Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e20b043a authored by Casey Schaufler's avatar Casey Schaufler Committed by James Morris
Browse files

LSM: Add security module hook list heads 



Add a list header for each security hook. They aren't used until
later in the patch series. They are grouped together in a structure
so that there doesn't need to be an external address for each.

Macro-ize the initialization of the security_operations
for each security module in anticipation of changing out
the security_operations structure.

Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Acked-by: default avatarJohn Johansen <john.johansen@canonical.com>
Acked-by: default avatarKees Cook <keescook@chromium.org>
Acked-by: default avatarPaul Moore <paul@paul-moore.com>
Acked-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
Acked-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
parent f25fce3e

include/linux/lsm_hooks.h

+220 −0
Original line number Diff line number Diff line
@@ -1626,6 +1626,226 @@ struct security_operations { 
#endif /* CONFIG_AUDIT */

};



struct security_hook_heads {

	struct list_head binder_set_context_mgr;

	struct list_head binder_transaction;

	struct list_head binder_transfer_binder;

	struct list_head binder_transfer_file;

	struct list_head ptrace_access_check;

	struct list_head ptrace_traceme;

	struct list_head capget;

	struct list_head capset;

	struct list_head capable;

	struct list_head quotactl;

	struct list_head quota_on;

	struct list_head syslog;

	struct list_head settime;

	struct list_head vm_enough_memory;

	struct list_head bprm_set_creds;

	struct list_head bprm_check_security;

	struct list_head bprm_secureexec;

	struct list_head bprm_committing_creds;

	struct list_head bprm_committed_creds;

	struct list_head sb_alloc_security;

	struct list_head sb_free_security;

	struct list_head sb_copy_data;

	struct list_head sb_remount;

	struct list_head sb_kern_mount;

	struct list_head sb_show_options;

	struct list_head sb_statfs;

	struct list_head sb_mount;

	struct list_head sb_umount;

	struct list_head sb_pivotroot;

	struct list_head sb_set_mnt_opts;

	struct list_head sb_clone_mnt_opts;

	struct list_head sb_parse_opts_str;

	struct list_head dentry_init_security;

#ifdef CONFIG_SECURITY_PATH

	struct list_head path_unlink;

	struct list_head path_mkdir;

	struct list_head path_rmdir;

	struct list_head path_mknod;

	struct list_head path_truncate;

	struct list_head path_symlink;

	struct list_head path_link;

	struct list_head path_rename;

	struct list_head path_chmod;

	struct list_head path_chown;

	struct list_head path_chroot;

#endif

	struct list_head inode_alloc_security;

	struct list_head inode_free_security;

	struct list_head inode_init_security;

	struct list_head inode_create;

	struct list_head inode_link;

	struct list_head inode_unlink;

	struct list_head inode_symlink;

	struct list_head inode_mkdir;

	struct list_head inode_rmdir;

	struct list_head inode_mknod;

	struct list_head inode_rename;

	struct list_head inode_readlink;

	struct list_head inode_follow_link;

	struct list_head inode_permission;

	struct list_head inode_setattr;

	struct list_head inode_getattr;

	struct list_head inode_setxattr;

	struct list_head inode_post_setxattr;

	struct list_head inode_getxattr;

	struct list_head inode_listxattr;

	struct list_head inode_removexattr;

	struct list_head inode_need_killpriv;

	struct list_head inode_killpriv;

	struct list_head inode_getsecurity;

	struct list_head inode_setsecurity;

	struct list_head inode_listsecurity;

	struct list_head inode_getsecid;

	struct list_head file_permission;

	struct list_head file_alloc_security;

	struct list_head file_free_security;

	struct list_head file_ioctl;

	struct list_head mmap_addr;

	struct list_head mmap_file;

	struct list_head file_mprotect;

	struct list_head file_lock;

	struct list_head file_fcntl;

	struct list_head file_set_fowner;

	struct list_head file_send_sigiotask;

	struct list_head file_receive;

	struct list_head file_open;

	struct list_head task_create;

	struct list_head task_free;

	struct list_head cred_alloc_blank;

	struct list_head cred_free;

	struct list_head cred_prepare;

	struct list_head cred_transfer;

	struct list_head kernel_act_as;

	struct list_head kernel_create_files_as;

	struct list_head kernel_fw_from_file;

	struct list_head kernel_module_request;

	struct list_head kernel_module_from_file;

	struct list_head task_fix_setuid;

	struct list_head task_setpgid;

	struct list_head task_getpgid;

	struct list_head task_getsid;

	struct list_head task_getsecid;

	struct list_head task_setnice;

	struct list_head task_setioprio;

	struct list_head task_getioprio;

	struct list_head task_setrlimit;

	struct list_head task_setscheduler;

	struct list_head task_getscheduler;

	struct list_head task_movememory;

	struct list_head task_kill;

	struct list_head task_wait;

	struct list_head task_prctl;

	struct list_head task_to_inode;

	struct list_head ipc_permission;

	struct list_head ipc_getsecid;

	struct list_head msg_msg_alloc_security;

	struct list_head msg_msg_free_security;

	struct list_head msg_queue_alloc_security;

	struct list_head msg_queue_free_security;

	struct list_head msg_queue_associate;

	struct list_head msg_queue_msgctl;

	struct list_head msg_queue_msgsnd;

	struct list_head msg_queue_msgrcv;

	struct list_head shm_alloc_security;

	struct list_head shm_free_security;

	struct list_head shm_associate;

	struct list_head shm_shmctl;

	struct list_head shm_shmat;

	struct list_head sem_alloc_security;

	struct list_head sem_free_security;

	struct list_head sem_associate;

	struct list_head sem_semctl;

	struct list_head sem_semop;

	struct list_head netlink_send;

	struct list_head d_instantiate;

	struct list_head getprocattr;

	struct list_head setprocattr;

	struct list_head ismaclabel;

	struct list_head secid_to_secctx;

	struct list_head secctx_to_secid;

	struct list_head release_secctx;

	struct list_head inode_notifysecctx;

	struct list_head inode_setsecctx;

	struct list_head inode_getsecctx;

#ifdef CONFIG_SECURITY_NETWORK

	struct list_head unix_stream_connect;

	struct list_head unix_may_send;

	struct list_head socket_create;

	struct list_head socket_post_create;

	struct list_head socket_bind;

	struct list_head socket_connect;

	struct list_head socket_listen;

	struct list_head socket_accept;

	struct list_head socket_sendmsg;

	struct list_head socket_recvmsg;

	struct list_head socket_getsockname;

	struct list_head socket_getpeername;

	struct list_head socket_getsockopt;

	struct list_head socket_setsockopt;

	struct list_head socket_shutdown;

	struct list_head socket_sock_rcv_skb;

	struct list_head socket_getpeersec_stream;

	struct list_head socket_getpeersec_dgram;

	struct list_head sk_alloc_security;

	struct list_head sk_free_security;

	struct list_head sk_clone_security;

	struct list_head sk_getsecid;

	struct list_head sock_graft;

	struct list_head inet_conn_request;

	struct list_head inet_csk_clone;

	struct list_head inet_conn_established;

	struct list_head secmark_relabel_packet;

	struct list_head secmark_refcount_inc;

	struct list_head secmark_refcount_dec;

	struct list_head req_classify_flow;

	struct list_head tun_dev_alloc_security;

	struct list_head tun_dev_free_security;

	struct list_head tun_dev_create;

	struct list_head tun_dev_attach_queue;

	struct list_head tun_dev_attach;

	struct list_head tun_dev_open;

	struct list_head skb_owned_by;

#endif	/* CONFIG_SECURITY_NETWORK */

#ifdef CONFIG_SECURITY_NETWORK_XFRM

	struct list_head xfrm_policy_alloc_security;

	struct list_head xfrm_policy_clone_security;

	struct list_head xfrm_policy_free_security;

	struct list_head xfrm_policy_delete_security;

	struct list_head xfrm_state_alloc;

	struct list_head xfrm_state_alloc_acquire;

	struct list_head xfrm_state_free_security;

	struct list_head xfrm_state_delete_security;

	struct list_head xfrm_policy_lookup;

	struct list_head xfrm_state_pol_flow_match;

	struct list_head xfrm_decode_session;

#endif	/* CONFIG_SECURITY_NETWORK_XFRM */

#ifdef CONFIG_KEYS

	struct list_head key_alloc;

	struct list_head key_free;

	struct list_head key_permission;

	struct list_head key_getsecurity;

#endif	/* CONFIG_KEYS */

#ifdef CONFIG_AUDIT

	struct list_head audit_rule_init;

	struct list_head audit_rule_known;

	struct list_head audit_rule_match;

	struct list_head audit_rule_free;

#endif /* CONFIG_AUDIT */

};



/*

 * Initializing a security_hook_list structure takes

 * up a lot of space in a source file. This macro takes

 * care of the common case and reduces the amount of

 * text involved.

 * Casey says: Comment is true in the next patch.

 */

#define LSM_HOOK_INIT(HEAD, HOOK)	.HEAD = HOOK



/* prototypes */

extern int security_module_enable(struct security_operations *ops);

extern int register_security(struct security_operations *ops);

security/apparmor/lsm.c

+42 −42
Original line number Diff line number Diff line
@@ -616,48 +616,48 @@ static int apparmor_task_setrlimit(struct task_struct *task, 
}



static struct security_operations apparmor_ops = {

	.name =				"apparmor",



	.ptrace_access_check =		apparmor_ptrace_access_check,

	.ptrace_traceme =		apparmor_ptrace_traceme,

	.capget =			apparmor_capget,

	.capable =			apparmor_capable,



	.path_link =			apparmor_path_link,

	.path_unlink =			apparmor_path_unlink,

	.path_symlink =			apparmor_path_symlink,

	.path_mkdir =			apparmor_path_mkdir,

	.path_rmdir =			apparmor_path_rmdir,

	.path_mknod =			apparmor_path_mknod,

	.path_rename =			apparmor_path_rename,

	.path_chmod =			apparmor_path_chmod,

	.path_chown =			apparmor_path_chown,

	.path_truncate =		apparmor_path_truncate,

	.inode_getattr =                apparmor_inode_getattr,



	.file_open =			apparmor_file_open,

	.file_permission =		apparmor_file_permission,

	.file_alloc_security =		apparmor_file_alloc_security,

	.file_free_security =		apparmor_file_free_security,

	.mmap_file =			apparmor_mmap_file,

	.mmap_addr =			cap_mmap_addr,

	.file_mprotect =		apparmor_file_mprotect,

	.file_lock =			apparmor_file_lock,



	.getprocattr =			apparmor_getprocattr,

	.setprocattr =			apparmor_setprocattr,



	.cred_alloc_blank =		apparmor_cred_alloc_blank,

	.cred_free =			apparmor_cred_free,

	.cred_prepare =			apparmor_cred_prepare,

	.cred_transfer =		apparmor_cred_transfer,



	.bprm_set_creds =		apparmor_bprm_set_creds,

	.bprm_committing_creds =	apparmor_bprm_committing_creds,

	.bprm_committed_creds =		apparmor_bprm_committed_creds,

	.bprm_secureexec =		apparmor_bprm_secureexec,



	.task_setrlimit =		apparmor_task_setrlimit,

	LSM_HOOK_INIT(name, "apparmor"),



	LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check),

	LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme),

	LSM_HOOK_INIT(capget, apparmor_capget),

	LSM_HOOK_INIT(capable, apparmor_capable),



	LSM_HOOK_INIT(path_link, apparmor_path_link),

	LSM_HOOK_INIT(path_unlink, apparmor_path_unlink),

	LSM_HOOK_INIT(path_symlink, apparmor_path_symlink),

	LSM_HOOK_INIT(path_mkdir, apparmor_path_mkdir),

	LSM_HOOK_INIT(path_rmdir, apparmor_path_rmdir),

	LSM_HOOK_INIT(path_mknod, apparmor_path_mknod),

	LSM_HOOK_INIT(path_rename, apparmor_path_rename),

	LSM_HOOK_INIT(path_chmod, apparmor_path_chmod),

	LSM_HOOK_INIT(path_chown, apparmor_path_chown),

	LSM_HOOK_INIT(path_truncate, apparmor_path_truncate),

	LSM_HOOK_INIT(inode_getattr, apparmor_inode_getattr),



	LSM_HOOK_INIT(file_open, apparmor_file_open),

	LSM_HOOK_INIT(file_permission, apparmor_file_permission),

	LSM_HOOK_INIT(file_alloc_security, apparmor_file_alloc_security),

	LSM_HOOK_INIT(file_free_security, apparmor_file_free_security),

	LSM_HOOK_INIT(mmap_file, apparmor_mmap_file),

	LSM_HOOK_INIT(mmap_addr, cap_mmap_addr),

	LSM_HOOK_INIT(file_mprotect, apparmor_file_mprotect),

	LSM_HOOK_INIT(file_lock, apparmor_file_lock),



	LSM_HOOK_INIT(getprocattr, apparmor_getprocattr),

	LSM_HOOK_INIT(setprocattr, apparmor_setprocattr),



	LSM_HOOK_INIT(cred_alloc_blank, apparmor_cred_alloc_blank),

	LSM_HOOK_INIT(cred_free, apparmor_cred_free),

	LSM_HOOK_INIT(cred_prepare, apparmor_cred_prepare),

	LSM_HOOK_INIT(cred_transfer, apparmor_cred_transfer),



	LSM_HOOK_INIT(bprm_set_creds, apparmor_bprm_set_creds),

	LSM_HOOK_INIT(bprm_committing_creds, apparmor_bprm_committing_creds),

	LSM_HOOK_INIT(bprm_committed_creds, apparmor_bprm_committed_creds),

	LSM_HOOK_INIT(bprm_secureexec, apparmor_bprm_secureexec),



	LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit),

};



/*

security/selinux/hooks.c

+201 −197

File changed.

Preview size limit exceeded, changes collapsed.

security/smack/smack_lsm.c

+129 −129
Original line number Diff line number Diff line
@@ -4267,146 +4267,146 @@ static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen) 
}



struct security_operations smack_ops = {

	.name =				"smack",



	.ptrace_access_check =		smack_ptrace_access_check,

	.ptrace_traceme =		smack_ptrace_traceme,

	.syslog = 			smack_syslog,



	.sb_alloc_security = 		smack_sb_alloc_security,

	.sb_free_security = 		smack_sb_free_security,

	.sb_copy_data = 		smack_sb_copy_data,

	.sb_kern_mount = 		smack_sb_kern_mount,

	.sb_statfs = 			smack_sb_statfs,



	.bprm_set_creds =		smack_bprm_set_creds,

	.bprm_committing_creds =	smack_bprm_committing_creds,

	.bprm_secureexec =		smack_bprm_secureexec,



	.inode_alloc_security = 	smack_inode_alloc_security,

	.inode_free_security = 		smack_inode_free_security,

	.inode_init_security = 		smack_inode_init_security,

	.inode_link = 			smack_inode_link,

	.inode_unlink = 		smack_inode_unlink,

	.inode_rmdir = 			smack_inode_rmdir,

	.inode_rename = 		smack_inode_rename,

	.inode_permission = 		smack_inode_permission,

	.inode_setattr = 		smack_inode_setattr,

	.inode_getattr = 		smack_inode_getattr,

	.inode_setxattr = 		smack_inode_setxattr,

	.inode_post_setxattr = 		smack_inode_post_setxattr,

	.inode_getxattr = 		smack_inode_getxattr,

	.inode_removexattr = 		smack_inode_removexattr,

	.inode_getsecurity = 		smack_inode_getsecurity,

	.inode_setsecurity = 		smack_inode_setsecurity,

	.inode_listsecurity = 		smack_inode_listsecurity,

	.inode_getsecid =		smack_inode_getsecid,



	.file_permission = 		smack_file_permission,

	.file_alloc_security = 		smack_file_alloc_security,

	.file_free_security = 		smack_file_free_security,

	.file_ioctl = 			smack_file_ioctl,

	.file_lock = 			smack_file_lock,

	.file_fcntl = 			smack_file_fcntl,

	.mmap_file =			smack_mmap_file,

	.mmap_addr =			cap_mmap_addr,

	.file_set_fowner = 		smack_file_set_fowner,

	.file_send_sigiotask = 		smack_file_send_sigiotask,

	.file_receive = 		smack_file_receive,



	.file_open =			smack_file_open,



	.cred_alloc_blank =		smack_cred_alloc_blank,

	.cred_free =			smack_cred_free,

	.cred_prepare =			smack_cred_prepare,

	.cred_transfer =		smack_cred_transfer,

	.kernel_act_as =		smack_kernel_act_as,

	.kernel_create_files_as =	smack_kernel_create_files_as,

	.task_setpgid = 		smack_task_setpgid,

	.task_getpgid = 		smack_task_getpgid,

	.task_getsid = 			smack_task_getsid,

	.task_getsecid = 		smack_task_getsecid,

	.task_setnice = 		smack_task_setnice,

	.task_setioprio = 		smack_task_setioprio,

	.task_getioprio = 		smack_task_getioprio,

	.task_setscheduler = 		smack_task_setscheduler,

	.task_getscheduler = 		smack_task_getscheduler,

	.task_movememory = 		smack_task_movememory,

	.task_kill = 			smack_task_kill,

	.task_wait = 			smack_task_wait,

	.task_to_inode = 		smack_task_to_inode,



	.ipc_permission = 		smack_ipc_permission,

	.ipc_getsecid =			smack_ipc_getsecid,



	.msg_msg_alloc_security = 	smack_msg_msg_alloc_security,

	.msg_msg_free_security = 	smack_msg_msg_free_security,



	.msg_queue_alloc_security = 	smack_msg_queue_alloc_security,

	.msg_queue_free_security = 	smack_msg_queue_free_security,

	.msg_queue_associate = 		smack_msg_queue_associate,

	.msg_queue_msgctl = 		smack_msg_queue_msgctl,

	.msg_queue_msgsnd = 		smack_msg_queue_msgsnd,

	.msg_queue_msgrcv = 		smack_msg_queue_msgrcv,



	.shm_alloc_security = 		smack_shm_alloc_security,

	.shm_free_security = 		smack_shm_free_security,

	.shm_associate = 		smack_shm_associate,

	.shm_shmctl = 			smack_shm_shmctl,

	.shm_shmat = 			smack_shm_shmat,



	.sem_alloc_security = 		smack_sem_alloc_security,

	.sem_free_security = 		smack_sem_free_security,

	.sem_associate = 		smack_sem_associate,

	.sem_semctl = 			smack_sem_semctl,

	.sem_semop = 			smack_sem_semop,



	.d_instantiate = 		smack_d_instantiate,



	.getprocattr = 			smack_getprocattr,

	.setprocattr = 			smack_setprocattr,



	.unix_stream_connect = 		smack_unix_stream_connect,

	.unix_may_send = 		smack_unix_may_send,



	.socket_post_create = 		smack_socket_post_create,

	LSM_HOOK_INIT(name, "smack"),



	LSM_HOOK_INIT(ptrace_access_check, smack_ptrace_access_check),

	LSM_HOOK_INIT(ptrace_traceme, smack_ptrace_traceme),

	LSM_HOOK_INIT(syslog, smack_syslog),



	LSM_HOOK_INIT(sb_alloc_security, smack_sb_alloc_security),

	LSM_HOOK_INIT(sb_free_security, smack_sb_free_security),

	LSM_HOOK_INIT(sb_copy_data, smack_sb_copy_data),

	LSM_HOOK_INIT(sb_kern_mount, smack_sb_kern_mount),

	LSM_HOOK_INIT(sb_statfs, smack_sb_statfs),



	LSM_HOOK_INIT(bprm_set_creds, smack_bprm_set_creds),

	LSM_HOOK_INIT(bprm_committing_creds, smack_bprm_committing_creds),

	LSM_HOOK_INIT(bprm_secureexec, smack_bprm_secureexec),



	LSM_HOOK_INIT(inode_alloc_security, smack_inode_alloc_security),

	LSM_HOOK_INIT(inode_free_security, smack_inode_free_security),

	LSM_HOOK_INIT(inode_init_security, smack_inode_init_security),

	LSM_HOOK_INIT(inode_link, smack_inode_link),

	LSM_HOOK_INIT(inode_unlink, smack_inode_unlink),

	LSM_HOOK_INIT(inode_rmdir, smack_inode_rmdir),

	LSM_HOOK_INIT(inode_rename, smack_inode_rename),

	LSM_HOOK_INIT(inode_permission, smack_inode_permission),

	LSM_HOOK_INIT(inode_setattr, smack_inode_setattr),

	LSM_HOOK_INIT(inode_getattr, smack_inode_getattr),

	LSM_HOOK_INIT(inode_setxattr, smack_inode_setxattr),

	LSM_HOOK_INIT(inode_post_setxattr, smack_inode_post_setxattr),

	LSM_HOOK_INIT(inode_getxattr, smack_inode_getxattr),

	LSM_HOOK_INIT(inode_removexattr, smack_inode_removexattr),

	LSM_HOOK_INIT(inode_getsecurity, smack_inode_getsecurity),

	LSM_HOOK_INIT(inode_setsecurity, smack_inode_setsecurity),

	LSM_HOOK_INIT(inode_listsecurity, smack_inode_listsecurity),

	LSM_HOOK_INIT(inode_getsecid, smack_inode_getsecid),



	LSM_HOOK_INIT(file_permission, smack_file_permission),

	LSM_HOOK_INIT(file_alloc_security, smack_file_alloc_security),

	LSM_HOOK_INIT(file_free_security, smack_file_free_security),

	LSM_HOOK_INIT(file_ioctl, smack_file_ioctl),

	LSM_HOOK_INIT(file_lock, smack_file_lock),

	LSM_HOOK_INIT(file_fcntl, smack_file_fcntl),

	LSM_HOOK_INIT(mmap_file, smack_mmap_file),

	LSM_HOOK_INIT(mmap_addr, cap_mmap_addr),

	LSM_HOOK_INIT(file_set_fowner, smack_file_set_fowner),

	LSM_HOOK_INIT(file_send_sigiotask, smack_file_send_sigiotask),

	LSM_HOOK_INIT(file_receive, smack_file_receive),



	LSM_HOOK_INIT(file_open, smack_file_open),



	LSM_HOOK_INIT(cred_alloc_blank, smack_cred_alloc_blank),

	LSM_HOOK_INIT(cred_free, smack_cred_free),

	LSM_HOOK_INIT(cred_prepare, smack_cred_prepare),

	LSM_HOOK_INIT(cred_transfer, smack_cred_transfer),

	LSM_HOOK_INIT(kernel_act_as, smack_kernel_act_as),

	LSM_HOOK_INIT(kernel_create_files_as, smack_kernel_create_files_as),

	LSM_HOOK_INIT(task_setpgid, smack_task_setpgid),

	LSM_HOOK_INIT(task_getpgid, smack_task_getpgid),

	LSM_HOOK_INIT(task_getsid, smack_task_getsid),

	LSM_HOOK_INIT(task_getsecid, smack_task_getsecid),

	LSM_HOOK_INIT(task_setnice, smack_task_setnice),

	LSM_HOOK_INIT(task_setioprio, smack_task_setioprio),

	LSM_HOOK_INIT(task_getioprio, smack_task_getioprio),

	LSM_HOOK_INIT(task_setscheduler, smack_task_setscheduler),

	LSM_HOOK_INIT(task_getscheduler, smack_task_getscheduler),

	LSM_HOOK_INIT(task_movememory, smack_task_movememory),

	LSM_HOOK_INIT(task_kill, smack_task_kill),

	LSM_HOOK_INIT(task_wait, smack_task_wait),

	LSM_HOOK_INIT(task_to_inode, smack_task_to_inode),



	LSM_HOOK_INIT(ipc_permission, smack_ipc_permission),

	LSM_HOOK_INIT(ipc_getsecid, smack_ipc_getsecid),



	LSM_HOOK_INIT(msg_msg_alloc_security, smack_msg_msg_alloc_security),

	LSM_HOOK_INIT(msg_msg_free_security, smack_msg_msg_free_security),



	LSM_HOOK_INIT(msg_queue_alloc_security, smack_msg_queue_alloc_security),

	LSM_HOOK_INIT(msg_queue_free_security, smack_msg_queue_free_security),

	LSM_HOOK_INIT(msg_queue_associate, smack_msg_queue_associate),

	LSM_HOOK_INIT(msg_queue_msgctl, smack_msg_queue_msgctl),

	LSM_HOOK_INIT(msg_queue_msgsnd, smack_msg_queue_msgsnd),

	LSM_HOOK_INIT(msg_queue_msgrcv, smack_msg_queue_msgrcv),



	LSM_HOOK_INIT(shm_alloc_security, smack_shm_alloc_security),

	LSM_HOOK_INIT(shm_free_security, smack_shm_free_security),

	LSM_HOOK_INIT(shm_associate, smack_shm_associate),

	LSM_HOOK_INIT(shm_shmctl, smack_shm_shmctl),

	LSM_HOOK_INIT(shm_shmat, smack_shm_shmat),



	LSM_HOOK_INIT(sem_alloc_security, smack_sem_alloc_security),

	LSM_HOOK_INIT(sem_free_security, smack_sem_free_security),

	LSM_HOOK_INIT(sem_associate, smack_sem_associate),

	LSM_HOOK_INIT(sem_semctl, smack_sem_semctl),

	LSM_HOOK_INIT(sem_semop, smack_sem_semop),



	LSM_HOOK_INIT(d_instantiate, smack_d_instantiate),



	LSM_HOOK_INIT(getprocattr, smack_getprocattr),

	LSM_HOOK_INIT(setprocattr, smack_setprocattr),



	LSM_HOOK_INIT(unix_stream_connect, smack_unix_stream_connect),

	LSM_HOOK_INIT(unix_may_send, smack_unix_may_send),



	LSM_HOOK_INIT(socket_post_create, smack_socket_post_create),

#ifndef CONFIG_SECURITY_SMACK_NETFILTER

	.socket_bind =			smack_socket_bind,

	LSM_HOOK_INIT(socket_bind, smack_socket_bind),

#endif /* CONFIG_SECURITY_SMACK_NETFILTER */

	.socket_connect =		smack_socket_connect,

	.socket_sendmsg =		smack_socket_sendmsg,

	.socket_sock_rcv_skb = 		smack_socket_sock_rcv_skb,

	.socket_getpeersec_stream =	smack_socket_getpeersec_stream,

	.socket_getpeersec_dgram =	smack_socket_getpeersec_dgram,

	.sk_alloc_security = 		smack_sk_alloc_security,

	.sk_free_security = 		smack_sk_free_security,

	.sock_graft = 			smack_sock_graft,

	.inet_conn_request = 		smack_inet_conn_request,

	.inet_csk_clone =		smack_inet_csk_clone,

	LSM_HOOK_INIT(socket_connect, smack_socket_connect),

	LSM_HOOK_INIT(socket_sendmsg, smack_socket_sendmsg),

	LSM_HOOK_INIT(socket_sock_rcv_skb, smack_socket_sock_rcv_skb),

	LSM_HOOK_INIT(socket_getpeersec_stream, smack_socket_getpeersec_stream),

	LSM_HOOK_INIT(socket_getpeersec_dgram, smack_socket_getpeersec_dgram),

	LSM_HOOK_INIT(sk_alloc_security, smack_sk_alloc_security),

	LSM_HOOK_INIT(sk_free_security, smack_sk_free_security),

	LSM_HOOK_INIT(sock_graft, smack_sock_graft),

	LSM_HOOK_INIT(inet_conn_request, smack_inet_conn_request),

	LSM_HOOK_INIT(inet_csk_clone, smack_inet_csk_clone),



 /* key management security hooks */

#ifdef CONFIG_KEYS

	.key_alloc = 			smack_key_alloc,

	.key_free = 			smack_key_free,

	.key_permission = 		smack_key_permission,

	.key_getsecurity =		smack_key_getsecurity,

	LSM_HOOK_INIT(key_alloc, smack_key_alloc),

	LSM_HOOK_INIT(key_free, smack_key_free),

	LSM_HOOK_INIT(key_permission, smack_key_permission),

	LSM_HOOK_INIT(key_getsecurity, smack_key_getsecurity),

#endif /* CONFIG_KEYS */



 /* Audit hooks */

#ifdef CONFIG_AUDIT

	.audit_rule_init =		smack_audit_rule_init,

	.audit_rule_known =		smack_audit_rule_known,

	.audit_rule_match =		smack_audit_rule_match,

	.audit_rule_free =		smack_audit_rule_free,

	LSM_HOOK_INIT(audit_rule_init, smack_audit_rule_init),

	LSM_HOOK_INIT(audit_rule_known, smack_audit_rule_known),

	LSM_HOOK_INIT(audit_rule_match, smack_audit_rule_match),

	LSM_HOOK_INIT(audit_rule_free, smack_audit_rule_free),

#endif /* CONFIG_AUDIT */



	.ismaclabel =			smack_ismaclabel,

	.secid_to_secctx = 		smack_secid_to_secctx,

	.secctx_to_secid = 		smack_secctx_to_secid,

	.release_secctx = 		smack_release_secctx,

	.inode_notifysecctx =		smack_inode_notifysecctx,

	.inode_setsecctx =		smack_inode_setsecctx,

	.inode_getsecctx =		smack_inode_getsecctx,

	LSM_HOOK_INIT(ismaclabel, smack_ismaclabel),

	LSM_HOOK_INIT(secid_to_secctx, smack_secid_to_secctx),

	LSM_HOOK_INIT(secctx_to_secid, smack_secctx_to_secid),

	LSM_HOOK_INIT(release_secctx, smack_release_secctx),

	LSM_HOOK_INIT(inode_notifysecctx, smack_inode_notifysecctx),

	LSM_HOOK_INIT(inode_setsecctx, smack_inode_setsecctx),

	LSM_HOOK_INIT(inode_getsecctx, smack_inode_getsecctx),

};

security/tomoyo/tomoyo.c

+29 −29

File changed.

Preview size limit exceeded, changes collapsed.