Merge tag 'lsm-pr-20240312' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm

Pull lsm updates from Paul Moore: - Promote IMA/EVM to a proper LSM This is the bulk of the diffstat, and the source of all the changes in the VFS code. Prior to the start of the LSM stacking work it was important that IMA/EVM were separate from the rest of the LSMs, complete with their own hooks, infrastructure, etc. as it was the only way to enable IMA/EVM at the same time as a LSM. However, now that the bulk of the LSM infrastructure supports multiple simultaneous LSMs, we can simplify things greatly by bringing IMA/EVM into the LSM infrastructure as proper LSMs. This is something I've wanted to see happen for quite some time and Roberto was kind enough to put in the work to make it happen. - Use the LSM hook default values to simplify the call_int_hook() macro Previously the call_int_hook() macro required callers to supply a default return value, despite a default value being specified when the LSM hook was defined. This simplifies the macro by using the defined default return value which makes life easier for callers and should also reduce the number of return value bugs in the future (we've had a few pop up recently, hence this work). - Use the KMEM_CACHE() macro instead of kmem_cache_create() The guidance appears to be to use the KMEM_CACHE() macro when possible and there is no reason why we can't use the macro, so let's use it. - Fix a number of comment typos in the LSM hook comment blocks Not much to say here, we fixed some questionable grammar decisions in the LSM hook comment blocks. * tag 'lsm-pr-20240312' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: (28 commits) cred: Use KMEM_CACHE() instead of kmem_cache_create() lsm: use default hook return value in call_int_hook() lsm: fix typos in security/security.c comment headers integrity: Remove LSM ima: Make it independent from 'integrity' LSM evm: Make it independent from 'integrity' LSM evm: Move to LSM infrastructure ima: Move IMA-Appraisal to LSM infrastructure ima: Move to LSM infrastructure integrity: Move integrity_kernel_module_request() to IMA security: Introduce key_post_create_or_update hook security: Introduce inode_post_remove_acl hook security: Introduce inode_post_set_acl hook security: Introduce inode_post_create_tmpfile hook security: Introduce path_post_mknod hook security: Introduce file_release hook security: Introduce file_post_open hook security: Introduce inode_post_removexattr hook security: Introduce inode_post_setattr hook security: Align inode_setattr hook definition with EVM ...

Linus Torvalds committed 2 years ago

Commit cc4a8752 parents ca661c5 edc667036 files · +1126 −1141Browse files

Unified · Split

36 files

fs/attr.c +1 −4
fs/file_table.c +1 −2
fs/namei.c +7 −5
fs/nfsd/vfs.c +1 −2
fs/open.c +0 −1
fs/posix_acl.c +2 −3
fs/xattr.c +4 −5
include/linux/evm.h +2 −115
include/linux/ima.h +0 −142
include/linux/integrity.h +0 −27
include/linux/lsm_hook_defs.h +19 −1
include/linux/security.h +59 −0
include/uapi/linux/lsm.h +2 −0
kernel/cred.c +2 −2
security/integrity/Makefile +1 −0
security/integrity/digsig_asymmetric.c +0 −23
security/integrity/evm/Kconfig +1 −0
security/integrity/evm/evm.h +19 −0
security/integrity/evm/evm_crypto.c +2 −2
security/integrity/evm/evm_main.c +161 −34
security/integrity/iint.c +2 −195
security/integrity/ima/Kconfig +1 −0
security/integrity/ima/Makefile +1 −1
security/integrity/ima/ima.h +129 −19
security/integrity/ima/ima_api.c +12 −11
security/integrity/ima/ima_appraise.c +43 −23
security/integrity/ima/ima_iint.c +142 −0
security/integrity/ima/ima_init.c +1 −1
security/integrity/ima/ima_main.c +113 −35
security/integrity/ima/ima_policy.c +1 −1
security/integrity/integrity.h +1 −79
security/keys/key.c +4 −6
security/security.c +381 −400
security/selinux/hooks.c +2 −1
security/smack/smack_lsm.c +3 −1
tools/testing/selftests/lsm/lsm_list_modules_test.c +6 −0

fs/attr.c+1−4

 #include <linux/fcntl.h>
 #include <linux/filelock.h>
 #include <linux/security.h>
-#include <linux/evm.h>
-#include <linux/ima.h>
 #include "internal.h"
 	if (!error) {
 		fsnotify_change(dentry, ia_valid);
-		ima_inode_post_setattr(idmap, dentry);
+		security_inode_post_setattr(idmap, dentry, ia_valid);
-		evm_inode_post_setattr(dentry, ia_valid);
 	}
 	return error;

fs/file_table.c+1−2

 #include <linux/percpu_counter.h>
 #include <linux/percpu.h>
 #include <linux/task_work.h>
-#include <linux/ima.h>
 #include <linux/swap.h>
 #include <linux/kmemleak.h>
 	eventpoll_release(file);
 	locks_remove_file(file);
-	ima_file_free(file);
+	security_file_release(file);
 	if (unlikely(file->f_flags & FASYNC)) {
 		if (file->f_op->fasync)
 			file->f_op->fasync(-1, file, 0);

fs/namei.c+7−5

 #include <linux/fsnotify.h>
 #include <linux/personality.h>
 #include <linux/security.h>
-#include <linux/ima.h>
 #include <linux/syscalls.h>
 #include <linux/mount.h>
 #include <linux/audit.h>
 	if (!error && !(file->f_mode & FMODE_OPENED))
 		error = vfs_open(&nd->path, file);
 	if (!error)
-		error = ima_file_check(file, op->acc_mode);
+		error = security_file_post_open(file, op->acc_mode);
 	if (!error && do_truncate)
 		error = handle_truncate(idmap, file);
 	if (unlikely(error > 0)) {
 		inode->i_state |= I_LINKABLE;
 		spin_unlock(&inode->i_lock);
 	}
-	ima_post_create_tmpfile(idmap, inode);
+	security_inode_post_create_tmpfile(idmap, inode);
 	return 0;
 }
 		case 0: case S_IFREG:
 			error = vfs_create(idmap, path.dentry->d_inode,
 					   dentry, mode, true);
-			if (!error)
-				ima_post_path_mknod(idmap, dentry);
 			break;
 		case S_IFCHR: case S_IFBLK:
 			error = vfs_mknod(idmap, path.dentry->d_inode,
 					  dentry, mode, 0);
 			break;
 	}
+	if (error)
+		goto out2;
+	security_path_post_mknod(idmap, dentry);
 out2:
 	done_path_create(&path, dentry);
 	if (retry_estale(error, lookup_flags)) {

fs/nfsd/vfs.c+1−2

 #include <linux/posix_acl_xattr.h>
 #include <linux/xattr.h>
 #include <linux/jhash.h>
-#include <linux/ima.h>
 #include <linux/pagemap.h>
 #include <linux/slab.h>
 #include <linux/uaccess.h>
 		goto out;
 	}
-	host_err = ima_file_check(file, may_flags);
+	host_err = security_file_post_open(file, may_flags);
 	if (host_err) {
 		fput(file);
 		goto out;

fs/open.c+0−1

@@ -29,7 +29,6 @@ · 28 unmodified lines
29	#include <linux/audit.h>	29	#include <linux/audit.h>
30	#include <linux/falloc.h>	30	#include <linux/falloc.h>
31	#include <linux/fs_struct.h>	31	#include <linux/fs_struct.h>
32	#include <linux/ima.h>
33	#include <linux/dnotify.h>	32	#include <linux/dnotify.h>
34	#include <linux/compat.h>	33	#include <linux/compat.h>
35	#include <linux/mnt_idmapping.h>	34	#include <linux/mnt_idmapping.h>

fs/posix_acl.c+2−3

 #include <linux/mnt_idmapping.h>
 #include <linux/iversion.h>
 #include <linux/security.h>
-#include <linux/evm.h>
 #include <linux/fsnotify.h>
 #include <linux/filelock.h>
 		error = -EIO;
 	if (!error) {
 		fsnotify_xattr(dentry);
-		evm_inode_post_set_acl(dentry, acl_name, kacl);
+		security_inode_post_set_acl(dentry, acl_name, kacl);
 	}
 out_inode_unlock:
 		error = -EIO;
 	if (!error) {
 		fsnotify_xattr(dentry);
-		evm_inode_post_remove_acl(idmap, dentry, acl_name);
+		security_inode_post_remove_acl(idmap, dentry, acl_name);
 	}
 out_inode_unlock:

fs/xattr.c+4−5

 #include <linux/mount.h>
 #include <linux/namei.h>
 #include <linux/security.h>
-#include <linux/evm.h>
 #include <linux/syscalls.h>
 #include <linux/export.h>
 #include <linux/fsnotify.h>
 		goto out;
 	error = __vfs_removexattr(idmap, dentry, name);
+	if (error)
+		return error;
-	if (!error) {
+	fsnotify_xattr(dentry);
-		fsnotify_xattr(dentry);
+	security_inode_post_removexattr(dentry, name);
-		evm_inode_post_removexattr(dentry, name);
-	}
 out:
 	return error;

include/linux/evm.h+2−115

@@ -12,52 +12,12 @@ · 11 unmodified lines
12	#include <linux/integrity.h>	12	#include <linux/integrity.h>
13	#include <linux/xattr.h>	13	#include <linux/xattr.h>
14		14
15	struct integrity_iint_cache;
16
17	#ifdef CONFIG_EVM	15	#ifdef CONFIG_EVM
18	extern int evm_set_key(void *key, size_t keylen);	16	extern int evm_set_key(void *key, size_t keylen);
19	extern enum integrity_status evm_verifyxattr(struct dentry *dentry,	17	extern enum integrity_status evm_verifyxattr(struct dentry *dentry,
20	const char *xattr_name,	18	const char *xattr_name,
21	void *xattr_value,	19	void *xattr_value,
22	size_t xattr_value_len,	20	size_t xattr_value_len);
23	struct integrity_iint_cache *iint);
24	extern int evm_inode_setattr(struct mnt_idmap *idmap,
25	struct dentry dentry, struct iattr attr);
26	extern void evm_inode_post_setattr(struct dentry *dentry, int ia_valid);
27	extern int evm_inode_setxattr(struct mnt_idmap *idmap,
28	struct dentry dentry, const char name,
29	const void *value, size_t size);
30	extern void evm_inode_post_setxattr(struct dentry *dentry,
31	const char *xattr_name,
32	const void *xattr_value,
33	size_t xattr_value_len);
34	extern int evm_inode_copy_up_xattr(const char *name);
35	extern int evm_inode_removexattr(struct mnt_idmap *idmap,
36	struct dentry dentry, const char xattr_name);
37	extern void evm_inode_post_removexattr(struct dentry *dentry,
38	const char *xattr_name);
39	static inline void evm_inode_post_remove_acl(struct mnt_idmap *idmap,
40	struct dentry *dentry,
41	const char *acl_name)
42	{
43	evm_inode_post_removexattr(dentry, acl_name);
44	}
45	extern int evm_inode_set_acl(struct mnt_idmap *idmap,
46	struct dentry dentry, const char acl_name,
47	struct posix_acl *kacl);
48	static inline int evm_inode_remove_acl(struct mnt_idmap *idmap,
49	struct dentry *dentry,
50	const char *acl_name)
51	{
52	return evm_inode_set_acl(idmap, dentry, acl_name, NULL);
53	}
54	static inline void evm_inode_post_set_acl(struct dentry *dentry,
55	const char *acl_name,
56	struct posix_acl *kacl)
57	{
58	return evm_inode_post_setxattr(dentry, acl_name, NULL, 0);
59	}
60
61	int evm_inode_init_security(struct inode inode, struct inode dir,	21	int evm_inode_init_security(struct inode inode, struct inode dir,
62	const struct qstr qstr, struct xattr xattrs,	22	const struct qstr qstr, struct xattr xattrs,
63	int *xattr_count);	23	int *xattr_count);
@@ -85,85 +45,12 @@ static inline int evm_set_key(void *key, size_t keylen) · 21 unmodified lines
85	static inline enum integrity_status evm_verifyxattr(struct dentry *dentry,	45	static inline enum integrity_status evm_verifyxattr(struct dentry *dentry,
86	const char *xattr_name,	46	const char *xattr_name,
87	void *xattr_value,	47	void *xattr_value,
88	size_t xattr_value_len,	48	size_t xattr_value_len)
89	struct integrity_iint_cache *iint)
90	{	49	{
91	return INTEGRITY_UNKNOWN;	50	return INTEGRITY_UNKNOWN;
92	}	51	}
93	#endif	52	#endif
94		53
95	static inline int evm_inode_setattr(struct mnt_idmap *idmap,
96	struct dentry dentry, struct iattr attr)
97	{
98	return 0;
99	}
100
101	static inline void evm_inode_post_setattr(struct dentry *dentry, int ia_valid)
102	{
103	return;
104	}
105
106	static inline int evm_inode_setxattr(struct mnt_idmap *idmap,
107	struct dentry dentry, const char name,
108	const void *value, size_t size)
109	{
110	return 0;
111	}
112
113	static inline void evm_inode_post_setxattr(struct dentry *dentry,
114	const char *xattr_name,
115	const void *xattr_value,
116	size_t xattr_value_len)
117	{
118	return;
119	}
120
121	static inline int evm_inode_copy_up_xattr(const char *name)
122	{
123	return 0;
124	}
125
126	static inline int evm_inode_removexattr(struct mnt_idmap *idmap,
127	struct dentry *dentry,
128	const char *xattr_name)
129	{
130	return 0;
131	}
132
133	static inline void evm_inode_post_removexattr(struct dentry *dentry,
134	const char *xattr_name)
135	{
136	return;
137	}
138
139	static inline void evm_inode_post_remove_acl(struct mnt_idmap *idmap,
140	struct dentry *dentry,
141	const char *acl_name)
142	{
143	return;
144	}
145
146	static inline int evm_inode_set_acl(struct mnt_idmap *idmap,
147	struct dentry dentry, const char acl_name,
148	struct posix_acl *kacl)
149	{
150	return 0;
151	}
152
153	static inline int evm_inode_remove_acl(struct mnt_idmap *idmap,
154	struct dentry *dentry,
155	const char *acl_name)
156	{
157	return 0;
158	}
159
160	static inline void evm_inode_post_set_acl(struct dentry *dentry,
161	const char *acl_name,
162	struct posix_acl *kacl)
163	{
164	return;
165	}
166
167	static inline int evm_inode_init_security(struct inode inode, struct inode dir,	54	static inline int evm_inode_init_security(struct inode inode, struct inode dir,
168	const struct qstr *qstr,	55	const struct qstr *qstr,
169	struct xattr *xattrs,	56	struct xattr *xattrs,

include/linux/ima.h+0−142

@@ -16,23 +16,6 @@ struct linux_binprm; · 15 unmodified lines
16		16
17	#ifdef CONFIG_IMA	17	#ifdef CONFIG_IMA
18	extern enum hash_algo ima_get_current_hash_algo(void);	18	extern enum hash_algo ima_get_current_hash_algo(void);
19	extern int ima_bprm_check(struct linux_binprm *bprm);
20	extern int ima_file_check(struct file *file, int mask);
21	extern void ima_post_create_tmpfile(struct mnt_idmap *idmap,
22	struct inode *inode);
23	extern void ima_file_free(struct file *file);
24	extern int ima_file_mmap(struct file *file, unsigned long reqprot,
25	unsigned long prot, unsigned long flags);
26	extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot);
27	extern int ima_load_data(enum kernel_load_data_id id, bool contents);
28	extern int ima_post_load_data(char *buf, loff_t size,
29	enum kernel_load_data_id id, char *description);
30	extern int ima_read_file(struct file *file, enum kernel_read_file_id id,
31	bool contents);
32	extern int ima_post_read_file(struct file file, void buf, loff_t size,
33	enum kernel_read_file_id id);
34	extern void ima_post_path_mknod(struct mnt_idmap *idmap,
35	struct dentry *dentry);
36	extern int ima_file_hash(struct file file, char buf, size_t buf_size);	19	extern int ima_file_hash(struct file file, char buf, size_t buf_size);
37	extern int ima_inode_hash(struct inode inode, char buf, size_t buf_size);	20	extern int ima_inode_hash(struct inode inode, char buf, size_t buf_size);
38	extern void ima_kexec_cmdline(int kernel_fd, const void *buf, int size);	21	extern void ima_kexec_cmdline(int kernel_fd, const void *buf, int size);
@@ -57,68 +40,6 @@ static inline enum hash_algo ima_get_current_hash_algo(void) · 18 unmodified lines
57	return HASH_ALGO__LAST;	40	return HASH_ALGO__LAST;
58	}	41	}
59		42
60	static inline int ima_bprm_check(struct linux_binprm *bprm)
61	{
62	return 0;
63	}
64
65	static inline int ima_file_check(struct file *file, int mask)
66	{
67	return 0;
68	}
69
70	static inline void ima_post_create_tmpfile(struct mnt_idmap *idmap,
71	struct inode *inode)
72	{
73	}
74
75	static inline void ima_file_free(struct file *file)
76	{
77	return;
78	}
79
80	static inline int ima_file_mmap(struct file *file, unsigned long reqprot,
81	unsigned long prot, unsigned long flags)
82	{
83	return 0;
84	}
85
86	static inline int ima_file_mprotect(struct vm_area_struct *vma,
87	unsigned long prot)
88	{
89	return 0;
90	}
91
92	static inline int ima_load_data(enum kernel_load_data_id id, bool contents)
93	{
94	return 0;
95	}
96
97	static inline int ima_post_load_data(char *buf, loff_t size,
98	enum kernel_load_data_id id,
99	char *description)
100	{
101	return 0;
102	}
103
104	static inline int ima_read_file(struct file *file, enum kernel_read_file_id id,
105	bool contents)
106	{
107	return 0;
108	}
109
110	static inline int ima_post_read_file(struct file file, void buf, loff_t size,
111	enum kernel_read_file_id id)
112	{
113	return 0;
114	}
115
116	static inline void ima_post_path_mknod(struct mnt_idmap *idmap,
117	struct dentry *dentry)
118	{
119	return;
120	}
121
122	static inline int ima_file_hash(struct file file, char buf, size_t buf_size)	43	static inline int ima_file_hash(struct file file, char buf, size_t buf_size)
123	{	44	{
124	return -EOPNOTSUPP;	45	return -EOPNOTSUPP;
@@ -169,76 +90,13 @@ static inline void ima_add_kexec_buffer(struct kimage *image) · 44 unmodified lines
169	{}	90	{}
170	#endif	91	#endif
171		92
172	#ifdef CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS
173	extern void ima_post_key_create_or_update(struct key *keyring,
174	struct key *key,
175	const void *payload, size_t plen,
176	unsigned long flags, bool create);
177	#else
178	static inline void ima_post_key_create_or_update(struct key *keyring,
179	struct key *key,
180	const void *payload,
181	size_t plen,
182	unsigned long flags,
183	bool create) {}
184	#endif /* CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS */
185
186	#ifdef CONFIG_IMA_APPRAISE	93	#ifdef CONFIG_IMA_APPRAISE
187	extern bool is_ima_appraise_enabled(void);	94	extern bool is_ima_appraise_enabled(void);
188	extern void ima_inode_post_setattr(struct mnt_idmap *idmap,
189	struct dentry *dentry);
190	extern int ima_inode_setxattr(struct dentry dentry, const char xattr_name,
191	const void *xattr_value, size_t xattr_value_len);
192	extern int ima_inode_set_acl(struct mnt_idmap *idmap,
193	struct dentry dentry, const char acl_name,
194	struct posix_acl *kacl);
195	static inline int ima_inode_remove_acl(struct mnt_idmap *idmap,
196	struct dentry *dentry,
197	const char *acl_name)
198	{
199	return ima_inode_set_acl(idmap, dentry, acl_name, NULL);
200	}
201	extern int ima_inode_removexattr(struct dentry dentry, const char xattr_name);
202	#else	95	#else
203	static inline bool is_ima_appraise_enabled(void)	96	static inline bool is_ima_appraise_enabled(void)
204	{	97	{
205	return 0;	98	return 0;
206	}	99	}
207
208	static inline void ima_inode_post_setattr(struct mnt_idmap *idmap,
209	struct dentry *dentry)
210	{
211	return;
212	}
213
214	static inline int ima_inode_setxattr(struct dentry *dentry,
215	const char *xattr_name,
216	const void *xattr_value,
217	size_t xattr_value_len)
218	{
219	return 0;
220	}
221
222	static inline int ima_inode_set_acl(struct mnt_idmap *idmap,
223	struct dentry dentry, const char acl_name,
224	struct posix_acl *kacl)
225	{
226
227	return 0;
228	}
229
230	static inline int ima_inode_removexattr(struct dentry *dentry,
231	const char *xattr_name)
232	{
233	return 0;
234	}
235
236	static inline int ima_inode_remove_acl(struct mnt_idmap *idmap,
237	struct dentry *dentry,
238	const char *acl_name)
239	{
240	return 0;
241	}
242	#endif /* CONFIG_IMA_APPRAISE */	100	#endif /* CONFIG_IMA_APPRAISE */
243		101
244	#if defined(CONFIG_IMA_APPRAISE) && defined(CONFIG_INTEGRITY_TRUSTED_KEYRING)	102	#if defined(CONFIG_IMA_APPRAISE) && defined(CONFIG_INTEGRITY_TRUSTED_KEYRING)

include/linux/integrity.h+0−27

@@ -19,40 +19,13 @@ enum integrity_status { · 18 unmodified lines
19	INTEGRITY_UNKNOWN,	19	INTEGRITY_UNKNOWN,
20	};	20	};
21		21
22	/* List of EVM protected security xattrs */
23	#ifdef CONFIG_INTEGRITY	22	#ifdef CONFIG_INTEGRITY
24	extern struct integrity_iint_cache integrity_inode_get(struct inode inode);
25	extern void integrity_inode_free(struct inode *inode);
26	extern void __init integrity_load_keys(void);	23	extern void __init integrity_load_keys(void);
27		24
28	#else	25	#else
29	static inline struct integrity_iint_cache *
30	integrity_inode_get(struct inode *inode)
31	{
32	return NULL;
33	}
34
35	static inline void integrity_inode_free(struct inode *inode)
36	{
37	return;
38	}
39
40	static inline void integrity_load_keys(void)	26	static inline void integrity_load_keys(void)
41	{	27	{
42	}	28	}
43	#endif /* CONFIG_INTEGRITY */	29	#endif /* CONFIG_INTEGRITY */
44		30
45	#ifdef CONFIG_INTEGRITY_ASYMMETRIC_KEYS
46
47	extern int integrity_kernel_module_request(char *kmod_name);
48
49	#else
50
51	static inline int integrity_kernel_module_request(char *kmod_name)
52	{
53	return 0;
54	}
55
56	#endif /* CONFIG_INTEGRITY_ASYMMETRIC_KEYS */
57
58	#endif /* _LINUX_INTEGRITY_H */	31	#endif /* _LINUX_INTEGRITY_H */

include/linux/lsm_hook_defs.h+19−1

 LSM_HOOK(int, 0, path_rmdir, const struct path *dir, struct dentry *dentry)
 LSM_HOOK(int, 0, path_mknod, const struct path *dir, struct dentry *dentry,
 	 umode_t mode, unsigned int dev)
+LSM_HOOK(void, LSM_RET_VOID, path_post_mknod, struct mnt_idmap *idmap,
+	 struct dentry *dentry)
 LSM_HOOK(int, 0, path_truncate, const struct path *path)
 LSM_HOOK(int, 0, path_symlink, const struct path *dir, struct dentry *dentry,
 	 const char *old_name)
 	 const struct qstr *name, const struct inode *context_inode)
 LSM_HOOK(int, 0, inode_create, struct inode *dir, struct dentry *dentry,
 	 umode_t mode)
+LSM_HOOK(void, LSM_RET_VOID, inode_post_create_tmpfile, struct mnt_idmap *idmap,
+	 struct inode *inode)
 LSM_HOOK(int, 0, inode_link, struct dentry *old_dentry, struct inode *dir,
 	 struct dentry *new_dentry)
 LSM_HOOK(int, 0, inode_unlink, struct inode *dir, struct dentry *dentry)
 LSM_HOOK(int, 0, inode_follow_link, struct dentry *dentry, struct inode *inode,
 	 bool rcu)
 LSM_HOOK(int, 0, inode_permission, struct inode *inode, int mask)
-LSM_HOOK(int, 0, inode_setattr, struct dentry *dentry, struct iattr *attr)
+LSM_HOOK(int, 0, inode_setattr, struct mnt_idmap *idmap, struct dentry *dentry,
+	 struct iattr *attr)
+LSM_HOOK(void, LSM_RET_VOID, inode_post_setattr, struct mnt_idmap *idmap,
+	 struct dentry *dentry, int ia_valid)
 LSM_HOOK(int, 0, inode_getattr, const struct path *path)
 LSM_HOOK(int, 0, inode_setxattr, struct mnt_idmap *idmap,
 	 struct dentry *dentry, const char *name, const void *value,
 LSM_HOOK(int, 0, inode_listxattr, struct dentry *dentry)
 LSM_HOOK(int, 0, inode_removexattr, struct mnt_idmap *idmap,
 	 struct dentry *dentry, const char *name)
+LSM_HOOK(void, LSM_RET_VOID, inode_post_removexattr, struct dentry *dentry,
+	 const char *name)
 LSM_HOOK(int, 0, inode_set_acl, struct mnt_idmap *idmap,
 	 struct dentry *dentry, const char *acl_name, struct posix_acl *kacl)
+LSM_HOOK(void, LSM_RET_VOID, inode_post_set_acl, struct dentry *dentry,
+	 const char *acl_name, struct posix_acl *kacl)
 LSM_HOOK(int, 0, inode_get_acl, struct mnt_idmap *idmap,
 	 struct dentry *dentry, const char *acl_name)
 LSM_HOOK(int, 0, inode_remove_acl, struct mnt_idmap *idmap,
 	 struct dentry *dentry, const char *acl_name)
+LSM_HOOK(void, LSM_RET_VOID, inode_post_remove_acl, struct mnt_idmap *idmap,
+	 struct dentry *dentry, const char *acl_name)
 LSM_HOOK(int, 0, inode_need_killpriv, struct dentry *dentry)
 LSM_HOOK(int, 0, inode_killpriv, struct mnt_idmap *idmap,
 	 struct dentry *dentry)
 	 struct kernfs_node *kn)
 LSM_HOOK(int, 0, file_permission, struct file *file, int mask)
 LSM_HOOK(int, 0, file_alloc_security, struct file *file)
+LSM_HOOK(void, LSM_RET_VOID, file_release, struct file *file)
 LSM_HOOK(void, LSM_RET_VOID, file_free_security, struct file *file)
 LSM_HOOK(int, 0, file_ioctl, struct file *file, unsigned int cmd,
 	 unsigned long arg)
 	 struct fown_struct *fown, int sig)
 LSM_HOOK(int, 0, file_receive, struct file *file)
 LSM_HOOK(int, 0, file_open, struct file *file)
+LSM_HOOK(int, 0, file_post_open, struct file *file, int mask)
 LSM_HOOK(int, 0, file_truncate, struct file *file)
 LSM_HOOK(int, 0, task_alloc, struct task_struct *task,
 	 unsigned long clone_flags)
 LSM_HOOK(int, 0, key_permission, key_ref_t key_ref, const struct cred *cred,
 	 enum key_need_perm need_perm)
 LSM_HOOK(int, 0, key_getsecurity, struct key *key, char **buffer)
+LSM_HOOK(void, LSM_RET_VOID, key_post_create_or_update, struct key *keyring,
+	 struct key *key, const void *payload, size_t payload_len,
+	 unsigned long flags, bool create)
 #endif /* CONFIG_KEYS */
 #ifdef CONFIG_AUDIT

include/linux/security.h+59−0

 				      const struct qstr *name,
 				      const struct inode *context_inode);
 int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode);
+void security_inode_post_create_tmpfile(struct mnt_idmap *idmap,
+					struct inode *inode);
 int security_inode_link(struct dentry *old_dentry, struct inode *dir,
 			 struct dentry *new_dentry);
 int security_inode_unlink(struct inode *dir, struct dentry *dentry);
 int security_inode_permission(struct inode *inode, int mask);
 int security_inode_setattr(struct mnt_idmap *idmap,
 			   struct dentry *dentry, struct iattr *attr);
+void security_inode_post_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
+				 int ia_valid);
 int security_inode_getattr(const struct path *path);
 int security_inode_setxattr(struct mnt_idmap *idmap,
 			    struct dentry *dentry, const char *name,
 int security_inode_set_acl(struct mnt_idmap *idmap,
 			   struct dentry *dentry, const char *acl_name,
 			   struct posix_acl *kacl);
+void security_inode_post_set_acl(struct dentry *dentry, const char *acl_name,
+				 struct posix_acl *kacl);
 int security_inode_get_acl(struct mnt_idmap *idmap,
 			   struct dentry *dentry, const char *acl_name);
 int security_inode_remove_acl(struct mnt_idmap *idmap,
 			      struct dentry *dentry, const char *acl_name);
+void security_inode_post_remove_acl(struct mnt_idmap *idmap,
+				    struct dentry *dentry,
+				    const char *acl_name);
 void security_inode_post_setxattr(struct dentry *dentry, const char *name,
 				  const void *value, size_t size, int flags);
 int security_inode_getxattr(struct dentry *dentry, const char *name);
 int security_inode_listxattr(struct dentry *dentry);
 int security_inode_removexattr(struct mnt_idmap *idmap,
 			       struct dentry *dentry, const char *name);
+void security_inode_post_removexattr(struct dentry *dentry, const char *name);
 int security_inode_need_killpriv(struct dentry *dentry);
 int security_inode_killpriv(struct mnt_idmap *idmap, struct dentry *dentry);
 int security_inode_getsecurity(struct mnt_idmap *idmap,
 				  struct kernfs_node *kn);
 int security_file_permission(struct file *file, int mask);
 int security_file_alloc(struct file *file);
+void security_file_release(struct file *file);
 void security_file_free(struct file *file);
 int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
 int security_file_ioctl_compat(struct file *file, unsigned int cmd,
 				 struct fown_struct *fown, int sig);
 int security_file_receive(struct file *file);
 int security_file_open(struct file *file);
+int security_file_post_open(struct file *file, int mask);
 int security_file_truncate(struct file *file);
 int security_task_alloc(struct task_struct *task, unsigned long clone_flags);
 void security_task_free(struct task_struct *task);
 	return 0;
 }
+static inline void
+security_inode_post_create_tmpfile(struct mnt_idmap *idmap, struct inode *inode)
+{ }
 static inline int security_inode_link(struct dentry *old_dentry,
 				       struct inode *dir,
 				       struct dentry *new_dentry)
 	return 0;
 }
+static inline void
+security_inode_post_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
+			    int ia_valid)
+{ }
 static inline int security_inode_getattr(const struct path *path)
 {
 	return 0;
 	return 0;
 }
+static inline void security_inode_post_set_acl(struct dentry *dentry,
+					       const char *acl_name,
+					       struct posix_acl *kacl)
+{ }
 static inline int security_inode_get_acl(struct mnt_idmap *idmap,
 					 struct dentry *dentry,
 					 const char *acl_name)
 	return 0;
 }
+static inline void security_inode_post_remove_acl(struct mnt_idmap *idmap,
+						  struct dentry *dentry,
+						  const char *acl_name)
+{ }
 static inline void security_inode_post_setxattr(struct dentry *dentry,
 		const char *name, const void *value, size_t size, int flags)
 { }
 	return cap_inode_removexattr(idmap, dentry, name);
 }
+static inline void security_inode_post_removexattr(struct dentry *dentry,
+						   const char *name)
+{ }
 static inline int security_inode_need_killpriv(struct dentry *dentry)
 {
 	return cap_inode_need_killpriv(dentry);
 	return 0;
 }
+static inline void security_file_release(struct file *file)
+{ }
 static inline void security_file_free(struct file *file)
 { }
 	return 0;
 }
+static inline int security_file_post_open(struct file *file, int mask)
+{
+	return 0;
+}
 static inline int security_file_truncate(struct file *file)
 {
 	return 0;
 int security_path_rmdir(const struct path *dir, struct dentry *dentry);
 int security_path_mknod(const struct path *dir, struct dentry *dentry, umode_t mode,
 			unsigned int dev);
+void security_path_post_mknod(struct mnt_idmap *idmap, struct dentry *dentry);
 int security_path_truncate(const struct path *path);
 int security_path_symlink(const struct path *dir, struct dentry *dentry,
 			  const char *old_name);
 	return 0;
 }
+static inline void security_path_post_mknod(struct mnt_idmap *idmap,
+					    struct dentry *dentry)
+{ }
 static inline int security_path_truncate(const struct path *path)
 {
 	return 0;
 int security_key_permission(key_ref_t key_ref, const struct cred *cred,
 			    enum key_need_perm need_perm);
 int security_key_getsecurity(struct key *key, char **_buffer);
+void security_key_post_create_or_update(struct key *keyring, struct key *key,
+					const void *payload, size_t payload_len,
+					unsigned long flags, bool create);
 #else
 	return 0;
 }
+static inline void security_key_post_create_or_update(struct key *keyring,
+						      struct key *key,
+						      const void *payload,
+						      size_t payload_len,
+						      unsigned long flags,
+						      bool create)
+{ }
 #endif
 #endif /* CONFIG_KEYS */

include/uapi/linux/lsm.h+2−0

@@ -62,6 +62,8 @@ struct lsm_ctx { · 61 unmodified lines
62	#define LSM_ID_LOCKDOWN 108	62	#define LSM_ID_LOCKDOWN 108
63	#define LSM_ID_BPF 109	63	#define LSM_ID_BPF 109
64	#define LSM_ID_LANDLOCK 110	64	#define LSM_ID_LANDLOCK 110
		65	#define LSM_ID_IMA 111
		66	#define LSM_ID_EVM 112
65		67
66	/*	68	/*
67	* LSM_ATTR_XXX definitions identify different LSM attributes	69	* LSM_ATTR_XXX definitions identify different LSM attributes

kernel/cred.c+2−2

@@ -606,8 +606,8 @@ int set_cred_ucounts(struct cred *new) · 605 unmodified lines
606	void __init cred_init(void)	606	void __init cred_init(void)
607	{	607	{
608	/* allocate a slab in which we can store credentials */	608	/* allocate a slab in which we can store credentials */
609	cred_jar = kmem_cache_create("cred_jar", sizeof(struct cred), 0,	609	cred_jar = KMEM_CACHE(cred,
610	SLAB_HWCACHE_ALIGN\|SLAB_PANIC\|SLAB_ACCOUNT, NULL);	610	SLAB_HWCACHE_ALIGN \| SLAB_PANIC \| SLAB_ACCOUNT);
611	}	611	}
612		612
613	/**	613	/**

security/integrity/Makefile+1−0

@@ -18,5 +18,6 @@ integrity-$(CONFIG_LOAD_IPL_KEYS) += platform_certs/load_ipl_s390.o · 17 unmodified lines
18	integrity-$(CONFIG_LOAD_PPC_KEYS) += platform_certs/efi_parser.o \	18	integrity-$(CONFIG_LOAD_PPC_KEYS) += platform_certs/efi_parser.o \
19	platform_certs/load_powerpc.o \	19	platform_certs/load_powerpc.o \
20	platform_certs/keyring_handler.o	20	platform_certs/keyring_handler.o
		21	# The relative order of the 'ima' and 'evm' LSMs depends on the order below.
21	obj-$(CONFIG_IMA) += ima/	22	obj-$(CONFIG_IMA) += ima/
22	obj-$(CONFIG_EVM) += evm/	23	obj-$(CONFIG_EVM) += evm/

security/integrity/digsig_asymmetric.c+0−23

@@ -132,26 +132,3 @@ out: · 131 unmodified lines
132	pr_debug("%s() = %d\n", __func__, ret);	132	pr_debug("%s() = %d\n", __func__, ret);
133	return ret;	133	return ret;
134	}	134	}
135
136	/**
137	* integrity_kernel_module_request - prevent crypto-pkcs1pad(rsa,*) requests
138	* @kmod_name: kernel module name
139	*
140	* We have situation, when public_key_verify_signature() in case of RSA
141	* algorithm use alg_name to store internal information in order to
142	* construct an algorithm on the fly, but crypto_larval_lookup() will try
143	* to use alg_name in order to load kernel module with same name.
144	* Since we don't have any real "crypto-pkcs1pad(rsa,*)" kernel modules,
145	* we are safe to fail such module request from crypto_larval_lookup().
146	*
147	* In this way we prevent modprobe execution during digsig verification
148	* and avoid possible deadlock if modprobe and/or it's dependencies
149	* also signed with digsig.
150	*/
151	int integrity_kernel_module_request(char *kmod_name)
152	{
153	if (strncmp(kmod_name, "crypto-pkcs1pad(rsa,", 20) == 0)
154	return -EINVAL;
155
156	return 0;
157	}

security/integrity/evm/Kconfig+1−0

@@ -6,6 +6,7 @@ config EVM · 5 unmodified lines
6	select CRYPTO_HMAC	6	select CRYPTO_HMAC
7	select CRYPTO_SHA1	7	select CRYPTO_SHA1
8	select CRYPTO_HASH_INFO	8	select CRYPTO_HASH_INFO
		9	select SECURITY_PATH
9	default n	10	default n
10	help	11	help
11	EVM protects a file's security extended attributes against	12	EVM protects a file's security extended attributes against

security/integrity/evm/evm.h+19−0

@@ -32,6 +32,25 @@ struct xattr_list { · 31 unmodified lines
32	bool enabled;	32	bool enabled;
33	};	33	};
34		34
		35	#define EVM_NEW_FILE 0x00000001
		36	#define EVM_IMMUTABLE_DIGSIG 0x00000002
		37
		38	/* EVM integrity metadata associated with an inode */
		39	struct evm_iint_cache {
		40	unsigned long flags;
		41	enum integrity_status evm_status:4;
		42	};
		43
		44	extern struct lsm_blob_sizes evm_blob_sizes;
		45
		46	static inline struct evm_iint_cache evm_iint_inode(const struct inode inode)
		47	{
		48	if (unlikely(!inode->i_security))
		49	return NULL;
		50
		51	return inode->i_security + evm_blob_sizes.lbs_inode;
		52	}
		53
35	extern int evm_initialized;	54	extern int evm_initialized;
36		55
37	#define EVM_ATTR_FSUUID 0x0001	56	#define EVM_ATTR_FSUUID 0x0001

security/integrity/evm/evm_crypto.c+2−2

@@ -322,10 +322,10 @@ int evm_calc_hash(struct dentry dentry, const char req_xattr_name, · 321 unmodified lines
322	static int evm_is_immutable(struct dentry dentry, struct inode inode)	322	static int evm_is_immutable(struct dentry dentry, struct inode inode)
323	{	323	{
324	const struct evm_ima_xattr_data *xattr_data = NULL;	324	const struct evm_ima_xattr_data *xattr_data = NULL;
325	struct integrity_iint_cache *iint;	325	struct evm_iint_cache *iint;
326	int rc = 0;	326	int rc = 0;
327		327
328	iint = integrity_iint_find(inode);	328	iint = evm_iint_inode(inode);
329	if (iint && (iint->flags & EVM_IMMUTABLE_DIGSIG))	329	if (iint && (iint->flags & EVM_IMMUTABLE_DIGSIG))
330	return 1;	330	return 1;
331		331

security/integrity/evm/evm_main.c+161−34

 static enum integrity_status evm_verify_hmac(struct dentry *dentry,
 					     const char *xattr_name,
 					     char *xattr_value,
-					     size_t xattr_value_len,
+					     size_t xattr_value_len)
-					     struct integrity_iint_cache *iint)
 {
 	struct evm_ima_xattr_data *xattr_data = NULL;
 	struct signature_v2_hdr *hdr;
 	enum integrity_status evm_status = INTEGRITY_PASS;
 	struct evm_digest digest;
-	struct inode *inode;
+	struct inode *inode = d_backing_inode(dentry);
+	struct evm_iint_cache *iint = evm_iint_inode(inode);
 	int rc, xattr_len, evm_immutable = 0;
 	if (iint && (iint->evm_status == INTEGRITY_PASS ||
 					(const char *)xattr_data, xattr_len,
 					digest.digest, digest.hdr.length);
 		if (!rc) {
-			inode = d_backing_inode(dentry);
 			if (xattr_data->type == EVM_XATTR_PORTABLE_DIGSIG) {
 				if (iint)
 					iint->flags |= EVM_IMMUTABLE_DIGSIG;
  * @xattr_name: requested xattr
  * @xattr_value: requested xattr value
  * @xattr_value_len: requested xattr value length
- * @iint: inode integrity metadata
  *
  * Calculate the HMAC for the given dentry and verify it against the stored
  * security.evm xattr. For performance, use the xattr value and length
  */
 enum integrity_status evm_verifyxattr(struct dentry *dentry,
 				      const char *xattr_name,
-				      void *xattr_value, size_t xattr_value_len,
+				      void *xattr_value, size_t xattr_value_len)
-				      struct integrity_iint_cache *iint)
 {
 	if (!evm_key_loaded() || !evm_protected_xattr(xattr_name))
 		return INTEGRITY_UNKNOWN;
 	if (is_unsupported_fs(dentry))
 		return INTEGRITY_UNKNOWN;
-	if (!iint) {
-		iint = integrity_iint_find(d_backing_inode(dentry));
-		if (!iint)
-			return INTEGRITY_UNKNOWN;
-	}
 	return evm_verify_hmac(dentry, xattr_name, xattr_value,
-				 xattr_value_len, iint);
+				 xattr_value_len);
 }
 EXPORT_SYMBOL_GPL(evm_verifyxattr);
 	if (!evm_key_loaded() || !S_ISREG(inode->i_mode) || evm_fixmode)
 		return INTEGRITY_PASS;
-	return evm_verify_hmac(dentry, NULL, NULL, 0, NULL);
+	return evm_verify_hmac(dentry, NULL, NULL, 0);
 }
 /*
 	evm_status = evm_verify_current_integrity(dentry);
 	if (evm_status == INTEGRITY_NOXATTRS) {
-		struct integrity_iint_cache *iint;
+		struct evm_iint_cache *iint;
 		/* Exception if the HMAC is not going to be calculated. */
 		if (evm_hmac_disabled())
 			return 0;
-		iint = integrity_iint_find(d_backing_inode(dentry));
+		iint = evm_iint_inode(d_backing_inode(dentry));
-		if (iint && (iint->flags & IMA_NEW_FILE))
+		if (iint && (iint->flags & EVM_NEW_FILE))
 			return 0;
 		/* exception for pseudo filesystems */
  * @xattr_name: pointer to the affected extended attribute name
  * @xattr_value: pointer to the new extended attribute value
  * @xattr_value_len: pointer to the new extended attribute value length
+ * @flags: flags to pass into filesystem operations
  *
  * Before allowing the 'security.evm' protected xattr to be updated,
  * verify the existing value is valid.  As only the kernel should have
  * userspace from writing HMAC value.  Writing 'security.evm' requires
  * requires CAP_SYS_ADMIN privileges.
  */
-int evm_inode_setxattr(struct mnt_idmap *idmap, struct dentry *dentry,
+static int evm_inode_setxattr(struct mnt_idmap *idmap, struct dentry *dentry,
-		       const char *xattr_name, const void *xattr_value,
+			      const char *xattr_name, const void *xattr_value,
-		       size_t xattr_value_len)
+			      size_t xattr_value_len, int flags)
 {
 	const struct evm_ima_xattr_data *xattr_data = xattr_value;
  * Removing 'security.evm' requires CAP_SYS_ADMIN privileges and that
  * the current value is valid.
  */
-int evm_inode_removexattr(struct mnt_idmap *idmap,
+static int evm_inode_removexattr(struct mnt_idmap *idmap, struct dentry *dentry,
-			  struct dentry *dentry, const char *xattr_name)
+				 const char *xattr_name)
 {
 	/* Policy permits modification of the protected xattrs even though
 	 * there's no HMAC key loaded
  * Prevent modifying posix acls causing the EVM HMAC to be re-calculated
  * and 'security.evm' xattr updated, unless the existing 'security.evm' is
  * valid.
+ *
+ * Return: zero on success, -EPERM on failure.
  */
-int evm_inode_set_acl(struct mnt_idmap *idmap, struct dentry *dentry,
+static int evm_inode_set_acl(struct mnt_idmap *idmap, struct dentry *dentry,
-		      const char *acl_name, struct posix_acl *kacl)
+			     const char *acl_name, struct posix_acl *kacl)
 {
 	enum integrity_status evm_status;
 	return -EPERM;
 }
+/**
+ * evm_inode_remove_acl - Protect the EVM extended attribute from posix acls
+ * @idmap: idmap of the mount
+ * @dentry: pointer to the affected dentry
+ * @acl_name: name of the posix acl
+ *
+ * Prevent removing posix acls causing the EVM HMAC to be re-calculated
+ * and 'security.evm' xattr updated, unless the existing 'security.evm' is
+ * valid.
+ *
+ * Return: zero on success, -EPERM on failure.
+ */
+static int evm_inode_remove_acl(struct mnt_idmap *idmap, struct dentry *dentry,
+				const char *acl_name)
+{
+	return evm_inode_set_acl(idmap, dentry, acl_name, NULL);
+}
 static void evm_reset_status(struct inode *inode)
 {
-	struct integrity_iint_cache *iint;
+	struct evm_iint_cache *iint;
-	iint = integrity_iint_find(inode);
+	iint = evm_iint_inode(inode);
 	if (iint)
 		iint->evm_status = INTEGRITY_UNKNOWN;
 }
  * @xattr_name: pointer to the affected extended attribute name
  * @xattr_value: pointer to the new extended attribute value
  * @xattr_value_len: pointer to the new extended attribute value length
+ * @flags: flags to pass into filesystem operations
  *
  * Update the HMAC stored in 'security.evm' to reflect the change.
  *
  * __vfs_setxattr_noperm().  The caller of which has taken the inode's
  * i_mutex lock.
  */
-void evm_inode_post_setxattr(struct dentry *dentry, const char *xattr_name,
+static void evm_inode_post_setxattr(struct dentry *dentry,
-			     const void *xattr_value, size_t xattr_value_len)
+				    const char *xattr_name,
+				    const void *xattr_value,
+				    size_t xattr_value_len,
+				    int flags)
 {
 	if (!evm_revalidate_status(xattr_name))
 		return;
 	evm_update_evmxattr(dentry, xattr_name, xattr_value, xattr_value_len);
 }
+/**
+ * evm_inode_post_set_acl - Update the EVM extended attribute from posix acls
+ * @dentry: pointer to the affected dentry
+ * @acl_name: name of the posix acl
+ * @kacl: pointer to the posix acls
+ *
+ * Update the 'security.evm' xattr with the EVM HMAC re-calculated after setting
+ * posix acls.
+ */
+static void evm_inode_post_set_acl(struct dentry *dentry, const char *acl_name,
+				   struct posix_acl *kacl)
+{
+	return evm_inode_post_setxattr(dentry, acl_name, NULL, 0, 0);
+}
 /**
  * evm_inode_post_removexattr - update 'security.evm' after removing the xattr
  * @dentry: pointer to the affected dentry
  * No need to take the i_mutex lock here, as this function is called from
  * vfs_removexattr() which takes the i_mutex.
  */
-void evm_inode_post_removexattr(struct dentry *dentry, const char *xattr_name)
+static void evm_inode_post_removexattr(struct dentry *dentry,
+				       const char *xattr_name)
 {
 	if (!evm_revalidate_status(xattr_name))
 		return;
 	evm_update_evmxattr(dentry, xattr_name, NULL, 0);
 }
+/**
+ * evm_inode_post_remove_acl - Update the EVM extended attribute from posix acls
+ * @idmap: idmap of the mount
+ * @dentry: pointer to the affected dentry
+ * @acl_name: name of the posix acl
+ *
+ * Update the 'security.evm' xattr with the EVM HMAC re-calculated after
+ * removing posix acls.
+ */
+static inline void evm_inode_post_remove_acl(struct mnt_idmap *idmap,
+					     struct dentry *dentry,
+					     const char *acl_name)
+{
+	evm_inode_post_removexattr(dentry, acl_name);
+}
 static int evm_attr_change(struct mnt_idmap *idmap,
 			   struct dentry *dentry, struct iattr *attr)
 {
  * Permit update of file attributes when files have a valid EVM signature,
  * except in the case of them having an immutable portable signature.
  */
-int evm_inode_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
+static int evm_inode_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
-		      struct iattr *attr)
+			     struct iattr *attr)
 {
 	unsigned int ia_valid = attr->ia_valid;
 	enum integrity_status evm_status;
 /**
  * evm_inode_post_setattr - update 'security.evm' after modifying metadata
+ * @idmap: idmap of the idmapped mount
  * @dentry: pointer to the affected dentry
  * @ia_valid: for the UID and GID status
  *
  * This function is called from notify_change(), which expects the caller
  * to lock the inode's i_mutex.
  */
-void evm_inode_post_setattr(struct dentry *dentry, int ia_valid)
+static void evm_inode_post_setattr(struct mnt_idmap *idmap,
+				   struct dentry *dentry, int ia_valid)
 {
 	if (!evm_revalidate_status(NULL))
 		return;
 		evm_update_evmxattr(dentry, NULL, NULL, 0);
 }
-int evm_inode_copy_up_xattr(const char *name)
+static int evm_inode_copy_up_xattr(const char *name)
 {
 	if (strcmp(name, XATTR_NAME_EVM) == 0)
 		return 1; /* Discard */
 }
 EXPORT_SYMBOL_GPL(evm_inode_init_security);
+static int evm_inode_alloc_security(struct inode *inode)
+{
+	struct evm_iint_cache *iint = evm_iint_inode(inode);
+	/* Called by security_inode_alloc(), it cannot be NULL. */
+	iint->flags = 0UL;
+	iint->evm_status = INTEGRITY_UNKNOWN;
+	return 0;
+}
+static void evm_file_release(struct file *file)
+{
+	struct inode *inode = file_inode(file);
+	struct evm_iint_cache *iint = evm_iint_inode(inode);
+	fmode_t mode = file->f_mode;
+	if (!S_ISREG(inode->i_mode) || !(mode & FMODE_WRITE))
+		return;
+	if (iint && atomic_read(&inode->i_writecount) == 1)
+		iint->flags &= ~EVM_NEW_FILE;
+}
+static void evm_post_path_mknod(struct mnt_idmap *idmap, struct dentry *dentry)
+{
+	struct inode *inode = d_backing_inode(dentry);
+	struct evm_iint_cache *iint = evm_iint_inode(inode);
+	if (!S_ISREG(inode->i_mode))
+		return;
+	if (iint)
+		iint->flags |= EVM_NEW_FILE;
+}
 #ifdef CONFIG_EVM_LOAD_X509
 void __init evm_load_x509(void)
 {
 	return error;
 }
+static struct security_hook_list evm_hooks[] __ro_after_init = {
+	LSM_HOOK_INIT(inode_setattr, evm_inode_setattr),
+	LSM_HOOK_INIT(inode_post_setattr, evm_inode_post_setattr),
+	LSM_HOOK_INIT(inode_copy_up_xattr, evm_inode_copy_up_xattr),
+	LSM_HOOK_INIT(inode_setxattr, evm_inode_setxattr),
+	LSM_HOOK_INIT(inode_post_setxattr, evm_inode_post_setxattr),
+	LSM_HOOK_INIT(inode_set_acl, evm_inode_set_acl),
+	LSM_HOOK_INIT(inode_post_set_acl, evm_inode_post_set_acl),
+	LSM_HOOK_INIT(inode_remove_acl, evm_inode_remove_acl),
+	LSM_HOOK_INIT(inode_post_remove_acl, evm_inode_post_remove_acl),
+	LSM_HOOK_INIT(inode_removexattr, evm_inode_removexattr),
+	LSM_HOOK_INIT(inode_post_removexattr, evm_inode_post_removexattr),
+	LSM_HOOK_INIT(inode_init_security, evm_inode_init_security),
+	LSM_HOOK_INIT(inode_alloc_security, evm_inode_alloc_security),
+	LSM_HOOK_INIT(file_release, evm_file_release),
+	LSM_HOOK_INIT(path_post_mknod, evm_post_path_mknod),
+};
+static const struct lsm_id evm_lsmid = {
+	.name = "evm",
+	.id = LSM_ID_EVM,
+};
+static int __init init_evm_lsm(void)
+{
+	security_add_hooks(evm_hooks, ARRAY_SIZE(evm_hooks), &evm_lsmid);
+	return 0;
+}
+struct lsm_blob_sizes evm_blob_sizes __ro_after_init = {
+	.lbs_inode = sizeof(struct evm_iint_cache),
+	.lbs_xattr_count = 1,
+};
+DEFINE_LSM(evm) = {
+	.name = "evm",
+	.init = init_evm_lsm,
+	.order = LSM_ORDER_LAST,
+	.blobs = &evm_blob_sizes,
+};
 late_initcall(init_evm);

security/integrity/iint.c+2−195

@@ -6,207 +6,14 @@ · 5 unmodified lines
6	* Mimi Zohar <zohar@us.ibm.com>	6	* Mimi Zohar <zohar@us.ibm.com>
7	*	7	*
8	* File: integrity_iint.c	8	* File: integrity_iint.c
9	* - implements the integrity hooks: integrity_inode_alloc,	9	* - initialize the integrity directory in securityfs
10	* integrity_inode_free	10	* - load IMA and EVM keys
11	* - cache integrity information associated with an inode
12	* using a rbtree tree.
13	*/	11	*/
14	#include <linux/slab.h>
15	#include <linux/init.h>
16	#include <linux/spinlock.h>
17	#include <linux/rbtree.h>
18	#include <linux/file.h>
19	#include <linux/uaccess.h>
20	#include <linux/security.h>	12	#include <linux/security.h>
21	#include <linux/lsm_hooks.h>
22	#include "integrity.h"	13	#include "integrity.h"
23		14
24	static struct rb_root integrity_iint_tree = RB_ROOT;
25	static DEFINE_RWLOCK(integrity_iint_lock);
26	static struct kmem_cache *iint_cache __ro_after_init;
27
28	struct dentry *integrity_dir;	15	struct dentry *integrity_dir;
29		16
30	/*
31	* __integrity_iint_find - return the iint associated with an inode
32	*/
33	static struct integrity_iint_cache __integrity_iint_find(struct inode inode)
34	{
35	struct integrity_iint_cache *iint;
36	struct rb_node *n = integrity_iint_tree.rb_node;
37
38	while (n) {
39	iint = rb_entry(n, struct integrity_iint_cache, rb_node);
40
41	if (inode < iint->inode)
42	n = n->rb_left;
43	else if (inode > iint->inode)
44	n = n->rb_right;
45	else
46	return iint;
47	}
48
49	return NULL;
50	}
51
52	/*
53	* integrity_iint_find - return the iint associated with an inode
54	*/
55	struct integrity_iint_cache integrity_iint_find(struct inode inode)
56	{
57	struct integrity_iint_cache *iint;
58
59	if (!IS_IMA(inode))
60	return NULL;
61
62	read_lock(&integrity_iint_lock);
63	iint = __integrity_iint_find(inode);
64	read_unlock(&integrity_iint_lock);
65
66	return iint;
67	}
68
69	#define IMA_MAX_NESTING (FILESYSTEM_MAX_STACK_DEPTH+1)
70
71	/*
72	* It is not clear that IMA should be nested at all, but as long is it measures
73	* files both on overlayfs and on underlying fs, we need to annotate the iint
74	* mutex to avoid lockdep false positives related to IMA + overlayfs.
75	* See ovl_lockdep_annotate_inode_mutex_key() for more details.
76	*/
77	static inline void iint_lockdep_annotate(struct integrity_iint_cache *iint,
78	struct inode *inode)
79	{
80	#ifdef CONFIG_LOCKDEP
81	static struct lock_class_key iint_mutex_key[IMA_MAX_NESTING];
82
83	int depth = inode->i_sb->s_stack_depth;
84
85	if (WARN_ON_ONCE(depth < 0 \|\| depth >= IMA_MAX_NESTING))
86	depth = 0;
87
88	lockdep_set_class(&iint->mutex, &iint_mutex_key[depth]);
89	#endif
90	}
91
92	static void iint_init_always(struct integrity_iint_cache *iint,
93	struct inode *inode)
94	{
95	iint->ima_hash = NULL;
96	iint->version = 0;
97	iint->flags = 0UL;
98	iint->atomic_flags = 0UL;
99	iint->ima_file_status = INTEGRITY_UNKNOWN;
100	iint->ima_mmap_status = INTEGRITY_UNKNOWN;
101	iint->ima_bprm_status = INTEGRITY_UNKNOWN;
102	iint->ima_read_status = INTEGRITY_UNKNOWN;
103	iint->ima_creds_status = INTEGRITY_UNKNOWN;
104	iint->evm_status = INTEGRITY_UNKNOWN;
105	iint->measured_pcrs = 0;
106	mutex_init(&iint->mutex);
107	iint_lockdep_annotate(iint, inode);
108	}
109
110	static void iint_free(struct integrity_iint_cache *iint)
111	{
112	kfree(iint->ima_hash);
113	mutex_destroy(&iint->mutex);
114	kmem_cache_free(iint_cache, iint);
115	}
116
117	/**
118	* integrity_inode_get - find or allocate an iint associated with an inode
119	* @inode: pointer to the inode
120	* @return: allocated iint
121	*
122	* Caller must lock i_mutex
123	*/
124	struct integrity_iint_cache integrity_inode_get(struct inode inode)
125	{
126	struct rb_node **p;
127	struct rb_node node, parent = NULL;
128	struct integrity_iint_cache iint, test_iint;
129
130	iint = integrity_iint_find(inode);
131	if (iint)
132	return iint;
133
134	iint = kmem_cache_alloc(iint_cache, GFP_NOFS);
135	if (!iint)
136	return NULL;
137
138	iint_init_always(iint, inode);
139
140	write_lock(&integrity_iint_lock);
141
142	p = &integrity_iint_tree.rb_node;
143	while (*p) {
144	parent = *p;
145	test_iint = rb_entry(parent, struct integrity_iint_cache,
146	rb_node);
147	if (inode < test_iint->inode) {
148	p = &(*p)->rb_left;
149	} else if (inode > test_iint->inode) {
150	p = &(*p)->rb_right;
151	} else {
152	write_unlock(&integrity_iint_lock);
153	kmem_cache_free(iint_cache, iint);
154	return test_iint;
155	}
156	}
157
158	iint->inode = inode;
159	node = &iint->rb_node;
160	inode->i_flags \|= S_IMA;
161	rb_link_node(node, parent, p);
162	rb_insert_color(node, &integrity_iint_tree);
163
164	write_unlock(&integrity_iint_lock);
165	return iint;
166	}
167
168	/**
169	* integrity_inode_free - called on security_inode_free
170	* @inode: pointer to the inode
171	*
172	* Free the integrity information(iint) associated with an inode.
173	*/
174	void integrity_inode_free(struct inode *inode)
175	{
176	struct integrity_iint_cache *iint;
177
178	if (!IS_IMA(inode))
179	return;
180
181	write_lock(&integrity_iint_lock);
182	iint = __integrity_iint_find(inode);
183	rb_erase(&iint->rb_node, &integrity_iint_tree);
184	write_unlock(&integrity_iint_lock);
185
186	iint_free(iint);
187	}
188
189	static void iint_init_once(void *foo)
190	{
191	struct integrity_iint_cache iint = (struct integrity_iint_cache ) foo;
192
193	memset(iint, 0, sizeof(*iint));
194	}
195
196	static int __init integrity_iintcache_init(void)
197	{
198	iint_cache =
199	kmem_cache_create("iint_cache", sizeof(struct integrity_iint_cache),
200	0, SLAB_PANIC, iint_init_once);
201	return 0;
202	}
203	DEFINE_LSM(integrity) = {
204	.name = "integrity",
205	.init = integrity_iintcache_init,
206	.order = LSM_ORDER_LAST,
207	};
208
209
210	/*	17	/*
211	* integrity_kernel_read - read data from the file	18	* integrity_kernel_read - read data from the file
212	*	19	*

security/integrity/ima/Kconfig+1−0

@@ -8,6 +8,7 @@ config IMA · 7 unmodified lines
8	select CRYPTO_HMAC	8	select CRYPTO_HMAC
9	select CRYPTO_SHA1	9	select CRYPTO_SHA1
10	select CRYPTO_HASH_INFO	10	select CRYPTO_HASH_INFO
		11	select SECURITY_PATH
11	select TCG_TPM if HAS_IOMEM	12	select TCG_TPM if HAS_IOMEM
12	select TCG_TIS if TCG_TPM && X86	13	select TCG_TIS if TCG_TPM && X86
13	select TCG_CRB if TCG_TPM && ACPI	14	select TCG_CRB if TCG_TPM && ACPI

security/integrity/ima/Makefile+1−1

@@ -4,7 +4,7 @@ · 3 unmodified lines
4	# Measurement Architecture(IMA).	4	# Measurement Architecture(IMA).
5	#	5	#
6		6
7	obj-$(CONFIG_IMA) += ima.o	7	obj-$(CONFIG_IMA) += ima.o ima_iint.o
8		8
9	ima-y := ima_fs.o ima_queue.o ima_init.o ima_main.o ima_crypto.o ima_api.o \	9	ima-y := ima_fs.o ima_queue.o ima_init.o ima_main.o ima_crypto.o ima_api.o \
10	ima_policy.o ima_template.o ima_template_lib.o	10	ima_policy.o ima_template.o ima_template_lib.o

security/integrity/ima/ima.h+129−19

@@ -60,7 +60,7 @@ extern const char boot_aggregate_name[]; · 59 unmodified lines
60		60
61	/* IMA event related data */	61	/* IMA event related data */
62	struct ima_event_data {	62	struct ima_event_data {
63	struct integrity_iint_cache *iint;	63	struct ima_iint_cache *iint;
64	struct file *file;	64	struct file *file;
65	const unsigned char *filename;	65	const unsigned char *filename;
66	struct evm_ima_xattr_data *xattr_value;	66	struct evm_ima_xattr_data *xattr_value;
@@ -119,6 +119,107 @@ struct ima_kexec_hdr { · 52 unmodified lines
119	u64 count;	119	u64 count;
120	};	120	};
121		121
		122	/* IMA iint action cache flags */
		123	#define IMA_MEASURE 0x00000001
		124	#define IMA_MEASURED 0x00000002
		125	#define IMA_APPRAISE 0x00000004
		126	#define IMA_APPRAISED 0x00000008
		127	/#define IMA_COLLECT 0x00000010 do not use this flag /
		128	#define IMA_COLLECTED 0x00000020
		129	#define IMA_AUDIT 0x00000040
		130	#define IMA_AUDITED 0x00000080
		131	#define IMA_HASH 0x00000100
		132	#define IMA_HASHED 0x00000200
		133
		134	/* IMA iint policy rule cache flags */
		135	#define IMA_NONACTION_FLAGS 0xff000000
		136	#define IMA_DIGSIG_REQUIRED 0x01000000
		137	#define IMA_PERMIT_DIRECTIO 0x02000000
		138	#define IMA_NEW_FILE 0x04000000
		139	#define IMA_FAIL_UNVERIFIABLE_SIGS 0x10000000
		140	#define IMA_MODSIG_ALLOWED 0x20000000
		141	#define IMA_CHECK_BLACKLIST 0x40000000
		142	#define IMA_VERITY_REQUIRED 0x80000000
		143
		144	#define IMA_DO_MASK (IMA_MEASURE \| IMA_APPRAISE \| IMA_AUDIT \| \
		145	IMA_HASH \| IMA_APPRAISE_SUBMASK)
		146	#define IMA_DONE_MASK (IMA_MEASURED \| IMA_APPRAISED \| IMA_AUDITED \| \
		147	IMA_HASHED \| IMA_COLLECTED \| \
		148	IMA_APPRAISED_SUBMASK)
		149
		150	/* IMA iint subaction appraise cache flags */
		151	#define IMA_FILE_APPRAISE 0x00001000
		152	#define IMA_FILE_APPRAISED 0x00002000
		153	#define IMA_MMAP_APPRAISE 0x00004000
		154	#define IMA_MMAP_APPRAISED 0x00008000
		155	#define IMA_BPRM_APPRAISE 0x00010000
		156	#define IMA_BPRM_APPRAISED 0x00020000
		157	#define IMA_READ_APPRAISE 0x00040000
		158	#define IMA_READ_APPRAISED 0x00080000
		159	#define IMA_CREDS_APPRAISE 0x00100000
		160	#define IMA_CREDS_APPRAISED 0x00200000
		161	#define IMA_APPRAISE_SUBMASK (IMA_FILE_APPRAISE \| IMA_MMAP_APPRAISE \| \
		162	IMA_BPRM_APPRAISE \| IMA_READ_APPRAISE \| \
		163	IMA_CREDS_APPRAISE)
		164	#define IMA_APPRAISED_SUBMASK (IMA_FILE_APPRAISED \| IMA_MMAP_APPRAISED \| \
		165	IMA_BPRM_APPRAISED \| IMA_READ_APPRAISED \| \
		166	IMA_CREDS_APPRAISED)
		167
		168	/* IMA iint cache atomic_flags */
		169	#define IMA_CHANGE_XATTR 0
		170	#define IMA_UPDATE_XATTR 1
		171	#define IMA_CHANGE_ATTR 2
		172	#define IMA_DIGSIG 3
		173	#define IMA_MUST_MEASURE 4
		174
		175	/* IMA integrity metadata associated with an inode */
		176	struct ima_iint_cache {
		177	struct mutex mutex; /* protects: version, flags, digest */
		178	u64 version; /* track inode changes */
		179	unsigned long flags;
		180	unsigned long measured_pcrs;
		181	unsigned long atomic_flags;
		182	unsigned long real_ino;
		183	dev_t real_dev;
		184	enum integrity_status ima_file_status:4;
		185	enum integrity_status ima_mmap_status:4;
		186	enum integrity_status ima_bprm_status:4;
		187	enum integrity_status ima_read_status:4;
		188	enum integrity_status ima_creds_status:4;
		189	struct ima_digest_data *ima_hash;
		190	};
		191
		192	extern struct lsm_blob_sizes ima_blob_sizes;
		193
		194	static inline struct ima_iint_cache *
		195	ima_inode_get_iint(const struct inode *inode)
		196	{
		197	struct ima_iint_cache **iint_sec;
		198
		199	if (unlikely(!inode->i_security))
		200	return NULL;
		201
		202	iint_sec = inode->i_security + ima_blob_sizes.lbs_inode;
		203	return *iint_sec;
		204	}
		205
		206	static inline void ima_inode_set_iint(const struct inode *inode,
		207	struct ima_iint_cache *iint)
		208	{
		209	struct ima_iint_cache **iint_sec;
		210
		211	if (unlikely(!inode->i_security))
		212	return;
		213
		214	iint_sec = inode->i_security + ima_blob_sizes.lbs_inode;
		215	*iint_sec = iint;
		216	}
		217
		218	struct ima_iint_cache ima_iint_find(struct inode inode);
		219	struct ima_iint_cache ima_inode_get(struct inode inode);
		220	void ima_inode_free(struct inode *inode);
		221	void __init ima_iintcache_init(void);
		222
122	extern const int read_idmap[];	223	extern const int read_idmap[];
123		224
124	#ifdef CONFIG_HAVE_IMA_KEXEC	225	#ifdef CONFIG_HAVE_IMA_KEXEC
@@ -127,6 +228,12 @@ void ima_load_kexec_buffer(void); · 2 unmodified lines
127	static inline void ima_load_kexec_buffer(void) {}	228	static inline void ima_load_kexec_buffer(void) {}
128	#endif /* CONFIG_HAVE_IMA_KEXEC */	229	#endif /* CONFIG_HAVE_IMA_KEXEC */
129		230
		231	#ifdef CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS
		232	void ima_post_key_create_or_update(struct key keyring, struct key key,
		233	const void *payload, size_t plen,
		234	unsigned long flags, bool create);
		235	#endif
		236
130	/*	237	/*
131	* The default binary_runtime_measurements list format is defined as the	238	* The default binary_runtime_measurements list format is defined as the
132	* platform native format. The canonical format is defined as little-endian.	239	* platform native format. The canonical format is defined as little-endian.
@@ -146,8 +253,8 @@ int ima_calc_field_array_hash(struct ima_field_data *field_data, · 13 unmodified lines
146	struct ima_template_entry *entry);	253	struct ima_template_entry *entry);
147	int ima_calc_boot_aggregate(struct ima_digest_data *hash);	254	int ima_calc_boot_aggregate(struct ima_digest_data *hash);
148	void ima_add_violation(struct file file, const unsigned char filename,	255	void ima_add_violation(struct file file, const unsigned char filename,
149	struct integrity_iint_cache *iint,	256	struct ima_iint_cache iint, const char op,
150	const char op, const char cause);	257	const char *cause);
151	int ima_init_crypto(void);	258	int ima_init_crypto(void);
152	void ima_putc(struct seq_file m, void data, int datalen);	259	void ima_putc(struct seq_file m, void data, int datalen);
153	void ima_print_digest(struct seq_file m, u8 digest, u32 size);	260	void ima_print_digest(struct seq_file m, u8 digest, u32 size);
@@ -261,10 +368,10 @@ int ima_get_action(struct mnt_idmap idmap, struct inode inode, · 107 unmodified lines
261	struct ima_template_desc **template_desc,	368	struct ima_template_desc **template_desc,
262	const char func_data, unsigned int allowed_algos);	369	const char func_data, unsigned int allowed_algos);
263	int ima_must_measure(struct inode *inode, int mask, enum ima_hooks func);	370	int ima_must_measure(struct inode *inode, int mask, enum ima_hooks func);
264	int ima_collect_measurement(struct integrity_iint_cache *iint,	371	int ima_collect_measurement(struct ima_iint_cache iint, struct file file,
265	struct file file, void buf, loff_t size,	372	void *buf, loff_t size, enum hash_algo algo,
266	enum hash_algo algo, struct modsig *modsig);	373	struct modsig *modsig);
267	void ima_store_measurement(struct integrity_iint_cache iint, struct file file,	374	void ima_store_measurement(struct ima_iint_cache iint, struct file file,
268	const unsigned char *filename,	375	const unsigned char *filename,
269	struct evm_ima_xattr_data *xattr_value,	376	struct evm_ima_xattr_data *xattr_value,
270	int xattr_len, const struct modsig *modsig, int pcr,	377	int xattr_len, const struct modsig *modsig, int pcr,
@@ -274,7 +381,7 @@ int process_buffer_measurement(struct mnt_idmap *idmap, · 3 unmodified lines
274	const char *eventname, enum ima_hooks func,	381	const char *eventname, enum ima_hooks func,
275	int pcr, const char *func_data,	382	int pcr, const char *func_data,
276	bool buf_hash, u8 *digest, size_t digest_len);	383	bool buf_hash, u8 *digest, size_t digest_len);
277	void ima_audit_measurement(struct integrity_iint_cache *iint,	384	void ima_audit_measurement(struct ima_iint_cache *iint,
278	const unsigned char *filename);	385	const unsigned char *filename);
279	int ima_alloc_init_template(struct ima_event_data *event_data,	386	int ima_alloc_init_template(struct ima_event_data *event_data,
280	struct ima_template_entry **entry,	387	struct ima_template_entry **entry,
@@ -312,32 +419,32 @@ int ima_policy_show(struct seq_file m, void v); · 31 unmodified lines
312	#define IMA_APPRAISE_KEXEC 0x40	419	#define IMA_APPRAISE_KEXEC 0x40
313		420
314	#ifdef CONFIG_IMA_APPRAISE	421	#ifdef CONFIG_IMA_APPRAISE
315	int ima_check_blacklist(struct integrity_iint_cache *iint,	422	int ima_check_blacklist(struct ima_iint_cache *iint,
316	const struct modsig *modsig, int pcr);	423	const struct modsig *modsig, int pcr);
317	int ima_appraise_measurement(enum ima_hooks func,	424	int ima_appraise_measurement(enum ima_hooks func, struct ima_iint_cache *iint,
318	struct integrity_iint_cache *iint,
319	struct file file, const unsigned char filename,	425	struct file file, const unsigned char filename,
320	struct evm_ima_xattr_data *xattr_value,	426	struct evm_ima_xattr_data *xattr_value,
321	int xattr_len, const struct modsig *modsig);	427	int xattr_len, const struct modsig *modsig);
322	int ima_must_appraise(struct mnt_idmap idmap, struct inode inode,	428	int ima_must_appraise(struct mnt_idmap idmap, struct inode inode,
323	int mask, enum ima_hooks func);	429	int mask, enum ima_hooks func);
324	void ima_update_xattr(struct integrity_iint_cache iint, struct file file);	430	void ima_update_xattr(struct ima_iint_cache iint, struct file file);
325	enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,	431	enum integrity_status ima_get_cache_status(struct ima_iint_cache *iint,
326	enum ima_hooks func);	432	enum ima_hooks func);
327	enum hash_algo ima_get_hash_algo(const struct evm_ima_xattr_data *xattr_value,	433	enum hash_algo ima_get_hash_algo(const struct evm_ima_xattr_data *xattr_value,
328	int xattr_len);	434	int xattr_len);
329	int ima_read_xattr(struct dentry *dentry,	435	int ima_read_xattr(struct dentry *dentry,
330	struct evm_ima_xattr_data **xattr_value, int xattr_len);	436	struct evm_ima_xattr_data **xattr_value, int xattr_len);
		437	void __init init_ima_appraise_lsm(const struct lsm_id *lsmid);
331		438
332	#else	439	#else
333	static inline int ima_check_blacklist(struct integrity_iint_cache *iint,	440	static inline int ima_check_blacklist(struct ima_iint_cache *iint,
334	const struct modsig *modsig, int pcr)	441	const struct modsig *modsig, int pcr)
335	{	442	{
336	return 0;	443	return 0;
337	}	444	}
338		445
339	static inline int ima_appraise_measurement(enum ima_hooks func,	446	static inline int ima_appraise_measurement(enum ima_hooks func,
340	struct integrity_iint_cache *iint,	447	struct ima_iint_cache *iint,
341	struct file *file,	448	struct file *file,
342	const unsigned char *filename,	449	const unsigned char *filename,
343	struct evm_ima_xattr_data *xattr_value,	450	struct evm_ima_xattr_data *xattr_value,
@@ -354,14 +461,13 @@ static inline int ima_must_appraise(struct mnt_idmap *idmap, · 10 unmodified lines
354	return 0;	461	return 0;
355	}	462	}
356		463
357	static inline void ima_update_xattr(struct integrity_iint_cache *iint,	464	static inline void ima_update_xattr(struct ima_iint_cache *iint,
358	struct file *file)	465	struct file *file)
359	{	466	{
360	}	467	}
361		468
362	static inline enum integrity_status ima_get_cache_status(struct integrity_iint_cache	469	static inline enum integrity_status
363	*iint,	470	ima_get_cache_status(struct ima_iint_cache *iint, enum ima_hooks func)
364	enum ima_hooks func)
365	{	471	{
366	return INTEGRITY_UNKNOWN;	472	return INTEGRITY_UNKNOWN;
367	}	473	}
@@ -379,6 +485,10 @@ static inline int ima_read_xattr(struct dentry *dentry, · 11 unmodified lines
379	return 0;	485	return 0;
380	}	486	}
381		487
		488	static inline void __init init_ima_appraise_lsm(const struct lsm_id *lsmid)
		489	{
		490	}
		491
382	#endif /* CONFIG_IMA_APPRAISE */	492	#endif /* CONFIG_IMA_APPRAISE */
383		493
384	#ifdef CONFIG_IMA_APPRAISE_MODSIG	494	#ifdef CONFIG_IMA_APPRAISE_MODSIG

security/integrity/ima/ima_api.c+12−11

  * value is invalidated.
  */
 void ima_add_violation(struct file *file, const unsigned char *filename,
-		       struct integrity_iint_cache *iint,
+		       struct ima_iint_cache *iint, const char *op,
-		       const char *op, const char *cause)
+		       const char *cause)
 {
 	struct ima_template_entry *entry;
 	struct inode *inode = file_inode(file);
 				allowed_algos);
 }
-static bool ima_get_verity_digest(struct integrity_iint_cache *iint,
+static bool ima_get_verity_digest(struct ima_iint_cache *iint,
+				  struct inode *inode,
 				  struct ima_max_digest_data *hash)
 {
 	enum hash_algo alg;
 	 * On failure, 'measure' policy rules will result in a file data
 	 * hash containing 0's.
 	 */
-	digest_len = fsverity_get_digest(iint->inode, hash->digest, NULL, &alg);
+	digest_len = fsverity_get_digest(inode, hash->digest, NULL, &alg);
 	if (digest_len == 0)
 		return false;
  *
  * Return 0 on success, error code otherwise
  */
-int ima_collect_measurement(struct integrity_iint_cache *iint,
+int ima_collect_measurement(struct ima_iint_cache *iint, struct file *file,
-			    struct file *file, void *buf, loff_t size,
+			    void *buf, loff_t size, enum hash_algo algo,
-			    enum hash_algo algo, struct modsig *modsig)
+			    struct modsig *modsig)
 {
 	const char *audit_cause = "failed";
 	struct inode *inode = file_inode(file);
 	memset(&hash.digest, 0, sizeof(hash.digest));
 	if (iint->flags & IMA_VERITY_REQUIRED) {
-		if (!ima_get_verity_digest(iint, &hash)) {
+		if (!ima_get_verity_digest(iint, inode, &hash)) {
 			audit_cause = "no-verity-digest";
 			result = -ENODATA;
 		}
  *
  * Must be called with iint->mutex held.
  */
-void ima_store_measurement(struct integrity_iint_cache *iint,
+void ima_store_measurement(struct ima_iint_cache *iint, struct file *file,
-			   struct file *file, const unsigned char *filename,
+			   const unsigned char *filename,
 			   struct evm_ima_xattr_data *xattr_value,
 			   int xattr_len, const struct modsig *modsig, int pcr,
 			   struct ima_template_desc *template_desc)
 		ima_free_template_entry(entry);
 }
-void ima_audit_measurement(struct integrity_iint_cache *iint,
+void ima_audit_measurement(struct ima_iint_cache *iint,
 			   const unsigned char *filename)
 {
 	struct audit_buffer *ab;

security/integrity/ima/ima_appraise.c+43−23

 				NULL, NULL, NULL);
 }
-static int ima_fix_xattr(struct dentry *dentry,
+static int ima_fix_xattr(struct dentry *dentry, struct ima_iint_cache *iint)
-			 struct integrity_iint_cache *iint)
 {
 	int rc, offset;
 	u8 algo = iint->ima_hash->algo;
 }
 /* Return specific func appraised cached result */
-enum integrity_status ima_get_cache_status(struct integrity_iint_cache *iint,
+enum integrity_status ima_get_cache_status(struct ima_iint_cache *iint,
 					   enum ima_hooks func)
 {
 	switch (func) {
 	}
 }
-static void ima_set_cache_status(struct integrity_iint_cache *iint,
+static void ima_set_cache_status(struct ima_iint_cache *iint,
 				 enum ima_hooks func,
 				 enum integrity_status status)
 {
 	}
 }
-static void ima_cache_flags(struct integrity_iint_cache *iint,
+static void ima_cache_flags(struct ima_iint_cache *iint, enum ima_hooks func)
-			     enum ima_hooks func)
 {
 	switch (func) {
 	case MMAP_CHECK:
  *
  * Return 0 on success, error code otherwise.
  */
-static int xattr_verify(enum ima_hooks func, struct integrity_iint_cache *iint,
+static int xattr_verify(enum ima_hooks func, struct ima_iint_cache *iint,
 			struct evm_ima_xattr_data *xattr_value, int xattr_len,
 			enum integrity_status *status, const char **cause)
 {
  *
  * Returns -EPERM if the hash is blacklisted.
  */
-int ima_check_blacklist(struct integrity_iint_cache *iint,
+int ima_check_blacklist(struct ima_iint_cache *iint,
 			const struct modsig *modsig, int pcr)
 {
 	enum hash_algo hash_algo;
  *
  * Return 0 on success, error code otherwise
  */
-int ima_appraise_measurement(enum ima_hooks func,
+int ima_appraise_measurement(enum ima_hooks func, struct ima_iint_cache *iint,
-			     struct integrity_iint_cache *iint,
 			     struct file *file, const unsigned char *filename,
 			     struct evm_ima_xattr_data *xattr_value,
 			     int xattr_len, const struct modsig *modsig)
 	}
 	status = evm_verifyxattr(dentry, XATTR_NAME_IMA, xattr_value,
-				 rc < 0 ? 0 : rc, iint);
+				 rc < 0 ? 0 : rc);
 	switch (status) {
 	case INTEGRITY_PASS:
 	case INTEGRITY_PASS_IMMUTABLE:
 /*
  * ima_update_xattr - update 'security.ima' hash value
  */
-void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file)
+void ima_update_xattr(struct ima_iint_cache *iint, struct file *file)
 {
 	struct dentry *dentry = file_dentry(file);
 	int rc = 0;
  * ima_inode_post_setattr - reflect file metadata changes
  * @idmap:  idmap of the mount the inode was found from
  * @dentry: pointer to the affected dentry
+ * @ia_valid: for the UID and GID status
  *
  * Changes to a dentry's metadata might result in needing to appraise.
  *
  * This function is called from notify_change(), which expects the caller
  * to lock the inode's i_mutex.
  */
-void ima_inode_post_setattr(struct mnt_idmap *idmap,
+static void ima_inode_post_setattr(struct mnt_idmap *idmap,
-			    struct dentry *dentry)
+				   struct dentry *dentry, int ia_valid)
 {
 	struct inode *inode = d_backing_inode(dentry);
-	struct integrity_iint_cache *iint;
+	struct ima_iint_cache *iint;
 	int action;
 	if (!(ima_policy_flag & IMA_APPRAISE) || !S_ISREG(inode->i_mode)
 		return;
 	action = ima_must_appraise(idmap, inode, MAY_ACCESS, POST_SETATTR);
-	iint = integrity_iint_find(inode);
+	iint = ima_iint_find(inode);
 	if (iint) {
 		set_bit(IMA_CHANGE_ATTR, &iint->atomic_flags);
 		if (!action)
 static void ima_reset_appraise_flags(struct inode *inode, int digsig)
 {
-	struct integrity_iint_cache *iint;
+	struct ima_iint_cache *iint;
 	if (!(ima_policy_flag & IMA_APPRAISE) || !S_ISREG(inode->i_mode))
 		return;
-	iint = integrity_iint_find(inode);
+	iint = ima_iint_find(inode);
 	if (!iint)
 		return;
 	iint->measured_pcrs = 0;
 	return -EACCES;
 }
-int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name,
+static int ima_inode_setxattr(struct mnt_idmap *idmap, struct dentry *dentry,
-		       const void *xattr_value, size_t xattr_value_len)
+			      const char *xattr_name, const void *xattr_value,
+			      size_t xattr_value_len, int flags)
 {
 	const struct evm_ima_xattr_data *xvalue = xattr_value;
 	int digsig = 0;
 	return result;
 }
-int ima_inode_set_acl(struct mnt_idmap *idmap, struct dentry *dentry,
+static int ima_inode_set_acl(struct mnt_idmap *idmap, struct dentry *dentry,
-		      const char *acl_name, struct posix_acl *kacl)
+			     const char *acl_name, struct posix_acl *kacl)
 {
 	if (evm_revalidate_status(acl_name))
 		ima_reset_appraise_flags(d_backing_inode(dentry), 0);
 	return 0;
 }
-int ima_inode_removexattr(struct dentry *dentry, const char *xattr_name)
+static int ima_inode_removexattr(struct mnt_idmap *idmap, struct dentry *dentry,
+				 const char *xattr_name)
 {
 	int result;
 	}
 	return result;
 }
+static int ima_inode_remove_acl(struct mnt_idmap *idmap, struct dentry *dentry,
+				const char *acl_name)
+{
+	return ima_inode_set_acl(idmap, dentry, acl_name, NULL);
+}
+static struct security_hook_list ima_appraise_hooks[] __ro_after_init = {
+	LSM_HOOK_INIT(inode_post_setattr, ima_inode_post_setattr),
+	LSM_HOOK_INIT(inode_setxattr, ima_inode_setxattr),
+	LSM_HOOK_INIT(inode_set_acl, ima_inode_set_acl),
+	LSM_HOOK_INIT(inode_removexattr, ima_inode_removexattr),
+	LSM_HOOK_INIT(inode_remove_acl, ima_inode_remove_acl),
+};
+void __init init_ima_appraise_lsm(const struct lsm_id *lsmid)
+{
+	security_add_hooks(ima_appraise_hooks, ARRAY_SIZE(ima_appraise_hooks),
+			   lsmid);
+}

security/integrity/ima/ima_iint.c+142−0

@@ -0,0 +1,142 @@
	1	// SPDX-License-Identifier: GPL-2.0-only
	2	/*
	3	* Copyright (C) 2008 IBM Corporation
	4	*
	5	* Authors:
	6	* Mimi Zohar <zohar@us.ibm.com>
	7	*
	8	* File: ima_iint.c
	9	* - implements the IMA hook: ima_inode_free
	10	* - cache integrity information in the inode security blob
	11	*/
	12	#include <linux/slab.h>
	13
	14	#include "ima.h"
	15
	16	static struct kmem_cache *ima_iint_cache __ro_after_init;
	17
	18	/**
	19	* ima_iint_find - Return the iint associated with an inode
	20	* @inode: Pointer to the inode
	21	*
	22	* Return the IMA integrity information (iint) associated with an inode, if the
	23	* inode was processed by IMA.
	24	*
	25	* Return: Found iint or NULL.
	26	*/
	27	struct ima_iint_cache ima_iint_find(struct inode inode)
	28	{
	29	if (!IS_IMA(inode))
	30	return NULL;
	31
	32	return ima_inode_get_iint(inode);
	33	}
	34
	35	#define IMA_MAX_NESTING (FILESYSTEM_MAX_STACK_DEPTH + 1)
	36
	37	/*
	38	* It is not clear that IMA should be nested at all, but as long is it measures
	39	* files both on overlayfs and on underlying fs, we need to annotate the iint
	40	* mutex to avoid lockdep false positives related to IMA + overlayfs.
	41	* See ovl_lockdep_annotate_inode_mutex_key() for more details.
	42	*/
	43	static inline void ima_iint_lockdep_annotate(struct ima_iint_cache *iint,
	44	struct inode *inode)
	45	{
	46	#ifdef CONFIG_LOCKDEP
	47	static struct lock_class_key ima_iint_mutex_key[IMA_MAX_NESTING];
	48
	49	int depth = inode->i_sb->s_stack_depth;
	50
	51	if (WARN_ON_ONCE(depth < 0 \|\| depth >= IMA_MAX_NESTING))
	52	depth = 0;
	53
	54	lockdep_set_class(&iint->mutex, &ima_iint_mutex_key[depth]);
	55	#endif
	56	}
	57
	58	static void ima_iint_init_always(struct ima_iint_cache *iint,
	59	struct inode *inode)
	60	{
	61	iint->ima_hash = NULL;
	62	iint->version = 0;
	63	iint->flags = 0UL;
	64	iint->atomic_flags = 0UL;
	65	iint->ima_file_status = INTEGRITY_UNKNOWN;
	66	iint->ima_mmap_status = INTEGRITY_UNKNOWN;
	67	iint->ima_bprm_status = INTEGRITY_UNKNOWN;
	68	iint->ima_read_status = INTEGRITY_UNKNOWN;
	69	iint->ima_creds_status = INTEGRITY_UNKNOWN;
	70	iint->measured_pcrs = 0;
	71	mutex_init(&iint->mutex);
	72	ima_iint_lockdep_annotate(iint, inode);
	73	}
	74
	75	static void ima_iint_free(struct ima_iint_cache *iint)
	76	{
	77	kfree(iint->ima_hash);
	78	mutex_destroy(&iint->mutex);
	79	kmem_cache_free(ima_iint_cache, iint);
	80	}
	81
	82	/**
	83	* ima_inode_get - Find or allocate an iint associated with an inode
	84	* @inode: Pointer to the inode
	85	*
	86	* Find an iint associated with an inode, and allocate a new one if not found.
	87	* Caller must lock i_mutex.
	88	*
	89	* Return: An iint on success, NULL on error.
	90	*/
	91	struct ima_iint_cache ima_inode_get(struct inode inode)
	92	{
	93	struct ima_iint_cache *iint;
	94
	95	iint = ima_iint_find(inode);
	96	if (iint)
	97	return iint;
	98
	99	iint = kmem_cache_alloc(ima_iint_cache, GFP_NOFS);
	100	if (!iint)
	101	return NULL;
	102
	103	ima_iint_init_always(iint, inode);
	104
	105	inode->i_flags \|= S_IMA;
	106	ima_inode_set_iint(inode, iint);
	107
	108	return iint;
	109	}
	110
	111	/**
	112	* ima_inode_free - Called on inode free
	113	* @inode: Pointer to the inode
	114	*
	115	* Free the iint associated with an inode.
	116	*/
	117	void ima_inode_free(struct inode *inode)
	118	{
	119	struct ima_iint_cache *iint;
	120
	121	if (!IS_IMA(inode))
	122	return;
	123
	124	iint = ima_iint_find(inode);
	125	ima_inode_set_iint(inode, NULL);
	126
	127	ima_iint_free(iint);
	128	}
	129
	130	static void ima_iint_init_once(void *foo)
	131	{
	132	struct ima_iint_cache iint = (struct ima_iint_cache )foo;
	133
	134	memset(iint, 0, sizeof(*iint));
	135	}
	136
	137	void __init ima_iintcache_init(void)
	138	{
	139	ima_iint_cache =
	140	kmem_cache_create("ima_iint_cache", sizeof(struct ima_iint_cache),
	141	0, SLAB_PANIC, ima_iint_init_once);
	142	}

security/integrity/ima/ima_init.c+1−1

@@ -44,7 +44,7 @@ static int __init ima_add_boot_aggregate(void) · 43 unmodified lines
44	static const char op[] = "add_boot_aggregate";	44	static const char op[] = "add_boot_aggregate";
45	const char *audit_cause = "ENOMEM";	45	const char *audit_cause = "ENOMEM";
46	struct ima_template_entry *entry;	46	struct ima_template_entry *entry;
47	struct integrity_iint_cache tmp_iint, *iint = &tmp_iint;	47	struct ima_iint_cache tmp_iint, *iint = &tmp_iint;
48	struct ima_event_data event_data = { .iint = iint,	48	struct ima_event_data event_data = { .iint = iint,
49	.filename = boot_aggregate_name };	49	.filename = boot_aggregate_name };
50	struct ima_max_digest_data hash;	50	struct ima_max_digest_data hash;

security/integrity/ima/ima_main.c+113−35

  *
  */
 static void ima_rdwr_violation_check(struct file *file,
-				     struct integrity_iint_cache *iint,
+				     struct ima_iint_cache *iint,
 				     int must_measure,
 				     char **pathbuf,
 				     const char **pathname,
 	if (mode & FMODE_WRITE) {
 		if (atomic_read(&inode->i_readcount) && IS_IMA(inode)) {
 			if (!iint)
-				iint = integrity_iint_find(inode);
+				iint = ima_iint_find(inode);
 			/* IMA_MEASURE is set from reader side */
 			if (iint && test_bit(IMA_MUST_MEASURE,
 						&iint->atomic_flags))
 				  "invalid_pcr", "open_writers");
 }
-static void ima_check_last_writer(struct integrity_iint_cache *iint,
+static void ima_check_last_writer(struct ima_iint_cache *iint,
 				  struct inode *inode, struct file *file)
 {
 	fmode_t mode = file->f_mode;
  *
  * Flag files that changed, based on i_version
  */
-void ima_file_free(struct file *file)
+static void ima_file_free(struct file *file)
 {
 	struct inode *inode = file_inode(file);
-	struct integrity_iint_cache *iint;
+	struct ima_iint_cache *iint;
 	if (!ima_policy_flag || !S_ISREG(inode->i_mode))
 		return;
-	iint = integrity_iint_find(inode);
+	iint = ima_iint_find(inode);
 	if (!iint)
 		return;
 			       enum ima_hooks func)
 {
 	struct inode *backing_inode, *inode = file_inode(file);
-	struct integrity_iint_cache *iint = NULL;
+	struct ima_iint_cache *iint = NULL;
 	struct ima_template_desc *template_desc = NULL;
 	char *pathbuf = NULL;
 	char filename[NAME_MAX];
 	inode_lock(inode);
 	if (action) {
-		iint = integrity_inode_get(inode);
+		iint = ima_inode_get(inode);
 		if (!iint)
 			rc = -ENOMEM;
 	}
  * On success return 0.  On integrity appraisal error, assuming the file
  * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
  */
-int ima_file_mmap(struct file *file, unsigned long reqprot,
+static int ima_file_mmap(struct file *file, unsigned long reqprot,
-		  unsigned long prot, unsigned long flags)
+			 unsigned long prot, unsigned long flags)
 {
 	u32 secid;
 	int ret;
 /**
  * ima_file_mprotect - based on policy, limit mprotect change
  * @vma: vm_area_struct protection is set to
- * @prot: contains the protection that will be applied by the kernel.
+ * @reqprot: protection requested by the application
+ * @prot: protection that will be applied by the kernel
  *
  * Files can be mmap'ed read/write and later changed to execute to circumvent
  * IMA's mmap appraisal policy rules.  Due to locking issues (mmap semaphore
  *
  * On mprotect change success, return 0.  On failure, return -EACESS.
  */
-int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot)
+static int ima_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
+			     unsigned long prot)
 {
 	struct ima_template_desc *template = NULL;
 	struct file *file;
  * On success return 0.  On integrity appraisal error, assuming the file
  * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
  */
-int ima_bprm_check(struct linux_binprm *bprm)
+static int ima_bprm_check(struct linux_binprm *bprm)
 {
 	int ret;
 	u32 secid;
  * On success return 0.  On integrity appraisal error, assuming the file
  * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
  */
-int ima_file_check(struct file *file, int mask)
+static int ima_file_check(struct file *file, int mask)
 {
 	u32 secid;
 				   mask & (MAY_READ | MAY_WRITE | MAY_EXEC |
 					   MAY_APPEND), FILE_CHECK);
 }
-EXPORT_SYMBOL_GPL(ima_file_check);
 static int __ima_inode_hash(struct inode *inode, struct file *file, char *buf,
 			    size_t buf_size)
 {
-	struct integrity_iint_cache *iint = NULL, tmp_iint;
+	struct ima_iint_cache *iint = NULL, tmp_iint;
 	int rc, hash_algo;
 	if (ima_policy_flag) {
-		iint = integrity_iint_find(inode);
+		iint = ima_iint_find(inode);
 		if (iint)
 			mutex_lock(&iint->mutex);
 	}
 			mutex_unlock(&iint->mutex);
 		memset(&tmp_iint, 0, sizeof(tmp_iint));
-		tmp_iint.inode = inode;
 		mutex_init(&tmp_iint.mutex);
 		rc = ima_collect_measurement(&tmp_iint, file, NULL, 0,
  * Skip calling process_measurement(), but indicate which newly, created
  * tmpfiles are in policy.
  */
-void ima_post_create_tmpfile(struct mnt_idmap *idmap,
+static void ima_post_create_tmpfile(struct mnt_idmap *idmap,
-			     struct inode *inode)
+				    struct inode *inode)
 {
-	struct integrity_iint_cache *iint;
+	struct ima_iint_cache *iint;
 	int must_appraise;
 	if (!ima_policy_flag || !S_ISREG(inode->i_mode))
 		return;
 	/* Nothing to do if we can't allocate memory */
-	iint = integrity_inode_get(inode);
+	iint = ima_inode_get(inode);
 	if (!iint)
 		return;
  * Mark files created via the mknodat syscall as new, so that the
  * file data can be written later.
  */
-void ima_post_path_mknod(struct mnt_idmap *idmap,
+static void ima_post_path_mknod(struct mnt_idmap *idmap, struct dentry *dentry)
-			 struct dentry *dentry)
 {
-	struct integrity_iint_cache *iint;
+	struct ima_iint_cache *iint;
 	struct inode *inode = dentry->d_inode;
 	int must_appraise;
 		return;
 	/* Nothing to do if we can't allocate memory */
-	iint = integrity_inode_get(inode);
+	iint = ima_inode_get(inode);
 	if (!iint)
 		return;
  *
  * For permission return 0, otherwise return -EACCES.
  */
-int ima_read_file(struct file *file, enum kernel_read_file_id read_id,
+static int ima_read_file(struct file *file, enum kernel_read_file_id read_id,
-		  bool contents)
+			 bool contents)
 {
 	enum ima_hooks func;
 	u32 secid;
  * On success return 0.  On integrity appraisal error, assuming the file
  * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
  */
-int ima_post_read_file(struct file *file, void *buf, loff_t size,
+static int ima_post_read_file(struct file *file, char *buf, loff_t size,
-		       enum kernel_read_file_id read_id)
+			      enum kernel_read_file_id read_id)
 {
 	enum ima_hooks func;
 	u32 secid;
  *
  * For permission return 0, otherwise return -EACCES.
  */
-int ima_load_data(enum kernel_load_data_id id, bool contents)
+static int ima_load_data(enum kernel_load_data_id id, bool contents)
 {
 	bool ima_enforce, sig_enforce;
  * On success return 0.  On integrity appraisal error, assuming the file
  * is in policy and IMA-appraisal is in enforcing mode, return -EACCES.
  */
-int ima_post_load_data(char *buf, loff_t size,
+static int ima_post_load_data(char *buf, loff_t size,
-		       enum kernel_load_data_id load_id,
+			      enum kernel_load_data_id load_id,
-		       char *description)
+			      char *description)
 {
 	if (load_id == LOADING_FIRMWARE) {
 		if ((ima_appraise & IMA_APPRAISE_FIRMWARE) &&
 	int ret = 0;
 	const char *audit_cause = "ENOMEM";
 	struct ima_template_entry *entry = NULL;
-	struct integrity_iint_cache iint = {};
+	struct ima_iint_cache iint = {};
 	struct ima_event_data event_data = {.iint = &iint,
 					    .filename = eventname,
 					    .buf = buf,
 }
 EXPORT_SYMBOL_GPL(ima_measure_critical_data);
+#ifdef CONFIG_INTEGRITY_ASYMMETRIC_KEYS
+/**
+ * ima_kernel_module_request - Prevent crypto-pkcs1pad(rsa,*) requests
+ * @kmod_name: kernel module name
+ *
+ * Avoid a verification loop where verifying the signature of the modprobe
+ * binary requires executing modprobe itself. Since the modprobe iint->mutex
+ * is already held when the signature verification is performed, a deadlock
+ * occurs as soon as modprobe is executed within the critical region, since
+ * the same lock cannot be taken again.
+ *
+ * This happens when public_key_verify_signature(), in case of RSA algorithm,
+ * use alg_name to store internal information in order to construct an
+ * algorithm on the fly, but crypto_larval_lookup() will try to use alg_name
+ * in order to load a kernel module with same name.
+ *
+ * Since we don't have any real "crypto-pkcs1pad(rsa,*)" kernel modules,
+ * we are safe to fail such module request from crypto_larval_lookup(), and
+ * avoid the verification loop.
+ *
+ * Return: Zero if it is safe to load the kernel module, -EINVAL otherwise.
+ */
+static int ima_kernel_module_request(char *kmod_name)
+{
+	if (strncmp(kmod_name, "crypto-pkcs1pad(rsa,", 20) == 0)
+		return -EINVAL;
+	return 0;
+}
+#endif /* CONFIG_INTEGRITY_ASYMMETRIC_KEYS */
 static int __init init_ima(void)
 {
 	int error;
 	return error;
 }
+static struct security_hook_list ima_hooks[] __ro_after_init = {
+	LSM_HOOK_INIT(bprm_check_security, ima_bprm_check),
+	LSM_HOOK_INIT(file_post_open, ima_file_check),
+	LSM_HOOK_INIT(inode_post_create_tmpfile, ima_post_create_tmpfile),
+	LSM_HOOK_INIT(file_release, ima_file_free),
+	LSM_HOOK_INIT(mmap_file, ima_file_mmap),
+	LSM_HOOK_INIT(file_mprotect, ima_file_mprotect),
+	LSM_HOOK_INIT(kernel_load_data, ima_load_data),
+	LSM_HOOK_INIT(kernel_post_load_data, ima_post_load_data),
+	LSM_HOOK_INIT(kernel_read_file, ima_read_file),
+	LSM_HOOK_INIT(kernel_post_read_file, ima_post_read_file),
+	LSM_HOOK_INIT(path_post_mknod, ima_post_path_mknod),
+#ifdef CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS
+	LSM_HOOK_INIT(key_post_create_or_update, ima_post_key_create_or_update),
+#endif
+#ifdef CONFIG_INTEGRITY_ASYMMETRIC_KEYS
+	LSM_HOOK_INIT(kernel_module_request, ima_kernel_module_request),
+#endif
+	LSM_HOOK_INIT(inode_free_security, ima_inode_free),
+};
+static const struct lsm_id ima_lsmid = {
+	.name = "ima",
+	.id = LSM_ID_IMA,
+};
+static int __init init_ima_lsm(void)
+{
+	ima_iintcache_init();
+	security_add_hooks(ima_hooks, ARRAY_SIZE(ima_hooks), &ima_lsmid);
+	init_ima_appraise_lsm(&ima_lsmid);
+	return 0;
+}
+struct lsm_blob_sizes ima_blob_sizes __ro_after_init = {
+	.lbs_inode = sizeof(struct ima_iint_cache *),
+};
+DEFINE_LSM(ima) = {
+	.name = "ima",
+	.init = init_ima_lsm,
+	.order = LSM_ORDER_LAST,
+	.blobs = &ima_blob_sizes,
+};
 late_initcall(init_ima);	/* Start IMA after the TPM is available */

security/integrity/ima/ima_policy.c+1−1

@@ -49,7 +49,7 @@ · 48 unmodified lines
49	#define DONT_HASH 0x0200	49	#define DONT_HASH 0x0200
50		50
51	#define INVALID_PCR(a) (((a) < 0) \|\| \	51	#define INVALID_PCR(a) (((a) < 0) \|\| \
52	(a) >= (sizeof_field(struct integrity_iint_cache, measured_pcrs) * 8))	52	(a) >= (sizeof_field(struct ima_iint_cache, measured_pcrs) * 8))
53		53
54	int ima_policy_flag;	54	int ima_policy_flag;
55	static int temp_ima_appraise;	55	static int temp_ima_appraise;

security/integrity/integrity.h+1−79

@@ -18,60 +18,7 @@ · 17 unmodified lines
18	#include <crypto/hash.h>	18	#include <crypto/hash.h>
19	#include <linux/key.h>	19	#include <linux/key.h>
20	#include <linux/audit.h>	20	#include <linux/audit.h>
21		21	#include <linux/lsm_hooks.h>
22	/* iint action cache flags */
23	#define IMA_MEASURE 0x00000001
24	#define IMA_MEASURED 0x00000002
25	#define IMA_APPRAISE 0x00000004
26	#define IMA_APPRAISED 0x00000008
27	/#define IMA_COLLECT 0x00000010 do not use this flag /
28	#define IMA_COLLECTED 0x00000020
29	#define IMA_AUDIT 0x00000040
30	#define IMA_AUDITED 0x00000080
31	#define IMA_HASH 0x00000100
32	#define IMA_HASHED 0x00000200
33
34	/* iint policy rule cache flags */
35	#define IMA_NONACTION_FLAGS 0xff000000
36	#define IMA_DIGSIG_REQUIRED 0x01000000
37	#define IMA_PERMIT_DIRECTIO 0x02000000
38	#define IMA_NEW_FILE 0x04000000
39	#define EVM_IMMUTABLE_DIGSIG 0x08000000
40	#define IMA_FAIL_UNVERIFIABLE_SIGS 0x10000000
41	#define IMA_MODSIG_ALLOWED 0x20000000
42	#define IMA_CHECK_BLACKLIST 0x40000000
43	#define IMA_VERITY_REQUIRED 0x80000000
44
45	#define IMA_DO_MASK (IMA_MEASURE \| IMA_APPRAISE \| IMA_AUDIT \| \
46	IMA_HASH \| IMA_APPRAISE_SUBMASK)
47	#define IMA_DONE_MASK (IMA_MEASURED \| IMA_APPRAISED \| IMA_AUDITED \| \
48	IMA_HASHED \| IMA_COLLECTED \| \
49	IMA_APPRAISED_SUBMASK)
50
51	/* iint subaction appraise cache flags */
52	#define IMA_FILE_APPRAISE 0x00001000
53	#define IMA_FILE_APPRAISED 0x00002000
54	#define IMA_MMAP_APPRAISE 0x00004000
55	#define IMA_MMAP_APPRAISED 0x00008000
56	#define IMA_BPRM_APPRAISE 0x00010000
57	#define IMA_BPRM_APPRAISED 0x00020000
58	#define IMA_READ_APPRAISE 0x00040000
59	#define IMA_READ_APPRAISED 0x00080000
60	#define IMA_CREDS_APPRAISE 0x00100000
61	#define IMA_CREDS_APPRAISED 0x00200000
62	#define IMA_APPRAISE_SUBMASK (IMA_FILE_APPRAISE \| IMA_MMAP_APPRAISE \| \
63	IMA_BPRM_APPRAISE \| IMA_READ_APPRAISE \| \
64	IMA_CREDS_APPRAISE)
65	#define IMA_APPRAISED_SUBMASK (IMA_FILE_APPRAISED \| IMA_MMAP_APPRAISED \| \
66	IMA_BPRM_APPRAISED \| IMA_READ_APPRAISED \| \
67	IMA_CREDS_APPRAISED)
68
69	/* iint cache atomic_flags */
70	#define IMA_CHANGE_XATTR 0
71	#define IMA_UPDATE_XATTR 1
72	#define IMA_CHANGE_ATTR 2
73	#define IMA_DIGSIG 3
74	#define IMA_MUST_MEASURE 4
75		22
76	enum evm_ima_xattr_type {	23	enum evm_ima_xattr_type {
77	IMA_XATTR_DIGEST = 0x01,	24	IMA_XATTR_DIGEST = 0x01,
@@ -155,31 +102,6 @@ struct ima_file_id { · 77 unmodified lines
155	__u8 hash[HASH_MAX_DIGESTSIZE];	102	__u8 hash[HASH_MAX_DIGESTSIZE];
156	} __packed;	103	} __packed;
157		104
158	/* integrity data associated with an inode */
159	struct integrity_iint_cache {
160	struct rb_node rb_node; /* rooted in integrity_iint_tree */
161	struct mutex mutex; /* protects: version, flags, digest */
162	struct inode inode; / back pointer to inode in question */
163	u64 version; /* track inode changes */
164	unsigned long flags;
165	unsigned long measured_pcrs;
166	unsigned long atomic_flags;
167	unsigned long real_ino;
168	dev_t real_dev;
169	enum integrity_status ima_file_status:4;
170	enum integrity_status ima_mmap_status:4;
171	enum integrity_status ima_bprm_status:4;
172	enum integrity_status ima_read_status:4;
173	enum integrity_status ima_creds_status:4;
174	enum integrity_status evm_status:4;
175	struct ima_digest_data *ima_hash;
176	};
177
178	/* rbtree tree calls to lookup, insert, delete
179	* integrity data associated with an inode.
180	*/
181	struct integrity_iint_cache integrity_iint_find(struct inode inode);
182
183	int integrity_kernel_read(struct file *file, loff_t offset,	105	int integrity_kernel_read(struct file *file, loff_t offset,
184	void *addr, unsigned long count);	106	void *addr, unsigned long count);
185		107

security/keys/key.c+4−6

 #include <linux/security.h>
 #include <linux/workqueue.h>
 #include <linux/random.h>
-#include <linux/ima.h>
 #include <linux/err.h>
 #include "internal.h"
 		goto error_link_end;
 	}
-	ima_post_key_create_or_update(keyring, key, payload, plen,
+	security_key_post_create_or_update(keyring, key, payload, plen, flags,
-				      flags, true);
+					   true);
 	key_ref = make_key_ref(key, is_key_possessed(keyring_ref));
 	key_ref = __key_update(key_ref, &prep);
 	if (!IS_ERR(key_ref))
-		ima_post_key_create_or_update(keyring, key,
+		security_key_post_create_or_update(keyring, key, payload, plen,
-					      payload, plen,
+						   flags, false);
-					      flags, false);
 	goto error_free_prep;
 }

security/security.c+381−400

@@ -19,15 +19,13 @@ · 18 unmodified lines
19	#include <linux/kernel.h>	19	#include <linux/kernel.h>
20	#include <linux/kernel_read_file.h>	20	#include <linux/kernel_read_file.h>
21	#include <linux/lsm_hooks.h>	21	#include <linux/lsm_hooks.h>
22	#include <linux/integrity.h>
23	#include <linux/ima.h>
24	#include <linux/evm.h>
25	#include <linux/fsnotify.h>	22	#include <linux/fsnotify.h>
26	#include <linux/mman.h>	23	#include <linux/mman.h>
27	#include <linux/mount.h>	24	#include <linux/mount.h>
28	#include <linux/personality.h>	25	#include <linux/personality.h>
29	#include <linux/backing-dev.h>	26	#include <linux/backing-dev.h>
30	#include <linux/string.h>	27	#include <linux/string.h>
		28	#include <linux/xattr.h>
31	#include <linux/msg.h>	29	#include <linux/msg.h>
32	#include <linux/overflow.h>	30	#include <linux/overflow.h>
33	#include <net/flow.h>	31	#include <net/flow.h>
@@ -51,7 +49,9 @@ · 17 unmodified lines
51	(IS_ENABLED(CONFIG_SECURITY_SAFESETID) ? 1 : 0) + \	49	(IS_ENABLED(CONFIG_SECURITY_SAFESETID) ? 1 : 0) + \
52	(IS_ENABLED(CONFIG_SECURITY_LOCKDOWN_LSM) ? 1 : 0) + \	50	(IS_ENABLED(CONFIG_SECURITY_LOCKDOWN_LSM) ? 1 : 0) + \
53	(IS_ENABLED(CONFIG_BPF_LSM) ? 1 : 0) + \	51	(IS_ENABLED(CONFIG_BPF_LSM) ? 1 : 0) + \
54	(IS_ENABLED(CONFIG_SECURITY_LANDLOCK) ? 1 : 0))	52	(IS_ENABLED(CONFIG_SECURITY_LANDLOCK) ? 1 : 0) + \
		53	(IS_ENABLED(CONFIG_IMA) ? 1 : 0) + \
		54	(IS_ENABLED(CONFIG_EVM) ? 1 : 0))
55		55
56	/*	56	/*
57	* These are descriptions of the reasons that can be passed to the	57	* These are descriptions of the reasons that can be passed to the
@@ -856,14 +856,14 @@ out: · 798 unmodified lines
856	P->hook.FUNC(__VA_ARGS__); \	856	P->hook.FUNC(__VA_ARGS__); \
857	} while (0)	857	} while (0)
858		858
859	#define call_int_hook(FUNC, IRC, ...) ({ \	859	#define call_int_hook(FUNC, ...) ({ \
860	int RC = IRC; \	860	int RC = LSM_RET_DEFAULT(FUNC); \
861	do { \	861	do { \
862	struct security_hook_list *P; \	862	struct security_hook_list *P; \
863	\	863	\
864	hlist_for_each_entry(P, &security_hook_heads.FUNC, list) { \	864	hlist_for_each_entry(P, &security_hook_heads.FUNC, list) { \
865	RC = P->hook.FUNC(__VA_ARGS__); \	865	RC = P->hook.FUNC(__VA_ARGS__); \
866	if (RC != 0) \	866	if (RC != LSM_RET_DEFAULT(FUNC)) \
867	break; \	867	break; \
868	} \	868	} \
869	} while (0); \	869	} while (0); \
@@ -882,7 +882,7 @@ out: · 12 unmodified lines
882	*/	882	*/
883	int security_binder_set_context_mgr(const struct cred *mgr)	883	int security_binder_set_context_mgr(const struct cred *mgr)
884	{	884	{
885	return call_int_hook(binder_set_context_mgr, 0, mgr);	885	return call_int_hook(binder_set_context_mgr, mgr);
886	}	886	}
887		887
888	/**	888	/**
@@ -897,7 +897,7 @@ int security_binder_set_context_mgr(const struct cred *mgr) · 8 unmodified lines
897	int security_binder_transaction(const struct cred *from,	897	int security_binder_transaction(const struct cred *from,
898	const struct cred *to)	898	const struct cred *to)
899	{	899	{
900	return call_int_hook(binder_transaction, 0, from, to);	900	return call_int_hook(binder_transaction, from, to);
901	}	901	}
902		902
903	/**	903	/**
@@ -912,7 +912,7 @@ int security_binder_transaction(const struct cred *from, · 8 unmodified lines
912	int security_binder_transfer_binder(const struct cred *from,	912	int security_binder_transfer_binder(const struct cred *from,
913	const struct cred *to)	913	const struct cred *to)
914	{	914	{
915	return call_int_hook(binder_transfer_binder, 0, from, to);	915	return call_int_hook(binder_transfer_binder, from, to);
916	}	916	}
917		917
918	/**	918	/**
@@ -928,7 +928,7 @@ int security_binder_transfer_binder(const struct cred *from, · 9 unmodified lines
928	int security_binder_transfer_file(const struct cred *from,	928	int security_binder_transfer_file(const struct cred *from,
929	const struct cred to, const struct file file)	929	const struct cred to, const struct file file)
930	{	930	{
931	return call_int_hook(binder_transfer_file, 0, from, to, file);	931	return call_int_hook(binder_transfer_file, from, to, file);
932	}	932	}
933		933
934	/**	934	/**
@@ -947,7 +947,7 @@ int security_binder_transfer_file(const struct cred *from, · 12 unmodified lines
947	*/	947	*/
948	int security_ptrace_access_check(struct task_struct *child, unsigned int mode)	948	int security_ptrace_access_check(struct task_struct *child, unsigned int mode)
949	{	949	{
950	return call_int_hook(ptrace_access_check, 0, child, mode);	950	return call_int_hook(ptrace_access_check, child, mode);
951	}	951	}
952		952
953	/**	953	/**
@@ -962,7 +962,7 @@ int security_ptrace_access_check(struct task_struct *child, unsigned int mode) · 8 unmodified lines
962	*/	962	*/
963	int security_ptrace_traceme(struct task_struct *parent)	963	int security_ptrace_traceme(struct task_struct *parent)
964	{	964	{
965	return call_int_hook(ptrace_traceme, 0, parent);	965	return call_int_hook(ptrace_traceme, parent);
966	}	966	}
967		967
968	/**	968	/**
@@ -984,8 +984,7 @@ int security_capget(const struct task_struct *target, · 15 unmodified lines
984	kernel_cap_t *inheritable,	984	kernel_cap_t *inheritable,
985	kernel_cap_t *permitted)	985	kernel_cap_t *permitted)
986	{	986	{
987	return call_int_hook(capget, 0, target,	987	return call_int_hook(capget, target, effective, inheritable, permitted);
988	effective, inheritable, permitted);
989	}	988	}
990		989
991	/**	990	/**
@@ -1006,8 +1005,8 @@ int security_capset(struct cred new, const struct cred old, · 14 unmodified lines
1006	const kernel_cap_t *inheritable,	1005	const kernel_cap_t *inheritable,
1007	const kernel_cap_t *permitted)	1006	const kernel_cap_t *permitted)
1008	{	1007	{
1009	return call_int_hook(capset, 0, new, old,	1008	return call_int_hook(capset, new, old, effective, inheritable,
1010	effective, inheritable, permitted);	1009	permitted);
1011	}	1010	}
1012		1011
1013	/**	1012	/**
@@ -1028,7 +1027,7 @@ int security_capable(const struct cred *cred, · 14 unmodified lines
1028	int cap,	1027	int cap,
1029	unsigned int opts)	1028	unsigned int opts)
1030	{	1029	{
1031	return call_int_hook(capable, 0, cred, ns, cap, opts);	1030	return call_int_hook(capable, cred, ns, cap, opts);
1032	}	1031	}
1033		1032
1034	/**	1033	/**
@@ -1044,7 +1043,7 @@ int security_capable(const struct cred *cred, · 9 unmodified lines
1044	*/	1043	*/
1045	int security_quotactl(int cmds, int type, int id, const struct super_block *sb)	1044	int security_quotactl(int cmds, int type, int id, const struct super_block *sb)
1046	{	1045	{
1047	return call_int_hook(quotactl, 0, cmds, type, id, sb);	1046	return call_int_hook(quotactl, cmds, type, id, sb);
1048	}	1047	}
1049		1048
1050	/**	1049	/**
@@ -1057,7 +1056,7 @@ int security_quotactl(int cmds, int type, int id, const struct super_block *sb) · 6 unmodified lines
1057	*/	1056	*/
1058	int security_quota_on(struct dentry *dentry)	1057	int security_quota_on(struct dentry *dentry)
1059	{	1058	{
1060	return call_int_hook(quota_on, 0, dentry);	1059	return call_int_hook(quota_on, dentry);
1061	}	1060	}
1062		1061
1063	/**	1062	/**
@@ -1072,7 +1071,7 @@ int security_quota_on(struct dentry *dentry) · 8 unmodified lines
1072	*/	1071	*/
1073	int security_syslog(int type)	1072	int security_syslog(int type)
1074	{	1073	{
1075	return call_int_hook(syslog, 0, type);	1074	return call_int_hook(syslog, type);
1076	}	1075	}
1077		1076
1078	/**	1077	/**
@@ -1087,7 +1086,7 @@ int security_syslog(int type) · 8 unmodified lines
1087	*/	1086	*/
1088	int security_settime64(const struct timespec64 ts, const struct timezone tz)	1087	int security_settime64(const struct timespec64 ts, const struct timezone tz)
1089	{	1088	{
1090	return call_int_hook(settime, 0, ts, tz);	1089	return call_int_hook(settime, ts, tz);
1091	}	1090	}
1092		1091
1093	/**	1092	/**
@@ -1142,7 +1141,7 @@ int security_vm_enough_memory_mm(struct mm_struct *mm, long pages) · 48 unmodified lines
1142	*/	1141	*/
1143	int security_bprm_creds_for_exec(struct linux_binprm *bprm)	1142	int security_bprm_creds_for_exec(struct linux_binprm *bprm)
1144	{	1143	{
1145	return call_int_hook(bprm_creds_for_exec, 0, bprm);	1144	return call_int_hook(bprm_creds_for_exec, bprm);
1146	}	1145	}
1147		1146
1148	/**	1147	/**
@@ -1166,7 +1165,7 @@ int security_bprm_creds_for_exec(struct linux_binprm *bprm) · 17 unmodified lines
1166	*/	1165	*/
1167	int security_bprm_creds_from_file(struct linux_binprm bprm, const struct file file)	1166	int security_bprm_creds_from_file(struct linux_binprm bprm, const struct file file)
1168	{	1167	{
1169	return call_int_hook(bprm_creds_from_file, 0, bprm, file);	1168	return call_int_hook(bprm_creds_from_file, bprm, file);
1170	}	1169	}
1171		1170
1172	/**	1171	/**
@@ -1183,12 +1182,7 @@ int security_bprm_creds_from_file(struct linux_binprm bprm, const struct file · 10 unmodified lines
1183	*/	1182	*/
1184	int security_bprm_check(struct linux_binprm *bprm)	1183	int security_bprm_check(struct linux_binprm *bprm)
1185	{	1184	{
1186	int ret;	1185	return call_int_hook(bprm_check_security, bprm);
1187
1188	ret = call_int_hook(bprm_check_security, 0, bprm);
1189	if (ret)
1190	return ret;
1191	return ima_bprm_check(bprm);
1192	}	1186	}
1193		1187
1194	/**	1188	/**
@@ -1235,7 +1229,7 @@ void security_bprm_committed_creds(const struct linux_binprm *bprm) · 40 unmodified lines
1235	*/	1229	*/
1236	int security_fs_context_submount(struct fs_context fc, struct super_block reference)	1230	int security_fs_context_submount(struct fs_context fc, struct super_block reference)
1237	{	1231	{
1238	return call_int_hook(fs_context_submount, 0, fc, reference);	1232	return call_int_hook(fs_context_submount, fc, reference);
1239	}	1233	}
1240		1234
1241	/**	1235	/**
@@ -1251,7 +1245,7 @@ int security_fs_context_submount(struct fs_context fc, struct super_block refe · 9 unmodified lines
1251	*/	1245	*/
1252	int security_fs_context_dup(struct fs_context fc, struct fs_context src_fc)	1246	int security_fs_context_dup(struct fs_context fc, struct fs_context src_fc)
1253	{	1247	{
1254	return call_int_hook(fs_context_dup, 0, fc, src_fc);	1248	return call_int_hook(fs_context_dup, fc, src_fc);
1255	}	1249	}
1256		1250
1257	/**	1251	/**
@@ -1300,7 +1294,7 @@ int security_sb_alloc(struct super_block *sb) · 42 unmodified lines
1300		1294
1301	if (unlikely(rc))	1295	if (unlikely(rc))
1302	return rc;	1296	return rc;
1303	rc = call_int_hook(sb_alloc_security, 0, sb);	1297	rc = call_int_hook(sb_alloc_security, sb);
1304	if (unlikely(rc))	1298	if (unlikely(rc))
1305	security_sb_free(sb);	1299	security_sb_free(sb);
1306	return rc;	1300	return rc;
@@ -1358,7 +1352,7 @@ EXPORT_SYMBOL(security_free_mnt_opts); · 51 unmodified lines
1358	*/	1352	*/
1359	int security_sb_eat_lsm_opts(char options, void *mnt_opts)	1353	int security_sb_eat_lsm_opts(char options, void *mnt_opts)
1360	{	1354	{
1361	return call_int_hook(sb_eat_lsm_opts, 0, options, mnt_opts);	1355	return call_int_hook(sb_eat_lsm_opts, options, mnt_opts);
1362	}	1356	}
1363	EXPORT_SYMBOL(security_sb_eat_lsm_opts);	1357	EXPORT_SYMBOL(security_sb_eat_lsm_opts);
1364		1358
@@ -1375,7 +1369,7 @@ EXPORT_SYMBOL(security_sb_eat_lsm_opts); · 10 unmodified lines
1375	int security_sb_mnt_opts_compat(struct super_block *sb,	1369	int security_sb_mnt_opts_compat(struct super_block *sb,
1376	void *mnt_opts)	1370	void *mnt_opts)
1377	{	1371	{
1378	return call_int_hook(sb_mnt_opts_compat, 0, sb, mnt_opts);	1372	return call_int_hook(sb_mnt_opts_compat, sb, mnt_opts);
1379	}	1373	}
1380	EXPORT_SYMBOL(security_sb_mnt_opts_compat);	1374	EXPORT_SYMBOL(security_sb_mnt_opts_compat);
1381		1375
@@ -1392,7 +1386,7 @@ EXPORT_SYMBOL(security_sb_mnt_opts_compat); · 10 unmodified lines
1392	int security_sb_remount(struct super_block *sb,	1386	int security_sb_remount(struct super_block *sb,
1393	void *mnt_opts)	1387	void *mnt_opts)
1394	{	1388	{
1395	return call_int_hook(sb_remount, 0, sb, mnt_opts);	1389	return call_int_hook(sb_remount, sb, mnt_opts);
1396	}	1390	}
1397	EXPORT_SYMBOL(security_sb_remount);	1391	EXPORT_SYMBOL(security_sb_remount);
1398		1392
@@ -1406,7 +1400,7 @@ EXPORT_SYMBOL(security_sb_remount); · 7 unmodified lines
1406	*/	1400	*/
1407	int security_sb_kern_mount(const struct super_block *sb)	1401	int security_sb_kern_mount(const struct super_block *sb)
1408	{	1402	{
1409	return call_int_hook(sb_kern_mount, 0, sb);	1403	return call_int_hook(sb_kern_mount, sb);
1410	}	1404	}
1411		1405
1412	/**	1406	/**
@@ -1420,7 +1414,7 @@ int security_sb_kern_mount(const struct super_block *sb) · 7 unmodified lines
1420	*/	1414	*/
1421	int security_sb_show_options(struct seq_file m, struct super_block sb)	1415	int security_sb_show_options(struct seq_file m, struct super_block sb)
1422	{	1416	{
1423	return call_int_hook(sb_show_options, 0, m, sb);	1417	return call_int_hook(sb_show_options, m, sb);
1424	}	1418	}
1425		1419
1426	/**	1420	/**
@@ -1434,7 +1428,7 @@ int security_sb_show_options(struct seq_file m, struct super_block sb) · 7 unmodified lines
1434	*/	1428	*/
1435	int security_sb_statfs(struct dentry *dentry)	1429	int security_sb_statfs(struct dentry *dentry)
1436	{	1430	{
1437	return call_int_hook(sb_statfs, 0, dentry);	1431	return call_int_hook(sb_statfs, dentry);
1438	}	1432	}
1439		1433
1440	/**	1434	/**
@@ -1457,7 +1451,7 @@ int security_sb_statfs(struct dentry *dentry) · 16 unmodified lines
1457	int security_sb_mount(const char dev_name, const struct path path,	1451	int security_sb_mount(const char dev_name, const struct path path,
1458	const char type, unsigned long flags, void data)	1452	const char type, unsigned long flags, void data)
1459	{	1453	{
1460	return call_int_hook(sb_mount, 0, dev_name, path, type, flags, data);	1454	return call_int_hook(sb_mount, dev_name, path, type, flags, data);
1461	}	1455	}
1462		1456
1463	/**	1457	/**
@@ -1471,7 +1465,7 @@ int security_sb_mount(const char dev_name, const struct path path, · 7 unmodified lines
1471	*/	1465	*/
1472	int security_sb_umount(struct vfsmount *mnt, int flags)	1466	int security_sb_umount(struct vfsmount *mnt, int flags)
1473	{	1467	{
1474	return call_int_hook(sb_umount, 0, mnt, flags);	1468	return call_int_hook(sb_umount, mnt, flags);
1475	}	1469	}
1476		1470
1477	/**	1471	/**
@@ -1486,7 +1480,7 @@ int security_sb_umount(struct vfsmount *mnt, int flags) · 8 unmodified lines
1486	int security_sb_pivotroot(const struct path *old_path,	1480	int security_sb_pivotroot(const struct path *old_path,
1487	const struct path *new_path)	1481	const struct path *new_path)
1488	{	1482	{
1489	return call_int_hook(sb_pivotroot, 0, old_path, new_path);	1483	return call_int_hook(sb_pivotroot, old_path, new_path);
1490	}	1484	}
1491		1485
1492	/**	1486	/**
@@ -1505,9 +1499,17 @@ int security_sb_set_mnt_opts(struct super_block *sb, · 12 unmodified lines
1505	unsigned long kern_flags,	1499	unsigned long kern_flags,
1506	unsigned long *set_kern_flags)	1500	unsigned long *set_kern_flags)
1507	{	1501	{
1508	return call_int_hook(sb_set_mnt_opts,	1502	struct security_hook_list *hp;
1509	mnt_opts ? -EOPNOTSUPP : 0, sb,	1503	int rc = mnt_opts ? -EOPNOTSUPP : LSM_RET_DEFAULT(sb_set_mnt_opts);
1510	mnt_opts, kern_flags, set_kern_flags);	1504
		1505	hlist_for_each_entry(hp, &security_hook_heads.sb_set_mnt_opts,
		1506	list) {
		1507	rc = hp->hook.sb_set_mnt_opts(sb, mnt_opts, kern_flags,
		1508	set_kern_flags);
		1509	if (rc != LSM_RET_DEFAULT(sb_set_mnt_opts))
		1510	break;
		1511	}
		1512	return rc;
1511	}	1513	}
1512	EXPORT_SYMBOL(security_sb_set_mnt_opts);	1514	EXPORT_SYMBOL(security_sb_set_mnt_opts);
1513		1515
@@ -1527,7 +1529,7 @@ int security_sb_clone_mnt_opts(const struct super_block *oldsb, · 13 unmodified lines
1527	unsigned long kern_flags,	1529	unsigned long kern_flags,
1528	unsigned long *set_kern_flags)	1530	unsigned long *set_kern_flags)
1529	{	1531	{
1530	return call_int_hook(sb_clone_mnt_opts, 0, oldsb, newsb,	1532	return call_int_hook(sb_clone_mnt_opts, oldsb, newsb,
1531	kern_flags, set_kern_flags);	1533	kern_flags, set_kern_flags);
1532	}	1534	}
1533	EXPORT_SYMBOL(security_sb_clone_mnt_opts);	1535	EXPORT_SYMBOL(security_sb_clone_mnt_opts);
@@ -1544,7 +1546,7 @@ EXPORT_SYMBOL(security_sb_clone_mnt_opts); · 10 unmodified lines
1544	int security_move_mount(const struct path *from_path,	1546	int security_move_mount(const struct path *from_path,
1545	const struct path *to_path)	1547	const struct path *to_path)
1546	{	1548	{
1547	return call_int_hook(move_mount, 0, from_path, to_path);	1549	return call_int_hook(move_mount, from_path, to_path);
1548	}	1550	}
1549		1551
1550	/**	1552	/**
@@ -1561,7 +1563,7 @@ int security_move_mount(const struct path *from_path, · 10 unmodified lines
1561	int security_path_notify(const struct path *path, u64 mask,	1563	int security_path_notify(const struct path *path, u64 mask,
1562	unsigned int obj_type)	1564	unsigned int obj_type)
1563	{	1565	{
1564	return call_int_hook(path_notify, 0, path, mask, obj_type);	1566	return call_int_hook(path_notify, path, mask, obj_type);
1565	}	1567	}
1566		1568
1567	/**	1569	/**
@@ -1580,7 +1582,7 @@ int security_inode_alloc(struct inode *inode) · 12 unmodified lines
1580		1582
1581	if (unlikely(rc))	1583	if (unlikely(rc))
1582	return rc;	1584	return rc;
1583	rc = call_int_hook(inode_alloc_security, 0, inode);	1585	rc = call_int_hook(inode_alloc_security, inode);
1584	if (unlikely(rc))	1586	if (unlikely(rc))
1585	security_inode_free(inode);	1587	security_inode_free(inode);
1586	return rc;	1588	return rc;
@@ -1602,7 +1604,6 @@ static void inode_free_by_rcu(struct rcu_head *head) · 15 unmodified lines
1602	*/	1604	*/
1603	void security_inode_free(struct inode *inode)	1605	void security_inode_free(struct inode *inode)
1604	{	1606	{
1605	integrity_inode_free(inode);
1606	call_void_hook(inode_free_security, inode);	1607	call_void_hook(inode_free_security, inode);
1607	/*	1608	/*
1608	* The inode may still be referenced in a path walk and	1609	* The inode may still be referenced in a path walk and
@@ -1638,20 +1639,8 @@ int security_dentry_init_security(struct dentry *dentry, int mode, · 29 unmodified lines
1638	const char xattr_name, void ctx,	1639	const char xattr_name, void ctx,
1639	u32 *ctxlen)	1640	u32 *ctxlen)
1640	{	1641	{
1641	struct security_hook_list *hp;	1642	return call_int_hook(dentry_init_security, dentry, mode, name,
1642	int rc;	1643	xattr_name, ctx, ctxlen);
1643
1644	/*
1645	* Only one module will provide a security context.
1646	*/
1647	hlist_for_each_entry(hp, &security_hook_heads.dentry_init_security,
1648	list) {
1649	rc = hp->hook.dentry_init_security(dentry, mode, name,
1650	xattr_name, ctx, ctxlen);
1651	if (rc != LSM_RET_DEFAULT(dentry_init_security))
1652	return rc;
1653	}
1654	return LSM_RET_DEFAULT(dentry_init_security);
1655	}	1644	}
1656	EXPORT_SYMBOL(security_dentry_init_security);	1645	EXPORT_SYMBOL(security_dentry_init_security);
1657		1646
@@ -1674,7 +1663,7 @@ int security_dentry_create_files_as(struct dentry *dentry, int mode, · 16 unmodified lines
1674	struct qstr *name,	1663	struct qstr *name,
1675	const struct cred old, struct cred new)	1664	const struct cred old, struct cred new)
1676	{	1665	{
1677	return call_int_hook(dentry_create_files_as, 0, dentry, mode,	1666	return call_int_hook(dentry_create_files_as, dentry, mode,
1678	name, old, new);	1667	name, old, new);
1679	}	1668	}
1680	EXPORT_SYMBOL(security_dentry_create_files_as);	1669	EXPORT_SYMBOL(security_dentry_create_files_as);
@@ -1721,8 +1710,8 @@ int security_inode_init_security(struct inode inode, struct inode dir, · 40 unmodified lines
1721	return 0;	1710	return 0;
1722		1711
1723	if (initxattrs) {	1712	if (initxattrs) {
1724	/* Allocate +1 for EVM and +1 as terminator. */	1713	/* Allocate +1 as terminator. */
1725	new_xattrs = kcalloc(blob_sizes.lbs_xattr_count + 2,	1714	new_xattrs = kcalloc(blob_sizes.lbs_xattr_count + 1,
1726	sizeof(*new_xattrs), GFP_NOFS);	1715	sizeof(*new_xattrs), GFP_NOFS);
1727	if (!new_xattrs)	1716	if (!new_xattrs)
1728	return -ENOMEM;	1717	return -ENOMEM;
@@ -1746,10 +1735,6 @@ int security_inode_init_security(struct inode inode, struct inode dir, · 17 unmodified lines
1746	if (!xattr_count)	1735	if (!xattr_count)
1747	goto out;	1736	goto out;
1748		1737
1749	ret = evm_inode_init_security(inode, dir, qstr, new_xattrs,
1750	&xattr_count);
1751	if (ret)
1752	goto out;
1753	ret = initxattrs(inode, new_xattrs, fs_data);	1738	ret = initxattrs(inode, new_xattrs, fs_data);
1754	out:	1739	out:
1755	for (; xattr_count > 0; xattr_count--)	1740	for (; xattr_count > 0; xattr_count--)
@@ -1775,7 +1760,7 @@ int security_inode_init_security_anon(struct inode *inode, · 19 unmodified lines
1775	const struct qstr *name,	1760	const struct qstr *name,
1776	const struct inode *context_inode)	1761	const struct inode *context_inode)
1777	{	1762	{
1778	return call_int_hook(inode_init_security_anon, 0, inode, name,	1763	return call_int_hook(inode_init_security_anon, inode, name,
1779	context_inode);	1764	context_inode);
1780	}	1765	}
1781		1766
@@ -1797,10 +1782,24 @@ int security_path_mknod(const struct path dir, struct dentry dentry, · 15 unmodified lines
1797	{	1782	{
1798	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))	1783	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
1799	return 0;	1784	return 0;
1800	return call_int_hook(path_mknod, 0, dir, dentry, mode, dev);	1785	return call_int_hook(path_mknod, dir, dentry, mode, dev);
1801	}	1786	}
1802	EXPORT_SYMBOL(security_path_mknod);	1787	EXPORT_SYMBOL(security_path_mknod);
1803		1788
		1789	/**
		1790	* security_path_post_mknod() - Update inode security field after file creation
		1791	* @idmap: idmap of the mount
		1792	* @dentry: new file
		1793	*
		1794	* Update inode security field after a file has been created.
		1795	*/
		1796	void security_path_post_mknod(struct mnt_idmap idmap, struct dentry dentry)
		1797	{
		1798	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
		1799	return;
		1800	call_void_hook(path_post_mknod, idmap, dentry);
		1801	}
		1802
1804	/**	1803	/**
1805	* security_path_mkdir() - Check if creating a new directory is allowed	1804	* security_path_mkdir() - Check if creating a new directory is allowed
1806	* @dir: parent directory	1805	* @dir: parent directory
@@ -1816,7 +1815,7 @@ int security_path_mkdir(const struct path dir, struct dentry dentry, · 9 unmodified lines
1816	{	1815	{
1817	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))	1816	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
1818	return 0;	1817	return 0;
1819	return call_int_hook(path_mkdir, 0, dir, dentry, mode);	1818	return call_int_hook(path_mkdir, dir, dentry, mode);
1820	}	1819	}
1821	EXPORT_SYMBOL(security_path_mkdir);	1820	EXPORT_SYMBOL(security_path_mkdir);
1822		1821
@@ -1833,7 +1832,7 @@ int security_path_rmdir(const struct path dir, struct dentry dentry) · 10 unmodified lines
1833	{	1832	{
1834	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))	1833	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
1835	return 0;	1834	return 0;
1836	return call_int_hook(path_rmdir, 0, dir, dentry);	1835	return call_int_hook(path_rmdir, dir, dentry);
1837	}	1836	}
1838		1837
1839	/**	1838	/**
@@ -1849,7 +1848,7 @@ int security_path_unlink(const struct path dir, struct dentry dentry) · 9 unmodified lines
1849	{	1848	{
1850	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))	1849	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
1851	return 0;	1850	return 0;
1852	return call_int_hook(path_unlink, 0, dir, dentry);	1851	return call_int_hook(path_unlink, dir, dentry);
1853	}	1852	}
1854	EXPORT_SYMBOL(security_path_unlink);	1853	EXPORT_SYMBOL(security_path_unlink);
1855		1854
@@ -1868,7 +1867,7 @@ int security_path_symlink(const struct path dir, struct dentry dentry, · 12 unmodified lines
1868	{	1867	{
1869	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))	1868	if (unlikely(IS_PRIVATE(d_backing_inode(dir->dentry))))
1870	return 0;	1869	return 0;
1871	return call_int_hook(path_symlink, 0, dir, dentry, old_name);	1870	return call_int_hook(path_symlink, dir, dentry, old_name);
1872	}	1871	}
1873		1872
1874	/**	1873	/**
@@ -1886,7 +1885,7 @@ int security_path_link(struct dentry old_dentry, const struct path new_dir, · 11 unmodified lines
1886	{	1885	{
1887	if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))	1886	if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))
1888	return 0;	1887	return 0;
1889	return call_int_hook(path_link, 0, old_dentry, new_dir, new_dentry);	1888	return call_int_hook(path_link, old_dentry, new_dir, new_dentry);
1890	}	1889	}
1891		1890
1892	/**	1891	/**
@@ -1910,7 +1909,7 @@ int security_path_rename(const struct path old_dir, struct dentry old_dentry, · 17 unmodified lines
1910	IS_PRIVATE(d_backing_inode(new_dentry)))))	1909	IS_PRIVATE(d_backing_inode(new_dentry)))))
1911	return 0;	1910	return 0;
1912		1911
1913	return call_int_hook(path_rename, 0, old_dir, old_dentry, new_dir,	1912	return call_int_hook(path_rename, old_dir, old_dentry, new_dir,
1914	new_dentry, flags);	1913	new_dentry, flags);
1915	}	1914	}
1916	EXPORT_SYMBOL(security_path_rename);	1915	EXPORT_SYMBOL(security_path_rename);
@@ -1929,7 +1928,7 @@ int security_path_truncate(const struct path *path) · 12 unmodified lines
1929	{	1928	{
1930	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))	1929	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
1931	return 0;	1930	return 0;
1932	return call_int_hook(path_truncate, 0, path);	1931	return call_int_hook(path_truncate, path);
1933	}	1932	}
1934		1933
1935	/**	1934	/**
@@ -1947,7 +1946,7 @@ int security_path_chmod(const struct path *path, umode_t mode) · 11 unmodified lines
1947	{	1946	{
1948	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))	1947	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
1949	return 0;	1948	return 0;
1950	return call_int_hook(path_chmod, 0, path, mode);	1949	return call_int_hook(path_chmod, path, mode);
1951	}	1950	}
1952		1951
1953	/**	1952	/**
@@ -1964,7 +1963,7 @@ int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid) · 10 unmodified lines
1964	{	1963	{
1965	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))	1964	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
1966	return 0;	1965	return 0;
1967	return call_int_hook(path_chown, 0, path, uid, gid);	1966	return call_int_hook(path_chown, path, uid, gid);
1968	}	1967	}
1969		1968
1970	/**	1969	/**
@@ -1977,7 +1976,7 @@ int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid) · 6 unmodified lines
1977	*/	1976	*/
1978	int security_path_chroot(const struct path *path)	1977	int security_path_chroot(const struct path *path)
1979	{	1978	{
1980	return call_int_hook(path_chroot, 0, path);	1979	return call_int_hook(path_chroot, path);
1981	}	1980	}
1982	#endif /* CONFIG_SECURITY_PATH */	1981	#endif /* CONFIG_SECURITY_PATH */
1983		1982
@@ -1996,10 +1995,25 @@ int security_inode_create(struct inode dir, struct dentry dentry, · 12 unmodified lines
1996	{	1995	{
1997	if (unlikely(IS_PRIVATE(dir)))	1996	if (unlikely(IS_PRIVATE(dir)))
1998	return 0;	1997	return 0;
1999	return call_int_hook(inode_create, 0, dir, dentry, mode);	1998	return call_int_hook(inode_create, dir, dentry, mode);
2000	}	1999	}
2001	EXPORT_SYMBOL_GPL(security_inode_create);	2000	EXPORT_SYMBOL_GPL(security_inode_create);
2002		2001
		2002	/**
		2003	* security_inode_post_create_tmpfile() - Update inode security of new tmpfile
		2004	* @idmap: idmap of the mount
		2005	* @inode: inode of the new tmpfile
		2006	*
		2007	* Update inode security data after a tmpfile has been created.
		2008	*/
		2009	void security_inode_post_create_tmpfile(struct mnt_idmap *idmap,
		2010	struct inode *inode)
		2011	{
		2012	if (unlikely(IS_PRIVATE(inode)))
		2013	return;
		2014	call_void_hook(inode_post_create_tmpfile, idmap, inode);
		2015	}
		2016
2003	/**	2017	/**
2004	* security_inode_link() - Check if creating a hard link is allowed	2018	* security_inode_link() - Check if creating a hard link is allowed
2005	* @old_dentry: existing file	2019	* @old_dentry: existing file
@@ -2015,7 +2029,7 @@ int security_inode_link(struct dentry old_dentry, struct inode dir, · 9 unmodified lines
2015	{	2029	{
2016	if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))	2030	if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))
2017	return 0;	2031	return 0;
2018	return call_int_hook(inode_link, 0, old_dentry, dir, new_dentry);	2032	return call_int_hook(inode_link, old_dentry, dir, new_dentry);
2019	}	2033	}
2020		2034
2021	/**	2035	/**
@@ -2031,7 +2045,7 @@ int security_inode_unlink(struct inode dir, struct dentry dentry) · 9 unmodified lines
2031	{	2045	{
2032	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))	2046	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2033	return 0;	2047	return 0;
2034	return call_int_hook(inode_unlink, 0, dir, dentry);	2048	return call_int_hook(inode_unlink, dir, dentry);
2035	}	2049	}
2036		2050
2037	/**	2051	/**
@@ -2049,7 +2063,7 @@ int security_inode_symlink(struct inode dir, struct dentry dentry, · 11 unmodified lines
2049	{	2063	{
2050	if (unlikely(IS_PRIVATE(dir)))	2064	if (unlikely(IS_PRIVATE(dir)))
2051	return 0;	2065	return 0;
2052	return call_int_hook(inode_symlink, 0, dir, dentry, old_name);	2066	return call_int_hook(inode_symlink, dir, dentry, old_name);
2053	}	2067	}
2054		2068
2055	/**	2069	/**
@@ -2067,7 +2081,7 @@ int security_inode_mkdir(struct inode dir, struct dentry dentry, umode_t mode) · 11 unmodified lines
2067	{	2081	{
2068	if (unlikely(IS_PRIVATE(dir)))	2082	if (unlikely(IS_PRIVATE(dir)))
2069	return 0;	2083	return 0;
2070	return call_int_hook(inode_mkdir, 0, dir, dentry, mode);	2084	return call_int_hook(inode_mkdir, dir, dentry, mode);
2071	}	2085	}
2072	EXPORT_SYMBOL_GPL(security_inode_mkdir);	2086	EXPORT_SYMBOL_GPL(security_inode_mkdir);
2073		2087
@@ -2084,7 +2098,7 @@ int security_inode_rmdir(struct inode dir, struct dentry dentry) · 10 unmodified lines
2084	{	2098	{
2085	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))	2099	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2086	return 0;	2100	return 0;
2087	return call_int_hook(inode_rmdir, 0, dir, dentry);	2101	return call_int_hook(inode_rmdir, dir, dentry);
2088	}	2102	}
2089		2103
2090	/**	2104	/**
@@ -2106,7 +2120,7 @@ int security_inode_mknod(struct inode dir, struct dentry dentry, · 15 unmodified lines
2106	{	2120	{
2107	if (unlikely(IS_PRIVATE(dir)))	2121	if (unlikely(IS_PRIVATE(dir)))
2108	return 0;	2122	return 0;
2109	return call_int_hook(inode_mknod, 0, dir, dentry, mode, dev);	2123	return call_int_hook(inode_mknod, dir, dentry, mode, dev);
2110	}	2124	}
2111		2125
2112	/**	2126	/**
@@ -2131,13 +2145,13 @@ int security_inode_rename(struct inode old_dir, struct dentry old_dentry, · 18 unmodified lines
2131	return 0;	2145	return 0;
2132		2146
2133	if (flags & RENAME_EXCHANGE) {	2147	if (flags & RENAME_EXCHANGE) {
2134	int err = call_int_hook(inode_rename, 0, new_dir, new_dentry,	2148	int err = call_int_hook(inode_rename, new_dir, new_dentry,
2135	old_dir, old_dentry);	2149	old_dir, old_dentry);
2136	if (err)	2150	if (err)
2137	return err;	2151	return err;
2138	}	2152	}
2139		2153
2140	return call_int_hook(inode_rename, 0, old_dir, old_dentry,	2154	return call_int_hook(inode_rename, old_dir, old_dentry,
2141	new_dir, new_dentry);	2155	new_dir, new_dentry);
2142	}	2156	}
2143		2157
@@ -2153,7 +2167,7 @@ int security_inode_readlink(struct dentry *dentry) · 9 unmodified lines
2153	{	2167	{
2154	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))	2168	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2155	return 0;	2169	return 0;
2156	return call_int_hook(inode_readlink, 0, dentry);	2170	return call_int_hook(inode_readlink, dentry);
2157	}	2171	}
2158		2172
2159	/**	2173	/**
@@ -2172,7 +2186,7 @@ int security_inode_follow_link(struct dentry dentry, struct inode inode, · 12 unmodified lines
2172	{	2186	{
2173	if (unlikely(IS_PRIVATE(inode)))	2187	if (unlikely(IS_PRIVATE(inode)))
2174	return 0;	2188	return 0;
2175	return call_int_hook(inode_follow_link, 0, dentry, inode, rcu);	2189	return call_int_hook(inode_follow_link, dentry, inode, rcu);
2176	}	2190	}
2177		2191
2178	/**	2192	/**
@@ -2193,7 +2207,7 @@ int security_inode_permission(struct inode *inode, int mask) · 14 unmodified lines
2193	{	2207	{
2194	if (unlikely(IS_PRIVATE(inode)))	2208	if (unlikely(IS_PRIVATE(inode)))
2195	return 0;	2209	return 0;
2196	return call_int_hook(inode_permission, 0, inode, mask);	2210	return call_int_hook(inode_permission, inode, mask);
2197	}	2211	}
2198		2212
2199	/**	2213	/**
@@ -2212,17 +2226,28 @@ int security_inode_permission(struct inode *inode, int mask) · 12 unmodified lines
2212	int security_inode_setattr(struct mnt_idmap *idmap,	2226	int security_inode_setattr(struct mnt_idmap *idmap,
2213	struct dentry dentry, struct iattr attr)	2227	struct dentry dentry, struct iattr attr)
2214	{	2228	{
2215	int ret;
2216
2217	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))	2229	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2218	return 0;	2230	return 0;
2219	ret = call_int_hook(inode_setattr, 0, dentry, attr);	2231	return call_int_hook(inode_setattr, idmap, dentry, attr);
2220	if (ret)
2221	return ret;
2222	return evm_inode_setattr(idmap, dentry, attr);
2223	}	2232	}
2224	EXPORT_SYMBOL_GPL(security_inode_setattr);	2233	EXPORT_SYMBOL_GPL(security_inode_setattr);
2225		2234
		2235	/**
		2236	* security_inode_post_setattr() - Update the inode after a setattr operation
		2237	* @idmap: idmap of the mount
		2238	* @dentry: file
		2239	* @ia_valid: file attributes set
		2240	*
		2241	* Update inode security field after successful setting file attributes.
		2242	*/
		2243	void security_inode_post_setattr(struct mnt_idmap idmap, struct dentry dentry,
		2244	int ia_valid)
		2245	{
		2246	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
		2247	return;
		2248	call_void_hook(inode_post_setattr, idmap, dentry, ia_valid);
		2249	}
		2250
2226	/**	2251	/**
2227	* security_inode_getattr() - Check if getting file attributes is allowed	2252	* security_inode_getattr() - Check if getting file attributes is allowed
2228	* @path: file	2253	* @path: file
@@ -2235,7 +2260,7 @@ int security_inode_getattr(const struct path *path) · 6 unmodified lines
2235	{	2260	{
2236	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))	2261	if (unlikely(IS_PRIVATE(d_backing_inode(path->dentry))))
2237	return 0;	2262	return 0;
2238	return call_int_hook(inode_getattr, 0, path);	2263	return call_int_hook(inode_getattr, path);
2239	}	2264	}
2240		2265
2241	/**	2266	/**
@@ -2263,17 +2288,12 @@ int security_inode_setxattr(struct mnt_idmap *idmap, · 21 unmodified lines
2263	* SELinux and Smack integrate the cap call,	2288	* SELinux and Smack integrate the cap call,
2264	* so assume that all LSMs supplying this call do so.	2289	* so assume that all LSMs supplying this call do so.
2265	*/	2290	*/
2266	ret = call_int_hook(inode_setxattr, 1, idmap, dentry, name, value,	2291	ret = call_int_hook(inode_setxattr, idmap, dentry, name, value, size,
2267	size, flags);	2292	flags);
2268		2293
2269	if (ret == 1)	2294	if (ret == 1)
2270	ret = cap_inode_setxattr(dentry, name, value, size, flags);	2295	ret = cap_inode_setxattr(dentry, name, value, size, flags);
2271	if (ret)	2296	return ret;
2272	return ret;
2273	ret = ima_inode_setxattr(dentry, name, value, size);
2274	if (ret)
2275	return ret;
2276	return evm_inode_setxattr(idmap, dentry, name, value, size);
2277	}	2297	}
2278		2298
2279	/**	2299	/**
@@ -2292,18 +2312,26 @@ int security_inode_set_acl(struct mnt_idmap *idmap, · 12 unmodified lines
2292	struct dentry dentry, const char acl_name,	2312	struct dentry dentry, const char acl_name,
2293	struct posix_acl *kacl)	2313	struct posix_acl *kacl)
2294	{	2314	{
2295	int ret;
2296
2297	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))	2315	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2298	return 0;	2316	return 0;
2299	ret = call_int_hook(inode_set_acl, 0, idmap, dentry, acl_name,	2317	return call_int_hook(inode_set_acl, idmap, dentry, acl_name, kacl);
2300	kacl);	2318	}
2301	if (ret)	2319
2302	return ret;	2320	/**
2303	ret = ima_inode_set_acl(idmap, dentry, acl_name, kacl);	2321	* security_inode_post_set_acl() - Update inode security from posix acls set
2304	if (ret)	2322	* @dentry: file
2305	return ret;	2323	* @acl_name: acl name
2306	return evm_inode_set_acl(idmap, dentry, acl_name, kacl);	2324	* @kacl: acl struct
		2325	*
		2326	* Update inode security data after successfully setting posix acls on @dentry.
		2327	* The posix acls in @kacl are identified by @acl_name.
		2328	*/
		2329	void security_inode_post_set_acl(struct dentry dentry, const char acl_name,
		2330	struct posix_acl *kacl)
		2331	{
		2332	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
		2333	return;
		2334	call_void_hook(inode_post_set_acl, dentry, acl_name, kacl);
2307	}	2335	}
2308		2336
2309	/**	2337	/**
@@ -2322,7 +2350,7 @@ int security_inode_get_acl(struct mnt_idmap *idmap, · 12 unmodified lines
2322	{	2350	{
2323	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))	2351	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2324	return 0;	2352	return 0;
2325	return call_int_hook(inode_get_acl, 0, idmap, dentry, acl_name);	2353	return call_int_hook(inode_get_acl, idmap, dentry, acl_name);
2326	}	2354	}
2327		2355
2328	/**	2356	/**
@@ -2339,17 +2367,26 @@ int security_inode_get_acl(struct mnt_idmap *idmap, · 10 unmodified lines
2339	int security_inode_remove_acl(struct mnt_idmap *idmap,	2367	int security_inode_remove_acl(struct mnt_idmap *idmap,
2340	struct dentry dentry, const char acl_name)	2368	struct dentry dentry, const char acl_name)
2341	{	2369	{
2342	int ret;
2343
2344	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))	2370	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2345	return 0;	2371	return 0;
2346	ret = call_int_hook(inode_remove_acl, 0, idmap, dentry, acl_name);	2372	return call_int_hook(inode_remove_acl, idmap, dentry, acl_name);
2347	if (ret)	2373	}
2348	return ret;	2374
2349	ret = ima_inode_remove_acl(idmap, dentry, acl_name);	2375	/**
2350	if (ret)	2376	* security_inode_post_remove_acl() - Update inode security after rm posix acls
2351	return ret;	2377	* @idmap: idmap of the mount
2352	return evm_inode_remove_acl(idmap, dentry, acl_name);	2378	* @dentry: file
		2379	* @acl_name: acl name
		2380	*
		2381	* Update inode security data after successfully removing posix acls on
		2382	* @dentry in @idmap. The posix acls are identified by @acl_name.
		2383	*/
		2384	void security_inode_post_remove_acl(struct mnt_idmap *idmap,
		2385	struct dentry dentry, const char acl_name)
		2386	{
		2387	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
		2388	return;
		2389	call_void_hook(inode_post_remove_acl, idmap, dentry, acl_name);
2353	}	2390	}
2354		2391
2355	/**	2392	/**
@@ -2368,7 +2405,6 @@ void security_inode_post_setxattr(struct dentry dentry, const char name, · 12 unmodified lines
2368	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))	2405	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2369	return;	2406	return;
2370	call_void_hook(inode_post_setxattr, dentry, name, value, size, flags);	2407	call_void_hook(inode_post_setxattr, dentry, name, value, size, flags);
2371	evm_inode_post_setxattr(dentry, name, value, size);
2372	}	2408	}
2373		2409
2374	/**	2410	/**
@@ -2385,7 +2421,7 @@ int security_inode_getxattr(struct dentry dentry, const char name) · 10 unmodified lines
2385	{	2421	{
2386	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))	2422	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2387	return 0;	2423	return 0;
2388	return call_int_hook(inode_getxattr, 0, dentry, name);	2424	return call_int_hook(inode_getxattr, dentry, name);
2389	}	2425	}
2390		2426
2391	/**	2427	/**
@@ -2401,7 +2437,7 @@ int security_inode_listxattr(struct dentry *dentry) · 9 unmodified lines
2401	{	2437	{
2402	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))	2438	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2403	return 0;	2439	return 0;
2404	return call_int_hook(inode_listxattr, 0, dentry);	2440	return call_int_hook(inode_listxattr, dentry);
2405	}	2441	}
2406		2442
2407	/**	2443	/**
@@ -2426,15 +2462,24 @@ int security_inode_removexattr(struct mnt_idmap *idmap, · 18 unmodified lines
2426	* SELinux and Smack integrate the cap call,	2462	* SELinux and Smack integrate the cap call,
2427	* so assume that all LSMs supplying this call do so.	2463	* so assume that all LSMs supplying this call do so.
2428	*/	2464	*/
2429	ret = call_int_hook(inode_removexattr, 1, idmap, dentry, name);	2465	ret = call_int_hook(inode_removexattr, idmap, dentry, name);
2430	if (ret == 1)	2466	if (ret == 1)
2431	ret = cap_inode_removexattr(idmap, dentry, name);	2467	ret = cap_inode_removexattr(idmap, dentry, name);
2432	if (ret)	2468	return ret;
2433	return ret;	2469	}
2434	ret = ima_inode_removexattr(dentry, name);	2470
2435	if (ret)	2471	/**
2436	return ret;	2472	* security_inode_post_removexattr() - Update the inode after a removexattr op
2437	return evm_inode_removexattr(idmap, dentry, name);	2473	* @dentry: file
		2474	* @name: xattr name
		2475	*
		2476	* Update the inode after a successful removexattr operation.
		2477	*/
		2478	void security_inode_post_removexattr(struct dentry dentry, const char name)
		2479	{
		2480	if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
		2481	return;
		2482	call_void_hook(inode_post_removexattr, dentry, name);
2438	}	2483	}
2439		2484
2440	/**	2485	/**
@@ -2450,7 +2495,7 @@ int security_inode_removexattr(struct mnt_idmap *idmap, · 9 unmodified lines
2450	*/	2495	*/
2451	int security_inode_need_killpriv(struct dentry *dentry)	2496	int security_inode_need_killpriv(struct dentry *dentry)
2452	{	2497	{
2453	return call_int_hook(inode_need_killpriv, 0, dentry);	2498	return call_int_hook(inode_need_killpriv, dentry);
2454	}	2499	}
2455		2500
2456	/**	2501	/**
@@ -2467,7 +2512,7 @@ int security_inode_need_killpriv(struct dentry *dentry) · 10 unmodified lines
2467	int security_inode_killpriv(struct mnt_idmap *idmap,	2512	int security_inode_killpriv(struct mnt_idmap *idmap,
2468	struct dentry *dentry)	2513	struct dentry *dentry)
2469	{	2514	{
2470	return call_int_hook(inode_killpriv, 0, idmap, dentry);	2515	return call_int_hook(inode_killpriv, idmap, dentry);
2471	}	2516	}
2472		2517
2473	/**	2518	/**
@@ -2490,21 +2535,11 @@ int security_inode_getsecurity(struct mnt_idmap *idmap, · 16 unmodified lines
2490	struct inode inode, const char name,	2535	struct inode inode, const char name,
2491	void **buffer, bool alloc)	2536	void **buffer, bool alloc)
2492	{	2537	{
2493	struct security_hook_list *hp;
2494	int rc;
2495
2496	if (unlikely(IS_PRIVATE(inode)))	2538	if (unlikely(IS_PRIVATE(inode)))
2497	return LSM_RET_DEFAULT(inode_getsecurity);	2539	return LSM_RET_DEFAULT(inode_getsecurity);
2498	/*	2540
2499	* Only one module will provide an attribute with a given name.	2541	return call_int_hook(inode_getsecurity, idmap, inode, name, buffer,
2500	*/	2542	alloc);
2501	hlist_for_each_entry(hp, &security_hook_heads.inode_getsecurity, list) {
2502	rc = hp->hook.inode_getsecurity(idmap, inode, name, buffer,
2503	alloc);
2504	if (rc != LSM_RET_DEFAULT(inode_getsecurity))
2505	return rc;
2506	}
2507	return LSM_RET_DEFAULT(inode_getsecurity);
2508	}	2543	}
2509		2544
2510	/**	2545	/**
@@ -2525,21 +2560,11 @@ int security_inode_getsecurity(struct mnt_idmap *idmap, · 14 unmodified lines
2525	int security_inode_setsecurity(struct inode inode, const char name,	2560	int security_inode_setsecurity(struct inode inode, const char name,
2526	const void *value, size_t size, int flags)	2561	const void *value, size_t size, int flags)
2527	{	2562	{
2528	struct security_hook_list *hp;
2529	int rc;
2530
2531	if (unlikely(IS_PRIVATE(inode)))	2563	if (unlikely(IS_PRIVATE(inode)))
2532	return LSM_RET_DEFAULT(inode_setsecurity);	2564	return LSM_RET_DEFAULT(inode_setsecurity);
2533	/*	2565
2534	* Only one module will provide an attribute with a given name.	2566	return call_int_hook(inode_setsecurity, inode, name, value, size,
2535	*/	2567	flags);
2536	hlist_for_each_entry(hp, &security_hook_heads.inode_setsecurity, list) {
2537	rc = hp->hook.inode_setsecurity(inode, name, value, size,
2538	flags);
2539	if (rc != LSM_RET_DEFAULT(inode_setsecurity))
2540	return rc;
2541	}
2542	return LSM_RET_DEFAULT(inode_setsecurity);
2543	}	2568	}
2544		2569
2545	/**	2570	/**
@@ -2560,7 +2585,7 @@ int security_inode_listsecurity(struct inode *inode, · 14 unmodified lines
2560	{	2585	{
2561	if (unlikely(IS_PRIVATE(inode)))	2586	if (unlikely(IS_PRIVATE(inode)))
2562	return 0;	2587	return 0;
2563	return call_int_hook(inode_listsecurity, 0, inode, buffer, buffer_size);	2588	return call_int_hook(inode_listsecurity, inode, buffer, buffer_size);
2564	}	2589	}
2565	EXPORT_SYMBOL(security_inode_listsecurity);	2590	EXPORT_SYMBOL(security_inode_listsecurity);
2566		2591
@@ -2591,7 +2616,7 @@ void security_inode_getsecid(struct inode inode, u32 secid) · 24 unmodified lines
2591	*/	2616	*/
2592	int security_inode_copy_up(struct dentry src, struct cred *new)	2617	int security_inode_copy_up(struct dentry src, struct cred *new)
2593	{	2618	{
2594	return call_int_hook(inode_copy_up, 0, src, new);	2619	return call_int_hook(inode_copy_up, src, new);
2595	}	2620	}
2596	EXPORT_SYMBOL(security_inode_copy_up);	2621	EXPORT_SYMBOL(security_inode_copy_up);
2597		2622
@@ -2609,7 +2634,6 @@ EXPORT_SYMBOL(security_inode_copy_up); · 11 unmodified lines
2609	*/	2634	*/
2610	int security_inode_copy_up_xattr(const char *name)	2635	int security_inode_copy_up_xattr(const char *name)
2611	{	2636	{
2612	struct security_hook_list *hp;
2613	int rc;	2637	int rc;
2614		2638
2615	/*	2639	/*
@@ -2617,14 +2641,11 @@ int security_inode_copy_up_xattr(const char *name) · 1 unmodified line
2617	* xattr), -EOPNOTSUPP if it does not know anything about the xattr or	2641	* xattr), -EOPNOTSUPP if it does not know anything about the xattr or
2618	* any other error code in case of an error.	2642	* any other error code in case of an error.
2619	*/	2643	*/
2620	hlist_for_each_entry(hp,	2644	rc = call_int_hook(inode_copy_up_xattr, name);
2621	&security_hook_heads.inode_copy_up_xattr, list) {	2645	if (rc != LSM_RET_DEFAULT(inode_copy_up_xattr))
2622	rc = hp->hook.inode_copy_up_xattr(name);	2646	return rc;
2623	if (rc != LSM_RET_DEFAULT(inode_copy_up_xattr))
2624	return rc;
2625	}
2626		2647
2627	return evm_inode_copy_up_xattr(name);	2648	return LSM_RET_DEFAULT(inode_copy_up_xattr);
2628	}	2649	}
2629	EXPORT_SYMBOL(security_inode_copy_up_xattr);	2650	EXPORT_SYMBOL(security_inode_copy_up_xattr);
2630		2651
@@ -2641,7 +2662,7 @@ EXPORT_SYMBOL(security_inode_copy_up_xattr); · 10 unmodified lines
2641	int security_kernfs_init_security(struct kernfs_node *kn_dir,	2662	int security_kernfs_init_security(struct kernfs_node *kn_dir,
2642	struct kernfs_node *kn)	2663	struct kernfs_node *kn)
2643	{	2664	{
2644	return call_int_hook(kernfs_init_security, 0, kn_dir, kn);	2665	return call_int_hook(kernfs_init_security, kn_dir, kn);
2645	}	2666	}
2646		2667
2647	/**	2668	/**
@@ -2665,7 +2686,7 @@ int security_kernfs_init_security(struct kernfs_node *kn_dir, · 17 unmodified lines
2665	*/	2686	*/
2666	int security_file_permission(struct file *file, int mask)	2687	int security_file_permission(struct file *file, int mask)
2667	{	2688	{
2668	return call_int_hook(file_permission, 0, file, mask);	2689	return call_int_hook(file_permission, file, mask);
2669	}	2690	}
2670		2691
2671	/**	2692	/**
@@ -2683,12 +2704,23 @@ int security_file_alloc(struct file *file) · 11 unmodified lines
2683		2704
2684	if (rc)	2705	if (rc)
2685	return rc;	2706	return rc;
2686	rc = call_int_hook(file_alloc_security, 0, file);	2707	rc = call_int_hook(file_alloc_security, file);
2687	if (unlikely(rc))	2708	if (unlikely(rc))
2688	security_file_free(file);	2709	security_file_free(file);
2689	return rc;	2710	return rc;
2690	}	2711	}
2691		2712
		2713	/**
		2714	* security_file_release() - Perform actions before releasing the file ref
		2715	* @file: the file
		2716	*
		2717	* Perform actions before releasing the last reference to a file.
		2718	*/
		2719	void security_file_release(struct file *file)
		2720	{
		2721	call_void_hook(file_release, file);
		2722	}
		2723
2692	/**	2724	/**
2693	* security_file_free() - Free a file's LSM blob	2725	* security_file_free() - Free a file's LSM blob
2694	* @file: the file	2726	* @file: the file
@@ -2723,7 +2755,7 @@ void security_file_free(struct file *file) · 28 unmodified lines
2723	*/	2755	*/
2724	int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)	2756	int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
2725	{	2757	{
2726	return call_int_hook(file_ioctl, 0, file, cmd, arg);	2758	return call_int_hook(file_ioctl, file, cmd, arg);
2727	}	2759	}
2728	EXPORT_SYMBOL_GPL(security_file_ioctl);	2760	EXPORT_SYMBOL_GPL(security_file_ioctl);
2729		2761
@@ -2741,7 +2773,7 @@ EXPORT_SYMBOL_GPL(security_file_ioctl); · 11 unmodified lines
2741	int security_file_ioctl_compat(struct file *file, unsigned int cmd,	2773	int security_file_ioctl_compat(struct file *file, unsigned int cmd,
2742	unsigned long arg)	2774	unsigned long arg)
2743	{	2775	{
2744	return call_int_hook(file_ioctl_compat, 0, file, cmd, arg);	2776	return call_int_hook(file_ioctl_compat, file, cmd, arg);
2745	}	2777	}
2746	EXPORT_SYMBOL_GPL(security_file_ioctl_compat);	2778	EXPORT_SYMBOL_GPL(security_file_ioctl_compat);
2747		2779
@@ -2792,13 +2824,8 @@ static inline unsigned long mmap_prot(struct file *file, unsigned long prot) · 44 unmodified lines
2792	int security_mmap_file(struct file *file, unsigned long prot,	2824	int security_mmap_file(struct file *file, unsigned long prot,
2793	unsigned long flags)	2825	unsigned long flags)
2794	{	2826	{
2795	unsigned long prot_adj = mmap_prot(file, prot);	2827	return call_int_hook(mmap_file, file, prot, mmap_prot(file, prot),
2796	int ret;	2828	flags);
2797
2798	ret = call_int_hook(mmap_file, 0, file, prot, prot_adj, flags);
2799	if (ret)
2800	return ret;
2801	return ima_file_mmap(file, prot, prot_adj, flags);
2802	}	2829	}
2803		2830
2804	/**	2831	/**
@@ -2811,7 +2838,7 @@ int security_mmap_file(struct file *file, unsigned long prot, · 6 unmodified lines
2811	*/	2838	*/
2812	int security_mmap_addr(unsigned long addr)	2839	int security_mmap_addr(unsigned long addr)
2813	{	2840	{
2814	return call_int_hook(mmap_addr, 0, addr);	2841	return call_int_hook(mmap_addr, addr);
2815	}	2842	}
2816		2843
2817	/**	2844	/**
@@ -2827,12 +2854,7 @@ int security_mmap_addr(unsigned long addr) · 9 unmodified lines
2827	int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,	2854	int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
2828	unsigned long prot)	2855	unsigned long prot)
2829	{	2856	{
2830	int ret;	2857	return call_int_hook(file_mprotect, vma, reqprot, prot);
2831
2832	ret = call_int_hook(file_mprotect, 0, vma, reqprot, prot);
2833	if (ret)
2834	return ret;
2835	return ima_file_mprotect(vma, prot);
2836	}	2858	}
2837		2859
2838	/**	2860	/**
@@ -2847,7 +2869,7 @@ int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, · 8 unmodified lines
2847	*/	2869	*/
2848	int security_file_lock(struct file *file, unsigned int cmd)	2870	int security_file_lock(struct file *file, unsigned int cmd)
2849	{	2871	{
2850	return call_int_hook(file_lock, 0, file, cmd);	2872	return call_int_hook(file_lock, file, cmd);
2851	}	2873	}
2852		2874
2853	/**	2875	/**
@@ -2866,7 +2888,7 @@ int security_file_lock(struct file *file, unsigned int cmd) · 12 unmodified lines
2866	*/	2888	*/
2867	int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg)	2889	int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
2868	{	2890	{
2869	return call_int_hook(file_fcntl, 0, file, cmd, arg);	2891	return call_int_hook(file_fcntl, file, cmd, arg);
2870	}	2892	}
2871		2893
2872	/**	2894	/**
@@ -2900,11 +2922,11 @@ void security_file_set_fowner(struct file *file) · 27 unmodified lines
2900	int security_file_send_sigiotask(struct task_struct *tsk,	2922	int security_file_send_sigiotask(struct task_struct *tsk,
2901	struct fown_struct *fown, int sig)	2923	struct fown_struct *fown, int sig)
2902	{	2924	{
2903	return call_int_hook(file_send_sigiotask, 0, tsk, fown, sig);	2925	return call_int_hook(file_send_sigiotask, tsk, fown, sig);
2904	}	2926	}
2905		2927
2906	/**	2928	/**
2907	* security_file_receive() - Check is receiving a file via IPC is allowed	2929	* security_file_receive() - Check if receiving a file via IPC is allowed
2908	* @file: file being received	2930	* @file: file being received
2909	*	2931	*
2910	* This hook allows security modules to control the ability of a process to	2932	* This hook allows security modules to control the ability of a process to
@@ -2914,7 +2936,7 @@ int security_file_send_sigiotask(struct task_struct *tsk, · 3 unmodified lines
2914	*/	2936	*/
2915	int security_file_receive(struct file *file)	2937	int security_file_receive(struct file *file)
2916	{	2938	{
2917	return call_int_hook(file_receive, 0, file);	2939	return call_int_hook(file_receive, file);
2918	}	2940	}
2919		2941
2920	/**	2942	/**
@@ -2930,13 +2952,30 @@ int security_file_open(struct file *file) · 9 unmodified lines
2930	{	2952	{
2931	int ret;	2953	int ret;
2932		2954
2933	ret = call_int_hook(file_open, 0, file);	2955	ret = call_int_hook(file_open, file);
2934	if (ret)	2956	if (ret)
2935	return ret;	2957	return ret;
2936		2958
2937	return fsnotify_open_perm(file);	2959	return fsnotify_open_perm(file);
2938	}	2960	}
2939		2961
		2962	/**
		2963	* security_file_post_open() - Evaluate a file after it has been opened
		2964	* @file: the file
		2965	* @mask: access mask
		2966	*
		2967	* Evaluate an opened file and the access mask requested with open(). The hook
		2968	* is useful for LSMs that require the file content to be available in order to
		2969	* make decisions.
		2970	*
		2971	* Return: Returns 0 if permission is granted.
		2972	*/
		2973	int security_file_post_open(struct file *file, int mask)
		2974	{
		2975	return call_int_hook(file_post_open, file, mask);
		2976	}
		2977	EXPORT_SYMBOL_GPL(security_file_post_open);
		2978
2940	/**	2979	/**
2941	* security_file_truncate() - Check if truncating a file is allowed	2980	* security_file_truncate() - Check if truncating a file is allowed
2942	* @file: file	2981	* @file: file
@@ -2949,7 +2988,7 @@ int security_file_open(struct file *file) · 6 unmodified lines
2949	*/	2988	*/
2950	int security_file_truncate(struct file *file)	2989	int security_file_truncate(struct file *file)
2951	{	2990	{
2952	return call_int_hook(file_truncate, 0, file);	2991	return call_int_hook(file_truncate, file);
2953	}	2992	}
2954		2993
2955	/**	2994	/**
@@ -2967,7 +3006,7 @@ int security_task_alloc(struct task_struct *task, unsigned long clone_flags) · 11 unmodified lines
2967		3006
2968	if (rc)	3007	if (rc)
2969	return rc;	3008	return rc;
2970	rc = call_int_hook(task_alloc, 0, task, clone_flags);	3009	rc = call_int_hook(task_alloc, task, clone_flags);
2971	if (unlikely(rc))	3010	if (unlikely(rc))
2972	security_task_free(task);	3011	security_task_free(task);
2973	return rc;	3012	return rc;
@@ -3005,7 +3044,7 @@ int security_cred_alloc_blank(struct cred *cred, gfp_t gfp) · 31 unmodified lines
3005	if (rc)	3044	if (rc)
3006	return rc;	3045	return rc;
3007		3046
3008	rc = call_int_hook(cred_alloc_blank, 0, cred, gfp);	3047	rc = call_int_hook(cred_alloc_blank, cred, gfp);
3009	if (unlikely(rc))	3048	if (unlikely(rc))
3010	security_cred_free(cred);	3049	security_cred_free(cred);
3011	return rc;	3050	return rc;
@@ -3049,7 +3088,7 @@ int security_prepare_creds(struct cred new, const struct cred old, gfp_t gfp) · 37 unmodified lines
3049	if (rc)	3088	if (rc)
3050	return rc;	3089	return rc;
3051		3090
3052	rc = call_int_hook(cred_prepare, 0, new, old, gfp);	3091	rc = call_int_hook(cred_prepare, new, old, gfp);
3053	if (unlikely(rc))	3092	if (unlikely(rc))
3054	security_cred_free(new);	3093	security_cred_free(new);
3055	return rc;	3094	return rc;
@@ -3094,7 +3133,7 @@ EXPORT_SYMBOL(security_cred_getsecid); · 38 unmodified lines
3094	*/	3133	*/
3095	int security_kernel_act_as(struct cred *new, u32 secid)	3134	int security_kernel_act_as(struct cred *new, u32 secid)
3096	{	3135	{
3097	return call_int_hook(kernel_act_as, 0, new, secid);	3136	return call_int_hook(kernel_act_as, new, secid);
3098	}	3137	}
3099		3138
3100	/**	3139	/**
@@ -3110,11 +3149,11 @@ int security_kernel_act_as(struct cred *new, u32 secid) · 9 unmodified lines
3110	*/	3149	*/
3111	int security_kernel_create_files_as(struct cred new, struct inode inode)	3150	int security_kernel_create_files_as(struct cred new, struct inode inode)
3112	{	3151	{
3113	return call_int_hook(kernel_create_files_as, 0, new, inode);	3152	return call_int_hook(kernel_create_files_as, new, inode);
3114	}	3153	}
3115		3154
3116	/**	3155	/**
3117	* security_kernel_module_request() - Check is loading a module is allowed	3156	* security_kernel_module_request() - Check if loading a module is allowed
3118	* @kmod_name: module name	3157	* @kmod_name: module name
3119	*	3158	*
3120	* Ability to trigger the kernel to automatically upcall to userspace for	3159	* Ability to trigger the kernel to automatically upcall to userspace for
@@ -3124,12 +3163,7 @@ int security_kernel_create_files_as(struct cred new, struct inode inode) · 3 unmodified lines
3124	*/	3163	*/
3125	int security_kernel_module_request(char *kmod_name)	3164	int security_kernel_module_request(char *kmod_name)
3126	{	3165	{
3127	int ret;	3166	return call_int_hook(kernel_module_request, kmod_name);
3128
3129	ret = call_int_hook(kernel_module_request, 0, kmod_name);
3130	if (ret)
3131	return ret;
3132	return integrity_kernel_module_request(kmod_name);
3133	}	3167	}
3134		3168
3135	/**	3169	/**
@@ -3145,12 +3179,7 @@ int security_kernel_module_request(char *kmod_name) · 9 unmodified lines
3145	int security_kernel_read_file(struct file *file, enum kernel_read_file_id id,	3179	int security_kernel_read_file(struct file *file, enum kernel_read_file_id id,
3146	bool contents)	3180	bool contents)
3147	{	3181	{
3148	int ret;	3182	return call_int_hook(kernel_read_file, file, id, contents);
3149
3150	ret = call_int_hook(kernel_read_file, 0, file, id, contents);
3151	if (ret)
3152	return ret;
3153	return ima_read_file(file, id, contents);
3154	}	3183	}
3155	EXPORT_SYMBOL_GPL(security_kernel_read_file);	3184	EXPORT_SYMBOL_GPL(security_kernel_read_file);
3156		3185
@@ -3170,12 +3199,7 @@ EXPORT_SYMBOL_GPL(security_kernel_read_file); · 13 unmodified lines
3170	int security_kernel_post_read_file(struct file file, char buf, loff_t size,	3199	int security_kernel_post_read_file(struct file file, char buf, loff_t size,
3171	enum kernel_read_file_id id)	3200	enum kernel_read_file_id id)
3172	{	3201	{
3173	int ret;	3202	return call_int_hook(kernel_post_read_file, file, buf, size, id);
3174
3175	ret = call_int_hook(kernel_post_read_file, 0, file, buf, size, id);
3176	if (ret)
3177	return ret;
3178	return ima_post_read_file(file, buf, size, id);
3179	}	3203	}
3180	EXPORT_SYMBOL_GPL(security_kernel_post_read_file);	3204	EXPORT_SYMBOL_GPL(security_kernel_post_read_file);
3181		3205
@@ -3190,12 +3214,7 @@ EXPORT_SYMBOL_GPL(security_kernel_post_read_file); · 8 unmodified lines
3190	*/	3214	*/
3191	int security_kernel_load_data(enum kernel_load_data_id id, bool contents)	3215	int security_kernel_load_data(enum kernel_load_data_id id, bool contents)
3192	{	3216	{
3193	int ret;	3217	return call_int_hook(kernel_load_data, id, contents);
3194
3195	ret = call_int_hook(kernel_load_data, 0, id, contents);
3196	if (ret)
3197	return ret;
3198	return ima_load_data(id, contents);
3199	}	3218	}
3200	EXPORT_SYMBOL_GPL(security_kernel_load_data);	3219	EXPORT_SYMBOL_GPL(security_kernel_load_data);
3201		3220
@@ -3217,13 +3236,7 @@ int security_kernel_post_load_data(char *buf, loff_t size, · 15 unmodified lines
3217	enum kernel_load_data_id id,	3236	enum kernel_load_data_id id,
3218	char *description)	3237	char *description)
3219	{	3238	{
3220	int ret;	3239	return call_int_hook(kernel_post_load_data, buf, size, id, description);
3221
3222	ret = call_int_hook(kernel_post_load_data, 0, buf, size, id,
3223	description);
3224	if (ret)
3225	return ret;
3226	return ima_post_load_data(buf, size, id, description);
3227	}	3240	}
3228	EXPORT_SYMBOL_GPL(security_kernel_post_load_data);	3241	EXPORT_SYMBOL_GPL(security_kernel_post_load_data);
3229		3242
@@ -3244,7 +3257,7 @@ EXPORT_SYMBOL_GPL(security_kernel_post_load_data); · 14 unmodified lines
3244	int security_task_fix_setuid(struct cred new, const struct cred old,	3257	int security_task_fix_setuid(struct cred new, const struct cred old,
3245	int flags)	3258	int flags)
3246	{	3259	{
3247	return call_int_hook(task_fix_setuid, 0, new, old, flags);	3260	return call_int_hook(task_fix_setuid, new, old, flags);
3248	}	3261	}
3249		3262
3250	/**	3263	/**
@@ -3264,7 +3277,7 @@ int security_task_fix_setuid(struct cred new, const struct cred old, · 13 unmodified lines
3264	int security_task_fix_setgid(struct cred new, const struct cred old,	3277	int security_task_fix_setgid(struct cred new, const struct cred old,
3265	int flags)	3278	int flags)
3266	{	3279	{
3267	return call_int_hook(task_fix_setgid, 0, new, old, flags);	3280	return call_int_hook(task_fix_setgid, new, old, flags);
3268	}	3281	}
3269		3282
3270	/**	3283	/**
@@ -3281,7 +3294,7 @@ int security_task_fix_setgid(struct cred new, const struct cred old, · 10 unmodified lines
3281	*/	3294	*/
3282	int security_task_fix_setgroups(struct cred new, const struct cred old)	3295	int security_task_fix_setgroups(struct cred new, const struct cred old)
3283	{	3296	{
3284	return call_int_hook(task_fix_setgroups, 0, new, old);	3297	return call_int_hook(task_fix_setgroups, new, old);
3285	}	3298	}
3286		3299
3287	/**	3300	/**
@@ -3296,7 +3309,7 @@ int security_task_fix_setgroups(struct cred new, const struct cred old) · 8 unmodified lines
3296	*/	3309	*/
3297	int security_task_setpgid(struct task_struct *p, pid_t pgid)	3310	int security_task_setpgid(struct task_struct *p, pid_t pgid)
3298	{	3311	{
3299	return call_int_hook(task_setpgid, 0, p, pgid);	3312	return call_int_hook(task_setpgid, p, pgid);
3300	}	3313	}
3301		3314
3302	/**	3315	/**
@@ -3310,7 +3323,7 @@ int security_task_setpgid(struct task_struct *p, pid_t pgid) · 7 unmodified lines
3310	*/	3323	*/
3311	int security_task_getpgid(struct task_struct *p)	3324	int security_task_getpgid(struct task_struct *p)
3312	{	3325	{
3313	return call_int_hook(task_getpgid, 0, p);	3326	return call_int_hook(task_getpgid, p);
3314	}	3327	}
3315		3328
3316	/**	3329	/**
@@ -3323,7 +3336,7 @@ int security_task_getpgid(struct task_struct *p) · 6 unmodified lines
3323	*/	3336	*/
3324	int security_task_getsid(struct task_struct *p)	3337	int security_task_getsid(struct task_struct *p)
3325	{	3338	{
3326	return call_int_hook(task_getsid, 0, p);	3339	return call_int_hook(task_getsid, p);
3327	}	3340	}
3328		3341
3329	/**	3342	/**
@@ -3366,7 +3379,7 @@ EXPORT_SYMBOL(security_task_getsecid_obj); · 36 unmodified lines
3366	*/	3379	*/
3367	int security_task_setnice(struct task_struct *p, int nice)	3380	int security_task_setnice(struct task_struct *p, int nice)
3368	{	3381	{
3369	return call_int_hook(task_setnice, 0, p, nice);	3382	return call_int_hook(task_setnice, p, nice);
3370	}	3383	}
3371		3384
3372	/**	3385	/**
@@ -3380,7 +3393,7 @@ int security_task_setnice(struct task_struct *p, int nice) · 7 unmodified lines
3380	*/	3393	*/
3381	int security_task_setioprio(struct task_struct *p, int ioprio)	3394	int security_task_setioprio(struct task_struct *p, int ioprio)
3382	{	3395	{
3383	return call_int_hook(task_setioprio, 0, p, ioprio);	3396	return call_int_hook(task_setioprio, p, ioprio);
3384	}	3397	}
3385		3398
3386	/**	3399	/**
@@ -3393,7 +3406,7 @@ int security_task_setioprio(struct task_struct *p, int ioprio) · 6 unmodified lines
3393	*/	3406	*/
3394	int security_task_getioprio(struct task_struct *p)	3407	int security_task_getioprio(struct task_struct *p)
3395	{	3408	{
3396	return call_int_hook(task_getioprio, 0, p);	3409	return call_int_hook(task_getioprio, p);
3397	}	3410	}
3398		3411
3399	/**	3412	/**
@@ -3410,7 +3423,7 @@ int security_task_getioprio(struct task_struct *p) · 10 unmodified lines
3410	int security_task_prlimit(const struct cred cred, const struct cred tcred,	3423	int security_task_prlimit(const struct cred cred, const struct cred tcred,
3411	unsigned int flags)	3424	unsigned int flags)
3412	{	3425	{
3413	return call_int_hook(task_prlimit, 0, cred, tcred, flags);	3426	return call_int_hook(task_prlimit, cred, tcred, flags);
3414	}	3427	}
3415		3428
3416	/**	3429	/**
@@ -3428,7 +3441,7 @@ int security_task_prlimit(const struct cred cred, const struct cred tcred, · 11 unmodified lines
3428	int security_task_setrlimit(struct task_struct *p, unsigned int resource,	3441	int security_task_setrlimit(struct task_struct *p, unsigned int resource,
3429	struct rlimit *new_rlim)	3442	struct rlimit *new_rlim)
3430	{	3443	{
3431	return call_int_hook(task_setrlimit, 0, p, resource, new_rlim);	3444	return call_int_hook(task_setrlimit, p, resource, new_rlim);
3432	}	3445	}
3433		3446
3434	/**	3447	/**
@@ -3442,7 +3455,7 @@ int security_task_setrlimit(struct task_struct *p, unsigned int resource, · 7 unmodified lines
3442	*/	3455	*/
3443	int security_task_setscheduler(struct task_struct *p)	3456	int security_task_setscheduler(struct task_struct *p)
3444	{	3457	{
3445	return call_int_hook(task_setscheduler, 0, p);	3458	return call_int_hook(task_setscheduler, p);
3446	}	3459	}
3447		3460
3448	/**	3461	/**
@@ -3455,7 +3468,7 @@ int security_task_setscheduler(struct task_struct *p) · 6 unmodified lines
3455	*/	3468	*/
3456	int security_task_getscheduler(struct task_struct *p)	3469	int security_task_getscheduler(struct task_struct *p)
3457	{	3470	{
3458	return call_int_hook(task_getscheduler, 0, p);	3471	return call_int_hook(task_getscheduler, p);
3459	}	3472	}
3460		3473
3461	/**	3474	/**
@@ -3468,7 +3481,7 @@ int security_task_getscheduler(struct task_struct *p) · 6 unmodified lines
3468	*/	3481	*/
3469	int security_task_movememory(struct task_struct *p)	3482	int security_task_movememory(struct task_struct *p)
3470	{	3483	{
3471	return call_int_hook(task_movememory, 0, p);	3484	return call_int_hook(task_movememory, p);
3472	}	3485	}
3473		3486
3474	/**	3487	/**
@@ -3489,7 +3502,7 @@ int security_task_movememory(struct task_struct *p) · 14 unmodified lines
3489	int security_task_kill(struct task_struct p, struct kernel_siginfo info,	3502	int security_task_kill(struct task_struct p, struct kernel_siginfo info,
3490	int sig, const struct cred *cred)	3503	int sig, const struct cred *cred)
3491	{	3504	{
3492	return call_int_hook(task_kill, 0, p, info, sig, cred);	3505	return call_int_hook(task_kill, p, info, sig, cred);
3493	}	3506	}
3494		3507
3495	/**	3508	/**
@@ -3547,7 +3560,7 @@ void security_task_to_inode(struct task_struct p, struct inode inode) · 51 unmodified lines
3547	*/	3560	*/
3548	int security_create_user_ns(const struct cred *cred)	3561	int security_create_user_ns(const struct cred *cred)
3549	{	3562	{
3550	return call_int_hook(userns_create, 0, cred);	3563	return call_int_hook(userns_create, cred);
3551	}	3564	}
3552		3565
3553	/**	3566	/**
@@ -3561,7 +3574,7 @@ int security_create_user_ns(const struct cred *cred) · 7 unmodified lines
3561	*/	3574	*/
3562	int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag)	3575	int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
3563	{	3576	{
3564	return call_int_hook(ipc_permission, 0, ipcp, flag);	3577	return call_int_hook(ipc_permission, ipcp, flag);
3565	}	3578	}
3566		3579
3567	/**	3580	/**
@@ -3593,7 +3606,7 @@ int security_msg_msg_alloc(struct msg_msg *msg) · 25 unmodified lines
3593		3606
3594	if (unlikely(rc))	3607	if (unlikely(rc))
3595	return rc;	3608	return rc;
3596	rc = call_int_hook(msg_msg_alloc_security, 0, msg);	3609	rc = call_int_hook(msg_msg_alloc_security, msg);
3597	if (unlikely(rc))	3610	if (unlikely(rc))
3598	security_msg_msg_free(msg);	3611	security_msg_msg_free(msg);
3599	return rc;	3612	return rc;
@@ -3627,7 +3640,7 @@ int security_msg_queue_alloc(struct kern_ipc_perm *msq) · 27 unmodified lines
3627		3640
3628	if (unlikely(rc))	3641	if (unlikely(rc))
3629	return rc;	3642	return rc;
3630	rc = call_int_hook(msg_queue_alloc_security, 0, msq);	3643	rc = call_int_hook(msg_queue_alloc_security, msq);
3631	if (unlikely(rc))	3644	if (unlikely(rc))
3632	security_msg_queue_free(msq);	3645	security_msg_queue_free(msq);
3633	return rc;	3646	return rc;
@@ -3659,7 +3672,7 @@ void security_msg_queue_free(struct kern_ipc_perm *msq) · 25 unmodified lines
3659	*/	3672	*/
3660	int security_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)	3673	int security_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
3661	{	3674	{
3662	return call_int_hook(msg_queue_associate, 0, msq, msqflg);	3675	return call_int_hook(msg_queue_associate, msq, msqflg);
3663	}	3676	}
3664		3677
3665	/**	3678	/**
@@ -3674,7 +3687,7 @@ int security_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg) · 8 unmodified lines
3674	*/	3687	*/
3675	int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)	3688	int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
3676	{	3689	{
3677	return call_int_hook(msg_queue_msgctl, 0, msq, cmd);	3690	return call_int_hook(msg_queue_msgctl, msq, cmd);
3678	}	3691	}
3679		3692
3680	/**	3693	/**
@@ -3691,7 +3704,7 @@ int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd) · 10 unmodified lines
3691	int security_msg_queue_msgsnd(struct kern_ipc_perm *msq,	3704	int security_msg_queue_msgsnd(struct kern_ipc_perm *msq,
3692	struct msg_msg *msg, int msqflg)	3705	struct msg_msg *msg, int msqflg)
3693	{	3706	{
3694	return call_int_hook(msg_queue_msgsnd, 0, msq, msg, msqflg);	3707	return call_int_hook(msg_queue_msgsnd, msq, msg, msqflg);
3695	}	3708	}
3696		3709
3697	/**	3710	/**
@@ -3712,7 +3725,7 @@ int security_msg_queue_msgsnd(struct kern_ipc_perm *msq, · 14 unmodified lines
3712	int security_msg_queue_msgrcv(struct kern_ipc_perm msq, struct msg_msg msg,	3725	int security_msg_queue_msgrcv(struct kern_ipc_perm msq, struct msg_msg msg,
3713	struct task_struct *target, long type, int mode)	3726	struct task_struct *target, long type, int mode)
3714	{	3727	{
3715	return call_int_hook(msg_queue_msgrcv, 0, msq, msg, target, type, mode);	3728	return call_int_hook(msg_queue_msgrcv, msq, msg, target, type, mode);
3716	}	3729	}
3717		3730
3718	/**	3731	/**
@@ -3730,7 +3743,7 @@ int security_shm_alloc(struct kern_ipc_perm *shp) · 11 unmodified lines
3730		3743
3731	if (unlikely(rc))	3744	if (unlikely(rc))
3732	return rc;	3745	return rc;
3733	rc = call_int_hook(shm_alloc_security, 0, shp);	3746	rc = call_int_hook(shm_alloc_security, shp);
3734	if (unlikely(rc))	3747	if (unlikely(rc))
3735	security_shm_free(shp);	3748	security_shm_free(shp);
3736	return rc;	3749	return rc;
@@ -3763,7 +3776,7 @@ void security_shm_free(struct kern_ipc_perm *shp) · 26 unmodified lines
3763	*/	3776	*/
3764	int security_shm_associate(struct kern_ipc_perm *shp, int shmflg)	3777	int security_shm_associate(struct kern_ipc_perm *shp, int shmflg)
3765	{	3778	{
3766	return call_int_hook(shm_associate, 0, shp, shmflg);	3779	return call_int_hook(shm_associate, shp, shmflg);
3767	}	3780	}
3768		3781
3769	/**	3782	/**
@@ -3778,7 +3791,7 @@ int security_shm_associate(struct kern_ipc_perm *shp, int shmflg) · 8 unmodified lines
3778	*/	3791	*/
3779	int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd)	3792	int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
3780	{	3793	{
3781	return call_int_hook(shm_shmctl, 0, shp, cmd);	3794	return call_int_hook(shm_shmctl, shp, cmd);
3782	}	3795	}
3783		3796
3784	/**	3797	/**
@@ -3796,7 +3809,7 @@ int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd) · 11 unmodified lines
3796	int security_shm_shmat(struct kern_ipc_perm *shp,	3809	int security_shm_shmat(struct kern_ipc_perm *shp,
3797	char __user *shmaddr, int shmflg)	3810	char __user *shmaddr, int shmflg)
3798	{	3811	{
3799	return call_int_hook(shm_shmat, 0, shp, shmaddr, shmflg);	3812	return call_int_hook(shm_shmat, shp, shmaddr, shmflg);
3800	}	3813	}
3801		3814
3802	/**	3815	/**
@@ -3814,7 +3827,7 @@ int security_sem_alloc(struct kern_ipc_perm *sma) · 11 unmodified lines
3814		3827
3815	if (unlikely(rc))	3828	if (unlikely(rc))
3816	return rc;	3829	return rc;
3817	rc = call_int_hook(sem_alloc_security, 0, sma);	3830	rc = call_int_hook(sem_alloc_security, sma);
3818	if (unlikely(rc))	3831	if (unlikely(rc))
3819	security_sem_free(sma);	3832	security_sem_free(sma);
3820	return rc;	3833	return rc;
@@ -3846,7 +3859,7 @@ void security_sem_free(struct kern_ipc_perm *sma) · 25 unmodified lines
3846	*/	3859	*/
3847	int security_sem_associate(struct kern_ipc_perm *sma, int semflg)	3860	int security_sem_associate(struct kern_ipc_perm *sma, int semflg)
3848	{	3861	{
3849	return call_int_hook(sem_associate, 0, sma, semflg);	3862	return call_int_hook(sem_associate, sma, semflg);
3850	}	3863	}
3851		3864
3852	/**	3865	/**
@@ -3861,7 +3874,7 @@ int security_sem_associate(struct kern_ipc_perm *sma, int semflg) · 8 unmodified lines
3861	*/	3874	*/
3862	int security_sem_semctl(struct kern_ipc_perm *sma, int cmd)	3875	int security_sem_semctl(struct kern_ipc_perm *sma, int cmd)
3863	{	3876	{
3864	return call_int_hook(sem_semctl, 0, sma, cmd);	3877	return call_int_hook(sem_semctl, sma, cmd);
3865	}	3878	}
3866		3879
3867	/**	3880	/**
@@ -3879,7 +3892,7 @@ int security_sem_semctl(struct kern_ipc_perm *sma, int cmd) · 11 unmodified lines
3879	int security_sem_semop(struct kern_ipc_perm sma, struct sembuf sops,	3892	int security_sem_semop(struct kern_ipc_perm sma, struct sembuf sops,
3880	unsigned nsops, int alter)	3893	unsigned nsops, int alter)
3881	{	3894	{
3882	return call_int_hook(sem_semop, 0, sma, sops, nsops, alter);	3895	return call_int_hook(sem_semop, sma, sops, nsops, alter);
3883	}	3896	}
3884		3897
3885	/**	3898	/**
@@ -4110,11 +4123,11 @@ int security_setprocattr(int lsmid, const char name, void value, size_t size) · 224 unmodified lines
4110	*/	4123	*/
4111	int security_netlink_send(struct sock sk, struct sk_buff skb)	4124	int security_netlink_send(struct sock sk, struct sk_buff skb)
4112	{	4125	{
4113	return call_int_hook(netlink_send, 0, sk, skb);	4126	return call_int_hook(netlink_send, sk, skb);
4114	}	4127	}
4115		4128
4116	/**	4129	/**
4117	* security_ismaclabel() - Check is the named attribute is a MAC label	4130	* security_ismaclabel() - Check if the named attribute is a MAC label
4118	* @name: full extended attribute name	4131	* @name: full extended attribute name
4119	*	4132	*
4120	* Check if the extended attribute specified by @name represents a MAC label.	4133	* Check if the extended attribute specified by @name represents a MAC label.
@@ -4123,7 +4136,7 @@ int security_netlink_send(struct sock sk, struct sk_buff skb) · 2 unmodified lines
4123	*/	4136	*/
4124	int security_ismaclabel(const char *name)	4137	int security_ismaclabel(const char *name)
4125	{	4138	{
4126	return call_int_hook(ismaclabel, 0, name);	4139	return call_int_hook(ismaclabel, name);
4127	}	4140	}
4128	EXPORT_SYMBOL(security_ismaclabel);	4141	EXPORT_SYMBOL(security_ismaclabel);
4129		4142
@@ -4142,20 +4155,7 @@ EXPORT_SYMBOL(security_ismaclabel); · 12 unmodified lines
4142	*/	4155	*/
4143	int security_secid_to_secctx(u32 secid, char *secdata, u32 seclen)	4156	int security_secid_to_secctx(u32 secid, char *secdata, u32 seclen)
4144	{	4157	{
4145	struct security_hook_list *hp;	4158	return call_int_hook(secid_to_secctx, secid, secdata, seclen);
4146	int rc;
4147
4148	/*
4149	* Currently, only one LSM can implement secid_to_secctx (i.e this
4150	* LSM hook is not "stackable").
4151	*/
4152	hlist_for_each_entry(hp, &security_hook_heads.secid_to_secctx, list) {
4153	rc = hp->hook.secid_to_secctx(secid, secdata, seclen);
4154	if (rc != LSM_RET_DEFAULT(secid_to_secctx))
4155	return rc;
4156	}
4157
4158	return LSM_RET_DEFAULT(secid_to_secctx);
4159	}	4159	}
4160	EXPORT_SYMBOL(security_secid_to_secctx);	4160	EXPORT_SYMBOL(security_secid_to_secctx);
4161		4161
@@ -4172,7 +4172,7 @@ EXPORT_SYMBOL(security_secid_to_secctx); · 10 unmodified lines
4172	int security_secctx_to_secid(const char secdata, u32 seclen, u32 secid)	4172	int security_secctx_to_secid(const char secdata, u32 seclen, u32 secid)
4173	{	4173	{
4174	*secid = 0;	4174	*secid = 0;
4175	return call_int_hook(secctx_to_secid, 0, secdata, seclen, secid);	4175	return call_int_hook(secctx_to_secid, secdata, seclen, secid);
4176	}	4176	}
4177	EXPORT_SYMBOL(security_secctx_to_secid);	4177	EXPORT_SYMBOL(security_secctx_to_secid);
4178		4178
@@ -4219,7 +4219,7 @@ EXPORT_SYMBOL(security_inode_invalidate_secctx); · 40 unmodified lines
4219	*/	4219	*/
4220	int security_inode_notifysecctx(struct inode inode, void ctx, u32 ctxlen)	4220	int security_inode_notifysecctx(struct inode inode, void ctx, u32 ctxlen)
4221	{	4221	{
4222	return call_int_hook(inode_notifysecctx, 0, inode, ctx, ctxlen);	4222	return call_int_hook(inode_notifysecctx, inode, ctx, ctxlen);
4223	}	4223	}
4224	EXPORT_SYMBOL(security_inode_notifysecctx);	4224	EXPORT_SYMBOL(security_inode_notifysecctx);
4225		4225
@@ -4241,7 +4241,7 @@ EXPORT_SYMBOL(security_inode_notifysecctx); · 15 unmodified lines
4241	*/	4241	*/
4242	int security_inode_setsecctx(struct dentry dentry, void ctx, u32 ctxlen)	4242	int security_inode_setsecctx(struct dentry dentry, void ctx, u32 ctxlen)
4243	{	4243	{
4244	return call_int_hook(inode_setsecctx, 0, dentry, ctx, ctxlen);	4244	return call_int_hook(inode_setsecctx, dentry, ctx, ctxlen);
4245	}	4245	}
4246	EXPORT_SYMBOL(security_inode_setsecctx);	4246	EXPORT_SYMBOL(security_inode_setsecctx);
4247		4247
@@ -4258,19 +4258,7 @@ EXPORT_SYMBOL(security_inode_setsecctx); · 10 unmodified lines
4258	*/	4258	*/
4259	int security_inode_getsecctx(struct inode inode, void ctx, u32 ctxlen)	4259	int security_inode_getsecctx(struct inode inode, void ctx, u32 ctxlen)
4260	{	4260	{
4261	struct security_hook_list *hp;	4261	return call_int_hook(inode_getsecctx, inode, ctx, ctxlen);
4262	int rc;
4263
4264	/*
4265	* Only one module will provide a security context.
4266	*/
4267	hlist_for_each_entry(hp, &security_hook_heads.inode_getsecctx, list) {
4268	rc = hp->hook.inode_getsecctx(inode, ctx, ctxlen);
4269	if (rc != LSM_RET_DEFAULT(inode_getsecctx))
4270	return rc;
4271	}
4272
4273	return LSM_RET_DEFAULT(inode_getsecctx);
4274	}	4262	}
4275	EXPORT_SYMBOL(security_inode_getsecctx);	4263	EXPORT_SYMBOL(security_inode_getsecctx);
4276		4264
@@ -4289,7 +4277,7 @@ int security_post_notification(const struct cred *w_cred, · 12 unmodified lines
4289	const struct cred *cred,	4277	const struct cred *cred,
4290	struct watch_notification *n)	4278	struct watch_notification *n)
4291	{	4279	{
4292	return call_int_hook(post_notification, 0, w_cred, cred, n);	4280	return call_int_hook(post_notification, w_cred, cred, n);
4293	}	4281	}
4294	#endif /* CONFIG_WATCH_QUEUE */	4282	#endif /* CONFIG_WATCH_QUEUE */
4295		4283
@@ -4305,7 +4293,7 @@ int security_post_notification(const struct cred *w_cred, · 9 unmodified lines
4305	*/	4293	*/
4306	int security_watch_key(struct key *key)	4294	int security_watch_key(struct key *key)
4307	{	4295	{
4308	return call_int_hook(watch_key, 0, key);	4296	return call_int_hook(watch_key, key);
4309	}	4297	}
4310	#endif /* CONFIG_KEY_NOTIFICATIONS */	4298	#endif /* CONFIG_KEY_NOTIFICATIONS */
4311		4299
@@ -4334,7 +4322,7 @@ int security_watch_key(struct key *key) · 22 unmodified lines
4334	int security_unix_stream_connect(struct sock sock, struct sock other,	4322	int security_unix_stream_connect(struct sock sock, struct sock other,
4335	struct sock *newsk)	4323	struct sock *newsk)
4336	{	4324	{
4337	return call_int_hook(unix_stream_connect, 0, sock, other, newsk);	4325	return call_int_hook(unix_stream_connect, sock, other, newsk);
4338	}	4326	}
4339	EXPORT_SYMBOL(security_unix_stream_connect);	4327	EXPORT_SYMBOL(security_unix_stream_connect);
4340		4328
@@ -4360,7 +4348,7 @@ EXPORT_SYMBOL(security_unix_stream_connect); · 19 unmodified lines
4360	*/	4348	*/
4361	int security_unix_may_send(struct socket sock, struct socket other)	4349	int security_unix_may_send(struct socket sock, struct socket other)
4362	{	4350	{
4363	return call_int_hook(unix_may_send, 0, sock, other);	4351	return call_int_hook(unix_may_send, sock, other);
4364	}	4352	}
4365	EXPORT_SYMBOL(security_unix_may_send);	4353	EXPORT_SYMBOL(security_unix_may_send);
4366		4354
@@ -4377,7 +4365,7 @@ EXPORT_SYMBOL(security_unix_may_send); · 10 unmodified lines
4377	*/	4365	*/
4378	int security_socket_create(int family, int type, int protocol, int kern)	4366	int security_socket_create(int family, int type, int protocol, int kern)
4379	{	4367	{
4380	return call_int_hook(socket_create, 0, family, type, protocol, kern);	4368	return call_int_hook(socket_create, family, type, protocol, kern);
4381	}	4369	}
4382		4370
4383	/**	4371	/**
@@ -4401,7 +4389,7 @@ int security_socket_create(int family, int type, int protocol, int kern) · 17 unmodified lines
4401	int security_socket_post_create(struct socket *sock, int family,	4389	int security_socket_post_create(struct socket *sock, int family,
4402	int type, int protocol, int kern)	4390	int type, int protocol, int kern)
4403	{	4391	{
4404	return call_int_hook(socket_post_create, 0, sock, family, type,	4392	return call_int_hook(socket_post_create, sock, family, type,
4405	protocol, kern);	4393	protocol, kern);
4406	}	4394	}
4407		4395
@@ -4417,7 +4405,7 @@ int security_socket_post_create(struct socket *sock, int family, · 9 unmodified lines
4417	*/	4405	*/
4418	int security_socket_socketpair(struct socket socka, struct socket sockb)	4406	int security_socket_socketpair(struct socket socka, struct socket sockb)
4419	{	4407	{
4420	return call_int_hook(socket_socketpair, 0, socka, sockb);	4408	return call_int_hook(socket_socketpair, socka, sockb);
4421	}	4409	}
4422	EXPORT_SYMBOL(security_socket_socketpair);	4410	EXPORT_SYMBOL(security_socket_socketpair);
4423		4411
@@ -4436,7 +4424,7 @@ EXPORT_SYMBOL(security_socket_socketpair); · 12 unmodified lines
4436	int security_socket_bind(struct socket *sock,	4424	int security_socket_bind(struct socket *sock,
4437	struct sockaddr *address, int addrlen)	4425	struct sockaddr *address, int addrlen)
4438	{	4426	{
4439	return call_int_hook(socket_bind, 0, sock, address, addrlen);	4427	return call_int_hook(socket_bind, sock, address, addrlen);
4440	}	4428	}
4441		4429
4442	/**	4430	/**
@@ -4453,7 +4441,7 @@ int security_socket_bind(struct socket *sock, · 10 unmodified lines
4453	int security_socket_connect(struct socket *sock,	4441	int security_socket_connect(struct socket *sock,
4454	struct sockaddr *address, int addrlen)	4442	struct sockaddr *address, int addrlen)
4455	{	4443	{
4456	return call_int_hook(socket_connect, 0, sock, address, addrlen);	4444	return call_int_hook(socket_connect, sock, address, addrlen);
4457	}	4445	}
4458		4446
4459	/**	4447	/**
@@ -4467,7 +4455,7 @@ int security_socket_connect(struct socket *sock, · 7 unmodified lines
4467	*/	4455	*/
4468	int security_socket_listen(struct socket *sock, int backlog)	4456	int security_socket_listen(struct socket *sock, int backlog)
4469	{	4457	{
4470	return call_int_hook(socket_listen, 0, sock, backlog);	4458	return call_int_hook(socket_listen, sock, backlog);
4471	}	4459	}
4472		4460
4473	/**	4461	/**
@@ -4483,11 +4471,11 @@ int security_socket_listen(struct socket *sock, int backlog) · 9 unmodified lines
4483	*/	4471	*/
4484	int security_socket_accept(struct socket sock, struct socket newsock)	4472	int security_socket_accept(struct socket sock, struct socket newsock)
4485	{	4473	{
4486	return call_int_hook(socket_accept, 0, sock, newsock);	4474	return call_int_hook(socket_accept, sock, newsock);
4487	}	4475	}
4488		4476
4489	/**	4477	/**
4490	* security_socket_sendmsg() - Check is sending a message is allowed	4478	* security_socket_sendmsg() - Check if sending a message is allowed
4491	* @sock: sending socket	4479	* @sock: sending socket
4492	* @msg: message to send	4480	* @msg: message to send
4493	* @size: size of message	4481	* @size: size of message
@@ -4498,7 +4486,7 @@ int security_socket_accept(struct socket sock, struct socket newsock) · 4 unmodified lines
4498	*/	4486	*/
4499	int security_socket_sendmsg(struct socket sock, struct msghdr msg, int size)	4487	int security_socket_sendmsg(struct socket sock, struct msghdr msg, int size)
4500	{	4488	{
4501	return call_int_hook(socket_sendmsg, 0, sock, msg, size);	4489	return call_int_hook(socket_sendmsg, sock, msg, size);
4502	}	4490	}
4503		4491
4504	/**	4492	/**
@@ -4515,7 +4503,7 @@ int security_socket_sendmsg(struct socket sock, struct msghdr msg, int size) · 10 unmodified lines
4515	int security_socket_recvmsg(struct socket sock, struct msghdr msg,	4503	int security_socket_recvmsg(struct socket sock, struct msghdr msg,
4516	int size, int flags)	4504	int size, int flags)
4517	{	4505	{
4518	return call_int_hook(socket_recvmsg, 0, sock, msg, size, flags);	4506	return call_int_hook(socket_recvmsg, sock, msg, size, flags);
4519	}	4507	}
4520		4508
4521	/**	4509	/**
@@ -4529,7 +4517,7 @@ int security_socket_recvmsg(struct socket sock, struct msghdr msg, · 7 unmodified lines
4529	*/	4517	*/
4530	int security_socket_getsockname(struct socket *sock)	4518	int security_socket_getsockname(struct socket *sock)
4531	{	4519	{
4532	return call_int_hook(socket_getsockname, 0, sock);	4520	return call_int_hook(socket_getsockname, sock);
4533	}	4521	}
4534		4522
4535	/**	4523	/**
@@ -4542,7 +4530,7 @@ int security_socket_getsockname(struct socket *sock) · 6 unmodified lines
4542	*/	4530	*/
4543	int security_socket_getpeername(struct socket *sock)	4531	int security_socket_getpeername(struct socket *sock)
4544	{	4532	{
4545	return call_int_hook(socket_getpeername, 0, sock);	4533	return call_int_hook(socket_getpeername, sock);
4546	}	4534	}
4547		4535
4548	/**	4536	/**
@@ -4558,7 +4546,7 @@ int security_socket_getpeername(struct socket *sock) · 9 unmodified lines
4558	*/	4546	*/
4559	int security_socket_getsockopt(struct socket *sock, int level, int optname)	4547	int security_socket_getsockopt(struct socket *sock, int level, int optname)
4560	{	4548	{
4561	return call_int_hook(socket_getsockopt, 0, sock, level, optname);	4549	return call_int_hook(socket_getsockopt, sock, level, optname);
4562	}	4550	}
4563		4551
4564	/**	4552	/**
@@ -4573,7 +4561,7 @@ int security_socket_getsockopt(struct socket *sock, int level, int optname) · 8 unmodified lines
4573	*/	4561	*/
4574	int security_socket_setsockopt(struct socket *sock, int level, int optname)	4562	int security_socket_setsockopt(struct socket *sock, int level, int optname)
4575	{	4563	{
4576	return call_int_hook(socket_setsockopt, 0, sock, level, optname);	4564	return call_int_hook(socket_setsockopt, sock, level, optname);
4577	}	4565	}
4578		4566
4579	/**	4567	/**
@@ -4588,7 +4576,7 @@ int security_socket_setsockopt(struct socket *sock, int level, int optname) · 8 unmodified lines
4588	*/	4576	*/
4589	int security_socket_shutdown(struct socket *sock, int how)	4577	int security_socket_shutdown(struct socket *sock, int how)
4590	{	4578	{
4591	return call_int_hook(socket_shutdown, 0, sock, how);	4579	return call_int_hook(socket_shutdown, sock, how);
4592	}	4580	}
4593		4581
4594	/**	4582	/**
@@ -4605,7 +4593,7 @@ int security_socket_shutdown(struct socket *sock, int how) · 10 unmodified lines
4605	*/	4593	*/
4606	int security_sock_rcv_skb(struct sock sk, struct sk_buff skb)	4594	int security_sock_rcv_skb(struct sock sk, struct sk_buff skb)
4607	{	4595	{
4608	return call_int_hook(socket_sock_rcv_skb, 0, sk, skb);	4596	return call_int_hook(socket_sock_rcv_skb, sk, skb);
4609	}	4597	}
4610	EXPORT_SYMBOL(security_sock_rcv_skb);	4598	EXPORT_SYMBOL(security_sock_rcv_skb);
4611		4599
@@ -4627,20 +4615,8 @@ EXPORT_SYMBOL(security_sock_rcv_skb); · 15 unmodified lines
4627	int security_socket_getpeersec_stream(struct socket *sock, sockptr_t optval,	4615	int security_socket_getpeersec_stream(struct socket *sock, sockptr_t optval,
4628	sockptr_t optlen, unsigned int len)	4616	sockptr_t optlen, unsigned int len)
4629	{	4617	{
4630	struct security_hook_list *hp;	4618	return call_int_hook(socket_getpeersec_stream, sock, optval, optlen,
4631	int rc;	4619	len);
4632
4633	/*
4634	* Only one module will provide a security context.
4635	*/
4636	hlist_for_each_entry(hp, &security_hook_heads.socket_getpeersec_stream,
4637	list) {
4638	rc = hp->hook.socket_getpeersec_stream(sock, optval, optlen,
4639	len);
4640	if (rc != LSM_RET_DEFAULT(socket_getpeersec_stream))
4641	return rc;
4642	}
4643	return LSM_RET_DEFAULT(socket_getpeersec_stream);
4644	}	4620	}
4645		4621
4646	/**	4622	/**
@@ -4660,19 +4636,7 @@ int security_socket_getpeersec_stream(struct socket *sock, sockptr_t optval, · 13 unmodified lines
4660	int security_socket_getpeersec_dgram(struct socket *sock,	4636	int security_socket_getpeersec_dgram(struct socket *sock,
4661	struct sk_buff skb, u32 secid)	4637	struct sk_buff skb, u32 secid)
4662	{	4638	{
4663	struct security_hook_list *hp;	4639	return call_int_hook(socket_getpeersec_dgram, sock, skb, secid);
4664	int rc;
4665
4666	/*
4667	* Only one module will provide a security context.
4668	*/
4669	hlist_for_each_entry(hp, &security_hook_heads.socket_getpeersec_dgram,
4670	list) {
4671	rc = hp->hook.socket_getpeersec_dgram(sock, skb, secid);
4672	if (rc != LSM_RET_DEFAULT(socket_getpeersec_dgram))
4673	return rc;
4674	}
4675	return LSM_RET_DEFAULT(socket_getpeersec_dgram);
4676	}	4640	}
4677	EXPORT_SYMBOL(security_socket_getpeersec_dgram);	4641	EXPORT_SYMBOL(security_socket_getpeersec_dgram);
4678		4642
@@ -4689,7 +4653,7 @@ EXPORT_SYMBOL(security_socket_getpeersec_dgram); · 10 unmodified lines
4689	*/	4653	*/
4690	int security_sk_alloc(struct sock *sk, int family, gfp_t priority)	4654	int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
4691	{	4655	{
4692	return call_int_hook(sk_alloc_security, 0, sk, family, priority);	4656	return call_int_hook(sk_alloc_security, sk, family, priority);
4693	}	4657	}
4694		4658
4695	/**	4659	/**
@@ -4770,7 +4734,7 @@ EXPORT_SYMBOL(security_sock_graft); · 74 unmodified lines
4770	int security_inet_conn_request(const struct sock *sk,	4734	int security_inet_conn_request(const struct sock *sk,
4771	struct sk_buff skb, struct request_sock req)	4735	struct sk_buff skb, struct request_sock req)
4772	{	4736	{
4773	return call_int_hook(inet_conn_request, 0, sk, skb, req);	4737	return call_int_hook(inet_conn_request, sk, skb, req);
4774	}	4738	}
4775	EXPORT_SYMBOL(security_inet_conn_request);	4739	EXPORT_SYMBOL(security_inet_conn_request);
4776		4740
@@ -4811,7 +4775,7 @@ EXPORT_SYMBOL(security_inet_conn_established); · 34 unmodified lines
4811	*/	4775	*/
4812	int security_secmark_relabel_packet(u32 secid)	4776	int security_secmark_relabel_packet(u32 secid)
4813	{	4777	{
4814	return call_int_hook(secmark_relabel_packet, 0, secid);	4778	return call_int_hook(secmark_relabel_packet, secid);
4815	}	4779	}
4816	EXPORT_SYMBOL(security_secmark_relabel_packet);	4780	EXPORT_SYMBOL(security_secmark_relabel_packet);
4817		4781
@@ -4848,7 +4812,7 @@ EXPORT_SYMBOL(security_secmark_refcount_dec); · 30 unmodified lines
4848	*/	4812	*/
4849	int security_tun_dev_alloc_security(void **security)	4813	int security_tun_dev_alloc_security(void **security)
4850	{	4814	{
4851	return call_int_hook(tun_dev_alloc_security, 0, security);	4815	return call_int_hook(tun_dev_alloc_security, security);
4852	}	4816	}
4853	EXPORT_SYMBOL(security_tun_dev_alloc_security);	4817	EXPORT_SYMBOL(security_tun_dev_alloc_security);
4854		4818
@@ -4873,7 +4837,7 @@ EXPORT_SYMBOL(security_tun_dev_free_security); · 18 unmodified lines
4873	*/	4837	*/
4874	int security_tun_dev_create(void)	4838	int security_tun_dev_create(void)
4875	{	4839	{
4876	return call_int_hook(tun_dev_create, 0);	4840	return call_int_hook(tun_dev_create);
4877	}	4841	}
4878	EXPORT_SYMBOL(security_tun_dev_create);	4842	EXPORT_SYMBOL(security_tun_dev_create);
4879		4843
@@ -4887,7 +4851,7 @@ EXPORT_SYMBOL(security_tun_dev_create); · 7 unmodified lines
4887	*/	4851	*/
4888	int security_tun_dev_attach_queue(void *security)	4852	int security_tun_dev_attach_queue(void *security)
4889	{	4853	{
4890	return call_int_hook(tun_dev_attach_queue, 0, security);	4854	return call_int_hook(tun_dev_attach_queue, security);
4891	}	4855	}
4892	EXPORT_SYMBOL(security_tun_dev_attach_queue);	4856	EXPORT_SYMBOL(security_tun_dev_attach_queue);
4893		4857
@@ -4903,7 +4867,7 @@ EXPORT_SYMBOL(security_tun_dev_attach_queue); · 9 unmodified lines
4903	*/	4867	*/
4904	int security_tun_dev_attach(struct sock sk, void security)	4868	int security_tun_dev_attach(struct sock sk, void security)
4905	{	4869	{
4906	return call_int_hook(tun_dev_attach, 0, sk, security);	4870	return call_int_hook(tun_dev_attach, sk, security);
4907	}	4871	}
4908	EXPORT_SYMBOL(security_tun_dev_attach);	4872	EXPORT_SYMBOL(security_tun_dev_attach);
4909		4873
@@ -4918,7 +4882,7 @@ EXPORT_SYMBOL(security_tun_dev_attach); · 8 unmodified lines
4918	*/	4882	*/
4919	int security_tun_dev_open(void *security)	4883	int security_tun_dev_open(void *security)
4920	{	4884	{
4921	return call_int_hook(tun_dev_open, 0, security);	4885	return call_int_hook(tun_dev_open, security);
4922	}	4886	}
4923	EXPORT_SYMBOL(security_tun_dev_open);	4887	EXPORT_SYMBOL(security_tun_dev_open);
4924		4888
@@ -4934,7 +4898,7 @@ EXPORT_SYMBOL(security_tun_dev_open); · 9 unmodified lines
4934	int security_sctp_assoc_request(struct sctp_association *asoc,	4898	int security_sctp_assoc_request(struct sctp_association *asoc,
4935	struct sk_buff *skb)	4899	struct sk_buff *skb)
4936	{	4900	{
4937	return call_int_hook(sctp_assoc_request, 0, asoc, skb);	4901	return call_int_hook(sctp_assoc_request, asoc, skb);
4938	}	4902	}
4939	EXPORT_SYMBOL(security_sctp_assoc_request);	4903	EXPORT_SYMBOL(security_sctp_assoc_request);
4940		4904
@@ -4955,8 +4919,7 @@ EXPORT_SYMBOL(security_sctp_assoc_request); · 14 unmodified lines
4955	int security_sctp_bind_connect(struct sock *sk, int optname,	4919	int security_sctp_bind_connect(struct sock *sk, int optname,
4956	struct sockaddr *address, int addrlen)	4920	struct sockaddr *address, int addrlen)
4957	{	4921	{
4958	return call_int_hook(sctp_bind_connect, 0, sk, optname,	4922	return call_int_hook(sctp_bind_connect, sk, optname, address, addrlen);
4959	address, addrlen);
4960	}	4923	}
4961	EXPORT_SYMBOL(security_sctp_bind_connect);	4924	EXPORT_SYMBOL(security_sctp_bind_connect);
4962		4925
@@ -4990,7 +4953,7 @@ EXPORT_SYMBOL(security_sctp_sk_clone); · 27 unmodified lines
4990	int security_sctp_assoc_established(struct sctp_association *asoc,	4953	int security_sctp_assoc_established(struct sctp_association *asoc,
4991	struct sk_buff *skb)	4954	struct sk_buff *skb)
4992	{	4955	{
4993	return call_int_hook(sctp_assoc_established, 0, asoc, skb);	4956	return call_int_hook(sctp_assoc_established, asoc, skb);
4994	}	4957	}
4995	EXPORT_SYMBOL(security_sctp_assoc_established);	4958	EXPORT_SYMBOL(security_sctp_assoc_established);
4996		4959
@@ -5008,7 +4971,7 @@ EXPORT_SYMBOL(security_sctp_assoc_established); · 11 unmodified lines
5008	*/	4971	*/
5009	int security_mptcp_add_subflow(struct sock sk, struct sock ssk)	4972	int security_mptcp_add_subflow(struct sock sk, struct sock ssk)
5010	{	4973	{
5011	return call_int_hook(mptcp_add_subflow, 0, sk, ssk);	4974	return call_int_hook(mptcp_add_subflow, sk, ssk);
5012	}	4975	}
5013		4976
5014	#endif /* CONFIG_SECURITY_NETWORK */	4977	#endif /* CONFIG_SECURITY_NETWORK */
@@ -5026,7 +4989,7 @@ int security_mptcp_add_subflow(struct sock sk, struct sock ssk) · 11 unmodified lines
5026	*/	4989	*/
5027	int security_ib_pkey_access(void *sec, u64 subnet_prefix, u16 pkey)	4990	int security_ib_pkey_access(void *sec, u64 subnet_prefix, u16 pkey)
5028	{	4991	{
5029	return call_int_hook(ib_pkey_access, 0, sec, subnet_prefix, pkey);	4992	return call_int_hook(ib_pkey_access, sec, subnet_prefix, pkey);
5030	}	4993	}
5031	EXPORT_SYMBOL(security_ib_pkey_access);	4994	EXPORT_SYMBOL(security_ib_pkey_access);
5032		4995
@@ -5043,8 +5006,7 @@ EXPORT_SYMBOL(security_ib_pkey_access); · 10 unmodified lines
5043	int security_ib_endport_manage_subnet(void *sec,	5006	int security_ib_endport_manage_subnet(void *sec,
5044	const char *dev_name, u8 port_num)	5007	const char *dev_name, u8 port_num)
5045	{	5008	{
5046	return call_int_hook(ib_endport_manage_subnet, 0, sec,	5009	return call_int_hook(ib_endport_manage_subnet, sec, dev_name, port_num);
5047	dev_name, port_num);
5048	}	5010	}
5049	EXPORT_SYMBOL(security_ib_endport_manage_subnet);	5011	EXPORT_SYMBOL(security_ib_endport_manage_subnet);
5050		5012
@@ -5058,7 +5020,7 @@ EXPORT_SYMBOL(security_ib_endport_manage_subnet); · 7 unmodified lines
5058	*/	5020	*/
5059	int security_ib_alloc_security(void **sec)	5021	int security_ib_alloc_security(void **sec)
5060	{	5022	{
5061	return call_int_hook(ib_alloc_security, 0, sec);	5023	return call_int_hook(ib_alloc_security, sec);
5062	}	5024	}
5063	EXPORT_SYMBOL(security_ib_alloc_security);	5025	EXPORT_SYMBOL(security_ib_alloc_security);
5064		5026
@@ -5091,7 +5053,7 @@ int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, · 26 unmodified lines
5091	struct xfrm_user_sec_ctx *sec_ctx,	5053	struct xfrm_user_sec_ctx *sec_ctx,
5092	gfp_t gfp)	5054	gfp_t gfp)
5093	{	5055	{
5094	return call_int_hook(xfrm_policy_alloc_security, 0, ctxp, sec_ctx, gfp);	5056	return call_int_hook(xfrm_policy_alloc_security, ctxp, sec_ctx, gfp);
5095	}	5057	}
5096	EXPORT_SYMBOL(security_xfrm_policy_alloc);	5058	EXPORT_SYMBOL(security_xfrm_policy_alloc);
5097		5059
@@ -5108,7 +5070,7 @@ EXPORT_SYMBOL(security_xfrm_policy_alloc); · 10 unmodified lines
5108	int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,	5070	int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
5109	struct xfrm_sec_ctx **new_ctxp)	5071	struct xfrm_sec_ctx **new_ctxp)
5110	{	5072	{
5111	return call_int_hook(xfrm_policy_clone_security, 0, old_ctx, new_ctxp);	5073	return call_int_hook(xfrm_policy_clone_security, old_ctx, new_ctxp);
5112	}	5074	}
5113		5075
5114	/**	5076	/**
@@ -5133,7 +5095,7 @@ EXPORT_SYMBOL(security_xfrm_policy_free); · 18 unmodified lines
5133	*/	5095	*/
5134	int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)	5096	int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
5135	{	5097	{
5136	return call_int_hook(xfrm_policy_delete_security, 0, ctx);	5098	return call_int_hook(xfrm_policy_delete_security, ctx);
5137	}	5099	}
5138		5100
5139	/**	5101	/**
@@ -5150,7 +5112,7 @@ int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx) · 10 unmodified lines
5150	int security_xfrm_state_alloc(struct xfrm_state *x,	5112	int security_xfrm_state_alloc(struct xfrm_state *x,
5151	struct xfrm_user_sec_ctx *sec_ctx)	5113	struct xfrm_user_sec_ctx *sec_ctx)
5152	{	5114	{
5153	return call_int_hook(xfrm_state_alloc, 0, x, sec_ctx);	5115	return call_int_hook(xfrm_state_alloc, x, sec_ctx);
5154	}	5116	}
5155	EXPORT_SYMBOL(security_xfrm_state_alloc);	5117	EXPORT_SYMBOL(security_xfrm_state_alloc);
5156		5118
@@ -5169,7 +5131,7 @@ EXPORT_SYMBOL(security_xfrm_state_alloc); · 12 unmodified lines
5169	int security_xfrm_state_alloc_acquire(struct xfrm_state *x,	5131	int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
5170	struct xfrm_sec_ctx *polsec, u32 secid)	5132	struct xfrm_sec_ctx *polsec, u32 secid)
5171	{	5133	{
5172	return call_int_hook(xfrm_state_alloc_acquire, 0, x, polsec, secid);	5134	return call_int_hook(xfrm_state_alloc_acquire, x, polsec, secid);
5173	}	5135	}
5174		5136
5175	/**	5137	/**
@@ -5182,7 +5144,7 @@ int security_xfrm_state_alloc_acquire(struct xfrm_state *x, · 6 unmodified lines
5182	*/	5144	*/
5183	int security_xfrm_state_delete(struct xfrm_state *x)	5145	int security_xfrm_state_delete(struct xfrm_state *x)
5184	{	5146	{
5185	return call_int_hook(xfrm_state_delete_security, 0, x);	5147	return call_int_hook(xfrm_state_delete_security, x);
5186	}	5148	}
5187	EXPORT_SYMBOL(security_xfrm_state_delete);	5149	EXPORT_SYMBOL(security_xfrm_state_delete);
5188		5150
@@ -5211,7 +5173,7 @@ void security_xfrm_state_free(struct xfrm_state *x) · 22 unmodified lines
5211	*/	5173	*/
5212	int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid)	5174	int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid)
5213	{	5175	{
5214	return call_int_hook(xfrm_policy_lookup, 0, ctx, fl_secid);	5176	return call_int_hook(xfrm_policy_lookup, ctx, fl_secid);
5215	}	5177	}
5216		5178
5217	/**	5179	/**
@@ -5259,12 +5221,12 @@ int security_xfrm_state_pol_flow_match(struct xfrm_state *x, · 41 unmodified lines
5259	*/	5221	*/
5260	int security_xfrm_decode_session(struct sk_buff skb, u32 secid)	5222	int security_xfrm_decode_session(struct sk_buff skb, u32 secid)
5261	{	5223	{
5262	return call_int_hook(xfrm_decode_session, 0, skb, secid, 1);	5224	return call_int_hook(xfrm_decode_session, skb, secid, 1);
5263	}	5225	}
5264		5226
5265	void security_skb_classify_flow(struct sk_buff skb, struct flowi_common flic)	5227	void security_skb_classify_flow(struct sk_buff skb, struct flowi_common flic)
5266	{	5228	{
5267	int rc = call_int_hook(xfrm_decode_session, 0, skb, &flic->flowic_secid,	5229	int rc = call_int_hook(xfrm_decode_session, skb, &flic->flowic_secid,
5268	0);	5230	0);
5269		5231
5270	BUG_ON(rc);	5232	BUG_ON(rc);
@@ -5287,7 +5249,7 @@ EXPORT_SYMBOL(security_skb_classify_flow); · 16 unmodified lines
5287	int security_key_alloc(struct key key, const struct cred cred,	5249	int security_key_alloc(struct key key, const struct cred cred,
5288	unsigned long flags)	5250	unsigned long flags)
5289	{	5251	{
5290	return call_int_hook(key_alloc, 0, key, cred, flags);	5252	return call_int_hook(key_alloc, key, cred, flags);
5291	}	5253	}
5292		5254
5293	/**	5255	/**
@@ -5314,7 +5276,7 @@ void security_key_free(struct key *key) · 20 unmodified lines
5314	int security_key_permission(key_ref_t key_ref, const struct cred *cred,	5276	int security_key_permission(key_ref_t key_ref, const struct cred *cred,
5315	enum key_need_perm need_perm)	5277	enum key_need_perm need_perm)
5316	{	5278	{
5317	return call_int_hook(key_permission, 0, key_ref, cred, need_perm);	5279	return call_int_hook(key_permission, key_ref, cred, need_perm);
5318	}	5280	}
5319		5281
5320	/**	5282	/**
@@ -5333,7 +5295,26 @@ int security_key_permission(key_ref_t key_ref, const struct cred *cred, · 12 unmodified lines
5333	int security_key_getsecurity(struct key key, char *buffer)	5295	int security_key_getsecurity(struct key key, char *buffer)
5334	{	5296	{
5335	*buffer = NULL;	5297	*buffer = NULL;
5336	return call_int_hook(key_getsecurity, 0, key, buffer);	5298	return call_int_hook(key_getsecurity, key, buffer);
		5299	}
		5300
		5301	/**
		5302	* security_key_post_create_or_update() - Notification of key create or update
		5303	* @keyring: keyring to which the key is linked to
		5304	* @key: created or updated key
		5305	* @payload: data used to instantiate or update the key
		5306	* @payload_len: length of payload
		5307	* @flags: key flags
		5308	* @create: flag indicating whether the key was created or updated
		5309	*
		5310	* Notify the caller of a key creation or update.
		5311	*/
		5312	void security_key_post_create_or_update(struct key keyring, struct key key,
		5313	const void *payload, size_t payload_len,
		5314	unsigned long flags, bool create)
		5315	{
		5316	call_void_hook(key_post_create_or_update, keyring, key, payload,
		5317	payload_len, flags, create);
5337	}	5318	}
5338	#endif /* CONFIG_KEYS */	5319	#endif /* CONFIG_KEYS */
5339		5320
@@ -5352,7 +5333,7 @@ int security_key_getsecurity(struct key key, char *buffer) · 12 unmodified lines
5352	*/	5333	*/
5353	int security_audit_rule_init(u32 field, u32 op, char rulestr, void *lsmrule)	5334	int security_audit_rule_init(u32 field, u32 op, char rulestr, void *lsmrule)
5354	{	5335	{
5355	return call_int_hook(audit_rule_init, 0, field, op, rulestr, lsmrule);	5336	return call_int_hook(audit_rule_init, field, op, rulestr, lsmrule);
5356	}	5337	}
5357		5338
5358	/**	5339	/**
@@ -5366,7 +5347,7 @@ int security_audit_rule_init(u32 field, u32 op, char rulestr, void *lsmrule) · 7 unmodified lines
5366	*/	5347	*/
5367	int security_audit_rule_known(struct audit_krule *krule)	5348	int security_audit_rule_known(struct audit_krule *krule)
5368	{	5349	{
5369	return call_int_hook(audit_rule_known, 0, krule);	5350	return call_int_hook(audit_rule_known, krule);
5370	}	5351	}
5371		5352
5372	/**	5353	/**
@@ -5396,7 +5377,7 @@ void security_audit_rule_free(void *lsmrule) · 23 unmodified lines
5396	*/	5377	*/
5397	int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule)	5378	int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule)
5398	{	5379	{
5399	return call_int_hook(audit_rule_match, 0, secid, field, op, lsmrule);	5380	return call_int_hook(audit_rule_match, secid, field, op, lsmrule);
5400	}	5381	}
5401	#endif /* CONFIG_AUDIT */	5382	#endif /* CONFIG_AUDIT */
5402		5383
@@ -5415,7 +5396,7 @@ int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule) · 12 unmodified lines
5415	*/	5396	*/
5416	int security_bpf(int cmd, union bpf_attr *attr, unsigned int size)	5397	int security_bpf(int cmd, union bpf_attr *attr, unsigned int size)
5417	{	5398	{
5418	return call_int_hook(bpf, 0, cmd, attr, size);	5399	return call_int_hook(bpf, cmd, attr, size);
5419	}	5400	}
5420		5401
5421	/**	5402	/**
@@ -5430,7 +5411,7 @@ int security_bpf(int cmd, union bpf_attr *attr, unsigned int size) · 8 unmodified lines
5430	*/	5411	*/
5431	int security_bpf_map(struct bpf_map *map, fmode_t fmode)	5412	int security_bpf_map(struct bpf_map *map, fmode_t fmode)
5432	{	5413	{
5433	return call_int_hook(bpf_map, 0, map, fmode);	5414	return call_int_hook(bpf_map, map, fmode);
5434	}	5415	}
5435		5416
5436	/**	5417	/**
@@ -5444,7 +5425,7 @@ int security_bpf_map(struct bpf_map *map, fmode_t fmode) · 7 unmodified lines
5444	*/	5425	*/
5445	int security_bpf_prog(struct bpf_prog *prog)	5426	int security_bpf_prog(struct bpf_prog *prog)
5446	{	5427	{
5447	return call_int_hook(bpf_prog, 0, prog);	5428	return call_int_hook(bpf_prog, prog);
5448	}	5429	}
5449		5430
5450	/**	5431	/**
@@ -5461,7 +5442,7 @@ int security_bpf_prog(struct bpf_prog *prog) · 10 unmodified lines
5461	int security_bpf_map_create(struct bpf_map map, union bpf_attr attr,	5442	int security_bpf_map_create(struct bpf_map map, union bpf_attr attr,
5462	struct bpf_token *token)	5443	struct bpf_token *token)
5463	{	5444	{
5464	return call_int_hook(bpf_map_create, 0, map, attr, token);	5445	return call_int_hook(bpf_map_create, map, attr, token);
5465	}	5446	}
5466		5447
5467	/**	5448	/**
@@ -5479,7 +5460,7 @@ int security_bpf_map_create(struct bpf_map map, union bpf_attr attr, · 11 unmodified lines
5479	int security_bpf_prog_load(struct bpf_prog prog, union bpf_attr attr,	5460	int security_bpf_prog_load(struct bpf_prog prog, union bpf_attr attr,
5480	struct bpf_token *token)	5461	struct bpf_token *token)
5481	{	5462	{
5482	return call_int_hook(bpf_prog_load, 0, prog, attr, token);	5463	return call_int_hook(bpf_prog_load, prog, attr, token);
5483	}	5464	}
5484		5465
5485	/**	5466	/**
@@ -5496,7 +5477,7 @@ int security_bpf_prog_load(struct bpf_prog prog, union bpf_attr attr, · 10 unmodified lines
5496	int security_bpf_token_create(struct bpf_token token, union bpf_attr attr,	5477	int security_bpf_token_create(struct bpf_token token, union bpf_attr attr,
5497	struct path *path)	5478	struct path *path)
5498	{	5479	{
5499	return call_int_hook(bpf_token_create, 0, token, attr, path);	5480	return call_int_hook(bpf_token_create, token, attr, path);
5500	}	5481	}
5501		5482
5502	/**	5483	/**
@@ -5512,7 +5493,7 @@ int security_bpf_token_create(struct bpf_token token, union bpf_attr attr, · 9 unmodified lines
5512	*/	5493	*/
5513	int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cmd)	5494	int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cmd)
5514	{	5495	{
5515	return call_int_hook(bpf_token_cmd, 0, token, cmd);	5496	return call_int_hook(bpf_token_cmd, token, cmd);
5516	}	5497	}
5517		5498
5518	/**	5499	/**
@@ -5528,7 +5509,7 @@ int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cmd) · 9 unmodified lines
5528	*/	5509	*/
5529	int security_bpf_token_capable(const struct bpf_token *token, int cap)	5510	int security_bpf_token_capable(const struct bpf_token *token, int cap)
5530	{	5511	{
5531	return call_int_hook(bpf_token_capable, 0, token, cap);	5512	return call_int_hook(bpf_token_capable, token, cap);
5532	}	5513	}
5533		5514
5534	/**	5515	/**
@@ -5576,7 +5557,7 @@ void security_bpf_token_free(struct bpf_token *token) · 41 unmodified lines
5576	*/	5557	*/
5577	int security_locked_down(enum lockdown_reason what)	5558	int security_locked_down(enum lockdown_reason what)
5578	{	5559	{
5579	return call_int_hook(locked_down, 0, what);	5560	return call_int_hook(locked_down, what);
5580	}	5561	}
5581	EXPORT_SYMBOL(security_locked_down);	5562	EXPORT_SYMBOL(security_locked_down);
5582		5563
@@ -5592,7 +5573,7 @@ EXPORT_SYMBOL(security_locked_down); · 9 unmodified lines
5592	*/	5573	*/
5593	int security_perf_event_open(struct perf_event_attr *attr, int type)	5574	int security_perf_event_open(struct perf_event_attr *attr, int type)
5594	{	5575	{
5595	return call_int_hook(perf_event_open, 0, attr, type);	5576	return call_int_hook(perf_event_open, attr, type);
5596	}	5577	}
5597		5578
5598	/**	5579	/**
@@ -5605,7 +5586,7 @@ int security_perf_event_open(struct perf_event_attr *attr, int type) · 6 unmodified lines
5605	*/	5586	*/
5606	int security_perf_event_alloc(struct perf_event *event)	5587	int security_perf_event_alloc(struct perf_event *event)
5607	{	5588	{
5608	return call_int_hook(perf_event_alloc, 0, event);	5589	return call_int_hook(perf_event_alloc, event);
5609	}	5590	}
5610		5591
5611	/**	5592	/**
@@ -5629,7 +5610,7 @@ void security_perf_event_free(struct perf_event *event) · 17 unmodified lines
5629	*/	5610	*/
5630	int security_perf_event_read(struct perf_event *event)	5611	int security_perf_event_read(struct perf_event *event)
5631	{	5612	{
5632	return call_int_hook(perf_event_read, 0, event);	5613	return call_int_hook(perf_event_read, event);
5633	}	5614	}
5634		5615
5635	/**	5616	/**
@@ -5642,7 +5623,7 @@ int security_perf_event_read(struct perf_event *event) · 6 unmodified lines
5642	*/	5623	*/
5643	int security_perf_event_write(struct perf_event *event)	5624	int security_perf_event_write(struct perf_event *event)
5644	{	5625	{
5645	return call_int_hook(perf_event_write, 0, event);	5626	return call_int_hook(perf_event_write, event);
5646	}	5627	}
5647	#endif /* CONFIG_PERF_EVENTS */	5628	#endif /* CONFIG_PERF_EVENTS */
5648		5629
@@ -5658,7 +5639,7 @@ int security_perf_event_write(struct perf_event *event) · 9 unmodified lines
5658	*/	5639	*/
5659	int security_uring_override_creds(const struct cred *new)	5640	int security_uring_override_creds(const struct cred *new)
5660	{	5641	{
5661	return call_int_hook(uring_override_creds, 0, new);	5642	return call_int_hook(uring_override_creds, new);
5662	}	5643	}
5663		5644
5664	/**	5645	/**
@@ -5671,7 +5652,7 @@ int security_uring_override_creds(const struct cred *new) · 6 unmodified lines
5671	*/	5652	*/
5672	int security_uring_sqpoll(void)	5653	int security_uring_sqpoll(void)
5673	{	5654	{
5674	return call_int_hook(uring_sqpoll, 0);	5655	return call_int_hook(uring_sqpoll);
5675	}	5656	}
5676		5657
5677	/**	5658	/**
@@ -5684,6 +5665,6 @@ int security_uring_sqpoll(void) · 6 unmodified lines
5684	*/	5665	*/
5685	int security_uring_cmd(struct io_uring_cmd *ioucmd)	5666	int security_uring_cmd(struct io_uring_cmd *ioucmd)
5686	{	5667	{
5687	return call_int_hook(uring_cmd, 0, ioucmd);	5668	return call_int_hook(uring_cmd, ioucmd);
5688	}	5669	}
5689	#endif /* CONFIG_IO_URING */	5670	#endif /* CONFIG_IO_URING */

security/selinux/hooks.c+2−1

@@ -3135,7 +3135,8 @@ static int selinux_inode_permission(struct inode *inode, int mask) · 3134 unmodified lines
3135	return rc;	3135	return rc;
3136	}	3136	}
3137		3137
3138	static int selinux_inode_setattr(struct dentry dentry, struct iattr iattr)	3138	static int selinux_inode_setattr(struct mnt_idmap idmap, struct dentry dentry,
		3139	struct iattr *iattr)
3139	{	3140	{
3140	const struct cred *cred = current_cred();	3141	const struct cred *cred = current_cred();
3141	struct inode *inode = d_backing_inode(dentry);	3142	struct inode *inode = d_backing_inode(dentry);

security/smack/smack_lsm.c+3−1

 /**
  * smack_inode_setattr - Smack check for setting attributes
+ * @idmap: idmap of the mount
  * @dentry: the object
  * @iattr: for the force flag
  *
  * Returns 0 if access is permitted, an error code otherwise
  */
-static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr)
+static int smack_inode_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
+			       struct iattr *iattr)
 {
 	struct smk_audit_info ad;
 	int rc;

tools/testing/selftests/lsm/lsm_list_modules_test.c+6−0

 		case LSM_ID_LANDLOCK:
 			name = "landlock";
 			break;
+		case LSM_ID_IMA:
+			name = "ima";
+			break;
+		case LSM_ID_EVM:
+			name = "evm";
+			break;
 		default:
 			name = "INVALID";
 			break;