int msgflg)
-{
- return 0;
-}
-
-static int cap_msg_queue_msgctl (struct msg_queue *msq, int msgid, int cmd)
-{
- return 0;
-}
-
-static int cap_msg_queue_msgsnd (struct msg_queue *msq, struct msg_msg *msg,
- int msgid, int msgflg)
-{
- return 0;
-}
-
-static int cap_msg_queue_msgrcv (struct msg_queue *msq, struct msg_msg *msg,
- struct task_struct *target, long type,
- int mode)
-{
- return 0;
-}
-
-static int cap_shm_alloc_security (struct shmid_kernel *shp)
-{
- return 0;
-}
-
-static void cap_shm_free_security (struct shmid_kernel *shp)
-{
- return;
-}
-
-static int cap_shm_associate (struct shmid_kernel *shp, int shmid, int shmflg)
-{
- return 0;
-}
-
-static int cap_shm_shmctl (struct shmid_kernel *shp, int shmid, int cmd)
-{
- return 0;
-}
-
-static int cap_shm_shmat (struct shmid_kernel *shp, int shmid, char *shmaddr,
- int shmflg)
-{
- return 0;
-}
-
-static int cap_sem_alloc_security (struct sem_array *sma)
-{
- return 0;
-}
-
-static void cap_sem_free_security (struct sem_array *sma)
-{
- return;
-}
-
-static int cap_sem_associate (struct sem_array *sma, int semid, int semflg)
-{
- return 0;
-}
-
-static int cap_sem_semctl (struct sem_array *sma, int semid, int cmd)
-{
- return 0;
-}
-
-static int cap_sem_semop (struct sem_array *sma, int semid, struct sembuf *sops,
- unsigned nsops, int alter)
-{
- return 0;
-}
-
-static int cap_skb_alloc_security (struct sk_buff *skb, int gfp_mask)
-{
- return 0;
-}
-
-static int cap_skb_clone (struct sk_buff *newskb, const struct sk_buff *oldskb)
-{
- return 0;
-}
-
-static void cap_skb_copy (struct sk_buff *newskb, const struct sk_buff *oldskb)
-{
- return;
-}
-
-static void cap_skb_set_owner_w (struct sk_buff *skb, struct sock *sk)
-{
- return;
-}
-
-static void cap_skb_recv_datagram (struct sk_buff *skb, struct sock *sk,
- unsigned flags)
-{
- return;
-}
-
-static void cap_skb_free_security (struct sk_buff *skb)
-{
- return;
-}
-
-static int cap_register (const char *name, struct security_operations *ops)
-{
- return -EINVAL;
-}
-
-static int cap_unregister (const char *name, struct security_operations *ops)
-{
- return -EINVAL;
-}
+#ifdef CONFIG_SECURITY
static struct security_operations capability_ops = {
- sethostname: cap_sethostname,
- setdomainname: cap_setdomainname,
- reboot: cap_reboot,
- ioperm: cap_ioperm,
- iopl: cap_iopl,
- ptrace: cap_ptrace,
- capget: cap_capget,
- capset_check: cap_capset_check,
- capset_set: cap_capset_set,
- acct: cap_acct,
- sysctl: cap_sysctl,
- capable: cap_capable,
- sys_security: cap_sys_security,
- swapon: cap_swapon,
- swapoff: cap_swapoff,
- nfsservctl: cap_nfsservctl,
- quotactl: cap_quotactl,
- quota_on: cap_quota_on,
- bdflush: cap_bdflush,
- syslog: cap_syslog,
- settime: cap_settime,
-
- netlink_send: cap_netlink_send,
- netlink_recv: cap_netlink_recv,
-
- unix_stream_connect: cap_socket_unix_stream_connect,
- unix_may_send: cap_socket_unix_may_send,
-
- bprm_alloc_security: cap_bprm_alloc_security,
- bprm_free_security: cap_bprm_free_security,
- bprm_compute_creds: cap_bprm_compute_creds,
- bprm_set_security: cap_bprm_set_security,
- bprm_check_security: cap_bprm_check_security,
-
- sb_alloc_security: cap_sb_alloc_security,
- sb_free_security: cap_sb_free_security,
- sb_kern_mount: cap_sb_kern_mount,
- sb_statfs: cap_sb_statfs,
- sb_mount: cap_mount,
- sb_check_sb: cap_check_sb,
- sb_umount: cap_umount,
- sb_umount_close: cap_umount_close,
- sb_umount_busy: cap_umount_busy,
- sb_post_remount: cap_post_remount,
- sb_post_mountroot: cap_post_mountroot,
- sb_post_addmount: cap_post_addmount,
- sb_pivotroot: cap_pivotroot,
- sb_post_pivotroot: cap_post_pivotroot,
-
- inode_alloc_security: cap_inode_alloc_security,
- inode_free_security: cap_inode_free_security,
- inode_create: cap_inode_create,
- inode_post_create: cap_inode_post_create,
- inode_link: cap_inode_link,
- inode_post_link: cap_inode_post_link,
- inode_unlink: cap_inode_unlink,
- inode_symlink: cap_inode_symlink,
- inode_post_symlink: cap_inode_post_symlink,
- inode_mkdir: cap_inode_mkdir,
- inode_post_mkdir: cap_inode_post_mkdir,
- inode_rmdir: cap_inode_rmdir,
- inode_mknod: cap_inode_mknod,
- inode_post_mknod: cap_inode_post_mknod,
- inode_rename: cap_inode_rename,
- inode_post_rename: cap_inode_post_rename,
- inode_readlink: cap_inode_readlink,
- inode_follow_link: cap_inode_follow_link,
- inode_permission: cap_inode_permission,
- inode_revalidate: cap_inode_revalidate,
- inode_setattr: cap_inode_setattr,
- inode_stat: cap_inode_stat,
- inode_post_lookup: cap_post_lookup,
- inode_delete: cap_delete,
-
- file_permission: cap_file_permission,
- file_alloc_security: cap_file_alloc_security,
- file_free_security: cap_file_free_security,
- file_llseek: cap_file_llseek,
- file_ioctl: cap_file_ioctl,
- file_mmap: cap_file_mmap,
- file_mprotect: cap_file_mprotect,
- file_lock: cap_file_lock,
- file_fcntl: cap_file_fcntl,
- file_set_fowner: cap_file_set_fowner,
- file_send_sigiotask: cap_file_send_sigiotask,
- file_receive: cap_file_receive,
-
- task_create: cap_task_create,
- task_alloc_security: cap_task_alloc_security,
- task_free_security: cap_task_free_security,
- task_setuid: cap_task_setuid,
- task_post_setuid: cap_task_post_setuid,
- task_setgid: cap_task_setgid,
- task_setpgid: cap_task_setpgid,
- task_getpgid: cap_task_getpgid,
- task_getsid: cap_task_getsid,
- task_setgroups: cap_task_setgroups,
- task_setnice: cap_task_setnice,
- task_setrlimit: cap_task_setrlimit,
- task_setscheduler: cap_task_setscheduler,
- task_getscheduler: cap_task_getscheduler,
- task_wait: cap_task_wait,
- task_kill: cap_task_kill,
- task_prctl: cap_task_prctl,
- task_kmod_set_label: cap_task_kmod_set_label,
- task_reparent_to_init: cap_task_reparent_to_init,
-
- socket_create: cap_socket_create,
- socket_post_create: cap_socket_post_create,
- socket_bind: cap_socket_bind,
- socket_connect: cap_socket_connect,
- socket_listen: cap_socket_listen,
- socket_accept: cap_socket_accept,
- socket_post_accept: cap_socket_post_accept,
- socket_sendmsg: cap_socket_sendmsg,
- socket_recvmsg: cap_socket_recvmsg,
- socket_getsockname: cap_socket_getsockname,
- socket_getpeername: cap_socket_getpeername,
- socket_getsockopt: cap_socket_getsockopt,
- socket_setsockopt: cap_socket_setsockopt,
- socket_shutdown: cap_socket_shutdown,
- socket_sock_alloc_security: cap_socket_sock_alloc_security,
- socket_sock_free_security: cap_socket_sock_free_security,
- socket_sock_rcv_skb: cap_socket_sock_rcv_skb,
- open_request_alloc_security: cap_open_request_alloc_security,
- open_request_free_security: cap_open_request_free_security,
- tcp_connection_request: cap_tcp_connection_request,
- tcp_synack: cap_tcp_synack,
- tcp_create_openreq_child: cap_tcp_create_openreq_child,
-
- skb_alloc_security: cap_skb_alloc_security,
- skb_clone: cap_skb_clone,
- skb_copy: cap_skb_copy,
- skb_set_owner_w: cap_skb_set_owner_w,
- skb_recv_datagram: cap_skb_recv_datagram,
- skb_free_security: cap_skb_free_security,
-
- ip_fragment: cap_ip_fragment,
- ip_defragment: cap_ip_defragment,
- ip_encapsulate: cap_ip_encapsulate,
- ip_decapsulate: cap_ip_decapsulate,
- ip_decode_options: cap_ip_decode_options,
-
- netdev_unregister: cap_netdev_unregister,
-
- module_create: cap_module_create,
- module_initialize: cap_module_initialize,
- module_delete: cap_module_delete,
-
- ipc_permission: cap_ipc_permission,
- ipc_getinfo: cap_ipc_getinfo,
-
- msg_msg_alloc_security: cap_msg_msg_alloc_security,
- msg_msg_free_security: cap_msg_msg_free_security,
-
- msg_queue_alloc_security: cap_msg_queue_alloc_security,
- msg_queue_free_security: cap_msg_queue_free_security,
- msg_queue_associate: cap_msg_queue_associate,
- msg_queue_msgctl: cap_msg_queue_msgctl,
- msg_queue_msgsnd: cap_msg_queue_msgsnd,
- msg_queue_msgrcv: cap_msg_queue_msgrcv,
-
- shm_alloc_security: cap_shm_alloc_security,
- shm_free_security: cap_shm_free_security,
- shm_associate: cap_shm_associate,
- shm_shmctl: cap_shm_shmctl,
- shm_shmat: cap_shm_shmat,
-
- sem_alloc_security: cap_sem_alloc_security,
- sem_free_security: cap_sem_free_security,
- sem_associate: cap_sem_associate,
- sem_semctl: cap_sem_semctl,
- sem_semop: cap_sem_semop,
-
- register_security: cap_register,
- unregister_security: cap_unregister,
+ .ptrace = cap_ptrace,
+ .capget = cap_capget,
+ .capset_check = cap_capset_check,
+ .capset_set = cap_capset_set,
+ .capable = cap_capable,
+ .netlink_send = cap_netlink_send,
+ .netlink_recv = cap_netlink_recv,
+
+ .bprm_compute_creds = cap_bprm_compute_creds,
+ .bprm_set_security = cap_bprm_set_security,
+
+ .task_post_setuid = cap_task_post_setuid,
+ .task_kmod_set_label = cap_task_kmod_set_label,
+ .task_reparent_to_init = cap_task_reparent_to_init,
+
+ .ip_decode_options = cap_ip_decode_options,
};
#if defined(CONFIG_SECURITY_CAPABILITIES_MODULE)
@@ -1250,6 +338,10 @@
#define MY_NAME "capability"
#endif
+/* flag to keep track of how we were registered */
+static int secondary;
+
+
static int __init capability_init (void)
{
/* register ourselves with the security framework */
@@ -1289,3 +381,5 @@
MODULE_DESCRIPTION("Standard Linux Capabilities Security Module");
MODULE_LICENSE("GPL");
+
+#endif /* CONFIG_SECURITY */
===== security/dummy.c 1.26 vs edited =====
--- 1.26/security/dummy.c Mon Oct 21 09:25:20 2002
+++ edited/security/dummy.c Tue Dec 31 11:25:04 2002
@@ -3,7 +3,7 @@
* security model is loaded.
*
* Copyright (C) 2001 WireX Communications, Inc <chrisat_private>
- * Copyright (C) 2001 Greg Kroah-Hartman <gregat_private>
+ * Copyright (C) 2001-2002 Greg Kroah-Hartman <gregat_private>
* Copyright (C) 2001 Networks Associates Technology, Inc <ssmalleyat_private>
*
* This program is free software; you can redistribute it and/or modify
@@ -12,6 +12,8 @@
* (at your option) any later version.
*/
+#undef DEBUG
+
#include <linux/config.h>
#include <linux/module.h>
#include <linux/kernel.h>
@@ -19,6 +21,37 @@
#include <linux/skbuff.h>
#include <linux/netlink.h>
+static int dummy_sys_security (unsigned int id, unsigned int call,
+ unsigned long *args)
+{
+ return -ENOSYS;
+}
+
+static int dummy_nfsservctl (int cmd, struct nfsctl_arg *arg)
+{
+ return 0;
+}
+
+static int dummy_bdflush (int func, long data)
+{
+ return 0;
+}
+
+static int dummy_module_create (const char *name_user, size_t size)
+{
+ return 0;
+}
+
+static int dummy_module_initialize (struct module *mod_user)
+{
+ return 0;
+}
+
+static int dummy_module_delete (const struct module *mod)
+{
+ return 0;
+}
+
static int dummy_sethostname (char *hostname)
{
return 0;
@@ -52,6 +85,17 @@
static int dummy_capget (struct task_struct *target, kernel_cap_t * effective,
kernel_cap_t * inheritable, kernel_cap_t * permitted)
{
+ *effective = *inheritable = *permitted = 0;
+ if (!issecure(SECURE_NOROOT)) {
+ if (target->euid == 0) {
+ *permitted |= (~0 & ~CAP_FS_MASK);
+ *effective |= (~0 & ~CAP_TO_MASK(CAP_SETPCAP) & ~CAP_FS_MASK);
+ }
+ if (target->fsuid == 0) {
+ *permitted |= CAP_FS_MASK;
+ *effective |= CAP_FS_MASK;
+ }
+ }
return 0;
}
@@ -60,7 +104,7 @@
kernel_cap_t * inheritable,
kernel_cap_t * permitted)
{
- return 0;
+ return -EPERM;
}
static void dummy_capset_set (struct task_struct *target,
@@ -91,12 +135,6 @@
return 0;
}
-static int dummy_sys_security (unsigned int id, unsigned int call,
- unsigned long *args)
-{
- return -ENOSYS;
-}
-
static int dummy_swapon (struct swap_info_struct *swap)
{
return 0;
@@ -107,11 +145,6 @@
return 0;
}
-static int dummy_nfsservctl (int cmd, struct nfsctl_arg *arg)
-{
- return 0;
-}
-
static int dummy_quotactl (int cmds, int type, int id, struct super_block *sb)
{
return 0;
@@ -122,11 +155,6 @@
return 0;
}
-static int dummy_bdflush (int func, long data)
-{
- return 0;
-}
-
static int dummy_syslog (int type)
{
return 0;
@@ -198,55 +226,55 @@
return 0;
}
-static int dummy_mount (char *dev_name, struct nameidata *nd, char *type,
- unsigned long flags, void *data)
+static int dummy_sb_mount (char *dev_name, struct nameidata *nd, char *type,
+ unsigned long flags, void *data)
{
return 0;
}
-static int dummy_check_sb (struct vfsmount *mnt, struct nameidata *nd)
+static int dummy_sb_check_sb (struct vfsmount *mnt, struct nameidata *nd)
{
return 0;
}
-static int dummy_umount (struct vfsmount *mnt, int flags)
+static int dummy_sb_umount (struct vfsmount *mnt, int flags)
{
return 0;
}
-static void dummy_umount_close (struct vfsmount *mnt)
+static void dummy_sb_umount_close (struct vfsmount *mnt)
{
return;
}
-static void dummy_umount_busy (struct vfsmount *mnt)
+static void dummy_sb_umount_busy (struct vfsmount *mnt)
{
return;
}
-static void dummy_post_remount (struct vfsmount *mnt, unsigned long flags,
- void *data)
+static void dummy_sb_post_remount (struct vfsmount *mnt, unsigned long flags,
+ void *data)
{
return;
}
-static void dummy_post_mountroot (void)
+static void dummy_sb_post_mountroot (void)
{
return;
}
-static void dummy_post_addmount (struct vfsmount *mnt, struct nameidata *nd)
+static void dummy_sb_post_addmount (struct vfsmount *mnt, struct nameidata *nd)
{
return;
}
-static int dummy_pivotroot (struct nameidata *old_nd, struct nameidata *new_nd)
+static int dummy_sb_pivotroot (struct nameidata *old_nd, struct nameidata *new_nd)
{
return 0;
}
-static void dummy_post_pivotroot (struct nameidata *old_nd, struct nameidata *new_nd)
+static void dummy_sb_post_pivotroot (struct nameidata *old_nd, struct nameidata *new_nd)
{
return;
}
@@ -321,13 +349,13 @@
}
static int dummy_inode_mknod (struct inode *inode, struct dentry *dentry,
- int major, dev_t minor)
+ int mode, dev_t dev)
{
return 0;
}
static void dummy_inode_post_mknod (struct inode *inode, struct dentry *dentry,
- int major, dev_t minor)
+ int mode, dev_t dev)
{
return;
}
@@ -364,7 +392,7 @@
return 0;
}
-static int dummy_inode_revalidate (struct dentry *inode)
+static int dummy_inode_revalidate (struct dentry *dentry)
{
return 0;
}
@@ -379,36 +407,52 @@
return 0;
}
-static void dummy_post_lookup (struct inode *ino, struct dentry *d)
+static void dummy_inode_post_lookup (struct inode *ino, struct dentry *d)
{
return;
}
-static void dummy_delete (struct inode *ino)
+static void dummy_inode_delete (struct inode *ino)
{
return;
}
-static int dummy_file_permission (struct file *file, int mask)
+static int dummy_inode_setxattr (struct dentry *dentry, char *name, void *value,
+ size_t size, int flags)
{
return 0;
}
-static int dummy_file_alloc_security (struct file *file)
+static int dummy_inode_getxattr (struct dentry *dentry, char *name)
{
return 0;
}
-static void dummy_file_free_security (struct file *file)
+static int dummy_inode_listxattr (struct dentry *dentry)
{
- return;
+ return 0;
}
-static int dummy_file_llseek (struct file *file)
+static int dummy_inode_removexattr (struct dentry *dentry, char *name)
{
return 0;
}
+static int dummy_file_permission (struct file *file, int mask)
+{
+ return 0;
+}
+
+static int dummy_file_alloc_security (struct file *file)
+{
+ return 0;
+}
+
+static void dummy_file_free_security (struct file *file)
+{
+ return;
+}
+
static int dummy_file_ioctl (struct file *file, unsigned int command,
unsigned long arg)
{
@@ -702,37 +746,22 @@
return;
}
-static void dummy_tcp_create_openreq_child(struct sock *sk, struct sock *newsk,
+static void dummy_tcp_create_openreq_child(struct sock *sk, struct sock *newsk,
struct sk_buff *skb,
struct open_request *req)
{
return;
}
-static int dummy_socket_unix_stream_connect (struct socket *sock,
- struct socket *other,
- struct sock *newsk)
-{
- return 0;
-}
-
-static int dummy_socket_unix_may_send (struct socket *sock,
- struct socket *other)
+static int dummy_unix_stream_connect (struct socket *sock,
+ struct socket *other,
+ struct sock *newsk)
{
return 0;
}
-static int dummy_module_create (const char *name_user, size_t size)
-{
- return 0;
-}
-
-static int dummy_module_initialize (struct module *mod_user)
-{
- return 0;
-}
-
-static int dummy_module_delete (const struct module *mod)
+static int dummy_unix_may_send (struct socket *sock,
+ struct socket *other)
{
return 0;
}
@@ -742,11 +771,6 @@
return 0;
}
-static int dummy_ipc_getinfo (int id, int cmd)
-{
- return 0;
-}
-
static int dummy_msg_msg_alloc_security (struct msg_msg *msg)
{
return 0;
@@ -767,19 +791,19 @@
return;
}
-static int dummy_msg_queue_associate (struct msg_queue *msq, int msqid,
+static int dummy_msg_queue_associate (struct msg_queue *msq,
int msqflg)
{
return 0;
}
-static int dummy_msg_queue_msgctl (struct msg_queue *msq, int msqid, int cmd)
+static int dummy_msg_queue_msgctl (struct msg_queue *msq, int cmd)
{
return 0;
}
static int dummy_msg_queue_msgsnd (struct msg_queue *msq, struct msg_msg *msg,
- int msqid, int msgflg)
+ int msgflg)
{
return 0;
}
@@ -801,17 +825,17 @@
return;
}
-static int dummy_shm_associate (struct shmid_kernel *shp, int shmid, int shmflg)
+static int dummy_shm_associate (struct shmid_kernel *shp, int shmflg)
{
return 0;
}
-static int dummy_shm_shmctl (struct shmid_kernel *shp, int shmid, int cmd)
+static int dummy_shm_shmctl (struct shmid_kernel *shp, int cmd)
{
return 0;
}
-static int dummy_shm_shmat (struct shmid_kernel *shp, int shmid, char *shmaddr,
+static int dummy_shm_shmat (struct shmid_kernel *shp, char *shmaddr,
int shmflg)
{
return 0;
@@ -827,17 +851,17 @@
return;
}
-static int dummy_sem_associate (struct sem_array *sma, int semid, int semflg)
+static int dummy_sem_associate (struct sem_array *sma, int semflg)
{
return 0;
}
-static int dummy_sem_semctl (struct sem_array *sma, int semid, int cmd)
+static int dummy_sem_semctl (struct sem_array *sma, int cmd)
{
return 0;
}
-static int dummy_sem_semop (struct sem_array *sma, int semid,
+static int dummy_sem_semop (struct sem_array *sma,
struct sembuf *sops, unsigned nsops, int alter)
{
return 0;
@@ -876,192 +900,188 @@
return;
}
-static int dummy_register (const char *name, struct security_operations *ops)
+static int dummy_register_security (const char *name, struct security_operations *ops)
{
return -EINVAL;
}
-static int dummy_unregister (const char *name, struct security_operations *ops)
+static int dummy_unregister_security (const char *name, struct security_operations *ops)
{
return -EINVAL;
}
-struct security_operations dummy_security_ops = {
- sethostname: dummy_sethostname,
- setdomainname: dummy_setdomainname,
- reboot: dummy_reboot,
- ioperm: dummy_ioperm,
- iopl: dummy_iopl,
- ptrace: dummy_ptrace,
- capget: dummy_capget,
- capset_check: dummy_capset_check,
- capset_set: dummy_capset_set,
- acct: dummy_acct,
- capable: dummy_capable,
- sysctl: dummy_sysctl,
- sys_security: dummy_sys_security,
- swapon: dummy_swapon,
- swapoff: dummy_swapoff,
- nfsservctl: dummy_nfsservctl,
- quotactl: dummy_quotactl,
- quota_on: dummy_quota_on,
- bdflush: dummy_bdflush,
- syslog: dummy_syslog,
- settime: dummy_settime,
-
- netlink_send: dummy_netlink_send,
- netlink_recv: dummy_netlink_recv,
-
- unix_stream_connect: dummy_socket_unix_stream_connect,
- unix_may_send: dummy_socket_unix_may_send,
-
- bprm_alloc_security: dummy_bprm_alloc_security,
- bprm_free_security: dummy_bprm_free_security,
- bprm_compute_creds: dummy_bprm_compute_creds,
- bprm_set_security: dummy_bprm_set_security,
- bprm_check_security: dummy_bprm_check_security,
-
- sb_alloc_security: dummy_sb_alloc_security,
- sb_free_security: dummy_sb_free_security,
- sb_kern_mount: dummy_sb_kern_mount,
- sb_statfs: dummy_sb_statfs,
- sb_mount: dummy_mount,
- sb_check_sb: dummy_check_sb,
- sb_umount: dummy_umount,
- sb_umount_close: dummy_umount_close,
- sb_umount_busy: dummy_umount_busy,
- sb_post_remount: dummy_post_remount,
- sb_post_mountroot: dummy_post_mountroot,
- sb_post_addmount: dummy_post_addmount,
- sb_pivotroot: dummy_pivotroot,
- sb_post_pivotroot: dummy_post_pivotroot,
-
- inode_alloc_security: dummy_inode_alloc_security,
- inode_free_security: dummy_inode_free_security,
- inode_create: dummy_inode_create,
- inode_post_create: dummy_inode_post_create,
- inode_link: dummy_inode_link,
- inode_post_link: dummy_inode_post_link,
- inode_unlink: dummy_inode_unlink,
- inode_symlink: dummy_inode_symlink,
- inode_post_symlink: dummy_inode_post_symlink,
- inode_mkdir: dummy_inode_mkdir,
- inode_post_mkdir: dummy_inode_post_mkdir,
- inode_rmdir: dummy_inode_rmdir,
- inode_mknod: dummy_inode_mknod,
- inode_post_mknod: dummy_inode_post_mknod,
- inode_rename: dummy_inode_rename,
- inode_post_rename: dummy_inode_post_rename,
- inode_readlink: dummy_inode_readlink,
- inode_follow_link: dummy_inode_follow_link,
- inode_permission: dummy_inode_permission,
- inode_revalidate: dummy_inode_revalidate,
- inode_setattr: dummy_inode_setattr,
- inode_stat: dummy_inode_stat,
- inode_post_lookup: dummy_post_lookup,
- inode_delete: dummy_delete,
-
- file_permission: dummy_file_permission,
- file_alloc_security: dummy_file_alloc_security,
- file_free_security: dummy_file_free_security,
- file_llseek: dummy_file_llseek,
- file_ioctl: dummy_file_ioctl,
- file_mmap: dummy_file_mmap,
- file_mprotect: dummy_file_mprotect,
- file_lock: dummy_file_lock,
- file_fcntl: dummy_file_fcntl,
- file_set_fowner: dummy_file_set_fowner,
- file_send_sigiotask: dummy_file_send_sigiotask,
- file_receive: dummy_file_receive,
-
- task_create: dummy_task_create,
- task_alloc_security: dummy_task_alloc_security,
- task_free_security: dummy_task_free_security,
- task_setuid: dummy_task_setuid,
- task_post_setuid: dummy_task_post_setuid,
- task_setgid: dummy_task_setgid,
- task_setpgid: dummy_task_setpgid,
- task_getpgid: dummy_task_getpgid,
- task_getsid: dummy_task_getsid,
- task_setgroups: dummy_task_setgroups,
- task_setnice: dummy_task_setnice,
- task_setrlimit: dummy_task_setrlimit,
- task_setscheduler: dummy_task_setscheduler,
- task_getscheduler: dummy_task_getscheduler,
- task_wait: dummy_task_wait,
- task_kill: dummy_task_kill,
- task_prctl: dummy_task_prctl,
- task_kmod_set_label: dummy_task_kmod_set_label,
- task_reparent_to_init: dummy_task_reparent_to_init,
-
- socket_create: dummy_socket_create,
- socket_post_create: dummy_socket_post_create,
- socket_bind: dummy_socket_bind,
- socket_connect: dummy_socket_connect,
- socket_listen: dummy_socket_listen,
- socket_accept: dummy_socket_accept,
- socket_post_accept: dummy_socket_post_accept,
- socket_sendmsg: dummy_socket_sendmsg,
- socket_recvmsg: dummy_socket_recvmsg,
- socket_getsockname: dummy_socket_getsockname,
- socket_getpeername: dummy_socket_getpeername,
- socket_getsockopt: dummy_socket_getsockopt,
- socket_setsockopt: dummy_socket_setsockopt,
- socket_shutdown: dummy_socket_shutdown,
- socket_sock_alloc_security: dummy_socket_sock_alloc_security,
- socket_sock_free_security: dummy_socket_sock_free_security,
- socket_sock_rcv_skb: dummy_socket_sock_rcv_skb,
- open_request_alloc_security: dummy_open_request_alloc_security,
- open_request_free_security: dummy_open_request_free_security,
- tcp_connection_request: dummy_tcp_connection_request,
- tcp_synack: dummy_tcp_synack,
- tcp_create_openreq_child: dummy_tcp_create_openreq_child,
-
- skb_alloc_security: dummy_skb_alloc_security,
- skb_clone: dummy_skb_clone,
- skb_copy: dummy_skb_copy,
- skb_set_owner_w: dummy_skb_set_owner_w,
- skb_recv_datagram: dummy_skb_recv_datagram,
- skb_free_security: dummy_skb_free_security,
-
- ip_fragment: dummy_ip_fragment,
- ip_defragment: dummy_ip_defragment,
- ip_encapsulate: dummy_ip_encapsulate,
- ip_decapsulate: dummy_ip_decapsulate,
- ip_decode_options: dummy_ip_decode_options,
-
- ipc_permission: dummy_ipc_permission,
- ipc_getinfo: dummy_ipc_getinfo,
-
- netdev_unregister: dummy_netdev_unregister,
-
- module_create: dummy_module_create,
- module_initialize: dummy_module_initialize,
- module_delete: dummy_module_delete,
-
- msg_msg_alloc_security: dummy_msg_msg_alloc_security,
- msg_msg_free_security: dummy_msg_msg_free_security,
-
- msg_queue_alloc_security: dummy_msg_queue_alloc_security,
- msg_queue_free_security: dummy_msg_queue_free_security,
- msg_queue_associate: dummy_msg_queue_associate,
- msg_queue_msgctl: dummy_msg_queue_msgctl,
- msg_queue_msgsnd: dummy_msg_queue_msgsnd,
- msg_queue_msgrcv: dummy_msg_queue_msgrcv,
-
- shm_alloc_security: dummy_shm_alloc_security,
- shm_free_security: dummy_shm_free_security,
- shm_associate: dummy_shm_associate,
- shm_shmctl: dummy_shm_shmctl,
- shm_shmat: dummy_shm_shmat,
-
- sem_alloc_security: dummy_sem_alloc_security,
- sem_free_security: dummy_sem_free_security,
- sem_associate: dummy_sem_associate,
- sem_semctl: dummy_sem_semctl,
- sem_semop: dummy_sem_semop,
-
- register_security: dummy_register,
- unregister_security: dummy_unregister,
-};
+struct security_operations dummy_security_ops;
+
+#define set_to_dummy_if_null(ops, function) \
+ do { \
+ if (!ops->function) { \
+ ops->function = dummy_##function; \
+ pr_debug("Had to override the " #function \
+ " security operation with the dummy one.\n");\
+ } \
+ } while (0)
+
+void security_fixup_ops (struct security_operations *ops)
+{
+ set_to_dummy_if_null(ops, sys_security);
+ set_to_dummy_if_null(ops, nfsservctl);
+ set_to_dummy_if_null(ops, bdflush);
+ set_to_dummy_if_null(ops, module_create);
+ set_to_dummy_if_null(ops, module_initialize);
+ set_to_dummy_if_null(ops, module_delete);
+ set_to_dummy_if_null(ops, ptrace);
+ set_to_dummy_if_null(ops, capget);
+ set_to_dummy_if_null(ops, capset_check);
+ set_to_dummy_if_null(ops, capset_set);
+ set_to_dummy_if_null(ops, acct);
+ set_to_dummy_if_null(ops, capable);
+ set_to_dummy_if_null(ops, quotactl);
+ set_to_dummy_if_null(ops, quota_on);
+ set_to_dummy_if_null(ops, bprm_alloc_security);
+ set_to_dummy_if_null(ops, bprm_free_security);
+ set_to_dummy_if_null(ops, bprm_compute_creds);
+ set_to_dummy_if_null(ops, bprm_set_security);
+ set_to_dummy_if_null(ops, bprm_check_security);
+ set_to_dummy_if_null(ops, sb_alloc_security);
+ set_to_dummy_if_null(ops, sb_free_security);
+ set_to_dummy_if_null(ops, sb_statfs);
+ set_to_dummy_if_null(ops, sb_mount);
+ set_to_dummy_if_null(ops, sb_check_sb);
+ set_to_dummy_if_null(ops, sb_umount);
+ set_to_dummy_if_null(ops, sb_umount_close);
+ set_to_dummy_if_null(ops, sb_umount_busy);
+ set_to_dummy_if_null(ops, sb_post_remount);
+ set_to_dummy_if_null(ops, sb_post_mountroot);
+ set_to_dummy_if_null(ops, sb_post_addmount);
+ set_to_dummy_if_null(ops, sb_pivotroot);
+ set_to_dummy_if_null(ops, sb_post_pivotroot);
+ set_to_dummy_if_null(ops, inode_alloc_security);
+ set_to_dummy_if_null(ops, inode_free_security);
+ set_to_dummy_if_null(ops, inode_create);
+ set_to_dummy_if_null(ops, inode_post_create);
+ set_to_dummy_if_null(ops, inode_link);
+ set_to_dummy_if_null(ops, inode_post_link);
+ set_to_dummy_if_null(ops, inode_unlink);
+ set_to_dummy_if_null(ops, inode_symlink);
+ set_to_dummy_if_null(ops, inode_post_symlink);
+ set_to_dummy_if_null(ops, inode_mkdir);
+ set_to_dummy_if_null(ops, inode_post_mkdir);
+ set_to_dummy_if_null(ops, inode_rmdir);
+ set_to_dummy_if_null(ops, inode_mknod);
+ set_to_dummy_if_null(ops, inode_post_mknod);
+ set_to_dummy_if_null(ops, inode_rename);
+ set_to_dummy_if_null(ops, inode_post_rename);
+ set_to_dummy_if_null(ops, inode_readlink);
+ set_to_dummy_if_null(ops, inode_follow_link);
+ set_to_dummy_if_null(ops, inode_permission);
+ set_to_dummy_if_null(ops, inode_revalidate);
+ set_to_dummy_if_null(ops, inode_setattr);
+ set_to_dummy_if_null(ops, inode_stat);
+ set_to_dummy_if_null(ops, inode_post_lookup);
+ set_to_dummy_if_null(ops, inode_delete);
+ set_to_dummy_if_null(ops, inode_setxattr);
+ set_to_dummy_if_null(ops, inode_getxattr);
+ set_to_dummy_if_null(ops, inode_listxattr);
+ set_to_dummy_if_null(ops, inode_removexattr);
+ set_to_dummy_if_null(ops, file_permission);
+ set_to_dummy_if_null(ops, file_alloc_security);
+ set_to_dummy_if_null(ops, file_free_security);
+ set_to_dummy_if_null(ops, file_ioctl);
+ set_to_dummy_if_null(ops, file_mmap);
+ set_to_dummy_if_null(ops, file_mprotect);
+ set_to_dummy_if_null(ops, file_lock);
+ set_to_dummy_if_null(ops, file_fcntl);
+ set_to_dummy_if_null(ops, file_set_fowner);
+ set_to_dummy_if_null(ops, file_send_sigiotask);
+ set_to_dummy_if_null(ops, file_receive);
+ set_to_dummy_if_null(ops, task_create);
+ set_to_dummy_if_null(ops, task_alloc_security);
+ set_to_dummy_if_null(ops, task_free_security);
+ set_to_dummy_if_null(ops, task_setuid);
+ set_to_dummy_if_null(ops, task_post_setuid);
+ set_to_dummy_if_null(ops, task_setgid);
+ set_to_dummy_if_null(ops, task_setpgid);
+ set_to_dummy_if_null(ops, task_getpgid);
+ set_to_dummy_if_null(ops, task_getsid);
+ set_to_dummy_if_null(ops, task_setgroups);
+ set_to_dummy_if_null(ops, task_setnice);
+ set_to_dummy_if_null(ops, task_setrlimit);
+ set_to_dummy_if_null(ops, task_setscheduler);
+ set_to_dummy_if_null(ops, task_getscheduler);
+ set_to_dummy_if_null(ops, task_wait);
+ set_to_dummy_if_null(ops, task_kill);
+ set_to_dummy_if_null(ops, task_prctl);
+ set_to_dummy_if_null(ops, task_kmod_set_label);
+ set_to_dummy_if_null(ops, task_reparent_to_init);
+ set_to_dummy_if_null(ops, ipc_permission);
+ set_to_dummy_if_null(ops, msg_queue_alloc_security);
+ set_to_dummy_if_null(ops, msg_queue_free_security);
+ set_to_dummy_if_null(ops, shm_alloc_security);
+ set_to_dummy_if_null(ops, shm_free_security);
+ set_to_dummy_if_null(ops, sem_alloc_security);
+ set_to_dummy_if_null(ops, sem_free_security);
+ set_to_dummy_if_null(ops, register_security);
+ set_to_dummy_if_null(ops, unregister_security);
+ set_to_dummy_if_null(ops, sethostname);
+ set_to_dummy_if_null(ops, setdomainname);
+ set_to_dummy_if_null(ops, reboot);
+ set_to_dummy_if_null(ops, ioperm);
+ set_to_dummy_if_null(ops, iopl);
+ set_to_dummy_if_null(ops, sysctl);
+ set_to_dummy_if_null(ops, swapon);
+ set_to_dummy_if_null(ops, swapoff);
+ set_to_dummy_if_null(ops, syslog);
+ set_to_dummy_if_null(ops, settime);
+ set_to_dummy_if_null(ops, netlink_send);
+ set_to_dummy_if_null(ops, netlink_recv);
+ set_to_dummy_if_null(ops, sb_kern_mount);
+ set_to_dummy_if_null(ops, ip_fragment);
+ set_to_dummy_if_null(ops, ip_defragment);
+ set_to_dummy_if_null(ops, ip_decapsulate);
+ set_to_dummy_if_null(ops, ip_encapsulate);
+ set_to_dummy_if_null(ops, ip_decode_options);
+ set_to_dummy_if_null(ops, netdev_unregister);
+ set_to_dummy_if_null(ops, socket_create);
+ set_to_dummy_if_null(ops, socket_post_create);
+ set_to_dummy_if_null(ops, socket_bind);
+ set_to_dummy_if_null(ops, socket_connect);
+ set_to_dummy_if_null(ops, socket_listen);
+ set_to_dummy_if_null(ops, socket_accept);
+ set_to_dummy_if_null(ops, socket_post_accept);
+ set_to_dummy_if_null(ops, socket_sendmsg);
+ set_to_dummy_if_null(ops, socket_recvmsg);
+ set_to_dummy_if_null(ops, socket_getsockname);
+ set_to_dummy_if_null(ops, socket_getpeername);
+ set_to_dummy_if_null(ops, socket_setsockopt);
+ set_to_dummy_if_null(ops, socket_getsockopt);
+ set_to_dummy_if_null(ops, socket_shutdown);
+ set_to_dummy_if_null(ops, socket_sock_alloc_security);
+ set_to_dummy_if_null(ops, socket_sock_free_security);
+ set_to_dummy_if_null(ops, socket_sock_rcv_skb);
+ set_to_dummy_if_null(ops, open_request_alloc_security);
+ set_to_dummy_if_null(ops, open_request_free_security);
+ set_to_dummy_if_null(ops, tcp_connection_request);
+ set_to_dummy_if_null(ops, tcp_synack);
+ set_to_dummy_if_null(ops, tcp_create_openreq_child);
+ set_to_dummy_if_null(ops, unix_stream_connect);
+ set_to_dummy_if_null(ops, unix_may_send);
+ set_to_dummy_if_null(ops, msg_msg_alloc_security);
+ set_to_dummy_if_null(ops, msg_msg_free_security);
+ set_to_dummy_if_null(ops, msg_queue_associate);
+ set_to_dummy_if_null(ops, msg_queue_msgctl);
+ set_to_dummy_if_null(ops, msg_queue_msgsnd);
+ set_to_dummy_if_null(ops, msg_queue_msgrcv);
+ set_to_dummy_if_null(ops, shm_associate);
+ set_to_dummy_if_null(ops, shm_shmctl);
+ set_to_dummy_if_null(ops, shm_shmat);
+ set_to_dummy_if_null(ops, sem_associate);
+ set_to_dummy_if_null(ops, sem_semctl);
+ set_to_dummy_if_null(ops, sem_semop);
+ set_to_dummy_if_null(ops, skb_alloc_security);
+ set_to_dummy_if_null(ops, skb_clone);
+ set_to_dummy_if_null(ops, skb_copy);
+ set_to_dummy_if_null(ops, skb_set_owner_w);
+ set_to_dummy_if_null(ops, skb_recv_datagram);
+ set_to_dummy_if_null(ops, skb_free_security);
+}
===== security/owlsm.c 1.25 vs edited =====
--- 1.25/security/owlsm.c Mon Oct 21 09:25:20 2002
+++ edited/security/owlsm.c Tue Dec 31 11:25:04 2002
@@ -419,11 +419,6 @@
return;
}
-static int owlsm_file_llseek (struct file *file)
-{
- return 0;
-}
-
static int owlsm_file_ioctl (struct file *file, unsigned int command ,
unsigned long arg)
{
@@ -752,112 +747,6 @@
return 0;
}
-static int owlsm_ipc_permission (struct kern_ipc_perm *ipcp, short flag)
-{
- return 0;
-}
-
-static int owlsm_ipc_getinfo (int id, int cmd)
-{
- return 0;
-}
-
-static int owlsm_msg_msg_alloc_security (struct msg_msg *msg)
-{
- return 0;
-}
-
-static void owlsm_msg_msg_free_security (struct msg_msg *msg)
-{
- return;
-}
-
-static int owlsm_msg_queue_alloc_security (struct msg_queue *msq)
-{
- return 0;
-}
-
-static void owlsm_msg_queue_free_security (struct msg_queue *msq)
-{
- return;
-}
-
-static int owlsm_msg_queue_associate (struct msg_queue *msq, int msgid,
- int msgflg)
-{
- return 0;
-}
-
-static int owlsm_msg_queue_msgctl (struct msg_queue *msq, int msgid, int cmd)
-{
- return 0;
-}
-
-static int owlsm_msg_queue_msgsnd (struct msg_queue *msq, struct msg_msg *msg,
- int msgid, int msgflg)
-{
- return 0;
-}
-
-static int owlsm_msg_queue_msgrcv (struct msg_queue *msq, struct msg_msg *msg,
- struct task_struct *target,
- long type, int mode)
-{
- return 0;
-}
-
-static int owlsm_shm_alloc_security (struct shmid_kernel *shp)
-{
- return 0;
-}
-
-static void owlsm_shm_free_security (struct shmid_kernel *shp)
-{
- return;
-}
-
-static int owlsm_shm_associate (struct shmid_kernel *shp, int shmid, int shmflg)
-{
- return 0;
-}
-
-static int owlsm_shm_shmctl (struct shmid_kernel *shp, int shmid, int cmd)
-{
- return 0;
-}
-
-static int owlsm_shm_shmat (struct shmid_kernel *shp, int shmid, char *shmaddr,
- int shmflg)
-{
- return 0;
-}
-
-static int owlsm_sem_alloc_security (struct sem_array *sma)
-{
- return 0;
-}
-
-static void owlsm_sem_free_security (struct sem_array *sma)
-{
- return;
-}
-
-static int owlsm_sem_associate (struct sem_array *sma, int semid, int semflg)
-{
- return 0;
-}
-
-static int owlsm_sem_semctl (struct sem_array *sma, int semid, int cmd)
-{
- return 0;
-}
-
-static int owlsm_sem_semop (struct sem_array *sma, int semid,
- struct sembuf *sops, unsigned nsops, int alter)
-{
- return 0;
-}
-
static int owlsm_skb_alloc_security (struct sk_buff *skb, int priority)
{
return 0;
@@ -979,7 +868,6 @@
file_permission: owlsm_file_permission,
file_alloc_security: owlsm_file_alloc_security,
file_free_security: owlsm_file_free_security,
- file_llseek: owlsm_file_llseek,
file_ioctl: owlsm_file_ioctl,
file_mmap: owlsm_file_mmap,
file_mprotect: owlsm_file_mprotect,
@@ -1050,31 +938,6 @@
module_create: owlsm_module_create_module,
module_initialize: owlsm_module_init_module,
module_delete: owlsm_module_delete_module,
-
- ipc_permission: owlsm_ipc_permission,
- ipc_getinfo: owlsm_ipc_getinfo,
-
- msg_msg_alloc_security: owlsm_msg_msg_alloc_security,
- msg_msg_free_security: owlsm_msg_msg_free_security,
-
- msg_queue_alloc_security: owlsm_msg_queue_alloc_security,
- msg_queue_free_security: owlsm_msg_queue_free_security,
- msg_queue_associate: owlsm_msg_queue_associate,
- msg_queue_msgctl: owlsm_msg_queue_msgctl,
- msg_queue_msgsnd: owlsm_msg_queue_msgsnd,
- msg_queue_msgrcv: owlsm_msg_queue_msgrcv,
-
- shm_alloc_security: owlsm_shm_alloc_security,
- shm_free_security: owlsm_shm_free_security,
- shm_associate: owlsm_shm_associate,
- shm_shmctl: owlsm_shm_shmctl,
- shm_shmat: owlsm_shm_shmat,
-
- sem_alloc_security: owlsm_sem_alloc_security,
- sem_free_security: owlsm_sem_free_security,
- sem_associate: owlsm_sem_associate,
- sem_semctl: owlsm_sem_semctl,
- sem_semop: owlsm_sem_semop,
register_security: owlsm_register,
unregister_security: owlsm_unregister,
===== security/security.c 1.84 vs edited =====
--- 1.84/security/security.c Fri Jul 5 12:57:13 2002
+++ edited/security/security.c Tue Dec 31 11:25:05 2002
@@ -2,7 +2,7 @@
* Security plug functions
*
* Copyright (C) 2001 WireX Communications, Inc <chrisat_private>
- * Copyright (C) 2001 Greg Kroah-Hartman <gregat_private>
+ * Copyright (C) 2001-2002 Greg Kroah-Hartman <gregat_private>
* Copyright (C) 2001 Networks Associates Technology, Inc <ssmalleyat_private>
*
* This program is free software; you can redistribute it and/or modify
@@ -20,59 +20,21 @@
#define SECURITY_SCAFFOLD_VERSION "1.0.0"
-extern struct security_operations dummy_security_ops; /* lives in dummy.c */
+/* things that live in dummy.c */
+extern struct security_operations dummy_security_ops;
+extern void security_fixup_ops (struct security_operations *ops);
struct security_operations *security_ops; /* Initialized to NULL */
-/* This macro checks that all pointers in a struct are non-NULL. It
- * can be fooled by struct padding for object tile alignment and when
- * pointers to data and pointers to functions aren't the same size.
- * Yes it's ugly, we'll replace it if it becomes a problem.
- */
-#define VERIFY_STRUCT(struct_type, s, e) \
- do { \
- unsigned long * __start = (unsigned long *)(s); \
- unsigned long * __end = __start + \
- sizeof(struct_type)/sizeof(unsigned long *); \
- while (__start != __end) { \
- if (!*__start) { \
- printk(KERN_INFO "%s is missing something\n",\
- #struct_type); \
- e++; \
- break; \
- } \
- __start++; \
- } \
- } while (0)
-
-static int inline verify (struct security_operations *ops)
+static inline int verify (struct security_operations *ops)
{
- int err;
-
/* verify the security_operations structure exists */
if (!ops) {
printk (KERN_INFO "Passed a NULL security_operations "
- "pointer, " __FUNCTION__ " failed.\n");
- return -EINVAL;
- }
-
- /* Perform a little sanity checking on our inputs */
- err = 0;
-
- /* This first check scans the whole security_ops struct for
- * missing structs or functions.
- *
- * (There is no further check now, but will leave as is until
- * the lazy registration stuff is done -- JM).
- */
- VERIFY_STRUCT(struct security_operations, ops, err);
-
- if (err) {
- printk (KERN_INFO "Not enough functions specified in the "
- "security_operation structure, " __FUNCTION__
- " failed.\n");
+ "pointer, %s failed.\n", __FUNCTION__);
return -EINVAL;
}
+ security_fixup_ops (ops);
return 0;
}
@@ -86,6 +48,12 @@
printk (KERN_INFO "Security Scaffold v" SECURITY_SCAFFOLD_VERSION
" initialized\n");
+ if (verify (&dummy_security_ops)) {
+ printk (KERN_ERR "%s could not verify "
+ "dummy_security_ops structure.\n", __FUNCTION__);
+ return -EIO;
+ }
+
security_ops = &dummy_security_ops;
return 0;
@@ -106,15 +74,15 @@
*/
int register_security (struct security_operations *ops)
{
-
if (verify (ops)) {
- printk (KERN_INFO __FUNCTION__ " could not verify "
- "security_operations structure.\n");
+ printk (KERN_INFO "%s could not verify "
+ "security_operations structure.\n", __FUNCTION__);
return -EINVAL;
}
+
if (security_ops != &dummy_security_ops) {
printk (KERN_INFO "There is already a security "
- "framework initialized, " __FUNCTION__ " failed.\n");
+ "framework initialized, %s failed.\n", __FUNCTION__);
return -EINVAL;
}
@@ -137,9 +105,9 @@
int unregister_security (struct security_operations *ops)
{
if (ops != security_ops) {
- printk (KERN_INFO __FUNCTION__ ": trying to unregister "
+ printk (KERN_INFO "%s: trying to unregister "
"a security_opts structure that is not "
- "registered, failing.\n");
+ "registered, failing.\n", __FUNCTION__);
return -EINVAL;
}
@@ -163,14 +131,14 @@
int mod_reg_security (const char *name, struct security_operations *ops)
{
if (verify (ops)) {
- printk (KERN_INFO __FUNCTION__ " could not verify "
- "security operations.\n");
+ printk (KERN_INFO "%s could not verify "
+ "security operations.\n", __FUNCTION__);
return -EINVAL;
}
if (ops == security_ops) {
- printk (KERN_INFO __FUNCTION__ " security operations "
- "already registered.\n");
+ printk (KERN_INFO "%s security operations "
+ "already registered.\n", __FUNCTION__);
return -EINVAL;
}
@@ -193,8 +161,8 @@
int mod_unreg_security (const char *name, struct security_operations *ops)
{
if (ops == security_ops) {
- printk (KERN_INFO __FUNCTION__ " invalid attempt to unregister "
- " primary security ops.\n");
+ printk (KERN_INFO "%s invalid attempt to unregister "
+ " primary security ops.\n", __FUNCTION__);
return -EINVAL;
}
@@ -238,12 +206,12 @@
asmlinkage long sys_security (unsigned int id, unsigned int call,
unsigned long *args)
{
- return security_ops->sys_security (id, call, args);
+ return security_syscall (id, call, args);
}
-EXPORT_SYMBOL (register_security);
-EXPORT_SYMBOL (unregister_security);
-EXPORT_SYMBOL (mod_reg_security);
-EXPORT_SYMBOL (mod_unreg_security);
-EXPORT_SYMBOL (capable);
-EXPORT_SYMBOL (security_ops);
+EXPORT_SYMBOL_GPL(register_security);
+EXPORT_SYMBOL_GPL(unregister_security);
+EXPORT_SYMBOL_GPL(mod_reg_security);
+EXPORT_SYMBOL_GPL(mod_unreg_security);
+EXPORT_SYMBOL(capable);
+EXPORT_SYMBOL(security_ops);
===== security/dte/dte.c 1.22 vs edited =====
--- 1.22/security/dte/dte.c Mon Oct 21 09:25:20 2002
+++ edited/security/dte/dte.c Tue Dec 31 11:25:05 2002
@@ -390,11 +390,6 @@
return;
}
-static int dte_file_llseek (struct file *file)
-{
- return 0;
-}
-
static int dte_file_ioctl (struct file *file, unsigned int command,
unsigned long arg)
{
@@ -762,112 +757,6 @@
return 0;
}
-static int dte_ipc_permission (struct kern_ipc_perm *ipcp, short flag)
-{
- return 0;
-}
-
-static int dte_ipc_getinfo (int id, int cmd)
-{
- return 0;
-}
-
-static int dte_msg_msg_alloc_security (struct msg_msg *msg)
-{
- return 0;
-}
-
-static void dte_msg_msg_free_security (struct msg_msg *msg)
-{
- return;
-}
-
-static int dte_msg_queue_alloc_security (struct msg_queue *msq)
-{
- return 0;
-}
-
-static void dte_msg_queue_free_security (struct msg_queue *msq)
-{
- return;
-}
-
-static int dte_msg_queue_associate (struct msg_queue *msq, int msgid,
- int msgflg)
-{
- return 0;
-}
-
-static int dte_msg_queue_msgctl (struct msg_queue *msq, int msgid, int cmd)
-{
- return 0;
-}
-
-static int dte_msg_queue_msgsnd (struct msg_queue *msq, struct msg_msg *msg,
- int msgid, int msgflg)
-{
- return 0;
-}
-
-static int dte_msg_queue_msgrcv (struct msg_queue *msq, struct msg_msg *msg,
- struct task_struct *target, long type,
- int mode)
-{
- return 0;
-}
-
-static int dte_shm_alloc_security (struct shmid_kernel *shp)
-{
- return 0;
-}
-
-static void dte_shm_free_security (struct shmid_kernel *shp)
-{
- return;
-}
-
-static int dte_shm_associate (struct shmid_kernel *shp, int shmid, int shmflg)
-{
- return 0;
-}
-
-static int dte_shm_shmctl (struct shmid_kernel *shp, int shmid, int cmd)
-{
- return 0;
-}
-
-static int dte_shm_shmat (struct shmid_kernel *shp, int shmid, char *shmaddr,
- int shmflg)
-{
- return 0;
-}
-
-static int dte_sem_alloc_security (struct sem_array *sma)
-{
- return 0;
-}
-
-static void dte_sem_free_security (struct sem_array *sma)
-{
- return;
-}
-
-static int dte_sem_associate (struct sem_array *sma, int semid, int semflg)
-{
- return 0;
-}
-
-static int dte_sem_semctl (struct sem_array *sma, int semid, int cmd)
-{
- return 0;
-}
-
-static int dte_sem_semop (struct sem_array *sma, int semid, struct sembuf *sops,
- unsigned nsops, int alter)
-{
- return 0;
-}
-
static int dte_skb_alloc_security (struct sk_buff *skb, int gfp_mask)
{
return 0;
@@ -1011,7 +900,6 @@
file_permission: dte_file_permission,
file_alloc_security: dte_file_alloc_security,
file_free_security: dte_file_free_security,
- file_llseek: dte_file_llseek,
file_ioctl: dte_file_ioctl,
file_mmap: dte_file_mmap,
file_mprotect: dte_file_mprotect,
@@ -1082,31 +970,6 @@
module_create: dte_module_create_module,
module_initialize: dte_module_init_module,
module_delete: dte_module_delete_module,
-
- ipc_permission: dte_ipc_permission,
- ipc_getinfo: dte_ipc_getinfo,
-
- msg_msg_alloc_security: dte_msg_msg_alloc_security,
- msg_msg_free_security: dte_msg_msg_free_security,
-
- msg_queue_alloc_security: dte_msg_queue_alloc_security,
- msg_queue_free_security: dte_msg_queue_free_security,
- msg_queue_associate: dte_msg_queue_associate,
- msg_queue_msgctl: dte_msg_queue_msgctl,
- msg_queue_msgsnd: dte_msg_queue_msgsnd,
- msg_queue_msgrcv: dte_msg_queue_msgrcv,
-
- shm_alloc_security: dte_shm_alloc_security,
- shm_free_security: dte_shm_free_security,
- shm_associate: dte_shm_associate,
- shm_shmctl: dte_shm_shmctl,
- shm_shmat: dte_shm_shmat,
-
- sem_alloc_security: dte_sem_alloc_security,
- sem_free_security: dte_sem_free_security,
- sem_associate: dte_sem_associate,
- sem_semctl: dte_sem_semctl,
- sem_semop: dte_sem_semop,
register_security: dte_register,
unregister_security: dte_unregister,
===== security/lids/lids_lsm.c 1.19 vs edited =====
--- 1.19/security/lids/lids_lsm.c Mon Oct 21 09:25:20 2002
+++ edited/security/lids/lids_lsm.c Tue Dec 31 11:25:05 2002
@@ -589,11 +589,6 @@
return;
}
-static int lids_file_llseek (struct file *file)
-{
- return 0;
-}
-
static int lids_file_ioctl (struct file *file, unsigned int command,
unsigned long arg)
{
@@ -938,112 +933,6 @@
return 0;
}
-static int lids_ipc_permission (struct kern_ipc_perm *ipcp, short flag)
-{
- return 0;
-}
-
-static int lids_ipc_getinfo (int id, int cmd)
-{
- return 0;
-}
-
-static int lids_msg_msg_alloc_security (struct msg_msg *msg)
-{
- return 0;
-}
-
-static void lids_msg_msg_free_security (struct msg_msg *msg)
-{
- return;
-}
-
-static int lids_msg_queue_alloc_security (struct msg_queue *msq)
-{
- return 0;
-}
-
-static void lids_msg_queue_free_security (struct msg_queue *msq)
-{
- return;
-}
-
-static int lids_msg_queue_associate (struct msg_queue *msq, int msqid,
- int msqflg)
-{
- return 0;
-}
-
-static int lids_msg_queue_msgctl (struct msg_queue *msq, int msqid, int cmd)
-{
- return 0;
-}
-
-static int lids_msg_queue_msgsnd (struct msg_queue *msq, struct msg_msg *msg,
- int msqid, int msgflg)
-{
- return 0;
-}
-
-static int lids_msg_queue_msgrcv (struct msg_queue *msq, struct msg_msg *msg,
- struct task_struct *target, long type,
- int mode)
-{
- return 0;
-}
-
-static int lids_shm_alloc_security (struct shmid_kernel *shp)
-{
- return 0;
-}
-
-static void lids_shm_free_security (struct shmid_kernel *shp)
-{
- return;
-}
-
-static int lids_shm_associate (struct shmid_kernel *shp, int shmid, int shmflg)
-{
- return 0;
-}
-
-static int lids_shm_shmctl (struct shmid_kernel *shp, int shmid, int cmd)
-{
- return 0;
-}
-
-static int lids_shm_shmat (struct shmid_kernel *shp, int shmid, char *shmaddr,
- int shmflg)
-{
- return 0;
-}
-
-static int lids_sem_alloc_security (struct sem_array *sma)
-{
- return 0;
-}
-
-static void lids_sem_free_security (struct sem_array *sma)
-{
- return;
-}
-
-static int lids_sem_associate (struct sem_array *sma, int semid, int semflg)
-{
- return 0;
-}
-
-static int lids_sem_semctl (struct sem_array *sma, int semid, int cmd)
-{
- return 0;
-}
-
-static int lids_sem_semop (struct sem_array *sma, int semid,
- struct sembuf *sops, unsigned nsops, int alter)
-{
- return 0;
-}
-
static int lids_skb_alloc_security (struct sk_buff *skb, int gfp_mask)
{
return 0;
@@ -1189,7 +1078,6 @@
file_permission: lids_file_permission,
file_alloc_security: lids_file_alloc_security,
file_free_security: lids_file_free_security,
- file_llseek: lids_file_llseek,
file_ioctl: lids_file_ioctl,
file_mmap: lids_file_mmap,
file_mprotect: lids_file_mprotect,
@@ -1255,36 +1143,11 @@
ip_decapsulate: lids_ip_decapsulate,
ip_decode_options: lids_ip_decode_options,
- ipc_permission: lids_ipc_permission,
- ipc_getinfo: lids_ipc_getinfo,
-
netdev_unregister: lids_netdev_unregister,
module_create: lids_module_create_module,
module_initialize: lids_module_init_module,
module_delete: lids_module_delete_module,
-
- msg_msg_alloc_security: lids_msg_msg_alloc_security,
- msg_msg_free_security: lids_msg_msg_free_security,
-
- msg_queue_alloc_security: lids_msg_queue_alloc_security,
- msg_queue_free_security: lids_msg_queue_free_security,
- msg_queue_associate: lids_msg_queue_associate,
- msg_queue_msgctl: lids_msg_queue_msgctl,
- msg_queue_msgsnd: lids_msg_queue_msgsnd,
- msg_queue_msgrcv: lids_msg_queue_msgrcv,
-
- shm_alloc_security: lids_shm_alloc_security,
- shm_free_security: lids_shm_free_security,
- shm_associate: lids_shm_associate,
- shm_shmctl: lids_shm_shmctl,
- shm_shmat: lids_shm_shmat,
-
- sem_alloc_security: lids_sem_alloc_security,
- sem_free_security: lids_sem_free_security,
- sem_associate: lids_sem_associate,
- sem_semctl: lids_sem_semctl,
- sem_semop: lids_sem_semop,
register_security: lids_register,
unregister_security: lids_unregister,
===== security/selinux/avc.c 1.10 vs edited =====
--- 1.10/security/selinux/avc.c Thu Oct 10 11:59:04 2002
+++ edited/security/selinux/avc.c Tue Dec 31 11:25:06 2002
@@ -645,7 +645,7 @@
if (a) {
switch (a->type) {
case AVC_AUDIT_DATA_IPC:
- printk(" IPCID=%d", a->u.ipc_id);
+ printk(" key=%d", a->u.ipc_id);
break;
case AVC_AUDIT_DATA_CAP:
printk(" capability=%d", a->u.cap);
===== security/selinux/hooks.c 1.41 vs edited =====
--- 1.41/security/selinux/hooks.c Wed Dec 4 09:42:51 2002
+++ edited/security/selinux/hooks.c Tue Dec 31 11:25:06 2002
@@ -2118,11 +2118,6 @@
file_free_security(file);
}
-static int selinux_file_llseek(struct file *file)
-{
- return file_has_perm(current, file, 0 /* descriptor only */);
-}
-
static int selinux_file_ioctl(struct file *file, unsigned int cmd,
unsigned long arg)
{
@@ -3423,7 +3418,7 @@
kfree(msec);
}
-static int ipc_has_perm(struct kern_ipc_perm *ipc_perms, int id,
+static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
security_class_t sclass, access_vector_t perms)
{
struct task_security_struct *tsec;
@@ -3434,7 +3429,7 @@
isec = ipc_perms->security;
AVC_AUDIT_DATA_INIT(&ad, IPC);
- ad.u.ipc_id = id;
+ ad.u.ipc_id = ipc_perms->key;
return avc_has_perm_ref_audit(tsec->sid, isec->sid, sclass,
perms, &isec->avcr, &ad);
@@ -3480,7 +3475,7 @@
isec = msq->q_perm.security;
AVC_AUDIT_DATA_INIT(&ad, IPC);
-/* ad.u.ipc_id = xxx; */ /* TBD: what to set to? */
+ ad.u.ipc_id = msq->q_perm.key;
rc = avc_has_perm_ref_audit(tsec->sid, isec->sid, SECCLASS_MSGQ,
MSGQ__CREATE, &isec->avcr, &ad);
@@ -3496,7 +3491,7 @@
ipc_free_security(&msq->q_perm);
}
-static int selinux_msg_queue_associate(struct msg_queue *msq, int msqid, int msqflg)
+static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
{
struct task_security_struct *tsec;
struct ipc_security_struct *isec;
@@ -3514,18 +3509,22 @@
}
AVC_AUDIT_DATA_INIT(&ad, IPC);
- ad.u.ipc_id = msqid;
+ ad.u.ipc_id = msq->q_perm.key;
return avc_has_perm_ref_audit(tsec->sid, isec->sid, SECCLASS_MSGQ,
MSGQ__ASSOCIATE, &isec->avcr, &ad);
}
-static int selinux_msg_queue_msgctl(struct msg_queue *msq, int msqid, int cmd)
+static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
{
int err;
int perms;
switch(cmd) {
+ case IPC_INFO:
+ case MSG_INFO:
+ /* No specific object, just general system-wide information. */
+ return task_has_system(current, SYSTEM__IPC_INFO);
case IPC_STAT:
case MSG_STAT:
perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
@@ -3540,7 +3539,7 @@
return 0;
}
- err = ipc_has_perm(&msq->q_perm, msqid, SECCLASS_MSGQ, perms);
+ err = ipc_has_perm(&msq->q_perm, SECCLASS_MSGQ, perms);
if (!err && cmd == IPC_STAT)
ipc_savesid(&msq->q_perm, SECCLASS_MSGQ);
@@ -3548,7 +3547,7 @@
}
static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg,
- int msqid, int msqflg)
+ int msqflg)
{
struct task_security_struct *tsec;
struct ipc_security_struct *isec;
@@ -3581,7 +3580,7 @@
}
AVC_AUDIT_DATA_INIT(&ad, IPC);
- ad.u.ipc_id = msqid;
+ ad.u.ipc_id = msq->q_perm.key;
/* Can this process write to the queue? */
rc = avc_has_perm_ref_audit(tsec->sid, isec->sid, SECCLASS_MSGQ,
@@ -3617,7 +3616,7 @@
tsec->out_sid[0] = SECSID_NULL;
AVC_AUDIT_DATA_INIT(&ad, IPC);
-/* ad.u.ipc_id = msqid; */
+ ad.u.ipc_id = msq->q_perm.key;
if (tsec->in_sid[0] && tsec->in_sid[0] != msec->sid) {
return -EACCES;
@@ -3652,7 +3651,7 @@
isec = shp->shm_perm.security;
AVC_AUDIT_DATA_INIT(&ad, IPC);
-/* ad.u.ipc_id = xxx; */ /* TBD: what to set to? */
+ ad.u.ipc_id = shp->shm_perm.key;
rc = avc_has_perm_ref_audit(tsec->sid, isec->sid, SECCLASS_SHM,
SHM__CREATE, &isec->avcr, &ad);
@@ -3668,7 +3667,7 @@
ipc_free_security(&shp->shm_perm);
}
-static int selinux_shm_associate(struct shmid_kernel *shp, int shmid, int shmflg)
+static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
{
struct task_security_struct *tsec;
struct ipc_security_struct *isec;
@@ -3686,19 +3685,23 @@
}
AVC_AUDIT_DATA_INIT(&ad, IPC);
- ad.u.ipc_id = shmid;
+ ad.u.ipc_id = shp->shm_perm.key;
return avc_has_perm_ref_audit(tsec->sid, isec->sid, SECCLASS_SHM,
SHM__ASSOCIATE, &isec->avcr, &ad);
}
/* Note, at this point, shp is locked down */
-static int selinux_shm_shmctl(struct shmid_kernel *shp, int shmid, int cmd)
+static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
{
int perms;
int err;
switch(cmd) {
+ case IPC_INFO:
+ case SHM_INFO:
+ /* No specific object, just general system-wide information. */
+ return task_has_system(current, SYSTEM__IPC_INFO);
case IPC_STAT:
case SHM_STAT:
perms = SHM__GETATTR | SHM__ASSOCIATE;
@@ -3717,14 +3720,14 @@
return 0;
}
- err = ipc_has_perm(&shp->shm_perm, shmid, SECCLASS_SHM, perms);
+ err = ipc_has_perm(&shp->shm_perm, SECCLASS_SHM, perms);
if (!err && cmd == IPC_STAT)
ipc_savesid(&shp->shm_perm, SECCLASS_SHM);
return err;
}
-static int selinux_shm_shmat(struct shmid_kernel *shp, int shmid,
+static int selinux_shm_shmat(struct shmid_kernel *shp,
char *shmaddr, int shmflg)
{
access_vector_t perms;
@@ -3734,7 +3737,7 @@
else
perms = SHM__READ | SHM__WRITE;
- return ipc_has_perm(&shp->shm_perm, shmid, SECCLASS_SHM, perms);
+ return ipc_has_perm(&shp->shm_perm, SECCLASS_SHM, perms);
}
/* Semaphore security operations */
@@ -3753,7 +3756,7 @@
isec = sma->sem_perm.security;
AVC_AUDIT_DATA_INIT(&ad, IPC);
-/* ad.u.ipc_id = xxx; */
+ ad.u.ipc_id = sma->sem_perm.key;
rc = avc_has_perm_ref_audit(tsec->sid, isec->sid, SECCLASS_SEM,
SEM__CREATE, &isec->avcr, &ad);
@@ -3769,7 +3772,7 @@
ipc_free_security(&sma->sem_perm);
}
-static int selinux_sem_associate(struct sem_array *sma, int semid, int semflg)
+static int selinux_sem_associate(struct sem_array *sma, int semflg)
{
struct task_security_struct *tsec;
struct ipc_security_struct *isec;
@@ -3787,19 +3790,23 @@
}
AVC_AUDIT_DATA_INIT(&ad, IPC);
- ad.u.ipc_id = semid;
+ ad.u.ipc_id = sma->sem_perm.key;
return avc_has_perm_ref_audit(tsec->sid, isec->sid, SECCLASS_SEM,
SEM__ASSOCIATE, &isec->avcr, &ad);
}
/* Note, at this point, sma is locked down */
-static int selinux_sem_semctl(struct sem_array *sma, int semid, int cmd)
+static int selinux_sem_semctl(struct sem_array *sma, int cmd)
{
int err;
access_vector_t perms;
switch(cmd) {
+ case IPC_INFO:
+ case SEM_INFO:
+ /* No specific object, just general system-wide information. */
+ return task_has_system(current, SYSTEM__IPC_INFO);
case GETPID:
case GETNCNT:
case GETZCNT:
@@ -3827,14 +3834,14 @@
return 0;
}
- err = ipc_has_perm(&sma->sem_perm, semid, SECCLASS_SEM, perms);
+ err = ipc_has_perm(&sma->sem_perm, SECCLASS_SEM, perms);
if (!err && cmd == IPC_STAT)
ipc_savesid(&sma->sem_perm, SECCLASS_SEM);
return err;
}
-static int selinux_sem_semop(struct sem_array *sma, int semid,
+static int selinux_sem_semop(struct sem_array *sma,
struct sembuf *sops, unsigned nsops, int alter)
{
access_vector_t perms;
@@ -3844,7 +3851,7 @@
else
perms = SEM__READ;
- return ipc_has_perm(&sma->sem_perm, semid, SECCLASS_SEM, perms);
+ return ipc_has_perm(&sma->sem_perm, SECCLASS_SEM, perms);
}
static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
@@ -3865,12 +3872,7 @@
if (av == 0)
return 0;
- return ipc_has_perm(ipcp, 0 /* XXX */, sclass, av);
-}
-
-static int selinux_ipc_getinfo(int id, int cmd)
-{
- return task_has_system(current, SYSTEM__IPC_INFO);
+ return ipc_has_perm(ipcp, sclass, av);
}
static int selinux_skb_alloc_security(struct sk_buff *skb, int gfp_mask)
@@ -4067,7 +4069,6 @@
file_permission: selinux_file_permission,
file_alloc_security: selinux_file_alloc_security,
file_free_security: selinux_file_free_security,
- file_llseek: selinux_file_llseek,
file_ioctl: selinux_file_ioctl,
file_mmap: selinux_file_mmap,
file_mprotect: selinux_file_mprotect,
@@ -4140,7 +4141,6 @@
module_delete: selinux_module_delete_module,
ipc_permission: selinux_ipc_permission,
- ipc_getinfo: selinux_ipc_getinfo,
msg_msg_alloc_security: selinux_msg_msg_alloc_security,
msg_msg_free_security: selinux_msg_msg_free_security,
_______________________________________________
linux-security-module mailing list
linux-security-moduleat_private
http://mail.wirex.com/mailman/listinfo/linux-security-module
This archive was generated by hypermail 2b30 : Tue Dec 31 2002 - 15:18:40 PST