Merge tag 'lsm-pr-20240312' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm

Pull lsm updates from Paul Moore: - Promote IMA/EVM to a proper LSM This is the bulk of the diffstat, and the source of all the changes in the VFS code. Prior to the start of the LSM stacking work it was important that IMA/EVM were separate from the rest of the LSMs, complete with their own hooks, infrastructure, etc. as it was the only way to enable IMA/EVM at the same time as a LSM. However, now that the bulk of the LSM infrastructure supports multiple simultaneous LSMs, we can simplify things greatly by bringing IMA/EVM into the LSM infrastructure as proper LSMs. This is something I've wanted to see happen for quite some time and Roberto was kind enough to put in the work to make it happen. - Use the LSM hook default values to simplify the call_int_hook() macro Previously the call_int_hook() macro required callers to supply a default return value, despite a default value being specified when the LSM hook was defined. This simplifies the macro by using the defined default return value which makes life easier for callers and should also reduce the number of return value bugs in the future (we've had a few pop up recently, hence this work). - Use the KMEM_CACHE() macro instead of kmem_cache_create() The guidance appears to be to use the KMEM_CACHE() macro when possible and there is no reason why we can't use the macro, so let's use it. - Fix a number of comment typos in the LSM hook comment blocks Not much to say here, we fixed some questionable grammar decisions in the LSM hook comment blocks. * tag 'lsm-pr-20240312' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: (28 commits) cred: Use KMEM_CACHE() instead of kmem_cache_create() lsm: use default hook return value in call_int_hook() lsm: fix typos in security/security.c comment headers integrity: Remove LSM ima: Make it independent from 'integrity' LSM evm: Make it independent from 'integrity' LSM evm: Move to LSM infrastructure ima: Move IMA-Appraisal to LSM infrastructure ima: Move to LSM infrastructure integrity: Move integrity_kernel_module_request() to IMA security: Introduce key_post_create_or_update hook security: Introduce inode_post_remove_acl hook security: Introduce inode_post_set_acl hook security: Introduce inode_post_create_tmpfile hook security: Introduce path_post_mknod hook security: Introduce file_release hook security: Introduce file_post_open hook security: Introduce inode_post_removexattr hook security: Introduce inode_post_setattr hook security: Align inode_setattr hook definition with EVM ...

Linus Torvalds committed 2 years ago

Commit cc4a8752 parents ca661c5 edc667036 files · +1126 −1141Browse files

Unified · Split

36 files

fs/attr.c +1 −4
fs/file_table.c +1 −2
fs/namei.c +7 −5
fs/nfsd/vfs.c +1 −2
fs/open.c +0 −1
fs/posix_acl.c +2 −3
fs/xattr.c +4 −5
include/linux/evm.h +2 −115
include/linux/ima.h +0 −142
include/linux/integrity.h +0 −27
include/linux/lsm_hook_defs.h +19 −1
include/linux/security.h +59 −0
include/uapi/linux/lsm.h +2 −0
kernel/cred.c +2 −2
security/integrity/Makefile +1 −0
security/integrity/digsig_asymmetric.c +0 −23
security/integrity/evm/Kconfig +1 −0
security/integrity/evm/evm.h +19 −0
security/integrity/evm/evm_crypto.c +2 −2
security/integrity/evm/evm_main.c +161 −34
security/integrity/iint.c +2 −195
security/integrity/ima/Kconfig +1 −0
security/integrity/ima/Makefile +1 −1
security/integrity/ima/ima.h +129 −19
security/integrity/ima/ima_api.c +12 −11
security/integrity/ima/ima_appraise.c +43 −23
security/integrity/ima/ima_iint.c +142 −0
security/integrity/ima/ima_init.c +1 −1
security/integrity/ima/ima_main.c +113 −35
security/integrity/ima/ima_policy.c +1 −1
security/integrity/integrity.h +1 −79
security/keys/key.c +4 −6
security/security.c +381 −400
security/selinux/hooks.c +2 −1
security/smack/smack_lsm.c +3 −1
tools/testing/selftests/lsm/lsm_list_modules_test.c +6 −0

fs/attr.c+1−4

@@ -16,8 +16,6 @@ · 15 unmodified lines
16	16	#include <linux/fcntl.h>
17	17	#include <linux/filelock.h>
18	18	#include <linux/security.h>
19		−#include <linux/evm.h>
20		−#include <linux/ima.h>
21	19
22	20	#include "internal.h"
23	21
@@ -502,8 +500,7 @@ int notify_change(struct mnt_idmap idmap, struct dentry dentry, · 478 unmodified lines
502	500
503	501	if (!error) {
504	502	fsnotify_change(dentry, ia_valid);
505		− ima_inode_post_setattr(idmap, dentry);
506		− evm_inode_post_setattr(dentry, ia_valid);
	503	+ security_inode_post_setattr(idmap, dentry, ia_valid);
507	504	}
508	505
509	506	return error;

fs/file_table.c+1−2

@@ -26,7 +26,6 @@ · 25 unmodified lines
26	26	#include <linux/percpu_counter.h>
27	27	#include <linux/percpu.h>
28	28	#include <linux/task_work.h>
29		−#include <linux/ima.h>
30	29	#include <linux/swap.h>
31	30	#include <linux/kmemleak.h>
32	31
@@ -414,7 +413,7 @@ static void __fput(struct file *file) · 381 unmodified lines
414	413	eventpoll_release(file);
415	414	locks_remove_file(file);
416	415
417		− ima_file_free(file);
	416	+ security_file_release(file);
418	417	if (unlikely(file->f_flags & FASYNC)) {
419	418	if (file->f_op->fasync)
420	419	file->f_op->fasync(-1, file, 0);

fs/namei.c+7−5

@@ -27,7 +27,6 @@ · 26 unmodified lines
27	27	#include <linux/fsnotify.h>
28	28	#include <linux/personality.h>
29	29	#include <linux/security.h>
30		−#include <linux/ima.h>
31	30	#include <linux/syscalls.h>
32	31	#include <linux/mount.h>
33	32	#include <linux/audit.h>
@@ -3642,7 +3641,7 @@ static int do_open(struct nameidata *nd, · 3608 unmodified lines
3642	3641	if (!error && !(file->f_mode & FMODE_OPENED))
3643	3642	error = vfs_open(&nd->path, file);
3644	3643	if (!error)
3645		− error = ima_file_check(file, op->acc_mode);
	3644	+ error = security_file_post_open(file, op->acc_mode);
3646	3645	if (!error && do_truncate)
3647	3646	error = handle_truncate(idmap, file);
3648	3647	if (unlikely(error > 0)) {
@@ -3705,7 +3704,7 @@ static int vfs_tmpfile(struct mnt_idmap *idmap, · 56 unmodified lines
3705	3704	inode->i_state \|= I_LINKABLE;
3706	3705	spin_unlock(&inode->i_lock);
3707	3706	}
3708		− ima_post_create_tmpfile(idmap, inode);
	3707	+ security_inode_post_create_tmpfile(idmap, inode);
3709	3708	return 0;
3710	3709	}
3711	3710
@@ -4051,8 +4050,6 @@ retry: · 339 unmodified lines
4051	4050	case 0: case S_IFREG:
4052	4051	error = vfs_create(idmap, path.dentry->d_inode,
4053	4052	dentry, mode, true);
4054		− if (!error)
4055		− ima_post_path_mknod(idmap, dentry);
4056	4053	break;
4057	4054	case S_IFCHR: case S_IFBLK:
4058	4055	error = vfs_mknod(idmap, path.dentry->d_inode,
@@ -4063,6 +4060,11 @@ retry: · 4 unmodified lines
4063	4060	dentry, mode, 0);
4064	4061	break;
4065	4062	}
	4063	+
	4064	+ if (error)
	4065	+ goto out2;
	4066	+
	4067	+ security_path_post_mknod(idmap, dentry);
4066	4068	out2:
4067	4069	done_path_create(&path, dentry);
4068	4070	if (retry_estale(error, lookup_flags)) {

fs/nfsd/vfs.c+1−2

@@ -25,7 +25,6 @@ · 24 unmodified lines
25	25	#include <linux/posix_acl_xattr.h>
26	26	#include <linux/xattr.h>
27	27	#include <linux/jhash.h>
28		−#include <linux/ima.h>
29	28	#include <linux/pagemap.h>
30	29	#include <linux/slab.h>
31	30	#include <linux/uaccess.h>
@@ -895,7 +894,7 @@ __nfsd_open(struct svc_rqst rqstp, struct svc_fh fhp, umode_t type, · 863 unmodified lines
895	894	goto out;
896	895	}
897	896
898		− host_err = ima_file_check(file, may_flags);
	897	+ host_err = security_file_post_open(file, may_flags);
899	898	if (host_err) {
900	899	fput(file);
901	900	goto out;

fs/open.c+0−1

@@ -29,7 +29,6 @@ · 28 unmodified lines
29	29	#include <linux/audit.h>
30	30	#include <linux/falloc.h>
31	31	#include <linux/fs_struct.h>
32		−#include <linux/ima.h>
33	32	#include <linux/dnotify.h>
34	33	#include <linux/compat.h>
35	34	#include <linux/mnt_idmapping.h>

fs/posix_acl.c+2−3

@@ -26,7 +26,6 @@ · 25 unmodified lines
26	26	#include <linux/mnt_idmapping.h>
27	27	#include <linux/iversion.h>
28	28	#include <linux/security.h>
29		−#include <linux/evm.h>
30	29	#include <linux/fsnotify.h>
31	30	#include <linux/filelock.h>
32	31
@@ -1137,7 +1136,7 @@ retry_deleg: · 1104 unmodified lines
1137	1136	error = -EIO;
1138	1137	if (!error) {
1139	1138	fsnotify_xattr(dentry);
1140		− evm_inode_post_set_acl(dentry, acl_name, kacl);
	1139	+ security_inode_post_set_acl(dentry, acl_name, kacl);
1141	1140	}
1142	1141
1143	1142	out_inode_unlock:
@@ -1245,7 +1244,7 @@ retry_deleg: · 101 unmodified lines
1245	1244	error = -EIO;
1246	1245	if (!error) {
1247	1246	fsnotify_xattr(dentry);
1248		− evm_inode_post_remove_acl(idmap, dentry, acl_name);
	1247	+ security_inode_post_remove_acl(idmap, dentry, acl_name);
1249	1248	}
1250	1249
1251	1250	out_inode_unlock:

fs/xattr.c+4−5

@@ -16,7 +16,6 @@ · 15 unmodified lines
16	16	#include <linux/mount.h>
17	17	#include <linux/namei.h>
18	18	#include <linux/security.h>
19		−#include <linux/evm.h>
20	19	#include <linux/syscalls.h>
21	20	#include <linux/export.h>
22	21	#include <linux/fsnotify.h>
@@ -552,11 +551,11 @@ __vfs_removexattr_locked(struct mnt_idmap *idmap, · 529 unmodified lines
552	551	goto out;
553	552
554	553	error = __vfs_removexattr(idmap, dentry, name);
	554	+ if (error)
	555	+ return error;
555	556
556		− if (!error) {
557		− fsnotify_xattr(dentry);
558		− evm_inode_post_removexattr(dentry, name);
559		− }
	557	+ fsnotify_xattr(dentry);
	558	+ security_inode_post_removexattr(dentry, name);
560	559
561	560	out:
562	561	return error;

include/linux/evm.h+2−115

@@ -12,52 +12,12 @@ · 11 unmodified lines
12	12	#include <linux/integrity.h>
13	13	#include <linux/xattr.h>
14	14
15		−struct integrity_iint_cache;
16		−
17	15	#ifdef CONFIG_EVM
18	16	extern int evm_set_key(void *key, size_t keylen);
19	17	extern enum integrity_status evm_verifyxattr(struct dentry *dentry,
20	18	const char *xattr_name,
21	19	void *xattr_value,
22		− size_t xattr_value_len,
23		− struct integrity_iint_cache *iint);
24		−extern int evm_inode_setattr(struct mnt_idmap *idmap,
25		− struct dentry dentry, struct iattr attr);
26		−extern void evm_inode_post_setattr(struct dentry *dentry, int ia_valid);
27		−extern int evm_inode_setxattr(struct mnt_idmap *idmap,
28		− struct dentry dentry, const char name,
29		− const void *value, size_t size);
30		−extern void evm_inode_post_setxattr(struct dentry *dentry,
31		− const char *xattr_name,
32		− const void *xattr_value,
33		− size_t xattr_value_len);
34		−extern int evm_inode_copy_up_xattr(const char *name);
35		−extern int evm_inode_removexattr(struct mnt_idmap *idmap,
36		− struct dentry dentry, const char xattr_name);
37		−extern void evm_inode_post_removexattr(struct dentry *dentry,
38		− const char *xattr_name);
39		−static inline void evm_inode_post_remove_acl(struct mnt_idmap *idmap,
40		− struct dentry *dentry,
41		− const char *acl_name)
42		−{
43		− evm_inode_post_removexattr(dentry, acl_name);
44		−}
45		−extern int evm_inode_set_acl(struct mnt_idmap *idmap,
46		− struct dentry dentry, const char acl_name,
47		− struct posix_acl *kacl);
48		−static inline int evm_inode_remove_acl(struct mnt_idmap *idmap,
49		− struct dentry *dentry,
50		− const char *acl_name)
51		−{
52		− return evm_inode_set_acl(idmap, dentry, acl_name, NULL);
53		−}
54		−static inline void evm_inode_post_set_acl(struct dentry *dentry,
55		− const char *acl_name,
56		− struct posix_acl *kacl)
57		−{
58		− return evm_inode_post_setxattr(dentry, acl_name, NULL, 0);
59		−}
60		−
	20	+ size_t xattr_value_len);
61	21	int evm_inode_init_security(struct inode inode, struct inode dir,
62	22	const struct qstr qstr, struct xattr xattrs,
63	23	int *xattr_count);
@@ -85,85 +45,12 @@ static inline int evm_set_key(void *key, size_t keylen) · 21 unmodified lines
85	45	static inline enum integrity_status evm_verifyxattr(struct dentry *dentry,
86	46	const char *xattr_name,
87	47	void *xattr_value,
88		− size_t xattr_value_len,
89		− struct integrity_iint_cache *iint)
	48	+ size_t xattr_value_len)
90	49	{
91	50	return INTEGRITY_UNKNOWN;
92	51	}
93	52	#endif
94	53
95		−static inline int evm_inode_setattr(struct mnt_idmap *idmap,
96		− struct dentry dentry, struct iattr attr)
97		−{
98		− return 0;
99		−}
100		−
101		−static inline void evm_inode_post_setattr(struct dentry *dentry, int ia_valid)
102		−{
103		− return;
104		−}
105		−
106		−static inline int evm_inode_setxattr(struct mnt_idmap *idmap,
107		− struct dentry dentry, const char name,
108		− const void *value, size_t size)
109		−{
110		− return 0;
111		−}
112		−
113		−static inline void evm_inode_post_setxattr(struct dentry *dentry,
114		− const char *xattr_name,
115		− const void *xattr_value,
116		− size_t xattr_value_len)
117		−{
118		− return;
119		−}
120		−
121		−static inline int evm_inode_copy_up_xattr(const char *name)
122		−{
123		− return 0;
124		−}
125		−
126		−static inline int evm_inode_removexattr(struct mnt_idmap *idmap,
127		− struct dentry *dentry,
128		− const char *xattr_name)
129		−{
130		− return 0;
131		−}
132		−
133		−static inline void evm_inode_post_removexattr(struct dentry *dentry,
134		− const char *xattr_name)
135		−{
136		− return;
137		−}
138		−
139		−static inline void evm_inode_post_remove_acl(struct mnt_idmap *idmap,
140		− struct dentry *dentry,
141		− const char *acl_name)
142		−{
143		− return;
144		−}
145		−
146		−static inline int evm_inode_set_acl(struct mnt_idmap *idmap,
147		− struct dentry dentry, const char acl_name,
148		− struct posix_acl *kacl)
149		−{
150		− return 0;
151		−}
152		−
153		−static inline int evm_inode_remove_acl(struct mnt_idmap *idmap,
154		− struct dentry *dentry,
155		− const char *acl_name)
156		−{
157		− return 0;
158		−}
159		−
160		−static inline void evm_inode_post_set_acl(struct dentry *dentry,
161		− const char *acl_name,
162		− struct posix_acl *kacl)
163		−{
164		− return;
165		−}
166		−
167	54	static inline int evm_inode_init_security(struct inode inode, struct inode dir,
168	55	const struct qstr *qstr,
169	56	struct xattr *xattrs,

include/linux/ima.h+0−142

@@ -16,23 +16,6 @@ struct linux_binprm; · 15 unmodified lines
16	16
17	17	#ifdef CONFIG_IMA
18	18	extern enum hash_algo ima_get_current_hash_algo(void);
19		−extern int ima_bprm_check(struct linux_binprm *bprm);
20		−extern int ima_file_check(struct file *file, int mask);
21		−extern void ima_post_create_tmpfile(struct mnt_idmap *idmap,
22		− struct inode *inode);
23		−extern void ima_file_free(struct file *file);
24		−extern int ima_file_mmap(struct file *file, unsigned long reqprot,
25		− unsigned long prot, unsigned long flags);
26		−extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot);
27		−extern int ima_load_data(enum kernel_load_data_id id, bool contents);
28		−extern int ima_post_load_data(char *buf, loff_t size,
29		− enum kernel_load_data_id id, char *description);
30		−extern int ima_read_file(struct file *file, enum kernel_read_file_id id,
31		− bool contents);
32		−extern int ima_post_read_file(struct file file, void buf, loff_t size,
33		− enum kernel_read_file_id id);
34		−extern void ima_post_path_mknod(struct mnt_idmap *idmap,
35		− struct dentry *dentry);
36	19	extern int ima_file_hash(struct file file, char buf, size_t buf_size);
37	20	extern int ima_inode_hash(struct inode inode, char buf, size_t buf_size);
38	21	extern void ima_kexec_cmdline(int kernel_fd, const void *buf, int size);
@@ -57,68 +40,6 @@ static inline enum hash_algo ima_get_current_hash_algo(void) · 18 unmodified lines
57	40	return HASH_ALGO__LAST;
58	41	}
59	42
60		−static inline int ima_bprm_check(struct linux_binprm *bprm)
61		−{
62		− return 0;
63		−}
64		−
65		−static inline int ima_file_check(struct file *file, int mask)
66		−{
67		− return 0;
68		−}
69		−
70		−static inline void ima_post_create_tmpfile(struct mnt_idmap *idmap,
71		− struct inode *inode)
72		−{
73		−}
74		−
75		−static inline void ima_file_free(struct file *file)
76		−{
77		− return;
78		−}
79		−
80		−static inline int ima_file_mmap(struct file *file, unsigned long reqprot,
81		− unsigned long prot, unsigned long flags)
82		−{
83		− return 0;
84		−}
85		−
86		−static inline int ima_file_mprotect(struct vm_area_struct *vma,
87		− unsigned long prot)
88		−{
89		− return 0;
90		−}
91		−
92		−static inline int ima_load_data(enum kernel_load_data_id id, bool contents)
93		−{
94		− return 0;
95		−}
96		−
97		−static inline int ima_post_load_data(char *buf, loff_t size,
98		− enum kernel_load_data_id id,
99		− char *description)
100		−{
101		− return 0;
102		−}
103		−
104		−static inline int ima_read_file(struct file *file, enum kernel_read_file_id id,
105		− bool contents)
106		−{
107		− return 0;
108		−}
109		−
110		−static inline int ima_post_read_file(struct file file, void buf, loff_t size,
111		− enum kernel_read_file_id id)
112		−{
113		− return 0;
114		−}
115		−
116		−static inline void ima_post_path_mknod(struct mnt_idmap *idmap,
117		− struct dentry *dentry)
118		−{
119		− return;
120		−}
121		−
122	43	static inline int ima_file_hash(struct file file, char buf, size_t buf_size)
123	44	{
124	45	return -EOPNOTSUPP;
@@ -169,76 +90,13 @@ static inline void ima_add_kexec_buffer(struct kimage *image) · 44 unmodified lines
169	90	{}
170	91	#endif
171	92
172		−#ifdef CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS
173		−extern void ima_post_key_create_or_update(struct key *keyring,
174		− struct key *key,
175		− const void *payload, size_t plen,
176		− unsigned long flags, bool create);
177		−#else
178		−static inline void ima_post_key_create_or_update(struct key *keyring,
179		− struct key *key,
180		− const void *payload,
181		− size_t plen,
182		− unsigned long flags,
183		− bool create) {}
184		−#endif /* CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS */
185		−
186	93	#ifdef CONFIG_IMA_APPRAISE
187	94	extern bool is_ima_appraise_enabled(void);
188		−extern void ima_inode_post_setattr(struct mnt_idmap *idmap,
189		− struct dentry *dentry);
190		−extern int ima_inode_setxattr(struct dentry dentry, const char xattr_name,
191		− const void *xattr_value, size_t xattr_value_len);
192		−extern int ima_inode_set_acl(struct mnt_idmap *idmap,
193		− struct dentry dentry, const char acl_name,
194		− struct posix_acl *kacl);
195		−static inline int ima_inode_remove_acl(struct mnt_idmap *idmap,
196		− struct dentry *dentry,
197		− const char *acl_name)
198		−{
199		− return ima_inode_set_acl(idmap, dentry, acl_name, NULL);
200		−}
201		−extern int ima_inode_removexattr(struct dentry dentry, const char xattr_name);
202	95	#else
203	96	static inline bool is_ima_appraise_enabled(void)
204	97	{
205	98	return 0;
206	99	}
207		−
208		−static inline void ima_inode_post_setattr(struct mnt_idmap *idmap,
209		− struct dentry *dentry)
210		−{
211		− return;
212		−}
213		−
214		−static inline int ima_inode_setxattr(struct dentry *dentry,
215		− const char *xattr_name,
216		− const void *xattr_value,
217		− size_t xattr_value_len)
218		−{
219		− return 0;
220		−}
221		−
222		−static inline int ima_inode_set_acl(struct mnt_idmap *idmap,
223		− struct dentry dentry, const char acl_name,
224		− struct posix_acl *kacl)
225		−{
226		−
227		− return 0;
228		−}
229		−
230		−static inline int ima_inode_removexattr(struct dentry *dentry,
231		− const char *xattr_name)
232		−{
233		− return 0;
234		−}
235		−
236		−static inline int ima_inode_remove_acl(struct mnt_idmap *idmap,
237		− struct dentry *dentry,
238		− const char *acl_name)
239		−{
240		− return 0;
241		−}
242	100	#endif /* CONFIG_IMA_APPRAISE */
243	101
244	102	#if defined(CONFIG_IMA_APPRAISE) && defined(CONFIG_INTEGRITY_TRUSTED_KEYRING)

include/linux/integrity.h+0−27

@@ -19,40 +19,13 @@ enum integrity_status { · 18 unmodified lines
19	19	INTEGRITY_UNKNOWN,
20	20	};
21	21
22		−/* List of EVM protected security xattrs */
23	22	#ifdef CONFIG_INTEGRITY
24		−extern struct integrity_iint_cache integrity_inode_get(struct inode inode);
25		−extern void integrity_inode_free(struct inode *inode);
26	23	extern void __init integrity_load_keys(void);
27	24
28	25	#else
29		−static inline struct integrity_iint_cache *
30		− integrity_inode_get(struct inode *inode)
31		−{
32		− return NULL;
33		−}
34		−
35		−static inline void integrity_inode_free(struct inode *inode)
36		−{
37		− return;
38		−}
39		−
40	26	static inline void integrity_load_keys(void)
41	27	{
42	28	}
43	29	#endif /* CONFIG_INTEGRITY */
44	30
45		−#ifdef CONFIG_INTEGRITY_ASYMMETRIC_KEYS
46		−
47		−extern int integrity_kernel_module_request(char *kmod_name);
48		−
49		−#else
50		−
51		−static inline int integrity_kernel_module_request(char *kmod_name)
52		−{
53		− return 0;
54		−}
55		−
56		−#endif /* CONFIG_INTEGRITY_ASYMMETRIC_KEYS */
57		−
58	31	#endif /* _LINUX_INTEGRITY_H */

include/linux/lsm_hook_defs.h+19−1

@@ -94,6 +94,8 @@ LSM_HOOK(int, 0, path_mkdir, const struct path dir, struct dentry dentry, · 93 unmodified lines
94	94	LSM_HOOK(int, 0, path_rmdir, const struct path dir, struct dentry dentry)
95	95	LSM_HOOK(int, 0, path_mknod, const struct path dir, struct dentry dentry,
96	96	umode_t mode, unsigned int dev)
	97	+LSM_HOOK(void, LSM_RET_VOID, path_post_mknod, struct mnt_idmap *idmap,
	98	+ struct dentry *dentry)
97	99	LSM_HOOK(int, 0, path_truncate, const struct path *path)
98	100	LSM_HOOK(int, 0, path_symlink, const struct path dir, struct dentry dentry,
99	101	const char *old_name)
@@ -119,6 +121,8 @@ LSM_HOOK(int, 0, inode_init_security_anon, struct inode *inode, · 19 unmodified lines
119	121	const struct qstr name, const struct inode context_inode)
120	122	LSM_HOOK(int, 0, inode_create, struct inode dir, struct dentry dentry,
121	123	umode_t mode)
	124	+LSM_HOOK(void, LSM_RET_VOID, inode_post_create_tmpfile, struct mnt_idmap *idmap,
	125	+ struct inode *inode)
122	126	LSM_HOOK(int, 0, inode_link, struct dentry old_dentry, struct inode dir,
123	127	struct dentry *new_dentry)
124	128	LSM_HOOK(int, 0, inode_unlink, struct inode dir, struct dentry dentry)
@@ -135,7 +139,10 @@ LSM_HOOK(int, 0, inode_readlink, struct dentry *dentry) · 10 unmodified lines
135	139	LSM_HOOK(int, 0, inode_follow_link, struct dentry dentry, struct inode inode,
136	140	bool rcu)
137	141	LSM_HOOK(int, 0, inode_permission, struct inode *inode, int mask)
138		−LSM_HOOK(int, 0, inode_setattr, struct dentry dentry, struct iattr attr)
	142	+LSM_HOOK(int, 0, inode_setattr, struct mnt_idmap idmap, struct dentry dentry,
	143	+ struct iattr *attr)
	144	+LSM_HOOK(void, LSM_RET_VOID, inode_post_setattr, struct mnt_idmap *idmap,
	145	+ struct dentry *dentry, int ia_valid)
139	146	LSM_HOOK(int, 0, inode_getattr, const struct path *path)
140	147	LSM_HOOK(int, 0, inode_setxattr, struct mnt_idmap *idmap,
141	148	struct dentry dentry, const char name, const void *value,
@@ -146,12 +153,18 @@ LSM_HOOK(int, 0, inode_getxattr, struct dentry dentry, const char name) · 4 unmodified lines
146	153	LSM_HOOK(int, 0, inode_listxattr, struct dentry *dentry)
147	154	LSM_HOOK(int, 0, inode_removexattr, struct mnt_idmap *idmap,
148	155	struct dentry dentry, const char name)
	156	+LSM_HOOK(void, LSM_RET_VOID, inode_post_removexattr, struct dentry *dentry,
	157	+ const char *name)
149	158	LSM_HOOK(int, 0, inode_set_acl, struct mnt_idmap *idmap,
150	159	struct dentry dentry, const char acl_name, struct posix_acl *kacl)
	160	+LSM_HOOK(void, LSM_RET_VOID, inode_post_set_acl, struct dentry *dentry,
	161	+ const char acl_name, struct posix_acl kacl)
151	162	LSM_HOOK(int, 0, inode_get_acl, struct mnt_idmap *idmap,
152	163	struct dentry dentry, const char acl_name)
153	164	LSM_HOOK(int, 0, inode_remove_acl, struct mnt_idmap *idmap,
154	165	struct dentry dentry, const char acl_name)
	166	+LSM_HOOK(void, LSM_RET_VOID, inode_post_remove_acl, struct mnt_idmap *idmap,
	167	+ struct dentry dentry, const char acl_name)
155	168	LSM_HOOK(int, 0, inode_need_killpriv, struct dentry *dentry)
156	169	LSM_HOOK(int, 0, inode_killpriv, struct mnt_idmap *idmap,
157	170	struct dentry *dentry)
@@ -168,6 +181,7 @@ LSM_HOOK(int, 0, kernfs_init_security, struct kernfs_node *kn_dir, · 10 unmodified lines
168	181	struct kernfs_node *kn)
169	182	LSM_HOOK(int, 0, file_permission, struct file *file, int mask)
170	183	LSM_HOOK(int, 0, file_alloc_security, struct file *file)
	184	+LSM_HOOK(void, LSM_RET_VOID, file_release, struct file *file)
171	185	LSM_HOOK(void, LSM_RET_VOID, file_free_security, struct file *file)
172	186	LSM_HOOK(int, 0, file_ioctl, struct file *file, unsigned int cmd,
173	187	unsigned long arg)
@@ -186,6 +200,7 @@ LSM_HOOK(int, 0, file_send_sigiotask, struct task_struct *tsk, · 12 unmodified lines
186	200	struct fown_struct *fown, int sig)
187	201	LSM_HOOK(int, 0, file_receive, struct file *file)
188	202	LSM_HOOK(int, 0, file_open, struct file *file)
	203	+LSM_HOOK(int, 0, file_post_open, struct file *file, int mask)
189	204	LSM_HOOK(int, 0, file_truncate, struct file *file)
190	205	LSM_HOOK(int, 0, task_alloc, struct task_struct *task,
191	206	unsigned long clone_flags)
@@ -390,6 +405,9 @@ LSM_HOOK(void, LSM_RET_VOID, key_free, struct key *key) · 198 unmodified lines
390	405	LSM_HOOK(int, 0, key_permission, key_ref_t key_ref, const struct cred *cred,
391	406	enum key_need_perm need_perm)
392	407	LSM_HOOK(int, 0, key_getsecurity, struct key key, char *buffer)
	408	+LSM_HOOK(void, LSM_RET_VOID, key_post_create_or_update, struct key *keyring,
	409	+ struct key key, const void payload, size_t payload_len,
	410	+ unsigned long flags, bool create)
393	411	#endif /* CONFIG_KEYS */
394	412
395	413	#ifdef CONFIG_AUDIT

include/linux/security.h+59−0

@@ -345,6 +345,8 @@ int security_inode_init_security_anon(struct inode *inode, · 344 unmodified lines
345	345	const struct qstr *name,
346	346	const struct inode *context_inode);
347	347	int security_inode_create(struct inode dir, struct dentry dentry, umode_t mode);
	348	+void security_inode_post_create_tmpfile(struct mnt_idmap *idmap,
	349	+ struct inode *inode);
348	350	int security_inode_link(struct dentry old_dentry, struct inode dir,
349	351	struct dentry *new_dentry);
350	352	int security_inode_unlink(struct inode dir, struct dentry dentry);
@@ -362,6 +364,8 @@ int security_inode_follow_link(struct dentry dentry, struct inode inode, · 11 unmodified lines
362	364	int security_inode_permission(struct inode *inode, int mask);
363	365	int security_inode_setattr(struct mnt_idmap *idmap,
364	366	struct dentry dentry, struct iattr attr);
	367	+void security_inode_post_setattr(struct mnt_idmap idmap, struct dentry dentry,
	368	+ int ia_valid);
365	369	int security_inode_getattr(const struct path *path);
366	370	int security_inode_setxattr(struct mnt_idmap *idmap,
367	371	struct dentry dentry, const char name,
@@ -369,16 +373,22 @@ int security_inode_setxattr(struct mnt_idmap *idmap, · 1 unmodified line
369	373	int security_inode_set_acl(struct mnt_idmap *idmap,
370	374	struct dentry dentry, const char acl_name,
371	375	struct posix_acl *kacl);
	376	+void security_inode_post_set_acl(struct dentry dentry, const char acl_name,
	377	+ struct posix_acl *kacl);
372	378	int security_inode_get_acl(struct mnt_idmap *idmap,
373	379	struct dentry dentry, const char acl_name);
374	380	int security_inode_remove_acl(struct mnt_idmap *idmap,
375	381	struct dentry dentry, const char acl_name);
	382	+void security_inode_post_remove_acl(struct mnt_idmap *idmap,
	383	+ struct dentry *dentry,
	384	+ const char *acl_name);
376	385	void security_inode_post_setxattr(struct dentry dentry, const char name,
377	386	const void *value, size_t size, int flags);
378	387	int security_inode_getxattr(struct dentry dentry, const char name);
379	388	int security_inode_listxattr(struct dentry *dentry);
380	389	int security_inode_removexattr(struct mnt_idmap *idmap,
381	390	struct dentry dentry, const char name);
	391	+void security_inode_post_removexattr(struct dentry dentry, const char name);
382	392	int security_inode_need_killpriv(struct dentry *dentry);
383	393	int security_inode_killpriv(struct mnt_idmap idmap, struct dentry dentry);
384	394	int security_inode_getsecurity(struct mnt_idmap *idmap,
@@ -393,6 +403,7 @@ int security_kernfs_init_security(struct kernfs_node *kn_dir, · 8 unmodified lines
393	403	struct kernfs_node *kn);
394	404	int security_file_permission(struct file *file, int mask);
395	405	int security_file_alloc(struct file *file);
	406	+void security_file_release(struct file *file);
396	407	void security_file_free(struct file *file);
397	408	int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
398	409	int security_file_ioctl_compat(struct file *file, unsigned int cmd,
@@ -409,6 +420,7 @@ int security_file_send_sigiotask(struct task_struct *tsk, · 10 unmodified lines
409	420	struct fown_struct *fown, int sig);
410	421	int security_file_receive(struct file *file);
411	422	int security_file_open(struct file *file);
	423	+int security_file_post_open(struct file *file, int mask);
412	424	int security_file_truncate(struct file *file);
413	425	int security_task_alloc(struct task_struct *task, unsigned long clone_flags);
414	426	void security_task_free(struct task_struct *task);
@@ -807,6 +819,10 @@ static inline int security_inode_create(struct inode *dir, · 392 unmodified lines
807	819	return 0;
808	820	}
809	821
	822	+static inline void
	823	+security_inode_post_create_tmpfile(struct mnt_idmap idmap, struct inode inode)
	824	+{ }
	825	+
810	826	static inline int security_inode_link(struct dentry *old_dentry,
811	827	struct inode *dir,
812	828	struct dentry *new_dentry)
@@ -880,6 +896,11 @@ static inline int security_inode_setattr(struct mnt_idmap *idmap, · 67 unmodified lines
880	896	return 0;
881	897	}
882	898
	899	+static inline void
	900	+security_inode_post_setattr(struct mnt_idmap idmap, struct dentry dentry,
	901	+ int ia_valid)
	902	+{ }
	903	+
883	904	static inline int security_inode_getattr(const struct path *path)
884	905	{
885	906	return 0;
@@ -900,6 +921,11 @@ static inline int security_inode_set_acl(struct mnt_idmap *idmap, · 14 unmodified lines
900	921	return 0;
901	922	}
902	923
	924	+static inline void security_inode_post_set_acl(struct dentry *dentry,
	925	+ const char *acl_name,
	926	+ struct posix_acl *kacl)
	927	+{ }
	928	+
903	929	static inline int security_inode_get_acl(struct mnt_idmap *idmap,
904	930	struct dentry *dentry,
905	931	const char *acl_name)
@@ -914,6 +940,11 @@ static inline int security_inode_remove_acl(struct mnt_idmap *idmap, · 8 unmodified lines
914	940	return 0;
915	941	}
916	942
	943	+static inline void security_inode_post_remove_acl(struct mnt_idmap *idmap,
	944	+ struct dentry *dentry,
	945	+ const char *acl_name)
	946	+{ }
	947	+
917	948	static inline void security_inode_post_setxattr(struct dentry *dentry,
918	949	const char name, const void value, size_t size, int flags)
919	950	{ }
@@ -936,6 +967,10 @@ static inline int security_inode_removexattr(struct mnt_idmap *idmap, · 16 unmodified lines
936	967	return cap_inode_removexattr(idmap, dentry, name);
937	968	}
938	969
	970	+static inline void security_inode_post_removexattr(struct dentry *dentry,
	971	+ const char *name)
	972	+{ }
	973	+
939	974	static inline int security_inode_need_killpriv(struct dentry *dentry)
940	975	{
941	976	return cap_inode_need_killpriv(dentry);
@@ -996,6 +1031,9 @@ static inline int security_file_alloc(struct file *file) · 54 unmodified lines
996	1031	return 0;
997	1032	}
998	1033
	1034	+static inline void security_file_release(struct file *file)
	1035	+{ }
	1036	+
999	1037	static inline void security_file_free(struct file *file)
1000	1038	{ }
1001	1039
@@ -1063,6 +1101,11 @@ static inline int security_file_open(struct file *file) · 61 unmodified lines
1063	1101	return 0;
1064	1102	}
1065	1103
	1104	+static inline int security_file_post_open(struct file *file, int mask)
	1105	+{
	1106	+ return 0;
	1107	+}
	1108	+
1066	1109	static inline int security_file_truncate(struct file *file)
1067	1110	{
1068	1111	return 0;
@@ -1872,6 +1915,7 @@ int security_path_mkdir(const struct path dir, struct dentry dentry, umode_t m · 803 unmodified lines
1872	1915	int security_path_rmdir(const struct path dir, struct dentry dentry);
1873	1916	int security_path_mknod(const struct path dir, struct dentry dentry, umode_t mode,
1874	1917	unsigned int dev);
	1918	+void security_path_post_mknod(struct mnt_idmap idmap, struct dentry dentry);
1875	1919	int security_path_truncate(const struct path *path);
1876	1920	int security_path_symlink(const struct path dir, struct dentry dentry,
1877	1921	const char *old_name);
@@ -1906,6 +1950,10 @@ static inline int security_path_mknod(const struct path dir, struct dentry den · 28 unmodified lines
1906	1950	return 0;
1907	1951	}
1908	1952
	1953	+static inline void security_path_post_mknod(struct mnt_idmap *idmap,
	1954	+ struct dentry *dentry)
	1955	+{ }
	1956	+
1909	1957	static inline int security_path_truncate(const struct path *path)
1910	1958	{
1911	1959	return 0;
@@ -1957,6 +2005,9 @@ void security_key_free(struct key *key); · 45 unmodified lines
1957	2005	int security_key_permission(key_ref_t key_ref, const struct cred *cred,
1958	2006	enum key_need_perm need_perm);
1959	2007	int security_key_getsecurity(struct key key, char *_buffer);
	2008	+void security_key_post_create_or_update(struct key keyring, struct key key,
	2009	+ const void *payload, size_t payload_len,
	2010	+ unsigned long flags, bool create);
1960	2011
1961	2012	#else
1962	2013
@@ -1984,6 +2035,14 @@ static inline int security_key_getsecurity(struct key key, char *_buffer) · 21 unmodified lines
1984	2035	return 0;
1985	2036	}
1986	2037
	2038	+static inline void security_key_post_create_or_update(struct key *keyring,
	2039	+ struct key *key,
	2040	+ const void *payload,
	2041	+ size_t payload_len,
	2042	+ unsigned long flags,
	2043	+ bool create)
	2044	+{ }
	2045	+
1987	2046	#endif
1988	2047	#endif /* CONFIG_KEYS */
1989	2048

include/uapi/linux/lsm.h+2−0

@@ -62,6 +62,8 @@ struct lsm_ctx { · 61 unmodified lines
62	62	#define LSM_ID_LOCKDOWN 108
63	63	#define LSM_ID_BPF 109
64	64	#define LSM_ID_LANDLOCK 110
	65	+#define LSM_ID_IMA 111
	66	+#define LSM_ID_EVM 112
65	67
66	68	/*
67	69	* LSM_ATTR_XXX definitions identify different LSM attributes

kernel/cred.c+2−2

@@ -606,8 +606,8 @@ int set_cred_ucounts(struct cred *new) · 605 unmodified lines
606	606	void __init cred_init(void)
607	607	{
608	608	/* allocate a slab in which we can store credentials */
609		− cred_jar = kmem_cache_create("cred_jar", sizeof(struct cred), 0,
610		− SLAB_HWCACHE_ALIGN\|SLAB_PANIC\|SLAB_ACCOUNT, NULL);
	609	+ cred_jar = KMEM_CACHE(cred,
	610	+ SLAB_HWCACHE_ALIGN \| SLAB_PANIC \| SLAB_ACCOUNT);
611	611	}
612	612
613	613	/**

security/integrity/Makefile+1−0

@@ -18,5 +18,6 @@ integrity-$(CONFIG_LOAD_IPL_KEYS) += platform_certs/load_ipl_s390.o · 17 unmodified lines
18	18	integrity-$(CONFIG_LOAD_PPC_KEYS) += platform_certs/efi_parser.o \
19	19	platform_certs/load_powerpc.o \
20	20	platform_certs/keyring_handler.o
	21	+# The relative order of the 'ima' and 'evm' LSMs depends on the order below.
21	22	obj-$(CONFIG_IMA) += ima/
22	23	obj-$(CONFIG_EVM) += evm/

security/integrity/digsig_asymmetric.c+0−23

@@ -132,26 +132,3 @@ out: · 131 unmodified lines
132	132	pr_debug("%s() = %d\n", __func__, ret);
133	133	return ret;
134	134	}
135		−
136		−/**
137		− * integrity_kernel_module_request - prevent crypto-pkcs1pad(rsa,*) requests
138		− * @kmod_name: kernel module name
139		− *
140		− * We have situation, when public_key_verify_signature() in case of RSA
141		− * algorithm use alg_name to store internal information in order to
142		− * construct an algorithm on the fly, but crypto_larval_lookup() will try
143		− * to use alg_name in order to load kernel module with same name.
144		− * Since we don't have any real "crypto-pkcs1pad(rsa,*)" kernel modules,
145		− * we are safe to fail such module request from crypto_larval_lookup().
146		− *
147		− * In this way we prevent modprobe execution during digsig verification
148		− * and avoid possible deadlock if modprobe and/or it's dependencies
149		− * also signed with digsig.
150		− */
151		−int integrity_kernel_module_request(char *kmod_name)
152		−{
153		− if (strncmp(kmod_name, "crypto-pkcs1pad(rsa,", 20) == 0)
154		− return -EINVAL;
155		−
156		− return 0;
157		−}

security/integrity/evm/Kconfig+1−0

@@ -6,6 +6,7 @@ config EVM · 5 unmodified lines
6	6	select CRYPTO_HMAC
7	7	select CRYPTO_SHA1
8	8	select CRYPTO_HASH_INFO
	9	+ select SECURITY_PATH
9	10	default n
10	11	help
11	12	EVM protects a file's security extended attributes against

security/integrity/evm/evm.h+19−0

@@ -32,6 +32,25 @@ struct xattr_list { · 31 unmodified lines
32	32	bool enabled;
33	33	};
34	34
	35	+#define EVM_NEW_FILE 0x00000001
	36	+#define EVM_IMMUTABLE_DIGSIG 0x00000002
	37	+
	38	+/* EVM integrity metadata associated with an inode */
	39	+struct evm_iint_cache {
	40	+ unsigned long flags;
	41	+ enum integrity_status evm_status:4;
	42	+};
	43	+
	44	+extern struct lsm_blob_sizes evm_blob_sizes;
	45	+
	46	+static inline struct evm_iint_cache evm_iint_inode(const struct inode inode)
	47	+{
	48	+ if (unlikely(!inode->i_security))
	49	+ return NULL;
	50	+
	51	+ return inode->i_security + evm_blob_sizes.lbs_inode;
	52	+}
	53	+
35	54	extern int evm_initialized;
36	55
37	56	#define EVM_ATTR_FSUUID 0x0001

security/integrity/evm/evm_crypto.c+2−2

@@ -322,10 +322,10 @@ int evm_calc_hash(struct dentry dentry, const char req_xattr_name, · 321 unmodified lines
322	322	static int evm_is_immutable(struct dentry dentry, struct inode inode)
323	323	{
324	324	const struct evm_ima_xattr_data *xattr_data = NULL;
325		− struct integrity_iint_cache *iint;
	325	+ struct evm_iint_cache *iint;
326	326	int rc = 0;
327	327
328		− iint = integrity_iint_find(inode);
	328	+ iint = evm_iint_inode(inode);
329	329	if (iint && (iint->flags & EVM_IMMUTABLE_DIGSIG))
330	330	return 1;
331	331

security/integrity/evm/evm_main.c+161−34

@@ -178,14 +178,14 @@ static int is_unsupported_fs(struct dentry *dentry) · 177 unmodified lines
178	178	static enum integrity_status evm_verify_hmac(struct dentry *dentry,
179	179	const char *xattr_name,
180	180	char *xattr_value,
181		− size_t xattr_value_len,
182		− struct integrity_iint_cache *iint)
	181	+ size_t xattr_value_len)
183	182	{
184	183	struct evm_ima_xattr_data *xattr_data = NULL;
185	184	struct signature_v2_hdr *hdr;
186	185	enum integrity_status evm_status = INTEGRITY_PASS;
187	186	struct evm_digest digest;
188		− struct inode *inode;
	187	+ struct inode *inode = d_backing_inode(dentry);
	188	+ struct evm_iint_cache *iint = evm_iint_inode(inode);
189	189	int rc, xattr_len, evm_immutable = 0;
190	190
191	191	if (iint && (iint->evm_status == INTEGRITY_PASS \|\|
@@ -254,8 +254,6 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry, · 62 unmodified lines
254	254	(const char *)xattr_data, xattr_len,
255	255	digest.digest, digest.hdr.length);
256	256	if (!rc) {
257		− inode = d_backing_inode(dentry);
258		−
259	257	if (xattr_data->type == EVM_XATTR_PORTABLE_DIGSIG) {
260	258	if (iint)
261	259	iint->flags \|= EVM_IMMUTABLE_DIGSIG;
@@ -403,7 +401,6 @@ int evm_read_protected_xattrs(struct dentry dentry, u8 buffer, · 141 unmodified lines
403	401	* @xattr_name: requested xattr
404	402	* @xattr_value: requested xattr value
405	403	* @xattr_value_len: requested xattr value length
406		− * @iint: inode integrity metadata
407	404	*
408	405	* Calculate the HMAC for the given dentry and verify it against the stored
409	406	* security.evm xattr. For performance, use the xattr value and length
@@ -416,8 +413,7 @@ int evm_read_protected_xattrs(struct dentry dentry, u8 buffer, · 6 unmodified lines
416	413	*/
417	414	enum integrity_status evm_verifyxattr(struct dentry *dentry,
418	415	const char *xattr_name,
419		− void *xattr_value, size_t xattr_value_len,
420		− struct integrity_iint_cache *iint)
	416	+ void *xattr_value, size_t xattr_value_len)
421	417	{
422	418	if (!evm_key_loaded() \|\| !evm_protected_xattr(xattr_name))
423	419	return INTEGRITY_UNKNOWN;
@@ -425,13 +421,8 @@ enum integrity_status evm_verifyxattr(struct dentry *dentry, · 1 unmodified line
425	421	if (is_unsupported_fs(dentry))
426	422	return INTEGRITY_UNKNOWN;
427	423
428		− if (!iint) {
429		− iint = integrity_iint_find(d_backing_inode(dentry));
430		− if (!iint)
431		− return INTEGRITY_UNKNOWN;
432		− }
433	424	return evm_verify_hmac(dentry, xattr_name, xattr_value,
434		− xattr_value_len, iint);
	425	+ xattr_value_len);
435	426	}
436	427	EXPORT_SYMBOL_GPL(evm_verifyxattr);
437	428
@@ -448,7 +439,7 @@ static enum integrity_status evm_verify_current_integrity(struct dentry *dentry) · 10 unmodified lines
448	439
449	440	if (!evm_key_loaded() \|\| !S_ISREG(inode->i_mode) \|\| evm_fixmode)
450	441	return INTEGRITY_PASS;
451		− return evm_verify_hmac(dentry, NULL, NULL, 0, NULL);
	442	+ return evm_verify_hmac(dentry, NULL, NULL, 0);
452	443	}
453	444
454	445	/*
@@ -526,14 +517,14 @@ static int evm_protect_xattr(struct mnt_idmap *idmap, · 71 unmodified lines
526	517
527	518	evm_status = evm_verify_current_integrity(dentry);
528	519	if (evm_status == INTEGRITY_NOXATTRS) {
529		− struct integrity_iint_cache *iint;
	520	+ struct evm_iint_cache *iint;
530	521
531	522	/* Exception if the HMAC is not going to be calculated. */
532	523	if (evm_hmac_disabled())
533	524	return 0;
534	525
535		− iint = integrity_iint_find(d_backing_inode(dentry));
536		− if (iint && (iint->flags & IMA_NEW_FILE))
	526	+ iint = evm_iint_inode(d_backing_inode(dentry));
	527	+ if (iint && (iint->flags & EVM_NEW_FILE))
537	528	return 0;
538	529
539	530	/* exception for pseudo filesystems */
@@ -581,6 +572,7 @@ out: · 41 unmodified lines
581	572	* @xattr_name: pointer to the affected extended attribute name
582	573	* @xattr_value: pointer to the new extended attribute value
583	574	* @xattr_value_len: pointer to the new extended attribute value length
	575	+ * @flags: flags to pass into filesystem operations
584	576	*
585	577	* Before allowing the 'security.evm' protected xattr to be updated,
586	578	* verify the existing value is valid. As only the kernel should have
@@ -588,9 +580,9 @@ out: · 1 unmodified line
588	580	* userspace from writing HMAC value. Writing 'security.evm' requires
589	581	* requires CAP_SYS_ADMIN privileges.
590	582	*/
591		−int evm_inode_setxattr(struct mnt_idmap idmap, struct dentry dentry,
592		− const char xattr_name, const void xattr_value,
593		− size_t xattr_value_len)
	583	+static int evm_inode_setxattr(struct mnt_idmap idmap, struct dentry dentry,
	584	+ const char xattr_name, const void xattr_value,
	585	+ size_t xattr_value_len, int flags)
594	586	{
595	587	const struct evm_ima_xattr_data *xattr_data = xattr_value;
596	588
@@ -620,8 +612,8 @@ int evm_inode_setxattr(struct mnt_idmap idmap, struct dentry dentry, · 23 unmodified lines
620	612	* Removing 'security.evm' requires CAP_SYS_ADMIN privileges and that
621	613	* the current value is valid.
622	614	*/
623		−int evm_inode_removexattr(struct mnt_idmap *idmap,
624		− struct dentry dentry, const char xattr_name)
	615	+static int evm_inode_removexattr(struct mnt_idmap idmap, struct dentry dentry,
	616	+ const char *xattr_name)
625	617	{
626	618	/* Policy permits modification of the protected xattrs even though
627	619	* there's no HMAC key loaded
@@ -671,9 +663,11 @@ static inline int evm_inode_set_acl_change(struct mnt_idmap *idmap, · 43 unmodified lines
671	663	* Prevent modifying posix acls causing the EVM HMAC to be re-calculated
672	664	* and 'security.evm' xattr updated, unless the existing 'security.evm' is
673	665	* valid.
	666	+ *
	667	+ * Return: zero on success, -EPERM on failure.
674	668	*/
675		−int evm_inode_set_acl(struct mnt_idmap idmap, struct dentry dentry,
676		− const char acl_name, struct posix_acl kacl)
	669	+static int evm_inode_set_acl(struct mnt_idmap idmap, struct dentry dentry,
	670	+ const char acl_name, struct posix_acl kacl)
677	671	{
678	672	enum integrity_status evm_status;
679	673
@@ -712,11 +706,29 @@ int evm_inode_set_acl(struct mnt_idmap idmap, struct dentry dentry, · 32 unmodified lines
712	706	return -EPERM;
713	707	}
714	708
	709	+/**
	710	+ * evm_inode_remove_acl - Protect the EVM extended attribute from posix acls
	711	+ * @idmap: idmap of the mount
	712	+ * @dentry: pointer to the affected dentry
	713	+ * @acl_name: name of the posix acl
	714	+ *
	715	+ * Prevent removing posix acls causing the EVM HMAC to be re-calculated
	716	+ * and 'security.evm' xattr updated, unless the existing 'security.evm' is
	717	+ * valid.
	718	+ *
	719	+ * Return: zero on success, -EPERM on failure.
	720	+ */
	721	+static int evm_inode_remove_acl(struct mnt_idmap idmap, struct dentry dentry,
	722	+ const char *acl_name)
	723	+{
	724	+ return evm_inode_set_acl(idmap, dentry, acl_name, NULL);
	725	+}
	726	+
715	727	static void evm_reset_status(struct inode *inode)
716	728	{
717		− struct integrity_iint_cache *iint;
	729	+ struct evm_iint_cache *iint;
718	730
719		− iint = integrity_iint_find(inode);
	731	+ iint = evm_iint_inode(inode);
720	732	if (iint)
721	733	iint->evm_status = INTEGRITY_UNKNOWN;
722	734	}
@@ -752,6 +764,7 @@ bool evm_revalidate_status(const char *xattr_name) · 29 unmodified lines
752	764	* @xattr_name: pointer to the affected extended attribute name
753	765	* @xattr_value: pointer to the new extended attribute value
754	766	* @xattr_value_len: pointer to the new extended attribute value length
	767	+ * @flags: flags to pass into filesystem operations
755	768	*
756	769	* Update the HMAC stored in 'security.evm' to reflect the change.
757	770	*
@@ -759,8 +772,11 @@ bool evm_revalidate_status(const char *xattr_name) · 1 unmodified line
759	772	* __vfs_setxattr_noperm(). The caller of which has taken the inode's
760	773	* i_mutex lock.
761	774	*/
762		−void evm_inode_post_setxattr(struct dentry dentry, const char xattr_name,
763		− const void *xattr_value, size_t xattr_value_len)
	775	+static void evm_inode_post_setxattr(struct dentry *dentry,
	776	+ const char *xattr_name,
	777	+ const void *xattr_value,
	778	+ size_t xattr_value_len,
	779	+ int flags)
764	780	{
765	781	if (!evm_revalidate_status(xattr_name))
766	782	return;
@@ -779,6 +795,21 @@ void evm_inode_post_setxattr(struct dentry dentry, const char xattr_name, · 12 unmodified lines
779	795	evm_update_evmxattr(dentry, xattr_name, xattr_value, xattr_value_len);
780	796	}
781	797
	798	+/**
	799	+ * evm_inode_post_set_acl - Update the EVM extended attribute from posix acls
	800	+ * @dentry: pointer to the affected dentry
	801	+ * @acl_name: name of the posix acl
	802	+ * @kacl: pointer to the posix acls
	803	+ *
	804	+ * Update the 'security.evm' xattr with the EVM HMAC re-calculated after setting
	805	+ * posix acls.
	806	+ */
	807	+static void evm_inode_post_set_acl(struct dentry dentry, const char acl_name,
	808	+ struct posix_acl *kacl)
	809	+{
	810	+ return evm_inode_post_setxattr(dentry, acl_name, NULL, 0, 0);
	811	+}
	812	+
782	813	/**
783	814	* evm_inode_post_removexattr - update 'security.evm' after removing the xattr
784	815	* @dentry: pointer to the affected dentry
@@ -789,7 +820,8 @@ void evm_inode_post_setxattr(struct dentry dentry, const char xattr_name, · 4 unmodified lines
789	820	* No need to take the i_mutex lock here, as this function is called from
790	821	* vfs_removexattr() which takes the i_mutex.
791	822	*/
792		−void evm_inode_post_removexattr(struct dentry dentry, const char xattr_name)
	823	+static void evm_inode_post_removexattr(struct dentry *dentry,
	824	+ const char *xattr_name)
793	825	{
794	826	if (!evm_revalidate_status(xattr_name))
795	827	return;
@@ -805,6 +837,22 @@ void evm_inode_post_removexattr(struct dentry dentry, const char xattr_name) · 9 unmodified lines
805	837	evm_update_evmxattr(dentry, xattr_name, NULL, 0);
806	838	}
807	839
	840	+/**
	841	+ * evm_inode_post_remove_acl - Update the EVM extended attribute from posix acls
	842	+ * @idmap: idmap of the mount
	843	+ * @dentry: pointer to the affected dentry
	844	+ * @acl_name: name of the posix acl
	845	+ *
	846	+ * Update the 'security.evm' xattr with the EVM HMAC re-calculated after
	847	+ * removing posix acls.
	848	+ */
	849	+static inline void evm_inode_post_remove_acl(struct mnt_idmap *idmap,
	850	+ struct dentry *dentry,
	851	+ const char *acl_name)
	852	+{
	853	+ evm_inode_post_removexattr(dentry, acl_name);
	854	+}
	855	+
808	856	static int evm_attr_change(struct mnt_idmap *idmap,
809	857	struct dentry dentry, struct iattr attr)
810	858	{
@@ -828,8 +876,8 @@ static int evm_attr_change(struct mnt_idmap *idmap, · 17 unmodified lines
828	876	* Permit update of file attributes when files have a valid EVM signature,
829	877	* except in the case of them having an immutable portable signature.
830	878	*/
831		−int evm_inode_setattr(struct mnt_idmap idmap, struct dentry dentry,
832		− struct iattr *attr)
	879	+static int evm_inode_setattr(struct mnt_idmap idmap, struct dentry dentry,
	880	+ struct iattr *attr)
833	881	{
834	882	unsigned int ia_valid = attr->ia_valid;
835	883	enum integrity_status evm_status;
@@ -870,6 +918,7 @@ int evm_inode_setattr(struct mnt_idmap idmap, struct dentry dentry, · 34 unmodified lines
870	918
871	919	/**
872	920	* evm_inode_post_setattr - update 'security.evm' after modifying metadata
	921	+ * @idmap: idmap of the idmapped mount
873	922	* @dentry: pointer to the affected dentry
874	923	* @ia_valid: for the UID and GID status
875	924	*
@@ -879,7 +928,8 @@ int evm_inode_setattr(struct mnt_idmap idmap, struct dentry dentry, · 3 unmodified lines
879	928	* This function is called from notify_change(), which expects the caller
880	929	* to lock the inode's i_mutex.
881	930	*/
882		−void evm_inode_post_setattr(struct dentry *dentry, int ia_valid)
	931	+static void evm_inode_post_setattr(struct mnt_idmap *idmap,
	932	+ struct dentry *dentry, int ia_valid)
883	933	{
884	934	if (!evm_revalidate_status(NULL))
885	935	return;
@@ -896,7 +946,7 @@ void evm_inode_post_setattr(struct dentry *dentry, int ia_valid) · 10 unmodified lines
896	946	evm_update_evmxattr(dentry, NULL, NULL, 0);
897	947	}
898	948
899		−int evm_inode_copy_up_xattr(const char *name)
	949	+static int evm_inode_copy_up_xattr(const char *name)
900	950	{
901	951	if (strcmp(name, XATTR_NAME_EVM) == 0)
902	952	return 1; /* Discard */
@@ -960,6 +1010,42 @@ out: · 57 unmodified lines
960	1010	}
961	1011	EXPORT_SYMBOL_GPL(evm_inode_init_security);
962	1012
	1013	+static int evm_inode_alloc_security(struct inode *inode)
	1014	+{
	1015	+ struct evm_iint_cache *iint = evm_iint_inode(inode);
	1016	+
	1017	+ /* Called by security_inode_alloc(), it cannot be NULL. */
	1018	+ iint->flags = 0UL;
	1019	+ iint->evm_status = INTEGRITY_UNKNOWN;
	1020	+
	1021	+ return 0;
	1022	+}
	1023	+
	1024	+static void evm_file_release(struct file *file)
	1025	+{
	1026	+ struct inode *inode = file_inode(file);
	1027	+ struct evm_iint_cache *iint = evm_iint_inode(inode);
	1028	+ fmode_t mode = file->f_mode;
	1029	+
	1030	+ if (!S_ISREG(inode->i_mode) \|\| !(mode & FMODE_WRITE))
	1031	+ return;
	1032	+
	1033	+ if (iint && atomic_read(&inode->i_writecount) == 1)
	1034	+ iint->flags &= ~EVM_NEW_FILE;
	1035	+}
	1036	+
	1037	+static void evm_post_path_mknod(struct mnt_idmap idmap, struct dentry dentry)
	1038	+{
	1039	+ struct inode *inode = d_backing_inode(dentry);
	1040	+ struct evm_iint_cache *iint = evm_iint_inode(inode);
	1041	+
	1042	+ if (!S_ISREG(inode->i_mode))
	1043	+ return;
	1044	+
	1045	+ if (iint)
	1046	+ iint->flags \|= EVM_NEW_FILE;
	1047	+}
	1048	+
963	1049	#ifdef CONFIG_EVM_LOAD_X509
964	1050	void __init evm_load_x509(void)
965	1051	{
@@ -999,4 +1085,45 @@ error: · 33 unmodified lines
999	1085	return error;
1000	1086	}
1001	1087
	1088	+static struct security_hook_list evm_hooks[] __ro_after_init = {
	1089	+ LSM_HOOK_INIT(inode_setattr, evm_inode_setattr),
	1090	+ LSM_HOOK_INIT(inode_post_setattr, evm_inode_post_setattr),
	1091	+ LSM_HOOK_INIT(inode_copy_up_xattr, evm_inode_copy_up_xattr),
	1092	+ LSM_HOOK_INIT(inode_setxattr, evm_inode_setxattr),
	1093	+ LSM_HOOK_INIT(inode_post_setxattr, evm_inode_post_setxattr),
	1094	+ LSM_HOOK_INIT(inode_set_acl, evm_inode_set_acl),
	1095	+ LSM_HOOK_INIT(inode_post_set_acl, evm_inode_post_set_acl),
	1096	+ LSM_HOOK_INIT(inode_remove_acl, evm_inode_remove_acl),
	1097	+ LSM_HOOK_INIT(inode_post_remove_acl, evm_inode_post_remove_acl),
	1098	+ LSM_HOOK_INIT(inode_removexattr, evm_inode_removexattr),
	1099	+ LSM_HOOK_INIT(inode_post_removexattr, evm_inode_post_removexattr),
	1100	+ LSM_HOOK_INIT(inode_init_security, evm_inode_init_security),
	1101	+ LSM_HOOK_INIT(inode_alloc_security, evm_inode_alloc_security),
	1102	+ LSM_HOOK_INIT(file_release, evm_file_release),
	1103	+ LSM_HOOK_INIT(path_post_mknod, evm_post_path_mknod),
	1104	+};
	1105	+
	1106	+static const struct lsm_id evm_lsmid = {
	1107	+ .name = "evm",
	1108	+ .id = LSM_ID_EVM,
	1109	+};
	1110	+
	1111	+static int __init init_evm_lsm(void)
	1112	+{
	1113	+ security_add_hooks(evm_hooks, ARRAY_SIZE(evm_hooks), &evm_lsmid);
	1114	+ return 0;
	1115	+}
	1116	+
	1117	+struct lsm_blob_sizes evm_blob_sizes __ro_after_init = {
	1118	+ .lbs_inode = sizeof(struct evm_iint_cache),
	1119	+ .lbs_xattr_count = 1,
	1120	+};
	1121	+
	1122	+DEFINE_LSM(evm) = {
	1123	+ .name = "evm",
	1124	+ .init = init_evm_lsm,
	1125	+ .order = LSM_ORDER_LAST,
	1126	+ .blobs = &evm_blob_sizes,
	1127	+};
	1128	+
1002	1129	late_initcall(init_evm);

security/integrity/iint.c+2−195

@@ -6,207 +6,14 @@ · 5 unmodified lines
6	6	* Mimi Zohar <zohar@us.ibm.com>
7	7	*
8	8	* File: integrity_iint.c
9		− * - implements the integrity hooks: integrity_inode_alloc,
10		− * integrity_inode_free
11		− * - cache integrity information associated with an inode
12		− * using a rbtree tree.
	9	+ * - initialize the integrity directory in securityfs
	10	+ * - load IMA and EVM keys
13	11	*/
14		−#include <linux/slab.h>
15		−#include <linux/init.h>
16		−#include <linux/spinlock.h>
17		−#include <linux/rbtree.h>
18		−#include <linux/file.h>
19		−#include <linux/uaccess.h>
20	12	#include <linux/security.h>
21		−#include <linux/lsm_hooks.h>
22	13	#include "integrity.h"
23	14
24		−static struct rb_root integrity_iint_tree = RB_ROOT;
25		−static DEFINE_RWLOCK(integrity_iint_lock);
26		−static struct kmem_cache *iint_cache __ro_after_init;
27		−
28	15	struct dentry *integrity_dir;
29	16
30		−/*
31		− * __integrity_iint_find - return the iint associated with an inode
32		− */
33		−static struct integrity_iint_cache __integrity_iint_find(struct inode inode)
34		−{
35		− struct integrity_iint_cache *iint;
36		− struct rb_node *n = integrity_iint_tree.rb_node;
37		−
38		− while (n) {
39		− iint = rb_entry(n, struct integrity_iint_cache, rb_node);
40		−
41		− if (inode < iint->inode)
42		− n = n->rb_left;
43		− else if (inode > iint->inode)
44		− n = n->rb_right;
45		− else
46		− return iint;
47		− }
48		−
49		− return NULL;
50		−}
51		−
52		−/*
53		− * integrity_iint_find - return the iint associated with an inode
54		− */
55		−struct integrity_iint_cache integrity_iint_find(struct inode inode)
56		−{
57		− struct integrity_iint_cache *iint;
58		−
59		− if (!IS_IMA(inode))
60		− return NULL;
61		−
62		− read_lock(&integrity_iint_lock);
63		− iint = __integrity_iint_find(inode);
64		− read_unlock(&integrity_iint_lock);
65		−
66		− return iint;
67		−}
68		−
69		−#define IMA_MAX_NESTING (FILESYSTEM_MAX_STACK_DEPTH+1)
70		−
71		−/*
72		− * It is not clear that IMA should be nested at all, but as long is it measures
73		− * files both on overlayfs and on underlying fs, we need to annotate the iint
74		− * mutex to avoid lockdep false positives related to IMA + overlayfs.
75		− * See ovl_lockdep_annotate_inode_mutex_key() for more details.
76		− */
77		−static inline void iint_lockdep_annotate(struct integrity_iint_cache *iint,
78		− struct inode *inode)
79		−{
80		−#ifdef CONFIG_LOCKDEP
81		− static struct lock_class_key iint_mutex_key[IMA_MAX_NESTING];
82		−
83		− int depth = inode->i_sb->s_stack_depth;
84		−
85		− if (WARN_ON_ONCE(depth < 0 \|\| depth >= IMA_MAX_NESTING))
86		− depth = 0;
87		−
88		− lockdep_set_class(&iint->mutex, &iint_mutex_key[depth]);
89		−#endif
90		−}
91		−
92		−static void iint_init_always(struct integrity_iint_cache *iint,
93		− struct inode *inode)
94		−{
95		− iint->ima_hash = NULL;
96		− iint->version = 0;
97		− iint->flags = 0UL;
98		− iint->atomic_flags = 0UL;
99		− iint->ima_file_status = INTEGRITY_UNKNOWN;
100		− iint->ima_mmap_status = INTEGRITY_UNKNOWN;
101		− iint->ima_bprm_status = INTEGRITY_UNKNOWN;
102		− iint->ima_read_status = INTEGRITY_UNKNOWN;
103		− iint->ima_creds_status = INTEGRITY_UNKNOWN;
104		− iint->evm_status = INTEGRITY_UNKNOWN;
105		− iint->measured_pcrs = 0;
106		− mutex_init(&iint->mutex);
107		− iint_lockdep_annotate(iint, inode);
108		−}
109		−
110		−static void iint_free(struct integrity_iint_cache *iint)
111		−{
112		− kfree(iint->ima_hash);
113		− mutex_destroy(&iint->mutex);
114		− kmem_cache_free(iint_cache, iint);
115		−}
116		−
117		−/**
118		− * integrity_inode_get - find or allocate an iint associated with an inode
119		− * @inode: pointer to the inode
120		− * @return: allocated iint
121		− *
122		− * Caller must lock i_mutex
123		− */
124		−struct integrity_iint_cache integrity_inode_get(struct inode inode)
125		−{
126		− struct rb_node **p;
127		− struct rb_node node, parent = NULL;
128		− struct integrity_iint_cache iint, test_iint;
129		−
130		− iint = integrity_iint_find(inode);
131		− if (iint)
132		− return iint;
133		−
134		− iint = kmem_cache_alloc(iint_cache, GFP_NOFS);
135		− if (!iint)
136		− return NULL;
137		−
138		− iint_init_always(iint, inode);
139		−
140		− write_lock(&integrity_iint_lock);
141		−
142		− p = &integrity_iint_tree.rb_node;
143		− while (*p) {
144		− parent = *p;
145		− test_iint = rb_entry(parent, struct integrity_iint_cache,
146		− rb_node);
147		− if (inode < test_iint->inode) {
148		− p = &(*p)->rb_left;
149		− } else if (inode > test_iint->inode) {
150		− p = &(*p)->rb_right;
151		− } else {
152		− write_unlock(&integrity_iint_lock);
153		− kmem_cache_free(iint_cache, iint);
154		− return test_iint;
155		− }
156		− }
157		−
158		− iint->inode = inode;
159		− node = &iint->rb_node;
160		− inode->i_flags \|= S_IMA;
161		− rb_link_node(node, parent, p);
162		− rb_insert_color(node, &integrity_iint_tree);
163		−
164		− write_unlock(&integrity_iint_lock);
165		− return iint;
166		−}
167		−
168		−/**
169		− * integrity_inode_free - called on security_inode_free
170		− * @inode: pointer to the inode
171		− *
172		− * Free the integrity information(iint) associated with an inode.
173		− */
174		−void integrity_inode_free(struct inode *inode)
175		−{
176		− struct integrity_iint_cache *iint;
177		−
178		− if (!IS_IMA(inode))
179		− return;
180		−
181		− write_lock(&integrity_iint_lock);
182		− iint = __integrity_iint_find(inode);
183		− rb_erase(&iint->rb_node, &integrity_iint_tree);
184		− write_unlock(&integrity_iint_lock);
185		−
186		− iint_free(iint);
187		−}
188		−
189		−static void iint_init_once(void *foo)
190		−{
191		− struct integrity_iint_cache iint = (struct integrity_iint_cache ) foo;
192		−
193		− memset(iint, 0, sizeof(*iint));
194		−}
195		−
196		−static int __init integrity_iintcache_init(void)
197		−{
198		− iint_cache =
199		− kmem_cache_create("iint_cache", sizeof(struct integrity_iint_cache),
200		− 0, SLAB_PANIC, iint_init_once);
201		− return 0;
202		−}
203		−DEFINE_LSM(integrity) = {
204		− .name = "integrity",
205		− .init = integrity_iintcache_init,
206		− .order = LSM_ORDER_LAST,
207		−};
208		−
209		−
210	17	/*
211	18	* integrity_kernel_read - read data from the file
212	19	*

security/integrity/ima/Kconfig+1−0

@@ -8,6 +8,7 @@ config IMA · 7 unmodified lines
8	8	select CRYPTO_HMAC
9	9	select CRYPTO_SHA1
10	10	select CRYPTO_HASH_INFO
	11	+ select SECURITY_PATH
11	12	select TCG_TPM if HAS_IOMEM
12	13	select TCG_TIS if TCG_TPM && X86
13	14	select TCG_CRB if TCG_TPM && ACPI

security/integrity/ima/Makefile+1−1

@@ -4,7 +4,7 @@ · 3 unmodified lines
4	4	# Measurement Architecture(IMA).
5	5	#
6	6
7		−obj-$(CONFIG_IMA) += ima.o
	7	+obj-$(CONFIG_IMA) += ima.o ima_iint.o
8	8
9	9	ima-y := ima_fs.o ima_queue.o ima_init.o ima_main.o ima_crypto.o ima_api.o \
10	10	ima_policy.o ima_template.o ima_template_lib.o

security/integrity/ima/ima.h+129−19

@@ -60,7 +60,7 @@ extern const char boot_aggregate_name[]; · 59 unmodified lines
60	60
61	61	/* IMA event related data */
62	62	struct ima_event_data {
63		− struct integrity_iint_cache *iint;
	63	+ struct ima_iint_cache *iint;
64	64	struct file *file;
65	65	const unsigned char *filename;
66	66	struct evm_ima_xattr_data *xattr_value;
@@ -119,6 +119,107 @@ struct ima_kexec_hdr { · 52 unmodified lines
119	119	u64 count;
120	120	};
121	121
	122	+/* IMA iint action cache flags */
	123	+#define IMA_MEASURE 0x00000001
	124	+#define IMA_MEASURED 0x00000002
	125	+#define IMA_APPRAISE 0x00000004
	126	+#define IMA_APPRAISED 0x00000008
	127	+/#define IMA_COLLECT 0x00000010 do not use this flag /
	128	+#define IMA_COLLECTED 0x00000020
	129	+#define IMA_AUDIT 0x00000040
	130	+#define IMA_AUDITED 0x00000080
	131	+#define IMA_HASH 0x00000100
	132	+#define IMA_HASHED 0x00000200
	133	+
	134	+/* IMA iint policy rule cache flags */
	135	+#define IMA_NONACTION_FLAGS 0xff000000
	136	+#define IMA_DIGSIG_REQUIRED 0x01000000
	137	+#define IMA_PERMIT_DIRECTIO 0x02000000
	138	+#define IMA_NEW_FILE 0x04000000
	139	+#define IMA_FAIL_UNVERIFIABLE_SIGS 0x10000000
	140	+#define IMA_MODSIG_ALLOWED 0x20000000
	141	+#define IMA_CHECK_BLACKLIST 0x40000000
	142	+#define IMA_VERITY_REQUIRED 0x80000000
	143	+
	144	+#define IMA_DO_MASK (IMA_MEASURE \| IMA_APPRAISE \| IMA_AUDIT \| \
	145	+ IMA_HASH \| IMA_APPRAISE_SUBMASK)
	146	+#define IMA_DONE_MASK (IMA_MEASURED \| IMA_APPRAISED \| IMA_AUDITED \| \
	147	+ IMA_HASHED \| IMA_COLLECTED \| \
	148	+ IMA_APPRAISED_SUBMASK)
	149	+
	150	+/* IMA iint subaction appraise cache flags */
	151	+#define IMA_FILE_APPRAISE 0x00001000
	152	+#define IMA_FILE_APPRAISED 0x00002000
	153	+#define IMA_MMAP_APPRAISE 0x00004000
	154	+#define IMA_MMAP_APPRAISED 0x00008000
	155	+#define IMA_BPRM_APPRAISE 0x00010000
	156	+#define IMA_BPRM_APPRAISED 0x00020000
	157	+#define IMA_READ_APPRAISE 0x00040000
	158	+#define IMA_READ_APPRAISED 0x00080000
	159	+#define IMA_CREDS_APPRAISE 0x00100000
	160	+#define IMA_CREDS_APPRAISED 0x00200000
	161	+#define IMA_APPRAISE_SUBMASK (IMA_FILE_APPRAISE \| IMA_MMAP_APPRAISE \| \
	162	+ IMA_BPRM_APPRAISE \| IMA_READ_APPRAISE \| \
	163	+ IMA_CREDS_APPRAISE)
	164	+#define IMA_APPRAISED_SUBMASK (IMA_FILE_APPRAISED \| IMA_MMAP_APPRAISED \| \
	165	+ IMA_BPRM_APPRAISED \| IMA_READ_APPRAISED \| \
	166	+ IMA_CREDS_APPRAISED)
	167	+
	168	+/* IMA iint cache atomic_flags */
	169	+#define IMA_CHANGE_XATTR 0
	170	+#define IMA_UPDATE_XATTR 1
	171	+#define IMA_CHANGE_ATTR 2
	172	+#define IMA_DIGSIG 3
	173	+#define IMA_MUST_MEASURE 4
	174	+
	175	+/* IMA integrity metadata associated with an inode */
	176	+struct ima_iint_cache {
	177	+ struct mutex mutex; /* protects: version, flags, digest */
	178	+ u64 version; /* track inode changes */
	179	+ unsigned long flags;
	180	+ unsigned long measured_pcrs;
	181	+ unsigned long atomic_flags;
	182	+ unsigned long real_ino;
	183	+ dev_t real_dev;
	184	+ enum integrity_status ima_file_status:4;
	185	+ enum integrity_status ima_mmap_status:4;
	186	+ enum integrity_status ima_bprm_status:4;
	187	+ enum integrity_status ima_read_status:4;
	188	+ enum integrity_status ima_creds_status:4;
	189	+ struct ima_digest_data *ima_hash;
	190	+};
	191	+
	192	+extern struct lsm_blob_sizes ima_blob_sizes;
	193	+
	194	+static inline struct ima_iint_cache *
	195	+ima_inode_get_iint(const struct inode *inode)
	196	+{
	197	+ struct ima_iint_cache **iint_sec;
	198	+
	199	+ if (unlikely(!inode->i_security))
	200	+ return NULL;
	201	+
	202	+ iint_sec = inode->i_security + ima_blob_sizes.lbs_inode;
	203	+ return *iint_sec;
	204	+}
	205	+
	206	+static inline void ima_inode_set_iint(const struct inode *inode,
	207	+ struct ima_iint_cache *iint)
	208	+{
	209	+ struct ima_iint_cache **iint_sec;
	210	+
	211	+ if (unlikely(!inode->i_security))
	212	+ return;
	213	+
	214	+ iint_sec = inode->i_security + ima_blob_sizes.lbs_inode;
	215	+ *iint_sec = iint;
	216	+}
	217	+
	218	+struct ima_iint_cache ima_iint_find(struct inode inode);
	219	+struct ima_iint_cache ima_inode_get(struct inode inode);
	220	+void ima_inode_free(struct inode *inode);
	221	+void __init ima_iintcache_init(void);
	222	+
122	223	extern const int read_idmap[];
123	224
124	225	#ifdef CONFIG_HAVE_IMA_KEXEC
@@ -127,6 +228,12 @@ void ima_load_kexec_buffer(void); · 2 unmodified lines
127	228	static inline void ima_load_kexec_buffer(void) {}
128	229	#endif /* CONFIG_HAVE_IMA_KEXEC */
129	230
	231	+#ifdef CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS
	232	+void ima_post_key_create_or_update(struct key keyring, struct key key,
	233	+ const void *payload, size_t plen,
	234	+ unsigned long flags, bool create);
	235	+#endif
	236	+
130	237	/*
131	238	* The default binary_runtime_measurements list format is defined as the
132	239	* platform native format. The canonical format is defined as little-endian.
@@ -146,8 +253,8 @@ int ima_calc_field_array_hash(struct ima_field_data *field_data, · 13 unmodified lines
146	253	struct ima_template_entry *entry);
147	254	int ima_calc_boot_aggregate(struct ima_digest_data *hash);
148	255	void ima_add_violation(struct file file, const unsigned char filename,
149		− struct integrity_iint_cache *iint,
150		− const char op, const char cause);
	256	+ struct ima_iint_cache iint, const char op,
	257	+ const char *cause);
151	258	int ima_init_crypto(void);
152	259	void ima_putc(struct seq_file m, void data, int datalen);
153	260	void ima_print_digest(struct seq_file m, u8 digest, u32 size);
@@ -261,10 +368,10 @@ int ima_get_action(struct mnt_idmap idmap, struct inode inode, · 107 unmodified lines
261	368	struct ima_template_desc **template_desc,
262	369	const char func_data, unsigned int allowed_algos);
263	370	int ima_must_measure(struct inode *inode, int mask, enum ima_hooks func);
264		−int ima_collect_measurement(struct integrity_iint_cache *iint,
265		− struct file file, void buf, loff_t size,
266		− enum hash_algo algo, struct modsig *modsig);
267		−void ima_store_measurement(struct integrity_iint_cache iint, struct file file,
	371	+int ima_collect_measurement(struct ima_iint_cache iint, struct file file,
	372	+ void *buf, loff_t size, enum hash_algo algo,
	373	+ struct modsig *modsig);
	374	+void ima_store_measurement(struct ima_iint_cache iint, struct file file,
268	375	const unsigned char *filename,
269	376	struct evm_ima_xattr_data *xattr_value,
270	377	int xattr_len, const struct modsig *modsig, int pcr,
@@ -274,7 +381,7 @@ int process_buffer_measurement(struct mnt_idmap *idmap, · 3 unmodified lines
274	381	const char *eventname, enum ima_hooks func,
275	382	int pcr, const char *func_data,
276	383	bool buf_hash, u8 *digest, size_t digest_len);
277		−void ima_audit_measurement(struct integrity_iint_cache *iint,
	384	+void ima_audit_measurement(struct ima_iint_cache *iint,
278	385	const unsigned char *filename);
279	386	int ima_alloc_init_template(struct ima_event_data *event_data,
280	387	struct ima_template_entry **entry,
@@ -312,32 +419,32 @@ int ima_policy_show(struct seq_file m, void v); · 31 unmodified lines
312	419	#define IMA_APPRAISE_KEXEC 0x40
313	420
314	421	#ifdef CONFIG_IMA_APPRAISE
315		−int ima_check_blacklist(struct integrity_iint_cache *iint,
	422	+int ima_check_blacklist(struct ima_iint_cache *iint,
316	423	const struct modsig *modsig, int pcr);
317		−int ima_appraise_measurement(enum ima_hooks func,
318		− struct integrity_iint_cache *iint,
	424	+int ima_appraise_measurement(enum ima_hooks func, struct ima_iint_cache *iint,
319	425	struct file file, const unsigned char filename,
320	426	struct evm_ima_xattr_data *xattr_value,
321	427	int xattr_len, const struct modsig *modsig);
322	428	int ima_must_appraise(struct mnt_idmap idmap, struct inode inode,
323	429	int mask, enum ima_hooks func);
324		−void ima_update_xattr(struct integrity_iint_cache iint, struct file file);
325		−enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,
	430	+void ima_update_xattr(struct ima_iint_cache iint, struct file file);
	431	+enum integrity_status ima_get_cache_status(struct ima_iint_cache *iint,
326	432	enum ima_hooks func);
327	433	enum hash_algo ima_get_hash_algo(const struct evm_ima_xattr_data *xattr_value,
328	434	int xattr_len);
329	435	int ima_read_xattr(struct dentry *dentry,
330	436	struct evm_ima_xattr_data **xattr_value, int xattr_len);
	437	+void __init init_ima_appraise_lsm(const struct lsm_id *lsmid);
331	438
332	439	#else
333		−static inline int ima_check_blacklist(struct integrity_iint_cache *iint,
	440	+static inline int ima_check_blacklist(struct ima_iint_cache *iint,
334	441	const struct modsig *modsig, int pcr)
335	442	{
336	443	return 0;
337	444	}
338	445
339	446	static inline int ima_appraise_measurement(enum ima_hooks func,
340		− struct integrity_iint_cache *iint,
	447	+ struct ima_iint_cache *iint,
341	448	struct file *file,
342	449	const unsigned char *filename,
343	450	struct evm_ima_xattr_data *xattr_value,
@@ -354,14 +461,13 @@ static inline int ima_must_appraise(struct mnt_idmap *idmap, · 10 unmodified lines
354	461	return 0;
355	462	}
356	463
357		−static inline void ima_update_xattr(struct integrity_iint_cache *iint,
	464	+static inline void ima_update_xattr(struct ima_iint_cache *iint,
358	465	struct file *file)
359	466	{
360	467	}
361	468
362		−static inline enum integrity_status ima_get_cache_status(struct integrity_iint_cache
363		− *iint,
364		− enum ima_hooks func)
	469	+static inline enum integrity_status
	470	+ima_get_cache_status(struct ima_iint_cache *iint, enum ima_hooks func)
365	471	{
366	472	return INTEGRITY_UNKNOWN;
367	473	}
@@ -379,6 +485,10 @@ static inline int ima_read_xattr(struct dentry *dentry, · 11 unmodified lines
379	485	return 0;
380	486	}
381	487
	488	+static inline void __init init_ima_appraise_lsm(const struct lsm_id *lsmid)
	489	+{
	490	+}
	491	+
382	492	#endif /* CONFIG_IMA_APPRAISE */
383	493
384	494	#ifdef CONFIG_IMA_APPRAISE_MODSIG

security/integrity/ima/ima_api.c+12−11

@@ -131,8 +131,8 @@ int ima_store_template(struct ima_template_entry *entry, · 130 unmodified lines
131	131	* value is invalidated.
132	132	*/
133	133	void ima_add_violation(struct file file, const unsigned char filename,
134		− struct integrity_iint_cache *iint,
135		− const char op, const char cause)
	134	+ struct ima_iint_cache iint, const char op,
	135	+ const char *cause)
136	136	{
137	137	struct ima_template_entry *entry;
138	138	struct inode *inode = file_inode(file);
@@ -201,7 +201,8 @@ int ima_get_action(struct mnt_idmap idmap, struct inode inode, · 62 unmodified lines
201	201	allowed_algos);
202	202	}
203	203
204		−static bool ima_get_verity_digest(struct integrity_iint_cache *iint,
	204	+static bool ima_get_verity_digest(struct ima_iint_cache *iint,
	205	+ struct inode *inode,
205	206	struct ima_max_digest_data *hash)
206	207	{
207	208	enum hash_algo alg;
@@ -211,7 +212,7 @@ static bool ima_get_verity_digest(struct integrity_iint_cache *iint, · 3 unmodified lines
211	212	* On failure, 'measure' policy rules will result in a file data
212	213	* hash containing 0's.
213	214	*/
214		− digest_len = fsverity_get_digest(iint->inode, hash->digest, NULL, &alg);
	215	+ digest_len = fsverity_get_digest(inode, hash->digest, NULL, &alg);
215	216	if (digest_len == 0)
216	217	return false;
217	218
@@ -237,9 +238,9 @@ static bool ima_get_verity_digest(struct integrity_iint_cache *iint, · 19 unmodified lines
237	238	*
238	239	* Return 0 on success, error code otherwise
239	240	*/
240		−int ima_collect_measurement(struct integrity_iint_cache *iint,
241		− struct file file, void buf, loff_t size,
242		− enum hash_algo algo, struct modsig *modsig)
	241	+int ima_collect_measurement(struct ima_iint_cache iint, struct file file,
	242	+ void *buf, loff_t size, enum hash_algo algo,
	243	+ struct modsig *modsig)
243	244	{
244	245	const char *audit_cause = "failed";
245	246	struct inode *inode = file_inode(file);
@@ -280,7 +281,7 @@ int ima_collect_measurement(struct integrity_iint_cache *iint, · 34 unmodified lines
280	281	memset(&hash.digest, 0, sizeof(hash.digest));
281	282
282	283	if (iint->flags & IMA_VERITY_REQUIRED) {
283		− if (!ima_get_verity_digest(iint, &hash)) {
	284	+ if (!ima_get_verity_digest(iint, inode, &hash)) {
284	285	audit_cause = "no-verity-digest";
285	286	result = -ENODATA;
286	287	}
@@ -338,8 +339,8 @@ out: · 51 unmodified lines
338	339	*
339	340	* Must be called with iint->mutex held.
340	341	*/
341		−void ima_store_measurement(struct integrity_iint_cache *iint,
342		− struct file file, const unsigned char filename,
	342	+void ima_store_measurement(struct ima_iint_cache iint, struct file file,
	343	+ const unsigned char *filename,
343	344	struct evm_ima_xattr_data *xattr_value,
344	345	int xattr_len, const struct modsig *modsig, int pcr,
345	346	struct ima_template_desc *template_desc)
@@ -382,7 +383,7 @@ void ima_store_measurement(struct integrity_iint_cache *iint, · 36 unmodified lines
382	383	ima_free_template_entry(entry);
383	384	}
384	385
385		−void ima_audit_measurement(struct integrity_iint_cache *iint,
	386	+void ima_audit_measurement(struct ima_iint_cache *iint,
386	387	const unsigned char *filename)
387	388	{
388	389	struct audit_buffer *ab;

security/integrity/ima/ima_appraise.c+43−23

@@ -84,8 +84,7 @@ int ima_must_appraise(struct mnt_idmap idmap, struct inode inode, · 83 unmodified lines
84	84	NULL, NULL, NULL);
85	85	}
86	86
87		−static int ima_fix_xattr(struct dentry *dentry,
88		− struct integrity_iint_cache *iint)
	87	+static int ima_fix_xattr(struct dentry dentry, struct ima_iint_cache iint)
89	88	{
90	89	int rc, offset;
91	90	u8 algo = iint->ima_hash->algo;
@@ -106,7 +105,7 @@ static int ima_fix_xattr(struct dentry *dentry, · 14 unmodified lines
106	105	}
107	106
108	107	/* Return specific func appraised cached result */
109		−enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,
	108	+enum integrity_status ima_get_cache_status(struct ima_iint_cache *iint,
110	109	enum ima_hooks func)
111	110	{
112	111	switch (func) {
@@ -126,7 +125,7 @@ enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint, · 13 unmodified lines
126	125	}
127	126	}
128	127
129		−static void ima_set_cache_status(struct integrity_iint_cache *iint,
	128	+static void ima_set_cache_status(struct ima_iint_cache *iint,
130	129	enum ima_hooks func,
131	130	enum integrity_status status)
132	131	{
@@ -152,8 +151,7 @@ static void ima_set_cache_status(struct integrity_iint_cache *iint, · 19 unmodified lines
152	151	}
153	152	}
154	153
155		−static void ima_cache_flags(struct integrity_iint_cache *iint,
156		− enum ima_hooks func)
	154	+static void ima_cache_flags(struct ima_iint_cache *iint, enum ima_hooks func)
157	155	{
158	156	switch (func) {
159	157	case MMAP_CHECK:
@@ -276,7 +274,7 @@ static int calc_file_id_hash(enum evm_ima_xattr_type type, · 116 unmodified lines
276	274	*
277	275	* Return 0 on success, error code otherwise.
278	276	*/
279		−static int xattr_verify(enum ima_hooks func, struct integrity_iint_cache *iint,
	277	+static int xattr_verify(enum ima_hooks func, struct ima_iint_cache *iint,
280	278	struct evm_ima_xattr_data *xattr_value, int xattr_len,
281	279	enum integrity_status status, const char *cause)
282	280	{
@@ -443,7 +441,7 @@ static int modsig_verify(enum ima_hooks func, const struct modsig *modsig, · 160 unmodified lines
443	441	*
444	442	* Returns -EPERM if the hash is blacklisted.
445	443	*/
446		−int ima_check_blacklist(struct integrity_iint_cache *iint,
	444	+int ima_check_blacklist(struct ima_iint_cache *iint,
447	445	const struct modsig *modsig, int pcr)
448	446	{
449	447	enum hash_algo hash_algo;
@@ -477,8 +475,7 @@ int ima_check_blacklist(struct integrity_iint_cache *iint, · 27 unmodified lines
477	475	*
478	476	* Return 0 on success, error code otherwise
479	477	*/
480		−int ima_appraise_measurement(enum ima_hooks func,
481		− struct integrity_iint_cache *iint,
	478	+int ima_appraise_measurement(enum ima_hooks func, struct ima_iint_cache *iint,
482	479	struct file file, const unsigned char filename,
483	480	struct evm_ima_xattr_data *xattr_value,
484	481	int xattr_len, const struct modsig *modsig)
@@ -520,7 +517,7 @@ int ima_appraise_measurement(enum ima_hooks func, · 35 unmodified lines
520	517	}
521	518
522	519	status = evm_verifyxattr(dentry, XATTR_NAME_IMA, xattr_value,
523		− rc < 0 ? 0 : rc, iint);
	520	+ rc < 0 ? 0 : rc);
524	521	switch (status) {
525	522	case INTEGRITY_PASS:
526	523	case INTEGRITY_PASS_IMMUTABLE:
@@ -603,7 +600,7 @@ out: · 76 unmodified lines
603	600	/*
604	601	* ima_update_xattr - update 'security.ima' hash value
605	602	*/
606		−void ima_update_xattr(struct integrity_iint_cache iint, struct file file)
	603	+void ima_update_xattr(struct ima_iint_cache iint, struct file file)
607	604	{
608	605	struct dentry *dentry = file_dentry(file);
609	606	int rc = 0;
@@ -629,17 +626,18 @@ void ima_update_xattr(struct integrity_iint_cache iint, struct file file) · 19 unmodified lines
629	626	* ima_inode_post_setattr - reflect file metadata changes
630	627	* @idmap: idmap of the mount the inode was found from
631	628	* @dentry: pointer to the affected dentry
	629	+ * @ia_valid: for the UID and GID status
632	630	*
633	631	* Changes to a dentry's metadata might result in needing to appraise.
634	632	*
635	633	* This function is called from notify_change(), which expects the caller
636	634	* to lock the inode's i_mutex.
637	635	*/
638		−void ima_inode_post_setattr(struct mnt_idmap *idmap,
639		− struct dentry *dentry)
	636	+static void ima_inode_post_setattr(struct mnt_idmap *idmap,
	637	+ struct dentry *dentry, int ia_valid)
640	638	{
641	639	struct inode *inode = d_backing_inode(dentry);
642		− struct integrity_iint_cache *iint;
	640	+ struct ima_iint_cache *iint;
643	641	int action;
644	642
645	643	if (!(ima_policy_flag & IMA_APPRAISE) \|\| !S_ISREG(inode->i_mode)
@@ -647,7 +645,7 @@ void ima_inode_post_setattr(struct mnt_idmap *idmap, · 1 unmodified line
647	645	return;
648	646
649	647	action = ima_must_appraise(idmap, inode, MAY_ACCESS, POST_SETATTR);
650		− iint = integrity_iint_find(inode);
	648	+ iint = ima_iint_find(inode);
651	649	if (iint) {
652	650	set_bit(IMA_CHANGE_ATTR, &iint->atomic_flags);
653	651	if (!action)
@@ -673,12 +671,12 @@ static int ima_protect_xattr(struct dentry dentry, const char xattr_name, · 19 unmodified lines
673	671
674	672	static void ima_reset_appraise_flags(struct inode *inode, int digsig)
675	673	{
676		− struct integrity_iint_cache *iint;
	674	+ struct ima_iint_cache *iint;
677	675
678	676	if (!(ima_policy_flag & IMA_APPRAISE) \|\| !S_ISREG(inode->i_mode))
679	677	return;
680	678
681		− iint = integrity_iint_find(inode);
	679	+ iint = ima_iint_find(inode);
682	680	if (!iint)
683	681	return;
684	682	iint->measured_pcrs = 0;
@@ -749,8 +747,9 @@ static int validate_hash_algo(struct dentry *dentry, · 64 unmodified lines
749	747	return -EACCES;
750	748	}
751	749
752		−int ima_inode_setxattr(struct dentry dentry, const char xattr_name,
753		− const void *xattr_value, size_t xattr_value_len)
	750	+static int ima_inode_setxattr(struct mnt_idmap idmap, struct dentry dentry,
	751	+ const char xattr_name, const void xattr_value,
	752	+ size_t xattr_value_len, int flags)
754	753	{
755	754	const struct evm_ima_xattr_data *xvalue = xattr_value;
756	755	int digsig = 0;
@@ -779,8 +778,8 @@ int ima_inode_setxattr(struct dentry dentry, const char xattr_name, · 22 unmodified lines
779	778	return result;
780	779	}
781	780
782		−int ima_inode_set_acl(struct mnt_idmap idmap, struct dentry dentry,
783		− const char acl_name, struct posix_acl kacl)
	781	+static int ima_inode_set_acl(struct mnt_idmap idmap, struct dentry dentry,
	782	+ const char acl_name, struct posix_acl kacl)
784	783	{
785	784	if (evm_revalidate_status(acl_name))
786	785	ima_reset_appraise_flags(d_backing_inode(dentry), 0);
@@ -788,7 +787,8 @@ int ima_inode_set_acl(struct mnt_idmap idmap, struct dentry dentry, · 1 unmodified line
788	787	return 0;
789	788	}
790	789
791		−int ima_inode_removexattr(struct dentry dentry, const char xattr_name)
	790	+static int ima_inode_removexattr(struct mnt_idmap idmap, struct dentry dentry,
	791	+ const char *xattr_name)
792	792	{
793	793	int result;
794	794
@@ -800,3 +800,23 @@ int ima_inode_removexattr(struct dentry dentry, const char xattr_name) · 5 unmodified lines
800	800	}
801	801	return result;
802	802	}
	803	+
	804	+static int ima_inode_remove_acl(struct mnt_idmap idmap, struct dentry dentry,
	805	+ const char *acl_name)
	806	+{
	807	+ return ima_inode_set_acl(idmap, dentry, acl_name, NULL);
	808	+}
	809	+
	810	+static struct security_hook_list ima_appraise_hooks[] __ro_after_init = {
	811	+ LSM_HOOK_INIT(inode_post_setattr, ima_inode_post_setattr),
	812	+ LSM_HOOK_INIT(inode_setxattr, ima_inode_setxattr),
	813	+ LSM_HOOK_INIT(inode_set_acl, ima_inode_set_acl),
	814	+ LSM_HOOK_INIT(inode_removexattr, ima_inode_removexattr),
	815	+ LSM_HOOK_INIT(inode_remove_acl, ima_inode_remove_acl),
	816	+};
	817	+
	818	+void __init init_ima_appraise_lsm(const struct lsm_id *lsmid)
	819	+{
	820	+ security_add_hooks(ima_appraise_hooks, ARRAY_SIZE(ima_appraise_hooks),
	821	+ lsmid);
	822	+}

security/integrity/ima/ima_iint.c+142−0

@@ -0,0 +1,142 @@
	1	+// SPDX-License-Identifier: GPL-2.0-only
	2	+/*
	3	+ * Copyright (C) 2008 IBM Corporation
	4	+ *
	5	+ * Authors:
	6	+ * Mimi Zohar <zohar@us.ibm.com>
	7	+ *
	8	+ * File: ima_iint.c
	9	+ * - implements the IMA hook: ima_inode_free
	10	+ * - cache integrity information in the inode security blob
	11	+ */
	12	+#include <linux/slab.h>
	13	+
	14	+#include "ima.h"
	15	+
	16	+static struct kmem_cache *ima_iint_cache __ro_after_init;
	17	+
	18	+/**
	19	+ * ima_iint_find - Return the iint associated with an inode
	20	+ * @inode: Pointer to the inode
	21	+ *
	22	+ * Return the IMA integrity information (iint) associated with an inode, if the
	23	+ * inode was processed by IMA.
	24	+ *
	25	+ * Return: Found iint or NULL.
	26	+ */
	27	+struct ima_iint_cache ima_iint_find(struct inode inode)
	28	+{
	29	+ if (!IS_IMA(inode))
	30	+ return NULL;
	31	+
	32	+ return ima_inode_get_iint(inode);
	33	+}
	34	+
	35	+#define IMA_MAX_NESTING (FILESYSTEM_MAX_STACK_DEPTH + 1)
	36	+
	37	+/*
	38	+ * It is not clear that IMA should be nested at all, but as long is it measures
	39	+ * files both on overlayfs and on underlying fs, we need to annotate the iint
	40	+ * mutex to avoid lockdep false positives related to IMA + overlayfs.
	41	+ * See ovl_lockdep_annotate_inode_mutex_key() for more details.
	42	+ */
	43	+static inline void ima_iint_lockdep_annotate(struct ima_iint_cache *iint,
	44	+ struct inode *inode)
	45	+{
	46	+#ifdef CONFIG_LOCKDEP
	47	+ static struct lock_class_key ima_iint_mutex_key[IMA_MAX_NESTING];
	48	+
	49	+ int depth = inode->i_sb->s_stack_depth;
	50	+
	51	+ if (WARN_ON_ONCE(depth < 0 \|\| depth >= IMA_MAX_NESTING))
	52	+ depth = 0;
	53	+
	54	+ lockdep_set_class(&iint->mutex, &ima_iint_mutex_key[depth]);
	55	+#endif
	56	+}
	57	+
	58	+static void ima_iint_init_always(struct ima_iint_cache *iint,
	59	+ struct inode *inode)
	60	+{
	61	+ iint->ima_hash = NULL;
	62	+ iint->version = 0;
	63	+ iint->flags = 0UL;
	64	+ iint->atomic_flags = 0UL;
	65	+ iint->ima_file_status = INTEGRITY_UNKNOWN;
	66	+ iint->ima_mmap_status = INTEGRITY_UNKNOWN;
	67	+ iint->ima_bprm_status = INTEGRITY_UNKNOWN;
	68	+ iint->ima_read_status = INTEGRITY_UNKNOWN;
	69	+ iint->ima_creds_status = INTEGRITY_UNKNOWN;
	70	+ iint->measured_pcrs = 0;
	71	+ mutex_init(&iint->mutex);
	72	+ ima_iint_lockdep_annotate(iint, inode);
	73	+}
	74	+
	75	+static void ima_iint_free(struct ima_iint_cache *iint)
	76	+{
	77	+ kfree(iint->ima_hash);
	78	+ mutex_destroy(&iint->mutex);
	79	+ kmem_cache_free(ima_iint_cache, iint);
	80	+}
	81	+
	82	+/**
	83	+ * ima_inode_get - Find or allocate an iint associated with an inode
	84	+ * @inode: Pointer to the inode
	85	+ *
	86	+ * Find an iint associated with an inode, and allocate a new one if not found.
	87	+ * Caller must lock i_mutex.
	88	+ *
	89	+ * Return: An iint on success, NULL on error.
	90	+ */
	91	+struct ima_iint_cache ima_inode_get(struct inode inode)
	92	+{
	93	+ struct ima_iint_cache *iint;
	94	+
	95	+ iint = ima_iint_find(inode);
	96	+ if (iint)
	97	+ return iint;
	98	+
	99	+ iint = kmem_cache_alloc(ima_iint_cache, GFP_NOFS);
	100	+ if (!iint)
	101	+ return NULL;
	102	+
	103	+ ima_iint_init_always(iint, inode);
	104	+
	105	+ inode->i_flags \|= S_IMA;
	106	+ ima_inode_set_iint(inode, iint);
	107	+
	108	+ return iint;
	109	+}
	110	+
	111	+/**
	112	+ * ima_inode_free - Called on inode free
	113	+ * @inode: Pointer to the inode
	114	+ *
	115	+ * Free the iint associated with an inode.
	116	+ */
	117	+void ima_inode_free(struct inode *inode)
	118	+{
	119	+ struct ima_iint_cache *iint;
	120	+
	121	+ if (!IS_IMA(inode))
	122	+ return;
	123	+
	124	+ iint = ima_iint_find(inode);
	125	+ ima_inode_set_iint(inode, NULL);
	126	+
	127	+ ima_iint_free(iint);
	128	+}
	129	+
	130	+static void ima_iint_init_once(void *foo)
	131	+{
	132	+ struct ima_iint_cache iint = (struct ima_iint_cache )foo;
	133	+
	134	+ memset(iint, 0, sizeof(*iint));
	135	+}
	136	+
	137	+void __init ima_iintcache_init(void)
	138	+{
	139	+ ima_iint_cache =
	140	+ kmem_cache_create("ima_iint_cache", sizeof(struct ima_iint_cache),
	141	+ 0, SLAB_PANIC, ima_iint_init_once);
	142	+}

security/integrity/ima/ima_init.c+1−1

@@ -44,7 +44,7 @@ static int __init ima_add_boot_aggregate(void) · 43 unmodified lines
44	44	static const char op[] = "add_boot_aggregate";
45	45	const char *audit_cause = "ENOMEM";
46	46	struct ima_template_entry *entry;
47		− struct integrity_iint_cache tmp_iint, *iint = &tmp_iint;
	47	+ struct ima_iint_cache tmp_iint, *iint = &tmp_iint;
48	48	struct ima_event_data event_data = { .iint = iint,
49	49	.filename = boot_aggregate_name };
50	50	struct ima_max_digest_data hash;

security/integrity/ima/ima_main.c+113−35

@@ -114,7 +114,7 @@ static int mmap_violation_check(enum ima_hooks func, struct file *file, · 113 unmodified lines
114	114	*
115	115	*/
116	116	static void ima_rdwr_violation_check(struct file *file,
117		− struct integrity_iint_cache *iint,
	117	+ struct ima_iint_cache *iint,
118	118	int must_measure,
119	119	char **pathbuf,
120	120	const char **pathname,
@@ -127,7 +127,7 @@ static void ima_rdwr_violation_check(struct file *file, · 6 unmodified lines
127	127	if (mode & FMODE_WRITE) {
128	128	if (atomic_read(&inode->i_readcount) && IS_IMA(inode)) {
129	129	if (!iint)
130		− iint = integrity_iint_find(inode);
	130	+ iint = ima_iint_find(inode);
131	131	/* IMA_MEASURE is set from reader side */
132	132	if (iint && test_bit(IMA_MUST_MEASURE,
133	133	&iint->atomic_flags))
@@ -153,7 +153,7 @@ static void ima_rdwr_violation_check(struct file *file, · 19 unmodified lines
153	153	"invalid_pcr", "open_writers");
154	154	}
155	155
156		−static void ima_check_last_writer(struct integrity_iint_cache *iint,
	156	+static void ima_check_last_writer(struct ima_iint_cache *iint,
157	157	struct inode inode, struct file file)
158	158	{
159	159	fmode_t mode = file->f_mode;
@@ -189,15 +189,15 @@ static void ima_check_last_writer(struct integrity_iint_cache *iint, · 29 unmodified lines
189	189	*
190	190	* Flag files that changed, based on i_version
191	191	*/
192		−void ima_file_free(struct file *file)
	192	+static void ima_file_free(struct file *file)
193	193	{
194	194	struct inode *inode = file_inode(file);
195		− struct integrity_iint_cache *iint;
	195	+ struct ima_iint_cache *iint;
196	196
197	197	if (!ima_policy_flag \|\| !S_ISREG(inode->i_mode))
198	198	return;
199	199
200		− iint = integrity_iint_find(inode);
	200	+ iint = ima_iint_find(inode);
201	201	if (!iint)
202	202	return;
203	203
@@ -209,7 +209,7 @@ static int process_measurement(struct file file, const struct cred cred, · 5 unmodified lines
209	209	enum ima_hooks func)
210	210	{
211	211	struct inode backing_inode, inode = file_inode(file);
212		− struct integrity_iint_cache *iint = NULL;
	212	+ struct ima_iint_cache *iint = NULL;
213	213	struct ima_template_desc *template_desc = NULL;
214	214	char *pathbuf = NULL;
215	215	char filename[NAME_MAX];
@@ -248,7 +248,7 @@ static int process_measurement(struct file file, const struct cred cred, · 32 unmodified lines
248	248	inode_lock(inode);
249	249
250	250	if (action) {
251		− iint = integrity_inode_get(inode);
	251	+ iint = ima_inode_get(inode);
252	252	if (!iint)
253	253	rc = -ENOMEM;
254	254	}
@@ -427,8 +427,8 @@ out: · 172 unmodified lines
427	427	* On success return 0. On integrity appraisal error, assuming the file
428	428	* is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
429	429	*/
430		−int ima_file_mmap(struct file *file, unsigned long reqprot,
431		− unsigned long prot, unsigned long flags)
	430	+static int ima_file_mmap(struct file *file, unsigned long reqprot,
	431	+ unsigned long prot, unsigned long flags)
432	432	{
433	433	u32 secid;
434	434	int ret;
@@ -455,7 +455,8 @@ int ima_file_mmap(struct file *file, unsigned long reqprot, · 20 unmodified lines
455	455	/**
456	456	* ima_file_mprotect - based on policy, limit mprotect change
457	457	* @vma: vm_area_struct protection is set to
458		− * @prot: contains the protection that will be applied by the kernel.
	458	+ * @reqprot: protection requested by the application
	459	+ * @prot: protection that will be applied by the kernel
459	460	*
460	461	* Files can be mmap'ed read/write and later changed to execute to circumvent
461	462	* IMA's mmap appraisal policy rules. Due to locking issues (mmap semaphore
@@ -465,7 +466,8 @@ int ima_file_mmap(struct file *file, unsigned long reqprot, · 3 unmodified lines
465	466	*
466	467	* On mprotect change success, return 0. On failure, return -EACESS.
467	468	*/
468		−int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot)
	469	+static int ima_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
	470	+ unsigned long prot)
469	471	{
470	472	struct ima_template_desc *template = NULL;
471	473	struct file *file;
@@ -523,7 +525,7 @@ int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot) · 51 unmodified lines
523	525	* On success return 0. On integrity appraisal error, assuming the file
524	526	* is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
525	527	*/
526		−int ima_bprm_check(struct linux_binprm *bprm)
	528	+static int ima_bprm_check(struct linux_binprm *bprm)
527	529	{
528	530	int ret;
529	531	u32 secid;
@@ -549,7 +551,7 @@ int ima_bprm_check(struct linux_binprm *bprm) · 19 unmodified lines
549	551	* On success return 0. On integrity appraisal error, assuming the file
550	552	* is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
551	553	*/
552		−int ima_file_check(struct file *file, int mask)
	554	+static int ima_file_check(struct file *file, int mask)
553	555	{
554	556	u32 secid;
555	557
@@ -558,16 +560,15 @@ int ima_file_check(struct file *file, int mask) · 2 unmodified lines
558	560	mask & (MAY_READ \| MAY_WRITE \| MAY_EXEC \|
559	561	MAY_APPEND), FILE_CHECK);
560	562	}
561		−EXPORT_SYMBOL_GPL(ima_file_check);
562	563
563	564	static int __ima_inode_hash(struct inode inode, struct file file, char *buf,
564	565	size_t buf_size)
565	566	{
566		− struct integrity_iint_cache *iint = NULL, tmp_iint;
	567	+ struct ima_iint_cache *iint = NULL, tmp_iint;
567	568	int rc, hash_algo;
568	569
569	570	if (ima_policy_flag) {
570		− iint = integrity_iint_find(inode);
	571	+ iint = ima_iint_find(inode);
571	572	if (iint)
572	573	mutex_lock(&iint->mutex);
573	574	}
@@ -577,7 +578,6 @@ static int __ima_inode_hash(struct inode inode, struct file file, char *buf, · 3 unmodified lines
577	578	mutex_unlock(&iint->mutex);
578	579
579	580	memset(&tmp_iint, 0, sizeof(tmp_iint));
580		− tmp_iint.inode = inode;
581	581	mutex_init(&tmp_iint.mutex);
582	582
583	583	rc = ima_collect_measurement(&tmp_iint, file, NULL, 0,
@@ -683,10 +683,11 @@ EXPORT_SYMBOL_GPL(ima_inode_hash); · 99 unmodified lines
683	683	* Skip calling process_measurement(), but indicate which newly, created
684	684	* tmpfiles are in policy.
685	685	*/
686		−void ima_post_create_tmpfile(struct mnt_idmap *idmap,
687		− struct inode *inode)
	686	+static void ima_post_create_tmpfile(struct mnt_idmap *idmap,
	687	+ struct inode *inode)
	688	+
688	689	{
689		− struct integrity_iint_cache *iint;
	690	+ struct ima_iint_cache *iint;
690	691	int must_appraise;
691	692
692	693	if (!ima_policy_flag \|\| !S_ISREG(inode->i_mode))
@@ -698,7 +699,7 @@ void ima_post_create_tmpfile(struct mnt_idmap *idmap, · 5 unmodified lines
698	699	return;
699	700
700	701	/* Nothing to do if we can't allocate memory */
701		− iint = integrity_inode_get(inode);
	702	+ iint = ima_inode_get(inode);
702	703	if (!iint)
703	704	return;
704	705
@@ -715,10 +716,9 @@ void ima_post_create_tmpfile(struct mnt_idmap *idmap, · 10 unmodified lines
715	716	* Mark files created via the mknodat syscall as new, so that the
716	717	* file data can be written later.
717	718	*/
718		−void ima_post_path_mknod(struct mnt_idmap *idmap,
719		− struct dentry *dentry)
	719	+static void ima_post_path_mknod(struct mnt_idmap idmap, struct dentry dentry)
720	720	{
721		− struct integrity_iint_cache *iint;
	721	+ struct ima_iint_cache *iint;
722	722	struct inode *inode = dentry->d_inode;
723	723	int must_appraise;
724	724
@@ -731,7 +731,7 @@ void ima_post_path_mknod(struct mnt_idmap *idmap, · 6 unmodified lines
731	731	return;
732	732
733	733	/* Nothing to do if we can't allocate memory */
734		− iint = integrity_inode_get(inode);
	734	+ iint = ima_inode_get(inode);
735	735	if (!iint)
736	736	return;
737	737
@@ -751,8 +751,8 @@ void ima_post_path_mknod(struct mnt_idmap *idmap, · 13 unmodified lines
751	751	*
752	752	* For permission return 0, otherwise return -EACCES.
753	753	*/
754		−int ima_read_file(struct file *file, enum kernel_read_file_id read_id,
755		− bool contents)
	754	+static int ima_read_file(struct file *file, enum kernel_read_file_id read_id,
	755	+ bool contents)
756	756	{
757	757	enum ima_hooks func;
758	758	u32 secid;
@@ -801,8 +801,8 @@ const int read_idmap[READING_MAX_ID] = { · 42 unmodified lines
801	801	* On success return 0. On integrity appraisal error, assuming the file
802	802	* is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
803	803	*/
804		−int ima_post_read_file(struct file file, void buf, loff_t size,
805		− enum kernel_read_file_id read_id)
	804	+static int ima_post_read_file(struct file file, char buf, loff_t size,
	805	+ enum kernel_read_file_id read_id)
806	806	{
807	807	enum ima_hooks func;
808	808	u32 secid;
@@ -835,7 +835,7 @@ int ima_post_read_file(struct file file, void buf, loff_t size, · 26 unmodified lines
835	835	*
836	836	* For permission return 0, otherwise return -EACCES.
837	837	*/
838		−int ima_load_data(enum kernel_load_data_id id, bool contents)
	838	+static int ima_load_data(enum kernel_load_data_id id, bool contents)
839	839	{
840	840	bool ima_enforce, sig_enforce;
841	841
@@ -889,9 +889,9 @@ int ima_load_data(enum kernel_load_data_id id, bool contents) · 47 unmodified lines
889	889	* On success return 0. On integrity appraisal error, assuming the file
890	890	* is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
891	891	*/
892		−int ima_post_load_data(char *buf, loff_t size,
893		− enum kernel_load_data_id load_id,
894		− char *description)
	892	+static int ima_post_load_data(char *buf, loff_t size,
	893	+ enum kernel_load_data_id load_id,
	894	+ char *description)
895	895	{
896	896	if (load_id == LOADING_FIRMWARE) {
897	897	if ((ima_appraise & IMA_APPRAISE_FIRMWARE) &&
@@ -934,7 +934,7 @@ int process_buffer_measurement(struct mnt_idmap *idmap, · 36 unmodified lines
934	934	int ret = 0;
935	935	const char *audit_cause = "ENOMEM";
936	936	struct ima_template_entry *entry = NULL;
937		− struct integrity_iint_cache iint = {};
	937	+ struct ima_iint_cache iint = {};
938	938	struct ima_event_data event_data = {.iint = &iint,
939	939	.filename = eventname,
940	940	.buf = buf,
@@ -1089,6 +1089,39 @@ int ima_measure_critical_data(const char *event_label, · 148 unmodified lines
1089	1089	}
1090	1090	EXPORT_SYMBOL_GPL(ima_measure_critical_data);
1091	1091
	1092	+#ifdef CONFIG_INTEGRITY_ASYMMETRIC_KEYS
	1093	+
	1094	+/**
	1095	+ * ima_kernel_module_request - Prevent crypto-pkcs1pad(rsa,*) requests
	1096	+ * @kmod_name: kernel module name
	1097	+ *
	1098	+ * Avoid a verification loop where verifying the signature of the modprobe
	1099	+ * binary requires executing modprobe itself. Since the modprobe iint->mutex
	1100	+ * is already held when the signature verification is performed, a deadlock
	1101	+ * occurs as soon as modprobe is executed within the critical region, since
	1102	+ * the same lock cannot be taken again.
	1103	+ *
	1104	+ * This happens when public_key_verify_signature(), in case of RSA algorithm,
	1105	+ * use alg_name to store internal information in order to construct an
	1106	+ * algorithm on the fly, but crypto_larval_lookup() will try to use alg_name
	1107	+ * in order to load a kernel module with same name.
	1108	+ *
	1109	+ * Since we don't have any real "crypto-pkcs1pad(rsa,*)" kernel modules,
	1110	+ * we are safe to fail such module request from crypto_larval_lookup(), and
	1111	+ * avoid the verification loop.
	1112	+ *
	1113	+ * Return: Zero if it is safe to load the kernel module, -EINVAL otherwise.
	1114	+ */
	1115	+static int ima_kernel_module_request(char *kmod_name)
	1116	+{
	1117	+ if (strncmp(kmod_name, "crypto-pkcs1pad(rsa,", 20) == 0)
	1118	+ return -EINVAL;
	1119	+
	1120	+ return 0;
	1121	+}
	1122	+
	1123	+#endif /* CONFIG_INTEGRITY_ASYMMETRIC_KEYS */
	1124	+
1092	1125	static int __init init_ima(void)
1093	1126	{
1094	1127	int error;
@@ -1120,4 +1153,49 @@ static int __init init_ima(void) · 25 unmodified lines
1120	1153	return error;
1121	1154	}
1122	1155
	1156	+static struct security_hook_list ima_hooks[] __ro_after_init = {
	1157	+ LSM_HOOK_INIT(bprm_check_security, ima_bprm_check),
	1158	+ LSM_HOOK_INIT(file_post_open, ima_file_check),
	1159	+ LSM_HOOK_INIT(inode_post_create_tmpfile, ima_post_create_tmpfile),
	1160	+ LSM_HOOK_INIT(file_release, ima_file_free),
	1161	+ LSM_HOOK_INIT(mmap_file, ima_file_mmap),
	1162	+ LSM_HOOK_INIT(file_mprotect, ima_file_mprotect),
	1163	+ LSM_HOOK_INIT(kernel_load_data, ima_load_data),
	1164	+ LSM_HOOK_INIT(kernel_post_load_data, ima_post_load_data),
	1165	+ LSM_HOOK_INIT(kernel_read_file, ima_read_file),
	1166	+ LSM_HOOK_INIT(kernel_post_read_file, ima_post_read_file),
	1167	+ LSM_HOOK_INIT(path_post_mknod, ima_post_path_mknod),
	1168	+#ifdef CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS
	1169	+ LSM_HOOK_INIT(key_post_create_or_update, ima_post_key_create_or_update),
	1170	+#endif
	1171	+#ifdef CONFIG_INTEGRITY_ASYMMETRIC_KEYS
	1172	+ LSM_HOOK_INIT(kernel_module_request, ima_kernel_module_request),
	1173	+#endif
	1174	+ LSM_HOOK_INIT(inode_free_security, ima_inode_free),
	1175	+};
	1176	+
	1177	+static const struct lsm_id ima_lsmid = {
	1178	+ .name = "ima",
	1179	+ .id = LSM_ID_IMA,
	1180	+};
	1181	+
	1182	+static int __init init_ima_lsm(void)
	1183	+{
	1184	+ ima_iintcache_init();
	1185	+ security_add_hooks(ima_hooks, ARRAY_SIZE(ima_hooks), &ima_lsmid);
	1186	+ init_ima_appraise_lsm(&ima_lsmid);
	1187	+ return 0;
	1188	+}
	1189	+
	1190	+struct lsm_blob_sizes ima_blob_sizes __ro_after_init = {
	1191	+ .lbs_inode = sizeof(struct ima_iint_cache *),
	1192	+};
	1193	+
	1194	+DEFINE_LSM(ima) = {
	1195	+ .name = "ima",
	1196	+ .init = init_ima_lsm,
	1197	+ .order = LSM_ORDER_LAST,
	1198	+ .blobs = &ima_blob_sizes,
	1199	+};
	1200	+
1123	1201	late_initcall(init_ima); /* Start IMA after the TPM is available */

security/integrity/ima/ima_policy.c+1−1

@@ -49,7 +49,7 @@ · 48 unmodified lines
49	49	#define DONT_HASH 0x0200
50	50
51	51	#define INVALID_PCR(a) (((a) < 0) \|\| \
52		− (a) >= (sizeof_field(struct integrity_iint_cache, measured_pcrs) * 8))
	52	+ (a) >= (sizeof_field(struct ima_iint_cache, measured_pcrs) * 8))
53	53
54	54	int ima_policy_flag;
55	55	static int temp_ima_appraise;

security/integrity/integrity.h+1−79

@@ -18,60 +18,7 @@ · 17 unmodified lines
18	18	#include <crypto/hash.h>
19	19	#include <linux/key.h>
20	20	#include <linux/audit.h>
21		−
22		−/* iint action cache flags */
23		−#define IMA_MEASURE 0x00000001
24		−#define IMA_MEASURED 0x00000002
25		−#define IMA_APPRAISE 0x00000004
26		−#define IMA_APPRAISED 0x00000008
27		−/#define IMA_COLLECT 0x00000010 do not use this flag /
28		−#define IMA_COLLECTED 0x00000020
29		−#define IMA_AUDIT 0x00000040
30		−#define IMA_AUDITED 0x00000080
31		−#define IMA_HASH 0x00000100
32		−#define IMA_HASHED 0x00000200
33		−
34		−/* iint policy rule cache flags */
35		−#define IMA_NONACTION_FLAGS 0xff000000
36		−#define IMA_DIGSIG_REQUIRED 0x01000000
37		−#define IMA_PERMIT_DIRECTIO 0x02000000
38		−#define IMA_NEW_FILE 0x04000000
39		−#define EVM_IMMUTABLE_DIGSIG 0x08000000
40		−#define IMA_FAIL_UNVERIFIABLE_SIGS 0x10000000
41		−#define IMA_MODSIG_ALLOWED 0x20000000
42		−#define IMA_CHECK_BLACKLIST 0x40000000
43		−#define IMA_VERITY_REQUIRED 0x80000000
44		−
45		−#define IMA_DO_MASK (IMA_MEASURE \| IMA_APPRAISE \| IMA_AUDIT \| \
46		− IMA_HASH \| IMA_APPRAISE_SUBMASK)
47		−#define IMA_DONE_MASK (IMA_MEASURED \| IMA_APPRAISED \| IMA_AUDITED \| \
48		− IMA_HASHED \| IMA_COLLECTED \| \
49		− IMA_APPRAISED_SUBMASK)
50		−
51		−/* iint subaction appraise cache flags */
52		−#define IMA_FILE_APPRAISE 0x00001000
53		−#define IMA_FILE_APPRAISED 0x00002000
54		−#define IMA_MMAP_APPRAISE 0x00004000
55		−#define IMA_MMAP_APPRAISED 0x00008000
56		−#define IMA_BPRM_APPRAISE 0x00010000
57		−#define IMA_BPRM_APPRAISED 0x00020000
58		−#define IMA_READ_APPRAISE 0x00040000
59		−#define IMA_READ_APPRAISED 0x00080000
60		−#define IMA_CREDS_APPRAISE 0x00100000
61		−#define IMA_CREDS_APPRAISED 0x00200000
62		−#define IMA_APPRAISE_SUBMASK (IMA_FILE_APPRAISE \| IMA_MMAP_APPRAISE \| \
63		− IMA_BPRM_APPRAISE \| IMA_READ_APPRAISE \| \
64		− IMA_CREDS_APPRAISE)
65		−#define IMA_APPRAISED_SUBMASK (IMA_FILE_APPRAISED \| IMA_MMAP_APPRAISED \| \
66		− IMA_BPRM_APPRAISED \| IMA_READ_APPRAISED \| \
67		− IMA_CREDS_APPRAISED)
68		−
69		−/* iint cache atomic_flags */
70		−#define IMA_CHANGE_XATTR 0
71		−#define IMA_UPDATE_XATTR 1
72		−#define IMA_CHANGE_ATTR 2
73		−#define IMA_DIGSIG 3
74		−#define IMA_MUST_MEASURE 4
	21	+#include <linux/lsm_hooks.h>
75	22
76	23	enum evm_ima_xattr_type {
77	24	IMA_XATTR_DIGEST = 0x01,
@@ -155,31 +102,6 @@ struct ima_file_id { · 77 unmodified lines
155	102	__u8 hash[HASH_MAX_DIGESTSIZE];
156	103	} __packed;
157	104
158		−/* integrity data associated with an inode */
159		−struct integrity_iint_cache {
160		− struct rb_node rb_node; /* rooted in integrity_iint_tree */
161		− struct mutex mutex; /* protects: version, flags, digest */
162		− struct inode inode; / back pointer to inode in question */
163		− u64 version; /* track inode changes */
164		− unsigned long flags;
165		− unsigned long measured_pcrs;
166		− unsigned long atomic_flags;
167		− unsigned long real_ino;
168		− dev_t real_dev;
169		− enum integrity_status ima_file_status:4;
170		− enum integrity_status ima_mmap_status:4;
171		− enum integrity_status ima_bprm_status:4;
172		− enum integrity_status ima_read_status:4;
173		− enum integrity_status ima_creds_status:4;
174		− enum integrity_status evm_status:4;
175		− struct ima_digest_data *ima_hash;
176		−};
177		−
178		−/* rbtree tree calls to lookup, insert, delete
179		− * integrity data associated with an inode.
180		− */
181		−struct integrity_iint_cache integrity_iint_find(struct inode inode);
182		−
183	105	int integrity_kernel_read(struct file *file, loff_t offset,
184	106	void *addr, unsigned long count);
185	107

security/keys/key.c+4−6

@@ -13,7 +13,6 @@ · 12 unmodified lines
13	13	#include <linux/security.h>
14	14	#include <linux/workqueue.h>
15	15	#include <linux/random.h>
16		−#include <linux/ima.h>
17	16	#include <linux/err.h>
18	17	#include "internal.h"
19	18
@@ -930,8 +929,8 @@ static key_ref_t __key_create_or_update(key_ref_t keyring_ref, · 910 unmodified lines
930	929	goto error_link_end;
931	930	}
932	931
933		− ima_post_key_create_or_update(keyring, key, payload, plen,
934		− flags, true);
	932	+ security_key_post_create_or_update(keyring, key, payload, plen, flags,
	933	+ true);
935	934
936	935	key_ref = make_key_ref(key, is_key_possessed(keyring_ref));
937	936
@@ -964,9 +963,8 @@ error: · 26 unmodified lines
964	963	key_ref = __key_update(key_ref, &prep);
965	964
966	965	if (!IS_ERR(key_ref))
967		− ima_post_key_create_or_update(keyring, key,
968		− payload, plen,
969		− flags, false);
	966	+ security_key_post_create_or_update(keyring, key, payload, plen,
	967	+ flags, false);
970	968
971	969	goto error_free_prep;
972	970	}

security/security.c+381−400

@@ -19,15 +19,13 @@ · 18 unmodified lines
19	19	#include <linux/kernel.h>
20	20	#include <linux/kernel_read_file.h>
21	21	#include <linux/lsm_hooks.h>
22		−#include <linux/integrity.h>
23		−#include <linux/ima.h>
24		−#include <linux/evm.h>
25	22	#include <linux/fsnotify.h>
26	23	#include <linux/mman.h>
27	24	#include <linux/mount.h>
28	25	#include <linux/personality.h>
29	26	#include <linux/backing-dev.h>
30	27	#include <linux/string.h>
	28	+#include <linux/xattr.h>
31	29	#include <linux/msg.h>
32	30	#include <linux/overflow.h>
33	31	#include <net/flow.h>
@@ -51,7 +49,9 @@ · 17 unmodified lines
51	49	(IS_ENABLED(CONFIG_SECURITY_SAFESETID) ? 1 : 0) + \
52	50	(IS_ENABLED(CONFIG_SECURITY_LOCKDOWN_LSM) ? 1 : 0) + \
53	51	(IS_ENABLED(CONFIG_BPF_LSM) ? 1 : 0) + \
54		− (IS_ENABLED(CONFIG_SECURITY_LANDLOCK) ? 1 : 0))
	52	+ (IS_ENABLED(CONFIG_SECURITY_LANDLOCK) ? 1 : 0) + \
	53	+ (IS_ENABLED(CONFIG_IMA) ? 1 : 0) + \
	54	+ (IS_ENABLED(CONFIG_EVM) ? 1 : 0))
55	55
56	56	/*
57	57	* These are descriptions of the reasons that can be passed to the
@@ -856,14 +856,14 @@ out: · 798 unmodified lines
856	856	P->hook.FUNC(__VA_ARGS__); \
857	857	} while (0)
858	858
859		−#define call_int_hook(FUNC, IRC, ...) ({ \
860		− int RC = IRC; \
	859	+#define call_int_hook(FUNC, ...) ({ \
	860	+ int RC = LSM_RET_DEFAULT(FUNC); \
861	861	do { \
862	862	struct security_hook_list *P; \
863	863	\
864	864	hlist_for_each_entry(P, &security_hook_heads.FUNC, list) { \
865	865	RC = P->hook.FUNC(__VA_ARGS__); \
866		− if (RC != 0) \
	866	+ if (RC != LSM_RET_DEFAULT(FUNC)) \
867	867	break; \
868	868	} \
869	869	} while (0); \
@@ -882,7 +882,7 @@ out: · 12 unmodified lines
882	882	*/
883	883	int security_binder_set_context_mgr(const struct cred *mgr)
884	884	{
885		− return call_int_hook(binder_set_context_mgr, 0, mgr);
	885	+ return call_int_hook(binder_set_context_mgr, mgr);
886	886	}
887	887
888	888	/**
@@ -897,7 +897,7 @@ int security_binder_set_context_mgr(const struct cred *mgr) · 8 unmodified lines
897	897	int security_binder_transaction(const struct cred *from,
898	898	const struct cred *to)
899	899	{
900		− return call_int_hook(binder_transaction, 0, from, to);
	900	+ return call_int_hook(binder_transaction, from, to);
901	901	}
902	902
903	903	/**
@@ -912,7 +912,7 @@ int security_binder_transaction(const struct cred *from, · 8 unmodified lines
912	912	int security_binder_transfer_binder(const struct cred *from,
913	913	const struct cred *to)
914	914	{
915		− return call_int_hook(binder_transfer_binder, 0, from, to);
	915	+ return call_int_hook(binder_transfer_binder, from, to);
916	916	}
917	917
918	918	/**
@@ -928,7 +928,7 @@ int security_binder_transfer_binder(const struct cred *from, · 9 unmodified lines
928	928	int security_binder_transfer_file(const struct cred *from,
929	929	const struct cred to, const struct file file)
930	930	{
931		− return call_int_hook(binder_transfer_file, 0, from, to, file);
	931	+ return call_int_hook(binder_transfer_file, from, to, file);
932	932	}
933	933
934	934	/**
@@ -947,7 +947,7 @@ int security_binder_transfer_file(const struct cred *from, · 12 unmodified lines
947	947	*/
948	948	int security_ptrace_access_check(struct task_struct *child, unsigned int mode)
949	949	{
950		− return call_int_hook(ptrace_access_check, 0, child, mode);
	950	+ return call_int_hook(ptrace_access_check, child, mode);
951	951	}
952	952
953	953	/**
@@ -962,7 +962,7 @@ int security_ptrace_access_check(struct task_struct *child, unsigned int mode) · 8 unmodified lines
962	962	*/
963	963	int security_ptrace_traceme(struct task_struct *parent)
964	964	{
965		− return call_int_hook(ptrace_traceme, 0, parent);
	965	+ return call_int_hook(ptrace_traceme, parent);
966	966	}
967	967
968	968	/**
@@ -984,8 +984,7 @@ int security_capget(const struct task_struct *target, · 15 unmodified lines
984	984	kernel_cap_t *inheritable,
985	985	kernel_cap_t *permitted)
986	986	{
987		− return call_int_hook(capget, 0, target,
988		− effective, inheritable, permitted);
	987	+ return call_int_hook(capget, target, effective, inheritable, permitted);
989	988	}
990	989
991	990	/**
@@ -1006,8 +1005,8 @@ int security_capset(struct cred new, const struct cred old, · 14 unmodified lines
1006	1005	const kernel_cap_t *inheritable,
1007	1006	const kernel_cap_t *permitted)
1008	1007	{
1009		− return call_int_hook(capset, 0, new, old,
1010		− effective, inheritable, permitted);
	1008	+ return call_int_hook(capset, new, old, effective, inheritable,
	1009	+ permitted);
1011	1010	}
1012	1011
1013	1012	/**
@@ -1028,7 +1027,7 @@ int security_capable(const struct cred *cred, · 14 unmodified lines
1028	1027	int cap,
1029	1028	unsigned int opts)
1030	1029	{
1031		− return call_int_hook(capable, 0, cred, ns, cap, opts);
	1030	+ return call_int_hook(capable, cred, ns, cap, opts);
1032	1031	}
1033	1032
1034	1033	/**
@@ -1044,7 +1043,7 @@ int security_capable(const struct cred *cred, · 9 unmodified lines
1044	1043	*/
1045	1044	int security_quotactl(int cmds, int type, int id, const struct super_block *sb)
1046	1045	{
1047		− return call_int_hook(quotactl, 0, cmds, type, id, sb);
	1046	+ return call_int_hook(quotactl, cmds, type, id, sb);
1048	1047	}
1049	1048
1050	1049	/**
@@ -1057,7 +1056,7 @@ int security_quotactl(int cmds, int type, int id, const struct super_block *sb) · 6 unmodified lines
1057	1056	*/
1058	1057	int security_quota_on(struct dentry *dentry)
1059	1058	{
1060		− return call_int_hook(quota_on, 0, dentry);
	1059	+ return call_int_hook(quota_on, dentry);
1061	1060	}
1062	1061
1063	1062	/**
@@ -1072,7 +1071,7 @@ int security_quota_on(struct dentry *dentry) · 8 unmodified lines
1072	1071	*/
1073	1072	int security_syslog(int type)
1074	1073	{
1075		− return call_int_hook(syslog, 0, type);
	1074	+ return call_int_hook(syslog, type);
1076	1075	}
1077	1076
1078	1077	/**
@@ -1087,7 +1086,7 @@ int security_syslog(int type) · 8 unmodified lines
1087	1086	*/
1088	1087	int security_settime64(const struct timespec64 ts, const struct timezone tz)
1089	1088	{
1090		− return call_int_hook(settime, 0, ts, tz);
	1089	+ return call_int_hook(settime, ts, tz);
1091	1090	}
1092	1091
1093	1092	/**
@@ -1142,7 +1141,7 @@ int security_vm_enough_memory_mm(struct mm_struct *mm, long pages) · 48 unmodified lines
1142	1141	*/
1143	1142	int security_bprm_creds_for_exec(struct linux_binprm *bprm)
1144	1143	{
1145		− return call_int_hook(bprm_creds_for_exec, 0, bprm);
	1144	+ return call_int_hook(bprm_creds_for_exec, bprm);
1146	1145	}
1147	1146
1148	1147	/**
@@ -1166,7 +1165,7 @@ int security_bprm_creds_for_exec(struct linux_binprm *bprm) · 17 unmodified lines
1166	1165	*/
1167	1166	int security_bprm_creds_from_file(struct linux_binprm bprm, const struct file file)
1168	1167	{
1169		− return call_int_hook(bprm_creds_from_file, 0, bprm, file);
	1168	+ return call_int_hook(bprm_creds_from_file, bprm, file);
1170	1169	}
1171	1170
1172	1171	/**
@@ -1183,12 +1182,7 @@ int security_bprm_creds_from_file(struct linux_binprm bprm, const struct file · 10 unmodified lines
1183	1182	*/
1184	1183	int security_bprm_check(struct linux_binprm *bprm)
1185	1184	{
1186		− int ret;
1187		−
1188		− ret = call_int_hook(bprm_check_security, 0, bprm);
1189		− if (ret)
1190		− return ret;
1191		− return ima_bprm_check(bprm);
	1185	+ return call_int_hook(bprm_check_security, bprm);
1192	1186	}
1193	1187
1194	1188	/**
@@ -1235,7 +1229,7 @@ void security_bprm_committed_creds(const struct linux_binprm *bprm) · 40 unmodified lines
1235	1229	*/
1236	1230	int security_fs_context_submount(struct fs_context fc, struct super_block reference)
1237	1231	{
1238		− return call_int_hook(fs_context_submount, 0, fc, reference);
	1232	+ return call_int_hook(fs_context_submount, fc, reference);
1239	1233	}
1240	1234
1241	1235	/**
@@ -1251,7 +1245,7 @@ int security_fs_context_submount(struct fs_context fc, struct super_block refe · 9 unmodified lines
1251	1245	*/
1252	1246	int security_fs_context_dup(struct fs_context fc, struct fs_context src_fc)
1253	1247	{
1254		− return call_int_hook(fs_context_dup, 0, fc, src_fc);
	1248	+ return call_int_hook(fs_context_dup, fc, src_fc);
1255	1249	}
1256	1250
1257	1251	/**
@@ -1300,7 +1294,7 @@ int security_sb_alloc(struct super_block *sb) · 42 unmodified lines
1300	1294
1301	1295	if (unlikely(rc))
1302	1296	return rc;
1303		− rc = call_int_hook(sb_alloc_security, 0, sb);
	1297	+ rc = call_int_hook(sb_alloc_security, sb);
1304	1298	if (unlikely(rc))
1305	1299	security_sb_free(sb);
1306	1300	return rc;
@@ -1358,7 +1352,7 @@ EXPORT_SYMBOL(security_free_mnt_opts); · 51 unmodified lines
1358	1352	*/
1359	1353	int security_sb_eat_lsm_opts(char options, void *mnt_opts)
1360	1354	{
1361		− return call_int_hook(sb_eat_lsm_opts, 0, options, mnt_opts);
	1355	+ return call_int_hook(sb_eat_lsm_opts, options, mnt_opts);
1362	1356	}
1363	1357	EXPORT_SYMBOL(security_sb_eat_lsm_opts);
1364	1358
@@ -1375,7 +1369,7 @@ EXPORT_SYMBOL(security_sb_eat_lsm_opts); · 10 unmodified lines
1375	1369	int security_sb_mnt_opts_compat(struct super_block *sb,
1376	1370	void *mnt_opts)
1377	1371	{
1378		− return call_int_hook(sb_mnt_opts_compat, 0, sb, mnt_opts);
	1372	+ return call_int_hook(sb_mnt_opts_compat, sb, mnt_opts);
1379	1373	}
1380	1374	EXPORT_SYMBOL(security_sb_mnt_opts_compat);
1381	1375
@@ -1392,7 +1386,7 @@ EXPORT_SYMBOL(security_sb_mnt_opts_compat); · 10 unmodified lines
1392	1386	int security_sb_remount(struct super_block *sb,
1393	1387	void *mnt_opts)
1394	1388	{
1395		− return call_int_hook(sb_remount, 0, sb, mnt_opts);
	1389	+ return call_int_hook(sb_remount, sb, mnt_opts);
1396	1390	}
1397	1391	EXPORT_SYMBOL(security_sb_remount);
1398	1392
@@ -1406,7 +1400,7 @@ EXPORT_SYMBOL(security_sb_remount); · 7 unmodified lines
1406	1400	*/
1407	1401	int security_sb_kern_mount(const struct super_block *sb)
1408	1402	{
1409		− return call_int_hook(sb_kern_mount, 0, sb);
	1403	+ return call_int_hook(sb_kern_mount, sb);
1410	1404	}
1411	1405
1412	1406	/**
@@ -1420,7 +1414,7 @@ int security_sb_kern_mount(const struct super_block *sb) · 7 unmodified lines
1420	1414	*/
1421	1415	int security_sb_show_options(struct seq_file m, struct super_block sb)
1422	1416	{
1423		− return call_int_hook(sb_show_options, 0, m, sb);
	1417	+ return call_int_hook(sb_show_options, m, sb);
1424	1418	}
1425	1419
1426	1420	/**
@@ -1434,7 +1428,7 @@ int security_sb_show_options(struct seq_file m, struct super_block sb) · 7 unmodified lines
1434	1428	*/
1435	1429	int security_sb_statfs(struct dentry *dentry)
1436	1430	{
1437		− return call_int_hook(sb_statfs, 0, dentry);
	1431	+ return call_int_hook(sb_statfs, dentry);
1438	1432	}
1439	1433
1440	1434	/**
@@ -1457,7 +1451,7 @@ int security_sb_statfs(struct dentry *dentry) · 16 unmodified lines
1457	1451	int security_sb_mount(const char dev_name, const struct path path,
1458	1452	const char type, unsigned long flags, void data)
1459	1453	{
1460		− return call_int_hook(sb_mount, 0, dev_name, path, type, flags, data);
	1454	+ return call_int_hook(sb_mount, dev_name, path, type, flags, data);
1461	1455	}
1462	1456
1463	1457	/**
@@ -1471,7 +1465,7 @@ int security_sb_mount(const char dev_name, const struct path path, · 7 unmodified lines
1471	1465	*/
1472	1466	int security_sb_umount(struct vfsmount *mnt, int flags)
1473	1467	{
1474		− return call_int_hook(sb_umount, 0, mnt, flags);
	1468	+ return call_int_hook(sb_umount, mnt, flags);
1475	1469	}
1476	1470
1477	1471	/**
@@ -1486,7 +1480,7 @@ int security_sb_umount(struct vfsmount *mnt, int flags) · 8 unmodified lines
1486	1480	int security_sb_pivotroot(const struct path *old_path,
1487	1481	const struct path *new_path)
1488	1482	{
1489		− return call_int_hook(sb_pivotroot, 0, old_path, new_path);
	1483	+ return call_int_hook(sb_pivotroot, old_path, new_path);
1490	1484	}
1491	1485
1492	1486	/**
@@ -1505,9 +1499,17 @@ int security_sb_set_mnt_opts(struct super_block *sb, · 12 unmodified lines
1505	1499	unsigned long kern_flags,
1506	1500	unsigned long *set_kern_flags)
1507	1501	{
1508		− return call_int_hook(sb_set_mnt_opts,
1509		− mnt_opts ? -EOPNOTSUPP : 0, sb,
1510		− mnt_opts, kern_flags, set_kern_flags);
	1502	+ struct security_hook_list *hp;
	1503	+ int rc = mnt_opts ? -EOPNOTSUPP : LSM_RET_DEFAULT(sb_set_mnt_opts);
	1504	+
	1505	+ hlist_for_each_entry(hp, &security_hook_heads.sb_set_mnt_opts,
	1506	+ list) {
	1507	+ rc = hp->hook.sb_set_mnt_opts(sb, mnt_opts, kern_flags,
	1508	+ set_kern_flags);
	1509	+ if (rc != LSM_RET_DEFAULT(sb_set_mnt_opts))
	1510	+ break;
	1511	+ }
	1512	+ return rc;
1511	1513	}
1512	1514	EXPORT_SYMBOL(security_sb_set_mnt_opts);
1513	1515
@@ -1527,7 +1529,7 @@ int security_sb_clone_mnt_opts(const struct super_block *oldsb, · 13 unmodified lines
1527	1529	unsigned long kern_flags,
1528	1530	unsigned long *set_kern_flags)
1529	1531	{
1530		− return call_int_hook(sb_clone_mnt_opts, 0, oldsb, newsb,
	1532	+ return call_int_hook(sb_clone_mnt_opts, oldsb, newsb,
1531	1533	kern_flags, set_kern_flags);
1532	1534	}
1533	1535	EXPORT_SYMBOL(security_sb_clone_mnt_opts);
@@ -1544,7 +1546,7 @@ EXPORT_SYMBOL(security_sb_clone_mnt_opts); · 10 unmodified lines
1544	1546	int security_move_mount(const struct path *from_path,
1545	1547	const struct path *to_path)
1546	1548	{
1547		− return call_int_hook(move_mount, 0, from_path, to_path);
	1549	+ return call_int_hook(move_mount, from_path, to_path);
1548	1550	}
1549	1551
1550	1552	/**
@@ -1561,7 +1563,7 @@ int security_move_mount(const struct path *from_path, · 10 unmodified lines
1561	1563	int security_path_notify(const struct path *path, u64 mask,
1562	1564	unsigned int obj_type)
1563	1565	{
1564		− return call_int_hook(path_notify, 0, path, mask, obj_type);
	1566	+ return call_int_hook(path_notify, path, mask, obj_type);
1565	1567	}
1566	1568
1567	1569	/**
@@ -1580,7 +1582,7 @@ int security_inode_alloc(struct inode *inode) · 12 unmodified lines
1580	1582
1581	1583	if (unlikely(rc))
1582	1584	return rc;
1583		− rc = call_int_hook(inode_alloc_security, 0, inode);
	1585	+ rc = call_int_hook(inode_alloc_security, inode);
1584	1586	if (unlikely(rc))
1585	1587	security_inode_free(inode);
1586	1588	return rc;
@@ -1602,7 +1604,6 @@ static void inode_free_by_rcu(struct rcu_head *head) · 15 unmodified lines
1602	1604	*/
1603	1605	void security_inode_free(struct inode *inode)
1604	1606	{
1605		− integrity_inode_free(inode);
1606	1607	call_void_hook(inode_free_security, inode);
1607	1608	/*
1608	1609	* The inode may still be referenced in a path walk and
@@ -1638,20 +1639,8 @@ int security_dentry_init_security(struct dentry *dentry, int mode, · 29 unmodified lines
1638	1639	const char xattr_name, void ctx,
1639	1640	u32 *ctxlen)
1640	1641	{
1641		− struct security_hook_list *hp;
1642		− int rc;
1643		−
1644		− /*
1645		− * Only one module will provide a security context.
1646		− */
1647		− hlist_for_each_entry(hp, &security_hook_heads.dentry_init_security,
1648		− list) {
1649		− rc = hp->hook.dentry_init_security(dentry, mode, name,
1650		− xattr_name, ctx, ctxlen);
1651		− if (rc != LSM_RET_DEFAULT(dentry_init_security))
1652		− return rc;
1653		− }
1654		− return LSM_RET_DEFAULT(dentry_init_security);
	1642	+ return call_int_hook(dentry_init_security, dentry, mode, name,
	1643	+ xattr_name, ctx, ctxlen);
1655	1644	}
1656	1645	EXPORT_SYMBOL(security_dentry_init_security);
1657	1646
@@ -1674,7 +1663,7 @@ int security_dentry_create_files_as(struct dentry *dentry, int mode, · 16 unmodified lines
1674	1663	struct qstr *name,
1675	1664	const struct cred old, struct cred new)
1676	1665	{
1677		− return call_int_hook(dentry_create_files_as, 0, dentry, mode,
	1666	+ return call_int_hook(dentry_create_files_as, dentry, mode,
1678	1667	name, old, new);
1679	1668	}
1680	1669	EXPORT_SYMBOL(security_dentry_create_files_as);
@@ -1721,8 +1710,8 @@ int security_inode_init_security(struct inode inode, struct inode dir, · 40 unmodified lines
1721	1710	return 0;
1722	1711
1723	1712	if (initxattrs) {
1724		− /* Allocate +1 for EVM and +1 as terminator. */
1725		− new_xattrs = kcalloc(blob_sizes.lbs_xattr_count + 2,
	1713	+ /* Allocate +1 as terminator. */
	1714	+ new_xattrs = kcalloc(blob_sizes.lbs_xattr_count + 1,
1726	1715	sizeof(*new_xattrs), GFP_NOFS);
1727	1716	if (!new_xattrs)
1728	1717	return -ENOMEM;
@@ -1746,10 +1735,6 @@ int security_inode_init_security(struct inode inode, struct inode dir, · 17 unmodified lines
1746	1735	if (!xattr_count)
1747	1736	goto out;
1748	1737
1749		− ret = evm_inode_init_security(inode, dir, qstr, new_xattrs,
1750		− &xattr_count);
1751		− if (ret)
1752		− goto out;
1753	1738	ret = initxattrs(inode, new_xattrs, fs_data);
1754	1739	out:
1755	1740	for (; xattr_count > 0; xattr_count--)
@@ -1775,7 +1760,7 @@ int security_inode_init_security_anon(struct inode *inode, · 19 unmodified lines
1775	1760	const struct qstr *name,
1776	1761	const struct inode *context_inode)
1777	1762	{
1778		− return call_int_hook(inode_init_security_anon, 0, inode, name,
	1763	+ return call_int_hook(inode_init_security_anon, inode, name,
1779	1764	context_inode);
1780	1765	}
1781	1766
@@ -1797,10 +1782,24 @@ int security_path_mknod(const struct path dir, struct dentry dentry, · 15 unmodified lines
1797	1782	{
1798	1783	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
1799	1784	return 0;
1800		− return call_int_hook(path_mknod, 0, dir, dentry, mode, dev);
	1785	+ return call_int_hook(path_mknod, dir, dentry, mode, dev);
1801	1786	}
1802	1787	EXPORT_SYMBOL(security_path_mknod);
1803	1788
	1789	+/**
	1790	+ * security_path_post_mknod() - Update inode security field after file creation
	1791	+ * @idmap: idmap of the mount
	1792	+ * @dentry: new file
	1793	+ *
	1794	+ * Update inode security field after a file has been created.
	1795	+ */
	1796	+void security_path_post_mknod(struct mnt_idmap idmap, struct dentry dentry)
	1797	+{
	1798	+ if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
	1799	+ return;
	1800	+ call_void_hook(path_post_mknod, idmap, dentry);
	1801	+}
	1802	+
1804	1803	/**
1805	1804	* security_path_mkdir() - Check if creating a new directory is allowed
1806	1805	* @dir: parent directory
@@ -1816,7 +1815,7 @@ int security_path_mkdir(const struct path dir, struct dentry dentry, · 9 unmodified lines
1816	1815	{
1817	1816	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
1818	1817	return 0;
1819		− return call_int_hook(path_mkdir, 0, dir, dentry, mode);
	1818	+ return call_int_hook(path_mkdir, dir, dentry, mode);
1820	1819	}
1821	1820	EXPORT_SYMBOL(security_path_mkdir);
1822	1821
@@ -1833,7 +1832,7 @@ int security_path_rmdir(const struct path dir, struct dentry dentry) · 10 unmodified lines
1833	1832	{
1834	1833	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
1835	1834	return 0;
1836		− return call_int_hook(path_rmdir, 0, dir, dentry);
	1835	+ return call_int_hook(path_rmdir, dir, dentry);
1837	1836	}
1838	1837
1839	1838	/**
@@ -1849,7 +1848,7 @@ int security_path_unlink(const struct path dir, struct dentry dentry) · 9 unmodified lines
1849	1848	{
1850	1849	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
1851	1850	return 0;
1852		− return call_int_hook(path_unlink, 0, dir, dentry);
	1851	+ return call_int_hook(path_unlink, dir, dentry);
1853	1852	}
1854	1853	EXPORT_SYMBOL(security_path_unlink);
1855	1854
@@ -1868,7 +1867,7 @@ int security_path_symlink(const struct path dir, struct dentry dentry, · 12 unmodified lines
1868	1867	{
1869	1868	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
1870	1869	return 0;
1871		− return call_int_hook(path_symlink, 0, dir, dentry, old_name);
	1870	+ return call_int_hook(path_symlink, dir, dentry, old_name);
1872	1871	}
1873	1872
1874	1873	/**
@@ -1886,7 +1885,7 @@ int security_path_link(struct dentry old_dentry, const struct path new_dir, · 11 unmodified lines
1886	1885	{
1887	1886	if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))
1888	1887	return 0;
1889		− return call_int_hook(path_link, 0, old_dentry, new_dir, new_dentry);
	1888	+ return call_int_hook(path_link, old_dentry, new_dir, new_dentry);
1890	1889	}
1891	1890
1892	1891	/**
@@ -1910,7 +1909,7 @@ int security_path_rename(const struct path old_dir, struct dentry old_dentry, · 17 unmodified lines
1910	1909	IS_PRIVATE(d_backing_inode(new_dentry)))))
1911	1910	return 0;
1912	1911
1913		− return call_int_hook(path_rename, 0, old_dir, old_dentry, new_dir,
	1912	+ return call_int_hook(path_rename, old_dir, old_dentry, new_dir,
1914	1913	new_dentry, flags);
1915	1914	}
1916	1915	EXPORT_SYMBOL(security_path_rename);
@@ -1929,7 +1928,7 @@ int security_path_truncate(const struct path *path) · 12 unmodified lines
1929	1928	{
1930	1929	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
1931	1930	return 0;
1932		− return call_int_hook(path_truncate, 0, path);
	1931	+ return call_int_hook(path_truncate, path);
1933	1932	}
1934	1933
1935	1934	/**
@@ -1947,7 +1946,7 @@ int security_path_chmod(const struct path *path, umode_t mode) · 11 unmodified lines
1947	1946	{
1948	1947	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
1949	1948	return 0;
1950		− return call_int_hook(path_chmod, 0, path, mode);
	1949	+ return call_int_hook(path_chmod, path, mode);
1951	1950	}
1952	1951
1953	1952	/**
@@ -1964,7 +1963,7 @@ int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid) · 10 unmodified lines
1964	1963	{
1965	1964	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
1966	1965	return 0;
1967		− return call_int_hook(path_chown, 0, path, uid, gid);
	1966	+ return call_int_hook(path_chown, path, uid, gid);
1968	1967	}
1969	1968
1970	1969	/**
@@ -1977,7 +1976,7 @@ int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid) · 6 unmodified lines
1977	1976	*/
1978	1977	int security_path_chroot(const struct path *path)
1979	1978	{
1980		− return call_int_hook(path_chroot, 0, path);
	1979	+ return call_int_hook(path_chroot, path);
1981	1980	}
1982	1981	#endif /* CONFIG_SECURITY_PATH */
1983	1982
@@ -1996,10 +1995,25 @@ int security_inode_create(struct inode dir, struct dentry dentry, · 12 unmodified lines
1996	1995	{
1997	1996	if (unlikely(IS_PRIVATE(dir)))
1998	1997	return 0;
1999		− return call_int_hook(inode_create, 0, dir, dentry, mode);
	1998	+ return call_int_hook(inode_create, dir, dentry, mode);
2000	1999	}
2001	2000	EXPORT_SYMBOL_GPL(security_inode_create);
2002	2001
	2002	+/**
	2003	+ * security_inode_post_create_tmpfile() - Update inode security of new tmpfile
	2004	+ * @idmap: idmap of the mount
	2005	+ * @inode: inode of the new tmpfile
	2006	+ *
	2007	+ * Update inode security data after a tmpfile has been created.
	2008	+ */
	2009	+void security_inode_post_create_tmpfile(struct mnt_idmap *idmap,
	2010	+ struct inode *inode)
	2011	+{
	2012	+ if (unlikely(IS_PRIVATE(inode)))
	2013	+ return;
	2014	+ call_void_hook(inode_post_create_tmpfile, idmap, inode);
	2015	+}
	2016	+
2003	2017	/**
2004	2018	* security_inode_link() - Check if creating a hard link is allowed
2005	2019	* @old_dentry: existing file
@@ -2015,7 +2029,7 @@ int security_inode_link(struct dentry old_dentry, struct inode dir, · 9 unmodified lines
2015	2029	{
2016	2030	if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))
2017	2031	return 0;
2018		− return call_int_hook(inode_link, 0, old_dentry, dir, new_dentry);
	2032	+ return call_int_hook(inode_link, old_dentry, dir, new_dentry);
2019	2033	}
2020	2034
2021	2035	/**
@@ -2031,7 +2045,7 @@ int security_inode_unlink(struct inode dir, struct dentry dentry) · 9 unmodified lines
2031	2045	{
2032	2046	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2033	2047	return 0;
2034		− return call_int_hook(inode_unlink, 0, dir, dentry);
	2048	+ return call_int_hook(inode_unlink, dir, dentry);
2035	2049	}
2036	2050
2037	2051	/**
@@ -2049,7 +2063,7 @@ int security_inode_symlink(struct inode dir, struct dentry dentry, · 11 unmodified lines
2049	2063	{
2050	2064	if (unlikely(IS_PRIVATE(dir)))
2051	2065	return 0;
2052		− return call_int_hook(inode_symlink, 0, dir, dentry, old_name);
	2066	+ return call_int_hook(inode_symlink, dir, dentry, old_name);
2053	2067	}
2054	2068
2055	2069	/**
@@ -2067,7 +2081,7 @@ int security_inode_mkdir(struct inode dir, struct dentry dentry, umode_t mode) · 11 unmodified lines
2067	2081	{
2068	2082	if (unlikely(IS_PRIVATE(dir)))
2069	2083	return 0;
2070		− return call_int_hook(inode_mkdir, 0, dir, dentry, mode);
	2084	+ return call_int_hook(inode_mkdir, dir, dentry, mode);
2071	2085	}
2072	2086	EXPORT_SYMBOL_GPL(security_inode_mkdir);
2073	2087
@@ -2084,7 +2098,7 @@ int security_inode_rmdir(struct inode dir, struct dentry dentry) · 10 unmodified lines
2084	2098	{
2085	2099	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2086	2100	return 0;
2087		− return call_int_hook(inode_rmdir, 0, dir, dentry);
	2101	+ return call_int_hook(inode_rmdir, dir, dentry);
2088	2102	}
2089	2103
2090	2104	/**
@@ -2106,7 +2120,7 @@ int security_inode_mknod(struct inode dir, struct dentry dentry, · 15 unmodified lines
2106	2120	{
2107	2121	if (unlikely(IS_PRIVATE(dir)))
2108	2122	return 0;
2109		− return call_int_hook(inode_mknod, 0, dir, dentry, mode, dev);
	2123	+ return call_int_hook(inode_mknod, dir, dentry, mode, dev);
2110	2124	}
2111	2125
2112	2126	/**
@@ -2131,13 +2145,13 @@ int security_inode_rename(struct inode old_dir, struct dentry old_dentry, · 18 unmodified lines
2131	2145	return 0;
2132	2146
2133	2147	if (flags & RENAME_EXCHANGE) {
2134		− int err = call_int_hook(inode_rename, 0, new_dir, new_dentry,
	2148	+ int err = call_int_hook(inode_rename, new_dir, new_dentry,
2135	2149	old_dir, old_dentry);
2136	2150	if (err)
2137	2151	return err;
2138	2152	}
2139	2153
2140		− return call_int_hook(inode_rename, 0, old_dir, old_dentry,
	2154	+ return call_int_hook(inode_rename, old_dir, old_dentry,
2141	2155	new_dir, new_dentry);
2142	2156	}
2143	2157
@@ -2153,7 +2167,7 @@ int security_inode_readlink(struct dentry *dentry) · 9 unmodified lines
2153	2167	{
2154	2168	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2155	2169	return 0;
2156		− return call_int_hook(inode_readlink, 0, dentry);
	2170	+ return call_int_hook(inode_readlink, dentry);
2157	2171	}
2158	2172
2159	2173	/**
@@ -2172,7 +2186,7 @@ int security_inode_follow_link(struct dentry dentry, struct inode inode, · 12 unmodified lines
2172	2186	{
2173	2187	if (unlikely(IS_PRIVATE(inode)))
2174	2188	return 0;
2175		− return call_int_hook(inode_follow_link, 0, dentry, inode, rcu);
	2189	+ return call_int_hook(inode_follow_link, dentry, inode, rcu);
2176	2190	}
2177	2191
2178	2192	/**
@@ -2193,7 +2207,7 @@ int security_inode_permission(struct inode *inode, int mask) · 14 unmodified lines
2193	2207	{
2194	2208	if (unlikely(IS_PRIVATE(inode)))
2195	2209	return 0;
2196		− return call_int_hook(inode_permission, 0, inode, mask);
	2210	+ return call_int_hook(inode_permission, inode, mask);
2197	2211	}
2198	2212
2199	2213	/**
@@ -2212,17 +2226,28 @@ int security_inode_permission(struct inode *inode, int mask) · 12 unmodified lines
2212	2226	int security_inode_setattr(struct mnt_idmap *idmap,
2213	2227	struct dentry dentry, struct iattr attr)
2214	2228	{
2215		− int ret;
2216		−
2217	2229	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2218	2230	return 0;
2219		− ret = call_int_hook(inode_setattr, 0, dentry, attr);
2220		− if (ret)
2221		− return ret;
2222		− return evm_inode_setattr(idmap, dentry, attr);
	2231	+ return call_int_hook(inode_setattr, idmap, dentry, attr);
2223	2232	}
2224	2233	EXPORT_SYMBOL_GPL(security_inode_setattr);
2225	2234
	2235	+/**
	2236	+ * security_inode_post_setattr() - Update the inode after a setattr operation
	2237	+ * @idmap: idmap of the mount
	2238	+ * @dentry: file
	2239	+ * @ia_valid: file attributes set
	2240	+ *
	2241	+ * Update inode security field after successful setting file attributes.
	2242	+ */
	2243	+void security_inode_post_setattr(struct mnt_idmap idmap, struct dentry dentry,
	2244	+ int ia_valid)
	2245	+{
	2246	+ if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
	2247	+ return;
	2248	+ call_void_hook(inode_post_setattr, idmap, dentry, ia_valid);
	2249	+}
	2250	+
2226	2251	/**
2227	2252	* security_inode_getattr() - Check if getting file attributes is allowed
2228	2253	* @path: file
@@ -2235,7 +2260,7 @@ int security_inode_getattr(const struct path *path) · 6 unmodified lines
2235	2260	{
2236	2261	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
2237	2262	return 0;
2238		− return call_int_hook(inode_getattr, 0, path);
	2263	+ return call_int_hook(inode_getattr, path);
2239	2264	}
2240	2265
2241	2266	/**
@@ -2263,17 +2288,12 @@ int security_inode_setxattr(struct mnt_idmap *idmap, · 21 unmodified lines
2263	2288	* SELinux and Smack integrate the cap call,
2264	2289	* so assume that all LSMs supplying this call do so.
2265	2290	*/
2266		− ret = call_int_hook(inode_setxattr, 1, idmap, dentry, name, value,
2267		− size, flags);
	2291	+ ret = call_int_hook(inode_setxattr, idmap, dentry, name, value, size,
	2292	+ flags);
2268	2293
2269	2294	if (ret == 1)
2270	2295	ret = cap_inode_setxattr(dentry, name, value, size, flags);
2271		− if (ret)
2272		− return ret;
2273		− ret = ima_inode_setxattr(dentry, name, value, size);
2274		− if (ret)
2275		− return ret;
2276		− return evm_inode_setxattr(idmap, dentry, name, value, size);
	2296	+ return ret;
2277	2297	}
2278	2298
2279	2299	/**
@@ -2292,18 +2312,26 @@ int security_inode_set_acl(struct mnt_idmap *idmap, · 12 unmodified lines
2292	2312	struct dentry dentry, const char acl_name,
2293	2313	struct posix_acl *kacl)
2294	2314	{
2295		− int ret;
2296		−
2297	2315	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2298	2316	return 0;
2299		− ret = call_int_hook(inode_set_acl, 0, idmap, dentry, acl_name,
2300		− kacl);
2301		− if (ret)
2302		− return ret;
2303		− ret = ima_inode_set_acl(idmap, dentry, acl_name, kacl);
2304		− if (ret)
2305		− return ret;
2306		− return evm_inode_set_acl(idmap, dentry, acl_name, kacl);
	2317	+ return call_int_hook(inode_set_acl, idmap, dentry, acl_name, kacl);
	2318	+}
	2319	+
	2320	+/**
	2321	+ * security_inode_post_set_acl() - Update inode security from posix acls set
	2322	+ * @dentry: file
	2323	+ * @acl_name: acl name
	2324	+ * @kacl: acl struct
	2325	+ *
	2326	+ * Update inode security data after successfully setting posix acls on @dentry.
	2327	+ * The posix acls in @kacl are identified by @acl_name.
	2328	+ */
	2329	+void security_inode_post_set_acl(struct dentry dentry, const char acl_name,
	2330	+ struct posix_acl *kacl)
	2331	+{
	2332	+ if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
	2333	+ return;
	2334	+ call_void_hook(inode_post_set_acl, dentry, acl_name, kacl);
2307	2335	}
2308	2336
2309	2337	/**
@@ -2322,7 +2350,7 @@ int security_inode_get_acl(struct mnt_idmap *idmap, · 12 unmodified lines
2322	2350	{
2323	2351	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2324	2352	return 0;
2325		− return call_int_hook(inode_get_acl, 0, idmap, dentry, acl_name);
	2353	+ return call_int_hook(inode_get_acl, idmap, dentry, acl_name);
2326	2354	}
2327	2355
2328	2356	/**
@@ -2339,17 +2367,26 @@ int security_inode_get_acl(struct mnt_idmap *idmap, · 10 unmodified lines
2339	2367	int security_inode_remove_acl(struct mnt_idmap *idmap,
2340	2368	struct dentry dentry, const char acl_name)
2341	2369	{
2342		− int ret;
2343		−
2344	2370	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2345	2371	return 0;
2346		− ret = call_int_hook(inode_remove_acl, 0, idmap, dentry, acl_name);
2347		− if (ret)
2348		− return ret;
2349		− ret = ima_inode_remove_acl(idmap, dentry, acl_name);
2350		− if (ret)
2351		− return ret;
2352		− return evm_inode_remove_acl(idmap, dentry, acl_name);
	2372	+ return call_int_hook(inode_remove_acl, idmap, dentry, acl_name);
	2373	+}
	2374	+
	2375	+/**
	2376	+ * security_inode_post_remove_acl() - Update inode security after rm posix acls
	2377	+ * @idmap: idmap of the mount
	2378	+ * @dentry: file
	2379	+ * @acl_name: acl name
	2380	+ *
	2381	+ * Update inode security data after successfully removing posix acls on
	2382	+ * @dentry in @idmap. The posix acls are identified by @acl_name.
	2383	+ */
	2384	+void security_inode_post_remove_acl(struct mnt_idmap *idmap,
	2385	+ struct dentry dentry, const char acl_name)
	2386	+{
	2387	+ if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
	2388	+ return;
	2389	+ call_void_hook(inode_post_remove_acl, idmap, dentry, acl_name);
2353	2390	}
2354	2391
2355	2392	/**
@@ -2368,7 +2405,6 @@ void security_inode_post_setxattr(struct dentry dentry, const char name, · 12 unmodified lines
2368	2405	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2369	2406	return;
2370	2407	call_void_hook(inode_post_setxattr, dentry, name, value, size, flags);
2371		− evm_inode_post_setxattr(dentry, name, value, size);
2372	2408	}
2373	2409
2374	2410	/**
@@ -2385,7 +2421,7 @@ int security_inode_getxattr(struct dentry dentry, const char name) · 10 unmodified lines
2385	2421	{
2386	2422	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2387	2423	return 0;
2388		− return call_int_hook(inode_getxattr, 0, dentry, name);
	2424	+ return call_int_hook(inode_getxattr, dentry, name);
2389	2425	}
2390	2426
2391	2427	/**
@@ -2401,7 +2437,7 @@ int security_inode_listxattr(struct dentry *dentry) · 9 unmodified lines
2401	2437	{
2402	2438	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2403	2439	return 0;
2404		− return call_int_hook(inode_listxattr, 0, dentry);
	2440	+ return call_int_hook(inode_listxattr, dentry);
2405	2441	}
2406	2442
2407	2443	/**
@@ -2426,15 +2462,24 @@ int security_inode_removexattr(struct mnt_idmap *idmap, · 18 unmodified lines
2426	2462	* SELinux and Smack integrate the cap call,
2427	2463	* so assume that all LSMs supplying this call do so.
2428	2464	*/
2429		− ret = call_int_hook(inode_removexattr, 1, idmap, dentry, name);
	2465	+ ret = call_int_hook(inode_removexattr, idmap, dentry, name);
2430	2466	if (ret == 1)
2431	2467	ret = cap_inode_removexattr(idmap, dentry, name);
2432		− if (ret)
2433		− return ret;
2434		− ret = ima_inode_removexattr(dentry, name);
2435		− if (ret)
2436		− return ret;
2437		− return evm_inode_removexattr(idmap, dentry, name);
	2468	+ return ret;
	2469	+}
	2470	+
	2471	+/**
	2472	+ * security_inode_post_removexattr() - Update the inode after a removexattr op
	2473	+ * @dentry: file
	2474	+ * @name: xattr name
	2475	+ *
	2476	+ * Update the inode after a successful removexattr operation.
	2477	+ */
	2478	+void security_inode_post_removexattr(struct dentry dentry, const char name)
	2479	+{
	2480	+ if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
	2481	+ return;
	2482	+ call_void_hook(inode_post_removexattr, dentry, name);
2438	2483	}
2439	2484
2440	2485	/**
@@ -2450,7 +2495,7 @@ int security_inode_removexattr(struct mnt_idmap *idmap, · 9 unmodified lines
2450	2495	*/
2451	2496	int security_inode_need_killpriv(struct dentry *dentry)
2452	2497	{
2453		− return call_int_hook(inode_need_killpriv, 0, dentry);
	2498	+ return call_int_hook(inode_need_killpriv, dentry);
2454	2499	}
2455	2500
2456	2501	/**
@@ -2467,7 +2512,7 @@ int security_inode_need_killpriv(struct dentry *dentry) · 10 unmodified lines
2467	2512	int security_inode_killpriv(struct mnt_idmap *idmap,
2468	2513	struct dentry *dentry)
2469	2514	{
2470		− return call_int_hook(inode_killpriv, 0, idmap, dentry);
	2515	+ return call_int_hook(inode_killpriv, idmap, dentry);
2471	2516	}
2472	2517
2473	2518	/**
@@ -2490,21 +2535,11 @@ int security_inode_getsecurity(struct mnt_idmap *idmap, · 16 unmodified lines
2490	2535	struct inode inode, const char name,
2491	2536	void **buffer, bool alloc)
2492	2537	{
2493		− struct security_hook_list *hp;
2494		− int rc;
2495		−
2496	2538	if (unlikely(IS_PRIVATE(inode)))
2497	2539	return LSM_RET_DEFAULT(inode_getsecurity);
2498		− /*
2499		− * Only one module will provide an attribute with a given name.
2500		− */
2501		− hlist_for_each_entry(hp, &security_hook_heads.inode_getsecurity, list) {
2502		− rc = hp->hook.inode_getsecurity(idmap, inode, name, buffer,
2503		− alloc);
2504		− if (rc != LSM_RET_DEFAULT(inode_getsecurity))
2505		− return rc;
2506		− }
2507		− return LSM_RET_DEFAULT(inode_getsecurity);
	2540	+
	2541	+ return call_int_hook(inode_getsecurity, idmap, inode, name, buffer,
	2542	+ alloc);
2508	2543	}
2509	2544
2510	2545	/**
@@ -2525,21 +2560,11 @@ int security_inode_getsecurity(struct mnt_idmap *idmap, · 14 unmodified lines
2525	2560	int security_inode_setsecurity(struct inode inode, const char name,
2526	2561	const void *value, size_t size, int flags)
2527	2562	{
2528		− struct security_hook_list *hp;
2529		− int rc;
2530		−
2531	2563	if (unlikely(IS_PRIVATE(inode)))
2532	2564	return LSM_RET_DEFAULT(inode_setsecurity);
2533		− /*
2534		− * Only one module will provide an attribute with a given name.
2535		− */
2536		− hlist_for_each_entry(hp, &security_hook_heads.inode_setsecurity, list) {
2537		− rc = hp->hook.inode_setsecurity(inode, name, value, size,
2538		− flags);
2539		− if (rc != LSM_RET_DEFAULT(inode_setsecurity))
2540		− return rc;
2541		− }
2542		− return LSM_RET_DEFAULT(inode_setsecurity);
	2565	+
	2566	+ return call_int_hook(inode_setsecurity, inode, name, value, size,
	2567	+ flags);
2543	2568	}
2544	2569
2545	2570	/**
@@ -2560,7 +2585,7 @@ int security_inode_listsecurity(struct inode *inode, · 14 unmodified lines
2560	2585	{
2561	2586	if (unlikely(IS_PRIVATE(inode)))
2562	2587	return 0;
2563		− return call_int_hook(inode_listsecurity, 0, inode, buffer, buffer_size);
	2588	+ return call_int_hook(inode_listsecurity, inode, buffer, buffer_size);
2564	2589	}
2565	2590	EXPORT_SYMBOL(security_inode_listsecurity);
2566	2591
@@ -2591,7 +2616,7 @@ void security_inode_getsecid(struct inode inode, u32 secid) · 24 unmodified lines
2591	2616	*/
2592	2617	int security_inode_copy_up(struct dentry src, struct cred *new)
2593	2618	{
2594		− return call_int_hook(inode_copy_up, 0, src, new);
	2619	+ return call_int_hook(inode_copy_up, src, new);
2595	2620	}
2596	2621	EXPORT_SYMBOL(security_inode_copy_up);
2597	2622
@@ -2609,7 +2634,6 @@ EXPORT_SYMBOL(security_inode_copy_up); · 11 unmodified lines
2609	2634	*/
2610	2635	int security_inode_copy_up_xattr(const char *name)
2611	2636	{
2612		− struct security_hook_list *hp;
2613	2637	int rc;
2614	2638
2615	2639	/*
@@ -2617,14 +2641,11 @@ int security_inode_copy_up_xattr(const char *name) · 1 unmodified line
2617	2641	* xattr), -EOPNOTSUPP if it does not know anything about the xattr or
2618	2642	* any other error code in case of an error.
2619	2643	*/
2620		− hlist_for_each_entry(hp,
2621		− &security_hook_heads.inode_copy_up_xattr, list) {
2622		− rc = hp->hook.inode_copy_up_xattr(name);
2623		− if (rc != LSM_RET_DEFAULT(inode_copy_up_xattr))
2624		− return rc;
2625		− }
	2644	+ rc = call_int_hook(inode_copy_up_xattr, name);
	2645	+ if (rc != LSM_RET_DEFAULT(inode_copy_up_xattr))
	2646	+ return rc;
2626	2647
2627		− return evm_inode_copy_up_xattr(name);
	2648	+ return LSM_RET_DEFAULT(inode_copy_up_xattr);
2628	2649	}
2629	2650	EXPORT_SYMBOL(security_inode_copy_up_xattr);
2630	2651
@@ -2641,7 +2662,7 @@ EXPORT_SYMBOL(security_inode_copy_up_xattr); · 10 unmodified lines
2641	2662	int security_kernfs_init_security(struct kernfs_node *kn_dir,
2642	2663	struct kernfs_node *kn)
2643	2664	{
2644		− return call_int_hook(kernfs_init_security, 0, kn_dir, kn);
	2665	+ return call_int_hook(kernfs_init_security, kn_dir, kn);
2645	2666	}
2646	2667
2647	2668	/**
@@ -2665,7 +2686,7 @@ int security_kernfs_init_security(struct kernfs_node *kn_dir, · 17 unmodified lines
2665	2686	*/
2666	2687	int security_file_permission(struct file *file, int mask)
2667	2688	{
2668		− return call_int_hook(file_permission, 0, file, mask);
	2689	+ return call_int_hook(file_permission, file, mask);
2669	2690	}
2670	2691
2671	2692	/**
@@ -2683,12 +2704,23 @@ int security_file_alloc(struct file *file) · 11 unmodified lines
2683	2704
2684	2705	if (rc)
2685	2706	return rc;
2686		− rc = call_int_hook(file_alloc_security, 0, file);
	2707	+ rc = call_int_hook(file_alloc_security, file);
2687	2708	if (unlikely(rc))
2688	2709	security_file_free(file);
2689	2710	return rc;
2690	2711	}
2691	2712
	2713	+/**
	2714	+ * security_file_release() - Perform actions before releasing the file ref
	2715	+ * @file: the file
	2716	+ *
	2717	+ * Perform actions before releasing the last reference to a file.
	2718	+ */
	2719	+void security_file_release(struct file *file)
	2720	+{
	2721	+ call_void_hook(file_release, file);
	2722	+}
	2723	+
2692	2724	/**
2693	2725	* security_file_free() - Free a file's LSM blob
2694	2726	* @file: the file
@@ -2723,7 +2755,7 @@ void security_file_free(struct file *file) · 28 unmodified lines
2723	2755	*/
2724	2756	int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2725	2757	{
2726		− return call_int_hook(file_ioctl, 0, file, cmd, arg);
	2758	+ return call_int_hook(file_ioctl, file, cmd, arg);
2727	2759	}
2728	2760	EXPORT_SYMBOL_GPL(security_file_ioctl);
2729	2761
@@ -2741,7 +2773,7 @@ EXPORT_SYMBOL_GPL(security_file_ioctl); · 11 unmodified lines
2741	2773	int security_file_ioctl_compat(struct file *file, unsigned int cmd,
2742	2774	unsigned long arg)
2743	2775	{
2744		− return call_int_hook(file_ioctl_compat, 0, file, cmd, arg);
	2776	+ return call_int_hook(file_ioctl_compat, file, cmd, arg);
2745	2777	}
2746	2778	EXPORT_SYMBOL_GPL(security_file_ioctl_compat);
2747	2779
@@ -2792,13 +2824,8 @@ static inline unsigned long mmap_prot(struct file *file, unsigned long prot) · 44 unmodified lines
2792	2824	int security_mmap_file(struct file *file, unsigned long prot,
2793	2825	unsigned long flags)
2794	2826	{
2795		− unsigned long prot_adj = mmap_prot(file, prot);
2796		− int ret;
2797		−
2798		− ret = call_int_hook(mmap_file, 0, file, prot, prot_adj, flags);
2799		− if (ret)
2800		− return ret;
2801		− return ima_file_mmap(file, prot, prot_adj, flags);
	2827	+ return call_int_hook(mmap_file, file, prot, mmap_prot(file, prot),
	2828	+ flags);
2802	2829	}
2803	2830
2804	2831	/**
@@ -2811,7 +2838,7 @@ int security_mmap_file(struct file *file, unsigned long prot, · 6 unmodified lines
2811	2838	*/
2812	2839	int security_mmap_addr(unsigned long addr)
2813	2840	{
2814		− return call_int_hook(mmap_addr, 0, addr);
	2841	+ return call_int_hook(mmap_addr, addr);
2815	2842	}
2816	2843
2817	2844	/**
@@ -2827,12 +2854,7 @@ int security_mmap_addr(unsigned long addr) · 9 unmodified lines
2827	2854	int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
2828	2855	unsigned long prot)
2829	2856	{
2830		− int ret;
2831		−
2832		− ret = call_int_hook(file_mprotect, 0, vma, reqprot, prot);
2833		− if (ret)
2834		− return ret;
2835		− return ima_file_mprotect(vma, prot);
	2857	+ return call_int_hook(file_mprotect, vma, reqprot, prot);
2836	2858	}
2837	2859
2838	2860	/**
@@ -2847,7 +2869,7 @@ int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, · 8 unmodified lines
2847	2869	*/
2848	2870	int security_file_lock(struct file *file, unsigned int cmd)
2849	2871	{
2850		− return call_int_hook(file_lock, 0, file, cmd);
	2872	+ return call_int_hook(file_lock, file, cmd);
2851	2873	}
2852	2874
2853	2875	/**
@@ -2866,7 +2888,7 @@ int security_file_lock(struct file *file, unsigned int cmd) · 12 unmodified lines
2866	2888	*/
2867	2889	int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
2868	2890	{
2869		− return call_int_hook(file_fcntl, 0, file, cmd, arg);
	2891	+ return call_int_hook(file_fcntl, file, cmd, arg);
2870	2892	}
2871	2893
2872	2894	/**
@@ -2900,11 +2922,11 @@ void security_file_set_fowner(struct file *file) · 27 unmodified lines
2900	2922	int security_file_send_sigiotask(struct task_struct *tsk,
2901	2923	struct fown_struct *fown, int sig)
2902	2924	{
2903		− return call_int_hook(file_send_sigiotask, 0, tsk, fown, sig);
	2925	+ return call_int_hook(file_send_sigiotask, tsk, fown, sig);
2904	2926	}
2905	2927
2906	2928	/**
2907		− * security_file_receive() - Check is receiving a file via IPC is allowed
	2929	+ * security_file_receive() - Check if receiving a file via IPC is allowed
2908	2930	* @file: file being received
2909	2931	*
2910	2932	* This hook allows security modules to control the ability of a process to
@@ -2914,7 +2936,7 @@ int security_file_send_sigiotask(struct task_struct *tsk, · 3 unmodified lines
2914	2936	*/
2915	2937	int security_file_receive(struct file *file)
2916	2938	{
2917		− return call_int_hook(file_receive, 0, file);
	2939	+ return call_int_hook(file_receive, file);
2918	2940	}
2919	2941
2920	2942	/**
@@ -2930,13 +2952,30 @@ int security_file_open(struct file *file) · 9 unmodified lines
2930	2952	{
2931	2953	int ret;
2932	2954
2933		− ret = call_int_hook(file_open, 0, file);
	2955	+ ret = call_int_hook(file_open, file);
2934	2956	if (ret)
2935	2957	return ret;
2936	2958
2937	2959	return fsnotify_open_perm(file);
2938	2960	}
2939	2961
	2962	+/**
	2963	+ * security_file_post_open() - Evaluate a file after it has been opened
	2964	+ * @file: the file
	2965	+ * @mask: access mask
	2966	+ *
	2967	+ * Evaluate an opened file and the access mask requested with open(). The hook
	2968	+ * is useful for LSMs that require the file content to be available in order to
	2969	+ * make decisions.
	2970	+ *
	2971	+ * Return: Returns 0 if permission is granted.
	2972	+ */
	2973	+int security_file_post_open(struct file *file, int mask)
	2974	+{
	2975	+ return call_int_hook(file_post_open, file, mask);
	2976	+}
	2977	+EXPORT_SYMBOL_GPL(security_file_post_open);
	2978	+
2940	2979	/**
2941	2980	* security_file_truncate() - Check if truncating a file is allowed
2942	2981	* @file: file
@@ -2949,7 +2988,7 @@ int security_file_open(struct file *file) · 6 unmodified lines
2949	2988	*/
2950	2989	int security_file_truncate(struct file *file)
2951	2990	{
2952		− return call_int_hook(file_truncate, 0, file);
	2991	+ return call_int_hook(file_truncate, file);
2953	2992	}
2954	2993
2955	2994	/**
@@ -2967,7 +3006,7 @@ int security_task_alloc(struct task_struct *task, unsigned long clone_flags) · 11 unmodified lines
2967	3006
2968	3007	if (rc)
2969	3008	return rc;
2970		− rc = call_int_hook(task_alloc, 0, task, clone_flags);
	3009	+ rc = call_int_hook(task_alloc, task, clone_flags);
2971	3010	if (unlikely(rc))
2972	3011	security_task_free(task);
2973	3012	return rc;
@@ -3005,7 +3044,7 @@ int security_cred_alloc_blank(struct cred *cred, gfp_t gfp) · 31 unmodified lines
3005	3044	if (rc)
3006	3045	return rc;
3007	3046
3008		− rc = call_int_hook(cred_alloc_blank, 0, cred, gfp);
	3047	+ rc = call_int_hook(cred_alloc_blank, cred, gfp);
3009	3048	if (unlikely(rc))
3010	3049	security_cred_free(cred);
3011	3050	return rc;
@@ -3049,7 +3088,7 @@ int security_prepare_creds(struct cred new, const struct cred old, gfp_t gfp) · 37 unmodified lines
3049	3088	if (rc)
3050	3089	return rc;
3051	3090
3052		− rc = call_int_hook(cred_prepare, 0, new, old, gfp);
	3091	+ rc = call_int_hook(cred_prepare, new, old, gfp);
3053	3092	if (unlikely(rc))
3054	3093	security_cred_free(new);
3055	3094	return rc;
@@ -3094,7 +3133,7 @@ EXPORT_SYMBOL(security_cred_getsecid); · 38 unmodified lines
3094	3133	*/
3095	3134	int security_kernel_act_as(struct cred *new, u32 secid)
3096	3135	{
3097		− return call_int_hook(kernel_act_as, 0, new, secid);
	3136	+ return call_int_hook(kernel_act_as, new, secid);
3098	3137	}
3099	3138
3100	3139	/**
@@ -3110,11 +3149,11 @@ int security_kernel_act_as(struct cred *new, u32 secid) · 9 unmodified lines
3110	3149	*/
3111	3150	int security_kernel_create_files_as(struct cred new, struct inode inode)
3112	3151	{
3113		− return call_int_hook(kernel_create_files_as, 0, new, inode);
	3152	+ return call_int_hook(kernel_create_files_as, new, inode);
3114	3153	}
3115	3154
3116	3155	/**
3117		− * security_kernel_module_request() - Check is loading a module is allowed
	3156	+ * security_kernel_module_request() - Check if loading a module is allowed
3118	3157	* @kmod_name: module name
3119	3158	*
3120	3159	* Ability to trigger the kernel to automatically upcall to userspace for
@@ -3124,12 +3163,7 @@ int security_kernel_create_files_as(struct cred new, struct inode inode) · 3 unmodified lines
3124	3163	*/
3125	3164	int security_kernel_module_request(char *kmod_name)
3126	3165	{
3127		− int ret;
3128		−
3129		− ret = call_int_hook(kernel_module_request, 0, kmod_name);
3130		− if (ret)
3131		− return ret;
3132		− return integrity_kernel_module_request(kmod_name);
	3166	+ return call_int_hook(kernel_module_request, kmod_name);
3133	3167	}
3134	3168
3135	3169	/**
@@ -3145,12 +3179,7 @@ int security_kernel_module_request(char *kmod_name) · 9 unmodified lines
3145	3179	int security_kernel_read_file(struct file *file, enum kernel_read_file_id id,
3146	3180	bool contents)
3147	3181	{
3148		− int ret;
3149		−
3150		− ret = call_int_hook(kernel_read_file, 0, file, id, contents);
3151		− if (ret)
3152		− return ret;
3153		− return ima_read_file(file, id, contents);
	3182	+ return call_int_hook(kernel_read_file, file, id, contents);
3154	3183	}
3155	3184	EXPORT_SYMBOL_GPL(security_kernel_read_file);
3156	3185
@@ -3170,12 +3199,7 @@ EXPORT_SYMBOL_GPL(security_kernel_read_file); · 13 unmodified lines
3170	3199	int security_kernel_post_read_file(struct file file, char buf, loff_t size,
3171	3200	enum kernel_read_file_id id)
3172	3201	{
3173		− int ret;
3174		−
3175		− ret = call_int_hook(kernel_post_read_file, 0, file, buf, size, id);
3176		− if (ret)
3177		− return ret;
3178		− return ima_post_read_file(file, buf, size, id);
	3202	+ return call_int_hook(kernel_post_read_file, file, buf, size, id);
3179	3203	}
3180	3204	EXPORT_SYMBOL_GPL(security_kernel_post_read_file);
3181	3205
@@ -3190,12 +3214,7 @@ EXPORT_SYMBOL_GPL(security_kernel_post_read_file); · 8 unmodified lines
3190	3214	*/
3191	3215	int security_kernel_load_data(enum kernel_load_data_id id, bool contents)
3192	3216	{
3193		− int ret;
3194		−
3195		− ret = call_int_hook(kernel_load_data, 0, id, contents);
3196		− if (ret)
3197		− return ret;
3198		− return ima_load_data(id, contents);
	3217	+ return call_int_hook(kernel_load_data, id, contents);
3199	3218	}
3200	3219	EXPORT_SYMBOL_GPL(security_kernel_load_data);
3201	3220
@@ -3217,13 +3236,7 @@ int security_kernel_post_load_data(char *buf, loff_t size, · 15 unmodified lines
3217	3236	enum kernel_load_data_id id,
3218	3237	char *description)
3219	3238	{
3220		− int ret;
3221		−
3222		− ret = call_int_hook(kernel_post_load_data, 0, buf, size, id,
3223		− description);
3224		− if (ret)
3225		− return ret;
3226		− return ima_post_load_data(buf, size, id, description);
	3239	+ return call_int_hook(kernel_post_load_data, buf, size, id, description);
3227	3240	}
3228	3241	EXPORT_SYMBOL_GPL(security_kernel_post_load_data);
3229	3242
@@ -3244,7 +3257,7 @@ EXPORT_SYMBOL_GPL(security_kernel_post_load_data); · 14 unmodified lines
3244	3257	int security_task_fix_setuid(struct cred new, const struct cred old,
3245	3258	int flags)
3246	3259	{
3247		− return call_int_hook(task_fix_setuid, 0, new, old, flags);
	3260	+ return call_int_hook(task_fix_setuid, new, old, flags);
3248	3261	}
3249	3262
3250	3263	/**
@@ -3264,7 +3277,7 @@ int security_task_fix_setuid(struct cred new, const struct cred old, · 13 unmodified lines
3264	3277	int security_task_fix_setgid(struct cred new, const struct cred old,
3265	3278	int flags)
3266	3279	{
3267		− return call_int_hook(task_fix_setgid, 0, new, old, flags);
	3280	+ return call_int_hook(task_fix_setgid, new, old, flags);
3268	3281	}
3269	3282
3270	3283	/**
@@ -3281,7 +3294,7 @@ int security_task_fix_setgid(struct cred new, const struct cred old, · 10 unmodified lines
3281	3294	*/
3282	3295	int security_task_fix_setgroups(struct cred new, const struct cred old)
3283	3296	{
3284		− return call_int_hook(task_fix_setgroups, 0, new, old);
	3297	+ return call_int_hook(task_fix_setgroups, new, old);
3285	3298	}
3286	3299
3287	3300	/**
@@ -3296,7 +3309,7 @@ int security_task_fix_setgroups(struct cred new, const struct cred old) · 8 unmodified lines
3296	3309	*/
3297	3310	int security_task_setpgid(struct task_struct *p, pid_t pgid)
3298	3311	{
3299		− return call_int_hook(task_setpgid, 0, p, pgid);
	3312	+ return call_int_hook(task_setpgid, p, pgid);
3300	3313	}
3301	3314
3302	3315	/**
@@ -3310,7 +3323,7 @@ int security_task_setpgid(struct task_struct *p, pid_t pgid) · 7 unmodified lines
3310	3323	*/
3311	3324	int security_task_getpgid(struct task_struct *p)
3312	3325	{
3313		− return call_int_hook(task_getpgid, 0, p);
	3326	+ return call_int_hook(task_getpgid, p);
3314	3327	}
3315	3328
3316	3329	/**
@@ -3323,7 +3336,7 @@ int security_task_getpgid(struct task_struct *p) · 6 unmodified lines
3323	3336	*/
3324	3337	int security_task_getsid(struct task_struct *p)
3325	3338	{
3326		− return call_int_hook(task_getsid, 0, p);
	3339	+ return call_int_hook(task_getsid, p);
3327	3340	}
3328	3341
3329	3342	/**
@@ -3366,7 +3379,7 @@ EXPORT_SYMBOL(security_task_getsecid_obj); · 36 unmodified lines
3366	3379	*/
3367	3380	int security_task_setnice(struct task_struct *p, int nice)
3368	3381	{
3369		− return call_int_hook(task_setnice, 0, p, nice);
	3382	+ return call_int_hook(task_setnice, p, nice);
3370	3383	}
3371	3384
3372	3385	/**
@@ -3380,7 +3393,7 @@ int security_task_setnice(struct task_struct *p, int nice) · 7 unmodified lines
3380	3393	*/
3381	3394	int security_task_setioprio(struct task_struct *p, int ioprio)
3382	3395	{
3383		− return call_int_hook(task_setioprio, 0, p, ioprio);
	3396	+ return call_int_hook(task_setioprio, p, ioprio);
3384	3397	}
3385	3398
3386	3399	/**
@@ -3393,7 +3406,7 @@ int security_task_setioprio(struct task_struct *p, int ioprio) · 6 unmodified lines
3393	3406	*/
3394	3407	int security_task_getioprio(struct task_struct *p)
3395	3408	{
3396		− return call_int_hook(task_getioprio, 0, p);
	3409	+ return call_int_hook(task_getioprio, p);
3397	3410	}
3398	3411
3399	3412	/**
@@ -3410,7 +3423,7 @@ int security_task_getioprio(struct task_struct *p) · 10 unmodified lines
3410	3423	int security_task_prlimit(const struct cred cred, const struct cred tcred,
3411	3424	unsigned int flags)
3412	3425	{
3413		− return call_int_hook(task_prlimit, 0, cred, tcred, flags);
	3426	+ return call_int_hook(task_prlimit, cred, tcred, flags);
3414	3427	}
3415	3428
3416	3429	/**
@@ -3428,7 +3441,7 @@ int security_task_prlimit(const struct cred cred, const struct cred tcred, · 11 unmodified lines
3428	3441	int security_task_setrlimit(struct task_struct *p, unsigned int resource,
3429	3442	struct rlimit *new_rlim)
3430	3443	{
3431		− return call_int_hook(task_setrlimit, 0, p, resource, new_rlim);
	3444	+ return call_int_hook(task_setrlimit, p, resource, new_rlim);
3432	3445	}
3433	3446
3434	3447	/**
@@ -3442,7 +3455,7 @@ int security_task_setrlimit(struct task_struct *p, unsigned int resource, · 7 unmodified lines
3442	3455	*/
3443	3456	int security_task_setscheduler(struct task_struct *p)
3444	3457	{
3445		− return call_int_hook(task_setscheduler, 0, p);
	3458	+ return call_int_hook(task_setscheduler, p);
3446	3459	}
3447	3460
3448	3461	/**
@@ -3455,7 +3468,7 @@ int security_task_setscheduler(struct task_struct *p) · 6 unmodified lines
3455	3468	*/
3456	3469	int security_task_getscheduler(struct task_struct *p)
3457	3470	{
3458		− return call_int_hook(task_getscheduler, 0, p);
	3471	+ return call_int_hook(task_getscheduler, p);
3459	3472	}
3460	3473
3461	3474	/**
@@ -3468,7 +3481,7 @@ int security_task_getscheduler(struct task_struct *p) · 6 unmodified lines
3468	3481	*/
3469	3482	int security_task_movememory(struct task_struct *p)
3470	3483	{
3471		− return call_int_hook(task_movememory, 0, p);
	3484	+ return call_int_hook(task_movememory, p);
3472	3485	}
3473	3486
3474	3487	/**
@@ -3489,7 +3502,7 @@ int security_task_movememory(struct task_struct *p) · 14 unmodified lines
3489	3502	int security_task_kill(struct task_struct p, struct kernel_siginfo info,
3490	3503	int sig, const struct cred *cred)
3491	3504	{
3492		− return call_int_hook(task_kill, 0, p, info, sig, cred);
	3505	+ return call_int_hook(task_kill, p, info, sig, cred);
3493	3506	}
3494	3507
3495	3508	/**
@@ -3547,7 +3560,7 @@ void security_task_to_inode(struct task_struct p, struct inode inode) · 51 unmodified lines
3547	3560	*/
3548	3561	int security_create_user_ns(const struct cred *cred)
3549	3562	{
3550		− return call_int_hook(userns_create, 0, cred);
	3563	+ return call_int_hook(userns_create, cred);
3551	3564	}
3552	3565
3553	3566	/**
@@ -3561,7 +3574,7 @@ int security_create_user_ns(const struct cred *cred) · 7 unmodified lines
3561	3574	*/
3562	3575	int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
3563	3576	{
3564		− return call_int_hook(ipc_permission, 0, ipcp, flag);
	3577	+ return call_int_hook(ipc_permission, ipcp, flag);
3565	3578	}
3566	3579
3567	3580	/**
@@ -3593,7 +3606,7 @@ int security_msg_msg_alloc(struct msg_msg *msg) · 25 unmodified lines
3593	3606
3594	3607	if (unlikely(rc))
3595	3608	return rc;
3596		− rc = call_int_hook(msg_msg_alloc_security, 0, msg);
	3609	+ rc = call_int_hook(msg_msg_alloc_security, msg);
3597	3610	if (unlikely(rc))
3598	3611	security_msg_msg_free(msg);
3599	3612	return rc;
@@ -3627,7 +3640,7 @@ int security_msg_queue_alloc(struct kern_ipc_perm *msq) · 27 unmodified lines
3627	3640
3628	3641	if (unlikely(rc))
3629	3642	return rc;
3630		− rc = call_int_hook(msg_queue_alloc_security, 0, msq);
	3643	+ rc = call_int_hook(msg_queue_alloc_security, msq);
3631	3644	if (unlikely(rc))
3632	3645	security_msg_queue_free(msq);
3633	3646	return rc;
@@ -3659,7 +3672,7 @@ void security_msg_queue_free(struct kern_ipc_perm *msq) · 25 unmodified lines
3659	3672	*/
3660	3673	int security_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
3661	3674	{
3662		− return call_int_hook(msg_queue_associate, 0, msq, msqflg);
	3675	+ return call_int_hook(msg_queue_associate, msq, msqflg);
3663	3676	}
3664	3677
3665	3678	/**
@@ -3674,7 +3687,7 @@ int security_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg) · 8 unmodified lines
3674	3687	*/
3675	3688	int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
3676	3689	{
3677		− return call_int_hook(msg_queue_msgctl, 0, msq, cmd);
	3690	+ return call_int_hook(msg_queue_msgctl, msq, cmd);
3678	3691	}
3679	3692
3680	3693	/**
@@ -3691,7 +3704,7 @@ int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd) · 10 unmodified lines
3691	3704	int security_msg_queue_msgsnd(struct kern_ipc_perm *msq,
3692	3705	struct msg_msg *msg, int msqflg)
3693	3706	{
3694		− return call_int_hook(msg_queue_msgsnd, 0, msq, msg, msqflg);
	3707	+ return call_int_hook(msg_queue_msgsnd, msq, msg, msqflg);
3695	3708	}
3696	3709
3697	3710	/**
@@ -3712,7 +3725,7 @@ int security_msg_queue_msgsnd(struct kern_ipc_perm *msq, · 14 unmodified lines
3712	3725	int security_msg_queue_msgrcv(struct kern_ipc_perm msq, struct msg_msg msg,
3713	3726	struct task_struct *target, long type, int mode)
3714	3727	{
3715		− return call_int_hook(msg_queue_msgrcv, 0, msq, msg, target, type, mode);
	3728	+ return call_int_hook(msg_queue_msgrcv, msq, msg, target, type, mode);
3716	3729	}
3717	3730
3718	3731	/**
@@ -3730,7 +3743,7 @@ int security_shm_alloc(struct kern_ipc_perm *shp) · 11 unmodified lines
3730	3743
3731	3744	if (unlikely(rc))
3732	3745	return rc;
3733		− rc = call_int_hook(shm_alloc_security, 0, shp);
	3746	+ rc = call_int_hook(shm_alloc_security, shp);
3734	3747	if (unlikely(rc))
3735	3748	security_shm_free(shp);
3736	3749	return rc;
@@ -3763,7 +3776,7 @@ void security_shm_free(struct kern_ipc_perm *shp) · 26 unmodified lines
3763	3776	*/
3764	3777	int security_shm_associate(struct kern_ipc_perm *shp, int shmflg)
3765	3778	{
3766		− return call_int_hook(shm_associate, 0, shp, shmflg);
	3779	+ return call_int_hook(shm_associate, shp, shmflg);
3767	3780	}
3768	3781
3769	3782	/**
@@ -3778,7 +3791,7 @@ int security_shm_associate(struct kern_ipc_perm *shp, int shmflg) · 8 unmodified lines
3778	3791	*/
3779	3792	int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
3780	3793	{
3781		− return call_int_hook(shm_shmctl, 0, shp, cmd);
	3794	+ return call_int_hook(shm_shmctl, shp, cmd);
3782	3795	}
3783	3796
3784	3797	/**
@@ -3796,7 +3809,7 @@ int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd) · 11 unmodified lines
3796	3809	int security_shm_shmat(struct kern_ipc_perm *shp,
3797	3810	char __user *shmaddr, int shmflg)
3798	3811	{
3799		− return call_int_hook(shm_shmat, 0, shp, shmaddr, shmflg);
	3812	+ return call_int_hook(shm_shmat, shp, shmaddr, shmflg);
3800	3813	}
3801	3814
3802	3815	/**
@@ -3814,7 +3827,7 @@ int security_sem_alloc(struct kern_ipc_perm *sma) · 11 unmodified lines
3814	3827
3815	3828	if (unlikely(rc))
3816	3829	return rc;
3817		− rc = call_int_hook(sem_alloc_security, 0, sma);
	3830	+ rc = call_int_hook(sem_alloc_security, sma);
3818	3831	if (unlikely(rc))
3819	3832	security_sem_free(sma);
3820	3833	return rc;
@@ -3846,7 +3859,7 @@ void security_sem_free(struct kern_ipc_perm *sma) · 25 unmodified lines
3846	3859	*/
3847	3860	int security_sem_associate(struct kern_ipc_perm *sma, int semflg)
3848	3861	{
3849		− return call_int_hook(sem_associate, 0, sma, semflg);
	3862	+ return call_int_hook(sem_associate, sma, semflg);
3850	3863	}
3851	3864
3852	3865	/**
@@ -3861,7 +3874,7 @@ int security_sem_associate(struct kern_ipc_perm *sma, int semflg) · 8 unmodified lines
3861	3874	*/
3862	3875	int security_sem_semctl(struct kern_ipc_perm *sma, int cmd)
3863	3876	{
3864		− return call_int_hook(sem_semctl, 0, sma, cmd);
	3877	+ return call_int_hook(sem_semctl, sma, cmd);
3865	3878	}
3866	3879
3867	3880	/**
@@ -3879,7 +3892,7 @@ int security_sem_semctl(struct kern_ipc_perm *sma, int cmd) · 11 unmodified lines
3879	3892	int security_sem_semop(struct kern_ipc_perm sma, struct sembuf sops,
3880	3893	unsigned nsops, int alter)
3881	3894	{
3882		− return call_int_hook(sem_semop, 0, sma, sops, nsops, alter);
	3895	+ return call_int_hook(sem_semop, sma, sops, nsops, alter);
3883	3896	}
3884	3897
3885	3898	/**
@@ -4110,11 +4123,11 @@ int security_setprocattr(int lsmid, const char name, void value, size_t size) · 224 unmodified lines
4110	4123	*/
4111	4124	int security_netlink_send(struct sock sk, struct sk_buff skb)
4112	4125	{
4113		− return call_int_hook(netlink_send, 0, sk, skb);
	4126	+ return call_int_hook(netlink_send, sk, skb);
4114	4127	}
4115	4128
4116	4129	/**
4117		− * security_ismaclabel() - Check is the named attribute is a MAC label
	4130	+ * security_ismaclabel() - Check if the named attribute is a MAC label
4118	4131	* @name: full extended attribute name
4119	4132	*
4120	4133	* Check if the extended attribute specified by @name represents a MAC label.
@@ -4123,7 +4136,7 @@ int security_netlink_send(struct sock sk, struct sk_buff skb) · 2 unmodified lines
4123	4136	*/
4124	4137	int security_ismaclabel(const char *name)
4125	4138	{
4126		− return call_int_hook(ismaclabel, 0, name);
	4139	+ return call_int_hook(ismaclabel, name);
4127	4140	}
4128	4141	EXPORT_SYMBOL(security_ismaclabel);
4129	4142
@@ -4142,20 +4155,7 @@ EXPORT_SYMBOL(security_ismaclabel); · 12 unmodified lines
4142	4155	*/
4143	4156	int security_secid_to_secctx(u32 secid, char *secdata, u32 seclen)
4144	4157	{
4145		− struct security_hook_list *hp;
4146		− int rc;
4147		−
4148		− /*
4149		− * Currently, only one LSM can implement secid_to_secctx (i.e this
4150		− * LSM hook is not "stackable").
4151		− */
4152		− hlist_for_each_entry(hp, &security_hook_heads.secid_to_secctx, list) {
4153		− rc = hp->hook.secid_to_secctx(secid, secdata, seclen);
4154		− if (rc != LSM_RET_DEFAULT(secid_to_secctx))
4155		− return rc;
4156		− }
4157		−
4158		− return LSM_RET_DEFAULT(secid_to_secctx);
	4158	+ return call_int_hook(secid_to_secctx, secid, secdata, seclen);
4159	4159	}
4160	4160	EXPORT_SYMBOL(security_secid_to_secctx);
4161	4161
@@ -4172,7 +4172,7 @@ EXPORT_SYMBOL(security_secid_to_secctx); · 10 unmodified lines
4172	4172	int security_secctx_to_secid(const char secdata, u32 seclen, u32 secid)
4173	4173	{
4174	4174	*secid = 0;
4175		− return call_int_hook(secctx_to_secid, 0, secdata, seclen, secid);
	4175	+ return call_int_hook(secctx_to_secid, secdata, seclen, secid);
4176	4176	}
4177	4177	EXPORT_SYMBOL(security_secctx_to_secid);
4178	4178
@@ -4219,7 +4219,7 @@ EXPORT_SYMBOL(security_inode_invalidate_secctx); · 40 unmodified lines
4219	4219	*/
4220	4220	int security_inode_notifysecctx(struct inode inode, void ctx, u32 ctxlen)
4221	4221	{
4222		− return call_int_hook(inode_notifysecctx, 0, inode, ctx, ctxlen);
	4222	+ return call_int_hook(inode_notifysecctx, inode, ctx, ctxlen);
4223	4223	}
4224	4224	EXPORT_SYMBOL(security_inode_notifysecctx);
4225	4225
@@ -4241,7 +4241,7 @@ EXPORT_SYMBOL(security_inode_notifysecctx); · 15 unmodified lines
4241	4241	*/
4242	4242	int security_inode_setsecctx(struct dentry dentry, void ctx, u32 ctxlen)
4243	4243	{
4244		− return call_int_hook(inode_setsecctx, 0, dentry, ctx, ctxlen);
	4244	+ return call_int_hook(inode_setsecctx, dentry, ctx, ctxlen);
4245	4245	}
4246	4246	EXPORT_SYMBOL(security_inode_setsecctx);
4247	4247
@@ -4258,19 +4258,7 @@ EXPORT_SYMBOL(security_inode_setsecctx); · 10 unmodified lines
4258	4258	*/
4259	4259	int security_inode_getsecctx(struct inode inode, void ctx, u32 ctxlen)
4260	4260	{
4261		− struct security_hook_list *hp;
4262		− int rc;
4263		−
4264		− /*
4265		− * Only one module will provide a security context.
4266		− */
4267		− hlist_for_each_entry(hp, &security_hook_heads.inode_getsecctx, list) {
4268		− rc = hp->hook.inode_getsecctx(inode, ctx, ctxlen);
4269		− if (rc != LSM_RET_DEFAULT(inode_getsecctx))
4270		− return rc;
4271		− }
4272		−
4273		− return LSM_RET_DEFAULT(inode_getsecctx);
	4261	+ return call_int_hook(inode_getsecctx, inode, ctx, ctxlen);
4274	4262	}
4275	4263	EXPORT_SYMBOL(security_inode_getsecctx);
4276	4264
@@ -4289,7 +4277,7 @@ int security_post_notification(const struct cred *w_cred, · 12 unmodified lines
4289	4277	const struct cred *cred,
4290	4278	struct watch_notification *n)
4291	4279	{
4292		− return call_int_hook(post_notification, 0, w_cred, cred, n);
	4280	+ return call_int_hook(post_notification, w_cred, cred, n);
4293	4281	}
4294	4282	#endif /* CONFIG_WATCH_QUEUE */
4295	4283
@@ -4305,7 +4293,7 @@ int security_post_notification(const struct cred *w_cred, · 9 unmodified lines
4305	4293	*/
4306	4294	int security_watch_key(struct key *key)
4307	4295	{
4308		− return call_int_hook(watch_key, 0, key);
	4296	+ return call_int_hook(watch_key, key);
4309	4297	}
4310	4298	#endif /* CONFIG_KEY_NOTIFICATIONS */
4311	4299
@@ -4334,7 +4322,7 @@ int security_watch_key(struct key *key) · 22 unmodified lines
4334	4322	int security_unix_stream_connect(struct sock sock, struct sock other,
4335	4323	struct sock *newsk)
4336	4324	{
4337		− return call_int_hook(unix_stream_connect, 0, sock, other, newsk);
	4325	+ return call_int_hook(unix_stream_connect, sock, other, newsk);
4338	4326	}
4339	4327	EXPORT_SYMBOL(security_unix_stream_connect);
4340	4328
@@ -4360,7 +4348,7 @@ EXPORT_SYMBOL(security_unix_stream_connect); · 19 unmodified lines
4360	4348	*/
4361	4349	int security_unix_may_send(struct socket sock, struct socket other)
4362	4350	{
4363		− return call_int_hook(unix_may_send, 0, sock, other);
	4351	+ return call_int_hook(unix_may_send, sock, other);
4364	4352	}
4365	4353	EXPORT_SYMBOL(security_unix_may_send);
4366	4354
@@ -4377,7 +4365,7 @@ EXPORT_SYMBOL(security_unix_may_send); · 10 unmodified lines
4377	4365	*/
4378	4366	int security_socket_create(int family, int type, int protocol, int kern)
4379	4367	{
4380		− return call_int_hook(socket_create, 0, family, type, protocol, kern);
	4368	+ return call_int_hook(socket_create, family, type, protocol, kern);
4381	4369	}
4382	4370
4383	4371	/**
@@ -4401,7 +4389,7 @@ int security_socket_create(int family, int type, int protocol, int kern) · 17 unmodified lines
4401	4389	int security_socket_post_create(struct socket *sock, int family,
4402	4390	int type, int protocol, int kern)
4403	4391	{
4404		− return call_int_hook(socket_post_create, 0, sock, family, type,
	4392	+ return call_int_hook(socket_post_create, sock, family, type,
4405	4393	protocol, kern);
4406	4394	}
4407	4395
@@ -4417,7 +4405,7 @@ int security_socket_post_create(struct socket *sock, int family, · 9 unmodified lines
4417	4405	*/
4418	4406	int security_socket_socketpair(struct socket socka, struct socket sockb)
4419	4407	{
4420		− return call_int_hook(socket_socketpair, 0, socka, sockb);
	4408	+ return call_int_hook(socket_socketpair, socka, sockb);
4421	4409	}
4422	4410	EXPORT_SYMBOL(security_socket_socketpair);
4423	4411
@@ -4436,7 +4424,7 @@ EXPORT_SYMBOL(security_socket_socketpair); · 12 unmodified lines
4436	4424	int security_socket_bind(struct socket *sock,
4437	4425	struct sockaddr *address, int addrlen)
4438	4426	{
4439		− return call_int_hook(socket_bind, 0, sock, address, addrlen);
	4427	+ return call_int_hook(socket_bind, sock, address, addrlen);
4440	4428	}
4441	4429
4442	4430	/**
@@ -4453,7 +4441,7 @@ int security_socket_bind(struct socket *sock, · 10 unmodified lines
4453	4441	int security_socket_connect(struct socket *sock,
4454	4442	struct sockaddr *address, int addrlen)
4455	4443	{
4456		− return call_int_hook(socket_connect, 0, sock, address, addrlen);
	4444	+ return call_int_hook(socket_connect, sock, address, addrlen);
4457	4445	}
4458	4446
4459	4447	/**
@@ -4467,7 +4455,7 @@ int security_socket_connect(struct socket *sock, · 7 unmodified lines
4467	4455	*/
4468	4456	int security_socket_listen(struct socket *sock, int backlog)
4469	4457	{
4470		− return call_int_hook(socket_listen, 0, sock, backlog);
	4458	+ return call_int_hook(socket_listen, sock, backlog);
4471	4459	}
4472	4460
4473	4461	/**
@@ -4483,11 +4471,11 @@ int security_socket_listen(struct socket *sock, int backlog) · 9 unmodified lines
4483	4471	*/
4484	4472	int security_socket_accept(struct socket sock, struct socket newsock)
4485	4473	{
4486		− return call_int_hook(socket_accept, 0, sock, newsock);
	4474	+ return call_int_hook(socket_accept, sock, newsock);
4487	4475	}
4488	4476
4489	4477	/**
4490		− * security_socket_sendmsg() - Check is sending a message is allowed
	4478	+ * security_socket_sendmsg() - Check if sending a message is allowed
4491	4479	* @sock: sending socket
4492	4480	* @msg: message to send
4493	4481	* @size: size of message
@@ -4498,7 +4486,7 @@ int security_socket_accept(struct socket sock, struct socket newsock) · 4 unmodified lines
4498	4486	*/
4499	4487	int security_socket_sendmsg(struct socket sock, struct msghdr msg, int size)
4500	4488	{
4501		− return call_int_hook(socket_sendmsg, 0, sock, msg, size);
	4489	+ return call_int_hook(socket_sendmsg, sock, msg, size);
4502	4490	}
4503	4491
4504	4492	/**
@@ -4515,7 +4503,7 @@ int security_socket_sendmsg(struct socket sock, struct msghdr msg, int size) · 10 unmodified lines
4515	4503	int security_socket_recvmsg(struct socket sock, struct msghdr msg,
4516	4504	int size, int flags)
4517	4505	{
4518		− return call_int_hook(socket_recvmsg, 0, sock, msg, size, flags);
	4506	+ return call_int_hook(socket_recvmsg, sock, msg, size, flags);
4519	4507	}
4520	4508
4521	4509	/**
@@ -4529,7 +4517,7 @@ int security_socket_recvmsg(struct socket sock, struct msghdr msg, · 7 unmodified lines
4529	4517	*/
4530	4518	int security_socket_getsockname(struct socket *sock)
4531	4519	{
4532		− return call_int_hook(socket_getsockname, 0, sock);
	4520	+ return call_int_hook(socket_getsockname, sock);
4533	4521	}
4534	4522
4535	4523	/**
@@ -4542,7 +4530,7 @@ int security_socket_getsockname(struct socket *sock) · 6 unmodified lines
4542	4530	*/
4543	4531	int security_socket_getpeername(struct socket *sock)
4544	4532	{
4545		− return call_int_hook(socket_getpeername, 0, sock);
	4533	+ return call_int_hook(socket_getpeername, sock);
4546	4534	}
4547	4535
4548	4536	/**
@@ -4558,7 +4546,7 @@ int security_socket_getpeername(struct socket *sock) · 9 unmodified lines
4558	4546	*/
4559	4547	int security_socket_getsockopt(struct socket *sock, int level, int optname)
4560	4548	{
4561		− return call_int_hook(socket_getsockopt, 0, sock, level, optname);
	4549	+ return call_int_hook(socket_getsockopt, sock, level, optname);
4562	4550	}
4563	4551
4564	4552	/**
@@ -4573,7 +4561,7 @@ int security_socket_getsockopt(struct socket *sock, int level, int optname) · 8 unmodified lines
4573	4561	*/
4574	4562	int security_socket_setsockopt(struct socket *sock, int level, int optname)
4575	4563	{
4576		− return call_int_hook(socket_setsockopt, 0, sock, level, optname);
	4564	+ return call_int_hook(socket_setsockopt, sock, level, optname);
4577	4565	}
4578	4566
4579	4567	/**
@@ -4588,7 +4576,7 @@ int security_socket_setsockopt(struct socket *sock, int level, int optname) · 8 unmodified lines
4588	4576	*/
4589	4577	int security_socket_shutdown(struct socket *sock, int how)
4590	4578	{
4591		− return call_int_hook(socket_shutdown, 0, sock, how);
	4579	+ return call_int_hook(socket_shutdown, sock, how);
4592	4580	}
4593	4581
4594	4582	/**
@@ -4605,7 +4593,7 @@ int security_socket_shutdown(struct socket *sock, int how) · 10 unmodified lines
4605	4593	*/
4606	4594	int security_sock_rcv_skb(struct sock sk, struct sk_buff skb)
4607	4595	{
4608		− return call_int_hook(socket_sock_rcv_skb, 0, sk, skb);
	4596	+ return call_int_hook(socket_sock_rcv_skb, sk, skb);
4609	4597	}
4610	4598	EXPORT_SYMBOL(security_sock_rcv_skb);
4611	4599
@@ -4627,20 +4615,8 @@ EXPORT_SYMBOL(security_sock_rcv_skb); · 15 unmodified lines
4627	4615	int security_socket_getpeersec_stream(struct socket *sock, sockptr_t optval,
4628	4616	sockptr_t optlen, unsigned int len)
4629	4617	{
4630		− struct security_hook_list *hp;
4631		− int rc;
4632		−
4633		− /*
4634		− * Only one module will provide a security context.
4635		− */
4636		− hlist_for_each_entry(hp, &security_hook_heads.socket_getpeersec_stream,
4637		− list) {
4638		− rc = hp->hook.socket_getpeersec_stream(sock, optval, optlen,
4639		− len);
4640		− if (rc != LSM_RET_DEFAULT(socket_getpeersec_stream))
4641		− return rc;
4642		− }
4643		− return LSM_RET_DEFAULT(socket_getpeersec_stream);
	4618	+ return call_int_hook(socket_getpeersec_stream, sock, optval, optlen,
	4619	+ len);
4644	4620	}
4645	4621
4646	4622	/**
@@ -4660,19 +4636,7 @@ int security_socket_getpeersec_stream(struct socket *sock, sockptr_t optval, · 13 unmodified lines
4660	4636	int security_socket_getpeersec_dgram(struct socket *sock,
4661	4637	struct sk_buff skb, u32 secid)
4662	4638	{
4663		− struct security_hook_list *hp;
4664		− int rc;
4665		−
4666		− /*
4667		− * Only one module will provide a security context.
4668		− */
4669		− hlist_for_each_entry(hp, &security_hook_heads.socket_getpeersec_dgram,
4670		− list) {
4671		− rc = hp->hook.socket_getpeersec_dgram(sock, skb, secid);
4672		− if (rc != LSM_RET_DEFAULT(socket_getpeersec_dgram))
4673		− return rc;
4674		− }
4675		− return LSM_RET_DEFAULT(socket_getpeersec_dgram);
	4639	+ return call_int_hook(socket_getpeersec_dgram, sock, skb, secid);
4676	4640	}
4677	4641	EXPORT_SYMBOL(security_socket_getpeersec_dgram);
4678	4642
@@ -4689,7 +4653,7 @@ EXPORT_SYMBOL(security_socket_getpeersec_dgram); · 10 unmodified lines
4689	4653	*/
4690	4654	int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
4691	4655	{
4692		− return call_int_hook(sk_alloc_security, 0, sk, family, priority);
	4656	+ return call_int_hook(sk_alloc_security, sk, family, priority);
4693	4657	}
4694	4658
4695	4659	/**
@@ -4770,7 +4734,7 @@ EXPORT_SYMBOL(security_sock_graft); · 74 unmodified lines
4770	4734	int security_inet_conn_request(const struct sock *sk,
4771	4735	struct sk_buff skb, struct request_sock req)
4772	4736	{
4773		− return call_int_hook(inet_conn_request, 0, sk, skb, req);
	4737	+ return call_int_hook(inet_conn_request, sk, skb, req);
4774	4738	}
4775	4739	EXPORT_SYMBOL(security_inet_conn_request);
4776	4740
@@ -4811,7 +4775,7 @@ EXPORT_SYMBOL(security_inet_conn_established); · 34 unmodified lines
4811	4775	*/
4812	4776	int security_secmark_relabel_packet(u32 secid)
4813	4777	{
4814		− return call_int_hook(secmark_relabel_packet, 0, secid);
	4778	+ return call_int_hook(secmark_relabel_packet, secid);
4815	4779	}
4816	4780	EXPORT_SYMBOL(security_secmark_relabel_packet);
4817	4781
@@ -4848,7 +4812,7 @@ EXPORT_SYMBOL(security_secmark_refcount_dec); · 30 unmodified lines
4848	4812	*/
4849	4813	int security_tun_dev_alloc_security(void **security)
4850	4814	{
4851		− return call_int_hook(tun_dev_alloc_security, 0, security);
	4815	+ return call_int_hook(tun_dev_alloc_security, security);
4852	4816	}
4853	4817	EXPORT_SYMBOL(security_tun_dev_alloc_security);
4854	4818
@@ -4873,7 +4837,7 @@ EXPORT_SYMBOL(security_tun_dev_free_security); · 18 unmodified lines
4873	4837	*/
4874	4838	int security_tun_dev_create(void)
4875	4839	{
4876		− return call_int_hook(tun_dev_create, 0);
	4840	+ return call_int_hook(tun_dev_create);
4877	4841	}
4878	4842	EXPORT_SYMBOL(security_tun_dev_create);
4879	4843
@@ -4887,7 +4851,7 @@ EXPORT_SYMBOL(security_tun_dev_create); · 7 unmodified lines
4887	4851	*/
4888	4852	int security_tun_dev_attach_queue(void *security)
4889	4853	{
4890		− return call_int_hook(tun_dev_attach_queue, 0, security);
	4854	+ return call_int_hook(tun_dev_attach_queue, security);
4891	4855	}
4892	4856	EXPORT_SYMBOL(security_tun_dev_attach_queue);
4893	4857
@@ -4903,7 +4867,7 @@ EXPORT_SYMBOL(security_tun_dev_attach_queue); · 9 unmodified lines
4903	4867	*/
4904	4868	int security_tun_dev_attach(struct sock sk, void security)
4905	4869	{
4906		− return call_int_hook(tun_dev_attach, 0, sk, security);
	4870	+ return call_int_hook(tun_dev_attach, sk, security);
4907	4871	}
4908	4872	EXPORT_SYMBOL(security_tun_dev_attach);
4909	4873
@@ -4918,7 +4882,7 @@ EXPORT_SYMBOL(security_tun_dev_attach); · 8 unmodified lines
4918	4882	*/
4919	4883	int security_tun_dev_open(void *security)
4920	4884	{
4921		− return call_int_hook(tun_dev_open, 0, security);
	4885	+ return call_int_hook(tun_dev_open, security);
4922	4886	}
4923	4887	EXPORT_SYMBOL(security_tun_dev_open);
4924	4888
@@ -4934,7 +4898,7 @@ EXPORT_SYMBOL(security_tun_dev_open); · 9 unmodified lines
4934	4898	int security_sctp_assoc_request(struct sctp_association *asoc,
4935	4899	struct sk_buff *skb)
4936	4900	{
4937		− return call_int_hook(sctp_assoc_request, 0, asoc, skb);
	4901	+ return call_int_hook(sctp_assoc_request, asoc, skb);
4938	4902	}
4939	4903	EXPORT_SYMBOL(security_sctp_assoc_request);
4940	4904
@@ -4955,8 +4919,7 @@ EXPORT_SYMBOL(security_sctp_assoc_request); · 14 unmodified lines
4955	4919	int security_sctp_bind_connect(struct sock *sk, int optname,
4956	4920	struct sockaddr *address, int addrlen)
4957	4921	{
4958		− return call_int_hook(sctp_bind_connect, 0, sk, optname,
4959		− address, addrlen);
	4922	+ return call_int_hook(sctp_bind_connect, sk, optname, address, addrlen);
4960	4923	}
4961	4924	EXPORT_SYMBOL(security_sctp_bind_connect);
4962	4925
@@ -4990,7 +4953,7 @@ EXPORT_SYMBOL(security_sctp_sk_clone); · 27 unmodified lines
4990	4953	int security_sctp_assoc_established(struct sctp_association *asoc,
4991	4954	struct sk_buff *skb)
4992	4955	{
4993		− return call_int_hook(sctp_assoc_established, 0, asoc, skb);
	4956	+ return call_int_hook(sctp_assoc_established, asoc, skb);
4994	4957	}
4995	4958	EXPORT_SYMBOL(security_sctp_assoc_established);
4996	4959
@@ -5008,7 +4971,7 @@ EXPORT_SYMBOL(security_sctp_assoc_established); · 11 unmodified lines
5008	4971	*/
5009	4972	int security_mptcp_add_subflow(struct sock sk, struct sock ssk)
5010	4973	{
5011		− return call_int_hook(mptcp_add_subflow, 0, sk, ssk);
	4974	+ return call_int_hook(mptcp_add_subflow, sk, ssk);
5012	4975	}
5013	4976
5014	4977	#endif /* CONFIG_SECURITY_NETWORK */
@@ -5026,7 +4989,7 @@ int security_mptcp_add_subflow(struct sock sk, struct sock ssk) · 11 unmodified lines
5026	4989	*/
5027	4990	int security_ib_pkey_access(void *sec, u64 subnet_prefix, u16 pkey)
5028	4991	{
5029		− return call_int_hook(ib_pkey_access, 0, sec, subnet_prefix, pkey);
	4992	+ return call_int_hook(ib_pkey_access, sec, subnet_prefix, pkey);
5030	4993	}
5031	4994	EXPORT_SYMBOL(security_ib_pkey_access);
5032	4995
@@ -5043,8 +5006,7 @@ EXPORT_SYMBOL(security_ib_pkey_access); · 10 unmodified lines
5043	5006	int security_ib_endport_manage_subnet(void *sec,
5044	5007	const char *dev_name, u8 port_num)
5045	5008	{
5046		− return call_int_hook(ib_endport_manage_subnet, 0, sec,
5047		− dev_name, port_num);
	5009	+ return call_int_hook(ib_endport_manage_subnet, sec, dev_name, port_num);
5048	5010	}
5049	5011	EXPORT_SYMBOL(security_ib_endport_manage_subnet);
5050	5012
@@ -5058,7 +5020,7 @@ EXPORT_SYMBOL(security_ib_endport_manage_subnet); · 7 unmodified lines
5058	5020	*/
5059	5021	int security_ib_alloc_security(void **sec)
5060	5022	{
5061		− return call_int_hook(ib_alloc_security, 0, sec);
	5023	+ return call_int_hook(ib_alloc_security, sec);
5062	5024	}
5063	5025	EXPORT_SYMBOL(security_ib_alloc_security);
5064	5026
@@ -5091,7 +5053,7 @@ int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, · 26 unmodified lines
5091	5053	struct xfrm_user_sec_ctx *sec_ctx,
5092	5054	gfp_t gfp)
5093	5055	{
5094		− return call_int_hook(xfrm_policy_alloc_security, 0, ctxp, sec_ctx, gfp);
	5056	+ return call_int_hook(xfrm_policy_alloc_security, ctxp, sec_ctx, gfp);
5095	5057	}
5096	5058	EXPORT_SYMBOL(security_xfrm_policy_alloc);
5097	5059
@@ -5108,7 +5070,7 @@ EXPORT_SYMBOL(security_xfrm_policy_alloc); · 10 unmodified lines
5108	5070	int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
5109	5071	struct xfrm_sec_ctx **new_ctxp)
5110	5072	{
5111		− return call_int_hook(xfrm_policy_clone_security, 0, old_ctx, new_ctxp);
	5073	+ return call_int_hook(xfrm_policy_clone_security, old_ctx, new_ctxp);
5112	5074	}
5113	5075
5114	5076	/**
@@ -5133,7 +5095,7 @@ EXPORT_SYMBOL(security_xfrm_policy_free); · 18 unmodified lines
5133	5095	*/
5134	5096	int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
5135	5097	{
5136		− return call_int_hook(xfrm_policy_delete_security, 0, ctx);
	5098	+ return call_int_hook(xfrm_policy_delete_security, ctx);
5137	5099	}
5138	5100
5139	5101	/**
@@ -5150,7 +5112,7 @@ int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx) · 10 unmodified lines
5150	5112	int security_xfrm_state_alloc(struct xfrm_state *x,
5151	5113	struct xfrm_user_sec_ctx *sec_ctx)
5152	5114	{
5153		− return call_int_hook(xfrm_state_alloc, 0, x, sec_ctx);
	5115	+ return call_int_hook(xfrm_state_alloc, x, sec_ctx);
5154	5116	}
5155	5117	EXPORT_SYMBOL(security_xfrm_state_alloc);
5156	5118
@@ -5169,7 +5131,7 @@ EXPORT_SYMBOL(security_xfrm_state_alloc); · 12 unmodified lines
5169	5131	int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
5170	5132	struct xfrm_sec_ctx *polsec, u32 secid)
5171	5133	{
5172		− return call_int_hook(xfrm_state_alloc_acquire, 0, x, polsec, secid);
	5134	+ return call_int_hook(xfrm_state_alloc_acquire, x, polsec, secid);
5173	5135	}
5174	5136
5175	5137	/**
@@ -5182,7 +5144,7 @@ int security_xfrm_state_alloc_acquire(struct xfrm_state *x, · 6 unmodified lines
5182	5144	*/
5183	5145	int security_xfrm_state_delete(struct xfrm_state *x)
5184	5146	{
5185		− return call_int_hook(xfrm_state_delete_security, 0, x);
	5147	+ return call_int_hook(xfrm_state_delete_security, x);
5186	5148	}
5187	5149	EXPORT_SYMBOL(security_xfrm_state_delete);
5188	5150
@@ -5211,7 +5173,7 @@ void security_xfrm_state_free(struct xfrm_state *x) · 22 unmodified lines
5211	5173	*/
5212	5174	int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid)
5213	5175	{
5214		− return call_int_hook(xfrm_policy_lookup, 0, ctx, fl_secid);
	5176	+ return call_int_hook(xfrm_policy_lookup, ctx, fl_secid);
5215	5177	}
5216	5178
5217	5179	/**
@@ -5259,12 +5221,12 @@ int security_xfrm_state_pol_flow_match(struct xfrm_state *x, · 41 unmodified lines
5259	5221	*/
5260	5222	int security_xfrm_decode_session(struct sk_buff skb, u32 secid)
5261	5223	{
5262		− return call_int_hook(xfrm_decode_session, 0, skb, secid, 1);
	5224	+ return call_int_hook(xfrm_decode_session, skb, secid, 1);
5263	5225	}
5264	5226
5265	5227	void security_skb_classify_flow(struct sk_buff skb, struct flowi_common flic)
5266	5228	{
5267		− int rc = call_int_hook(xfrm_decode_session, 0, skb, &flic->flowic_secid,
	5229	+ int rc = call_int_hook(xfrm_decode_session, skb, &flic->flowic_secid,
5268	5230	0);
5269	5231
5270	5232	BUG_ON(rc);
@@ -5287,7 +5249,7 @@ EXPORT_SYMBOL(security_skb_classify_flow); · 16 unmodified lines
5287	5249	int security_key_alloc(struct key key, const struct cred cred,
5288	5250	unsigned long flags)
5289	5251	{
5290		− return call_int_hook(key_alloc, 0, key, cred, flags);
	5252	+ return call_int_hook(key_alloc, key, cred, flags);
5291	5253	}
5292	5254
5293	5255	/**
@@ -5314,7 +5276,7 @@ void security_key_free(struct key *key) · 20 unmodified lines
5314	5276	int security_key_permission(key_ref_t key_ref, const struct cred *cred,
5315	5277	enum key_need_perm need_perm)
5316	5278	{
5317		− return call_int_hook(key_permission, 0, key_ref, cred, need_perm);
	5279	+ return call_int_hook(key_permission, key_ref, cred, need_perm);
5318	5280	}
5319	5281
5320	5282	/**
@@ -5333,7 +5295,26 @@ int security_key_permission(key_ref_t key_ref, const struct cred *cred, · 12 unmodified lines
5333	5295	int security_key_getsecurity(struct key key, char *buffer)
5334	5296	{
5335	5297	*buffer = NULL;
5336		− return call_int_hook(key_getsecurity, 0, key, buffer);
	5298	+ return call_int_hook(key_getsecurity, key, buffer);
	5299	+}
	5300	+
	5301	+/**
	5302	+ * security_key_post_create_or_update() - Notification of key create or update
	5303	+ * @keyring: keyring to which the key is linked to
	5304	+ * @key: created or updated key
	5305	+ * @payload: data used to instantiate or update the key
	5306	+ * @payload_len: length of payload
	5307	+ * @flags: key flags
	5308	+ * @create: flag indicating whether the key was created or updated
	5309	+ *
	5310	+ * Notify the caller of a key creation or update.
	5311	+ */
	5312	+void security_key_post_create_or_update(struct key keyring, struct key key,
	5313	+ const void *payload, size_t payload_len,
	5314	+ unsigned long flags, bool create)
	5315	+{
	5316	+ call_void_hook(key_post_create_or_update, keyring, key, payload,
	5317	+ payload_len, flags, create);
5337	5318	}
5338	5319	#endif /* CONFIG_KEYS */
5339	5320
@@ -5352,7 +5333,7 @@ int security_key_getsecurity(struct key key, char *buffer) · 12 unmodified lines
5352	5333	*/
5353	5334	int security_audit_rule_init(u32 field, u32 op, char rulestr, void *lsmrule)
5354	5335	{
5355		− return call_int_hook(audit_rule_init, 0, field, op, rulestr, lsmrule);
	5336	+ return call_int_hook(audit_rule_init, field, op, rulestr, lsmrule);
5356	5337	}
5357	5338
5358	5339	/**
@@ -5366,7 +5347,7 @@ int security_audit_rule_init(u32 field, u32 op, char rulestr, void *lsmrule) · 7 unmodified lines
5366	5347	*/
5367	5348	int security_audit_rule_known(struct audit_krule *krule)
5368	5349	{
5369		− return call_int_hook(audit_rule_known, 0, krule);
	5350	+ return call_int_hook(audit_rule_known, krule);
5370	5351	}
5371	5352
5372	5353	/**
@@ -5396,7 +5377,7 @@ void security_audit_rule_free(void *lsmrule) · 23 unmodified lines
5396	5377	*/
5397	5378	int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule)
5398	5379	{
5399		− return call_int_hook(audit_rule_match, 0, secid, field, op, lsmrule);
	5380	+ return call_int_hook(audit_rule_match, secid, field, op, lsmrule);
5400	5381	}
5401	5382	#endif /* CONFIG_AUDIT */
5402	5383
@@ -5415,7 +5396,7 @@ int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule) · 12 unmodified lines
5415	5396	*/
5416	5397	int security_bpf(int cmd, union bpf_attr *attr, unsigned int size)
5417	5398	{
5418		− return call_int_hook(bpf, 0, cmd, attr, size);
	5399	+ return call_int_hook(bpf, cmd, attr, size);
5419	5400	}
5420	5401
5421	5402	/**
@@ -5430,7 +5411,7 @@ int security_bpf(int cmd, union bpf_attr *attr, unsigned int size) · 8 unmodified lines
5430	5411	*/
5431	5412	int security_bpf_map(struct bpf_map *map, fmode_t fmode)
5432	5413	{
5433		− return call_int_hook(bpf_map, 0, map, fmode);
	5414	+ return call_int_hook(bpf_map, map, fmode);
5434	5415	}
5435	5416
5436	5417	/**
@@ -5444,7 +5425,7 @@ int security_bpf_map(struct bpf_map *map, fmode_t fmode) · 7 unmodified lines
5444	5425	*/
5445	5426	int security_bpf_prog(struct bpf_prog *prog)
5446	5427	{
5447		− return call_int_hook(bpf_prog, 0, prog);
	5428	+ return call_int_hook(bpf_prog, prog);
5448	5429	}
5449	5430
5450	5431	/**
@@ -5461,7 +5442,7 @@ int security_bpf_prog(struct bpf_prog *prog) · 10 unmodified lines
5461	5442	int security_bpf_map_create(struct bpf_map map, union bpf_attr attr,
5462	5443	struct bpf_token *token)
5463	5444	{
5464		− return call_int_hook(bpf_map_create, 0, map, attr, token);
	5445	+ return call_int_hook(bpf_map_create, map, attr, token);
5465	5446	}
5466	5447
5467	5448	/**
@@ -5479,7 +5460,7 @@ int security_bpf_map_create(struct bpf_map map, union bpf_attr attr, · 11 unmodified lines
5479	5460	int security_bpf_prog_load(struct bpf_prog prog, union bpf_attr attr,
5480	5461	struct bpf_token *token)
5481	5462	{
5482		− return call_int_hook(bpf_prog_load, 0, prog, attr, token);
	5463	+ return call_int_hook(bpf_prog_load, prog, attr, token);
5483	5464	}
5484	5465
5485	5466	/**
@@ -5496,7 +5477,7 @@ int security_bpf_prog_load(struct bpf_prog prog, union bpf_attr attr, · 10 unmodified lines
5496	5477	int security_bpf_token_create(struct bpf_token token, union bpf_attr attr,
5497	5478	struct path *path)
5498	5479	{
5499		− return call_int_hook(bpf_token_create, 0, token, attr, path);
	5480	+ return call_int_hook(bpf_token_create, token, attr, path);
5500	5481	}
5501	5482
5502	5483	/**
@@ -5512,7 +5493,7 @@ int security_bpf_token_create(struct bpf_token token, union bpf_attr attr, · 9 unmodified lines
5512	5493	*/
5513	5494	int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cmd)
5514	5495	{
5515		− return call_int_hook(bpf_token_cmd, 0, token, cmd);
	5496	+ return call_int_hook(bpf_token_cmd, token, cmd);
5516	5497	}
5517	5498
5518	5499	/**
@@ -5528,7 +5509,7 @@ int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cmd) · 9 unmodified lines
5528	5509	*/
5529	5510	int security_bpf_token_capable(const struct bpf_token *token, int cap)
5530	5511	{
5531		− return call_int_hook(bpf_token_capable, 0, token, cap);
	5512	+ return call_int_hook(bpf_token_capable, token, cap);
5532	5513	}
5533	5514
5534	5515	/**
@@ -5576,7 +5557,7 @@ void security_bpf_token_free(struct bpf_token *token) · 41 unmodified lines
5576	5557	*/
5577	5558	int security_locked_down(enum lockdown_reason what)
5578	5559	{
5579		− return call_int_hook(locked_down, 0, what);
	5560	+ return call_int_hook(locked_down, what);
5580	5561	}
5581	5562	EXPORT_SYMBOL(security_locked_down);
5582	5563
@@ -5592,7 +5573,7 @@ EXPORT_SYMBOL(security_locked_down); · 9 unmodified lines
5592	5573	*/
5593	5574	int security_perf_event_open(struct perf_event_attr *attr, int type)
5594	5575	{
5595		− return call_int_hook(perf_event_open, 0, attr, type);
	5576	+ return call_int_hook(perf_event_open, attr, type);
5596	5577	}
5597	5578
5598	5579	/**
@@ -5605,7 +5586,7 @@ int security_perf_event_open(struct perf_event_attr *attr, int type) · 6 unmodified lines
5605	5586	*/
5606	5587	int security_perf_event_alloc(struct perf_event *event)
5607	5588	{
5608		− return call_int_hook(perf_event_alloc, 0, event);
	5589	+ return call_int_hook(perf_event_alloc, event);
5609	5590	}
5610	5591
5611	5592	/**
@@ -5629,7 +5610,7 @@ void security_perf_event_free(struct perf_event *event) · 17 unmodified lines
5629	5610	*/
5630	5611	int security_perf_event_read(struct perf_event *event)
5631	5612	{
5632		− return call_int_hook(perf_event_read, 0, event);
	5613	+ return call_int_hook(perf_event_read, event);
5633	5614	}
5634	5615
5635	5616	/**
@@ -5642,7 +5623,7 @@ int security_perf_event_read(struct perf_event *event) · 6 unmodified lines
5642	5623	*/
5643	5624	int security_perf_event_write(struct perf_event *event)
5644	5625	{
5645		− return call_int_hook(perf_event_write, 0, event);
	5626	+ return call_int_hook(perf_event_write, event);
5646	5627	}
5647	5628	#endif /* CONFIG_PERF_EVENTS */
5648	5629
@@ -5658,7 +5639,7 @@ int security_perf_event_write(struct perf_event *event) · 9 unmodified lines
5658	5639	*/
5659	5640	int security_uring_override_creds(const struct cred *new)
5660	5641	{
5661		− return call_int_hook(uring_override_creds, 0, new);
	5642	+ return call_int_hook(uring_override_creds, new);
5662	5643	}
5663	5644
5664	5645	/**
@@ -5671,7 +5652,7 @@ int security_uring_override_creds(const struct cred *new) · 6 unmodified lines
5671	5652	*/
5672	5653	int security_uring_sqpoll(void)
5673	5654	{
5674		− return call_int_hook(uring_sqpoll, 0);
	5655	+ return call_int_hook(uring_sqpoll);
5675	5656	}
5676	5657
5677	5658	/**
@@ -5684,6 +5665,6 @@ int security_uring_sqpoll(void) · 6 unmodified lines
5684	5665	*/
5685	5666	int security_uring_cmd(struct io_uring_cmd *ioucmd)
5686	5667	{
5687		− return call_int_hook(uring_cmd, 0, ioucmd);
	5668	+ return call_int_hook(uring_cmd, ioucmd);
5688	5669	}
5689	5670	#endif /* CONFIG_IO_URING */

security/selinux/hooks.c+2−1

@@ -3135,7 +3135,8 @@ static int selinux_inode_permission(struct inode *inode, int mask) · 3134 unmodified lines
3135	3135	return rc;
3136	3136	}
3137	3137
3138		−static int selinux_inode_setattr(struct dentry dentry, struct iattr iattr)
	3138	+static int selinux_inode_setattr(struct mnt_idmap idmap, struct dentry dentry,
	3139	+ struct iattr *iattr)
3139	3140	{
3140	3141	const struct cred *cred = current_cred();
3141	3142	struct inode *inode = d_backing_inode(dentry);

security/smack/smack_lsm.c+3−1

@@ -1238,12 +1238,14 @@ static int smack_inode_permission(struct inode *inode, int mask) · 1237 unmodified lines
1238	1238
1239	1239	/**
1240	1240	* smack_inode_setattr - Smack check for setting attributes
	1241	+ * @idmap: idmap of the mount
1241	1242	* @dentry: the object
1242	1243	* @iattr: for the force flag
1243	1244	*
1244	1245	* Returns 0 if access is permitted, an error code otherwise
1245	1246	*/
1246		−static int smack_inode_setattr(struct dentry dentry, struct iattr iattr)
	1247	+static int smack_inode_setattr(struct mnt_idmap idmap, struct dentry dentry,
	1248	+ struct iattr *iattr)
1247	1249	{
1248	1250	struct smk_audit_info ad;
1249	1251	int rc;

tools/testing/selftests/lsm/lsm_list_modules_test.c+6−0

@@ -122,6 +122,12 @@ TEST(correct_lsm_list_modules) · 121 unmodified lines
122	122	case LSM_ID_LANDLOCK:
123	123	name = "landlock";
124	124	break;
	125	+ case LSM_ID_IMA:
	126	+ name = "ima";
	127	+ break;
	128	+ case LSM_ID_EVM:
	129	+ name = "evm";
	130	+ break;
125	131	default:
126	132	name = "INVALID";
127	133	break;