capability.c 24 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106
  1. /*
  2. * Capabilities Linux Security Module
  3. *
  4. * This is the default security module in case no other module is loaded.
  5. *
  6. * This program is free software; you can redistribute it and/or modify
  7. * it under the terms of the GNU General Public License as published by
  8. * the Free Software Foundation; either version 2 of the License, or
  9. * (at your option) any later version.
  10. *
  11. */
  12. #include <linux/security.h>
  13. static int cap_syslog(int type)
  14. {
  15. return 0;
  16. }
  17. static int cap_quotactl(int cmds, int type, int id, struct super_block *sb)
  18. {
  19. return 0;
  20. }
  21. static int cap_quota_on(struct dentry *dentry)
  22. {
  23. return 0;
  24. }
  25. static int cap_bprm_check_security(struct linux_binprm *bprm)
  26. {
  27. return 0;
  28. }
  29. static void cap_bprm_committing_creds(struct linux_binprm *bprm)
  30. {
  31. }
  32. static void cap_bprm_committed_creds(struct linux_binprm *bprm)
  33. {
  34. }
  35. static int cap_sb_alloc_security(struct super_block *sb)
  36. {
  37. return 0;
  38. }
  39. static void cap_sb_free_security(struct super_block *sb)
  40. {
  41. }
  42. static int cap_sb_copy_data(char *orig, char *copy)
  43. {
  44. return 0;
  45. }
  46. static int cap_sb_remount(struct super_block *sb, void *data)
  47. {
  48. return 0;
  49. }
  50. static int cap_sb_kern_mount(struct super_block *sb, int flags, void *data)
  51. {
  52. return 0;
  53. }
  54. static int cap_sb_show_options(struct seq_file *m, struct super_block *sb)
  55. {
  56. return 0;
  57. }
  58. static int cap_sb_statfs(struct dentry *dentry)
  59. {
  60. return 0;
  61. }
  62. static int cap_sb_mount(const char *dev_name, struct path *path,
  63. const char *type, unsigned long flags, void *data)
  64. {
  65. return 0;
  66. }
  67. static int cap_sb_umount(struct vfsmount *mnt, int flags)
  68. {
  69. return 0;
  70. }
  71. static int cap_sb_pivotroot(struct path *old_path, struct path *new_path)
  72. {
  73. return 0;
  74. }
  75. static int cap_sb_set_mnt_opts(struct super_block *sb,
  76. struct security_mnt_opts *opts)
  77. {
  78. if (unlikely(opts->num_mnt_opts))
  79. return -EOPNOTSUPP;
  80. return 0;
  81. }
  82. static int cap_sb_clone_mnt_opts(const struct super_block *oldsb,
  83. struct super_block *newsb)
  84. {
  85. return 0;
  86. }
  87. static int cap_sb_parse_opts_str(char *options, struct security_mnt_opts *opts)
  88. {
  89. return 0;
  90. }
  91. static int cap_inode_alloc_security(struct inode *inode)
  92. {
  93. return 0;
  94. }
  95. static void cap_inode_free_security(struct inode *inode)
  96. {
  97. }
  98. static int cap_inode_init_security(struct inode *inode, struct inode *dir,
  99. const struct qstr *qstr, char **name,
  100. void **value, size_t *len)
  101. {
  102. return -EOPNOTSUPP;
  103. }
  104. static int cap_inode_create(struct inode *inode, struct dentry *dentry,
  105. umode_t mask)
  106. {
  107. return 0;
  108. }
  109. static int cap_inode_link(struct dentry *old_dentry, struct inode *inode,
  110. struct dentry *new_dentry)
  111. {
  112. return 0;
  113. }
  114. static int cap_inode_unlink(struct inode *inode, struct dentry *dentry)
  115. {
  116. return 0;
  117. }
  118. static int cap_inode_symlink(struct inode *inode, struct dentry *dentry,
  119. const char *name)
  120. {
  121. return 0;
  122. }
  123. static int cap_inode_mkdir(struct inode *inode, struct dentry *dentry,
  124. umode_t mask)
  125. {
  126. return 0;
  127. }
  128. static int cap_inode_rmdir(struct inode *inode, struct dentry *dentry)
  129. {
  130. return 0;
  131. }
  132. static int cap_inode_mknod(struct inode *inode, struct dentry *dentry,
  133. umode_t mode, dev_t dev)
  134. {
  135. return 0;
  136. }
  137. static int cap_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
  138. struct inode *new_inode, struct dentry *new_dentry)
  139. {
  140. return 0;
  141. }
  142. static int cap_inode_readlink(struct dentry *dentry)
  143. {
  144. return 0;
  145. }
  146. static int cap_inode_follow_link(struct dentry *dentry,
  147. struct nameidata *nameidata)
  148. {
  149. return 0;
  150. }
  151. static int cap_inode_permission(struct inode *inode, int mask)
  152. {
  153. return 0;
  154. }
  155. static int cap_inode_setattr(struct dentry *dentry, struct iattr *iattr)
  156. {
  157. return 0;
  158. }
  159. static int cap_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
  160. {
  161. return 0;
  162. }
  163. static void cap_inode_post_setxattr(struct dentry *dentry, const char *name,
  164. const void *value, size_t size, int flags)
  165. {
  166. }
  167. static int cap_inode_getxattr(struct dentry *dentry, const char *name)
  168. {
  169. return 0;
  170. }
  171. static int cap_inode_listxattr(struct dentry *dentry)
  172. {
  173. return 0;
  174. }
  175. static int cap_inode_getsecurity(const struct inode *inode, const char *name,
  176. void **buffer, bool alloc)
  177. {
  178. return -EOPNOTSUPP;
  179. }
  180. static int cap_inode_setsecurity(struct inode *inode, const char *name,
  181. const void *value, size_t size, int flags)
  182. {
  183. return -EOPNOTSUPP;
  184. }
  185. static int cap_inode_listsecurity(struct inode *inode, char *buffer,
  186. size_t buffer_size)
  187. {
  188. return 0;
  189. }
  190. static void cap_inode_getsecid(const struct inode *inode, u32 *secid)
  191. {
  192. *secid = 0;
  193. }
  194. #ifdef CONFIG_SECURITY_PATH
  195. static int cap_path_mknod(struct path *dir, struct dentry *dentry, umode_t mode,
  196. unsigned int dev)
  197. {
  198. return 0;
  199. }
  200. static int cap_path_mkdir(struct path *dir, struct dentry *dentry, umode_t mode)
  201. {
  202. return 0;
  203. }
  204. static int cap_path_rmdir(struct path *dir, struct dentry *dentry)
  205. {
  206. return 0;
  207. }
  208. static int cap_path_unlink(struct path *dir, struct dentry *dentry)
  209. {
  210. return 0;
  211. }
  212. static int cap_path_symlink(struct path *dir, struct dentry *dentry,
  213. const char *old_name)
  214. {
  215. return 0;
  216. }
  217. static int cap_path_link(struct dentry *old_dentry, struct path *new_dir,
  218. struct dentry *new_dentry)
  219. {
  220. return 0;
  221. }
  222. static int cap_path_rename(struct path *old_path, struct dentry *old_dentry,
  223. struct path *new_path, struct dentry *new_dentry)
  224. {
  225. return 0;
  226. }
  227. static int cap_path_truncate(struct path *path)
  228. {
  229. return 0;
  230. }
  231. static int cap_path_chmod(struct path *path, umode_t mode)
  232. {
  233. return 0;
  234. }
  235. static int cap_path_chown(struct path *path, kuid_t uid, kgid_t gid)
  236. {
  237. return 0;
  238. }
  239. static int cap_path_chroot(struct path *root)
  240. {
  241. return 0;
  242. }
  243. #endif
  244. static int cap_file_permission(struct file *file, int mask)
  245. {
  246. return 0;
  247. }
  248. static int cap_file_alloc_security(struct file *file)
  249. {
  250. return 0;
  251. }
  252. static void cap_file_free_security(struct file *file)
  253. {
  254. }
  255. static int cap_file_ioctl(struct file *file, unsigned int command,
  256. unsigned long arg)
  257. {
  258. return 0;
  259. }
  260. static int cap_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
  261. unsigned long prot)
  262. {
  263. return 0;
  264. }
  265. static int cap_file_lock(struct file *file, unsigned int cmd)
  266. {
  267. return 0;
  268. }
  269. static int cap_file_fcntl(struct file *file, unsigned int cmd,
  270. unsigned long arg)
  271. {
  272. return 0;
  273. }
  274. static int cap_file_set_fowner(struct file *file)
  275. {
  276. return 0;
  277. }
  278. static int cap_file_send_sigiotask(struct task_struct *tsk,
  279. struct fown_struct *fown, int sig)
  280. {
  281. return 0;
  282. }
  283. static int cap_file_receive(struct file *file)
  284. {
  285. return 0;
  286. }
  287. static int cap_file_open(struct file *file, const struct cred *cred)
  288. {
  289. return 0;
  290. }
  291. static int cap_task_create(unsigned long clone_flags)
  292. {
  293. return 0;
  294. }
  295. static void cap_task_free(struct task_struct *task)
  296. {
  297. }
  298. static int cap_cred_alloc_blank(struct cred *cred, gfp_t gfp)
  299. {
  300. return 0;
  301. }
  302. static void cap_cred_free(struct cred *cred)
  303. {
  304. }
  305. static int cap_cred_prepare(struct cred *new, const struct cred *old, gfp_t gfp)
  306. {
  307. return 0;
  308. }
  309. static void cap_cred_transfer(struct cred *new, const struct cred *old)
  310. {
  311. }
  312. static int cap_kernel_act_as(struct cred *new, u32 secid)
  313. {
  314. return 0;
  315. }
  316. static int cap_kernel_create_files_as(struct cred *new, struct inode *inode)
  317. {
  318. return 0;
  319. }
  320. static int cap_kernel_module_request(char *kmod_name)
  321. {
  322. return 0;
  323. }
  324. static int cap_kernel_module_from_file(struct file *file)
  325. {
  326. return 0;
  327. }
  328. static int cap_task_setpgid(struct task_struct *p, pid_t pgid)
  329. {
  330. return 0;
  331. }
  332. static int cap_task_getpgid(struct task_struct *p)
  333. {
  334. return 0;
  335. }
  336. static int cap_task_getsid(struct task_struct *p)
  337. {
  338. return 0;
  339. }
  340. static void cap_task_getsecid(struct task_struct *p, u32 *secid)
  341. {
  342. *secid = 0;
  343. }
  344. static int cap_task_getioprio(struct task_struct *p)
  345. {
  346. return 0;
  347. }
  348. static int cap_task_setrlimit(struct task_struct *p, unsigned int resource,
  349. struct rlimit *new_rlim)
  350. {
  351. return 0;
  352. }
  353. static int cap_task_getscheduler(struct task_struct *p)
  354. {
  355. return 0;
  356. }
  357. static int cap_task_movememory(struct task_struct *p)
  358. {
  359. return 0;
  360. }
  361. static int cap_task_wait(struct task_struct *p)
  362. {
  363. return 0;
  364. }
  365. static int cap_task_kill(struct task_struct *p, struct siginfo *info,
  366. int sig, u32 secid)
  367. {
  368. return 0;
  369. }
  370. static void cap_task_to_inode(struct task_struct *p, struct inode *inode)
  371. {
  372. }
  373. static int cap_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
  374. {
  375. return 0;
  376. }
  377. static void cap_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
  378. {
  379. *secid = 0;
  380. }
  381. static int cap_msg_msg_alloc_security(struct msg_msg *msg)
  382. {
  383. return 0;
  384. }
  385. static void cap_msg_msg_free_security(struct msg_msg *msg)
  386. {
  387. }
  388. static int cap_msg_queue_alloc_security(struct msg_queue *msq)
  389. {
  390. return 0;
  391. }
  392. static void cap_msg_queue_free_security(struct msg_queue *msq)
  393. {
  394. }
  395. static int cap_msg_queue_associate(struct msg_queue *msq, int msqflg)
  396. {
  397. return 0;
  398. }
  399. static int cap_msg_queue_msgctl(struct msg_queue *msq, int cmd)
  400. {
  401. return 0;
  402. }
  403. static int cap_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg,
  404. int msgflg)
  405. {
  406. return 0;
  407. }
  408. static int cap_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
  409. struct task_struct *target, long type, int mode)
  410. {
  411. return 0;
  412. }
  413. static int cap_shm_alloc_security(struct shmid_kernel *shp)
  414. {
  415. return 0;
  416. }
  417. static void cap_shm_free_security(struct shmid_kernel *shp)
  418. {
  419. }
  420. static int cap_shm_associate(struct shmid_kernel *shp, int shmflg)
  421. {
  422. return 0;
  423. }
  424. static int cap_shm_shmctl(struct shmid_kernel *shp, int cmd)
  425. {
  426. return 0;
  427. }
  428. static int cap_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr,
  429. int shmflg)
  430. {
  431. return 0;
  432. }
  433. static int cap_sem_alloc_security(struct sem_array *sma)
  434. {
  435. return 0;
  436. }
  437. static void cap_sem_free_security(struct sem_array *sma)
  438. {
  439. }
  440. static int cap_sem_associate(struct sem_array *sma, int semflg)
  441. {
  442. return 0;
  443. }
  444. static int cap_sem_semctl(struct sem_array *sma, int cmd)
  445. {
  446. return 0;
  447. }
  448. static int cap_sem_semop(struct sem_array *sma, struct sembuf *sops,
  449. unsigned nsops, int alter)
  450. {
  451. return 0;
  452. }
  453. #ifdef CONFIG_SECURITY_NETWORK
  454. static int cap_unix_stream_connect(struct sock *sock, struct sock *other,
  455. struct sock *newsk)
  456. {
  457. return 0;
  458. }
  459. static int cap_unix_may_send(struct socket *sock, struct socket *other)
  460. {
  461. return 0;
  462. }
  463. static int cap_socket_create(int family, int type, int protocol, int kern)
  464. {
  465. return 0;
  466. }
  467. static int cap_socket_post_create(struct socket *sock, int family, int type,
  468. int protocol, int kern)
  469. {
  470. return 0;
  471. }
  472. static int cap_socket_bind(struct socket *sock, struct sockaddr *address,
  473. int addrlen)
  474. {
  475. return 0;
  476. }
  477. static int cap_socket_connect(struct socket *sock, struct sockaddr *address,
  478. int addrlen)
  479. {
  480. return 0;
  481. }
  482. static int cap_socket_listen(struct socket *sock, int backlog)
  483. {
  484. return 0;
  485. }
  486. static int cap_socket_accept(struct socket *sock, struct socket *newsock)
  487. {
  488. return 0;
  489. }
  490. static int cap_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size)
  491. {
  492. return 0;
  493. }
  494. static int cap_socket_recvmsg(struct socket *sock, struct msghdr *msg,
  495. int size, int flags)
  496. {
  497. return 0;
  498. }
  499. static int cap_socket_getsockname(struct socket *sock)
  500. {
  501. return 0;
  502. }
  503. static int cap_socket_getpeername(struct socket *sock)
  504. {
  505. return 0;
  506. }
  507. static int cap_socket_setsockopt(struct socket *sock, int level, int optname)
  508. {
  509. return 0;
  510. }
  511. static int cap_socket_getsockopt(struct socket *sock, int level, int optname)
  512. {
  513. return 0;
  514. }
  515. static int cap_socket_shutdown(struct socket *sock, int how)
  516. {
  517. return 0;
  518. }
  519. static int cap_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
  520. {
  521. return 0;
  522. }
  523. static int cap_socket_getpeersec_stream(struct socket *sock,
  524. char __user *optval,
  525. int __user *optlen, unsigned len)
  526. {
  527. return -ENOPROTOOPT;
  528. }
  529. static int cap_socket_getpeersec_dgram(struct socket *sock,
  530. struct sk_buff *skb, u32 *secid)
  531. {
  532. return -ENOPROTOOPT;
  533. }
  534. static int cap_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
  535. {
  536. return 0;
  537. }
  538. static void cap_sk_free_security(struct sock *sk)
  539. {
  540. }
  541. static void cap_sk_clone_security(const struct sock *sk, struct sock *newsk)
  542. {
  543. }
  544. static void cap_sk_getsecid(struct sock *sk, u32 *secid)
  545. {
  546. }
  547. static void cap_sock_graft(struct sock *sk, struct socket *parent)
  548. {
  549. }
  550. static int cap_inet_conn_request(struct sock *sk, struct sk_buff *skb,
  551. struct request_sock *req)
  552. {
  553. return 0;
  554. }
  555. static void cap_inet_csk_clone(struct sock *newsk,
  556. const struct request_sock *req)
  557. {
  558. }
  559. static void cap_inet_conn_established(struct sock *sk, struct sk_buff *skb)
  560. {
  561. }
  562. static int cap_secmark_relabel_packet(u32 secid)
  563. {
  564. return 0;
  565. }
  566. static void cap_secmark_refcount_inc(void)
  567. {
  568. }
  569. static void cap_secmark_refcount_dec(void)
  570. {
  571. }
  572. static void cap_req_classify_flow(const struct request_sock *req,
  573. struct flowi *fl)
  574. {
  575. }
  576. static int cap_tun_dev_alloc_security(void **security)
  577. {
  578. return 0;
  579. }
  580. static void cap_tun_dev_free_security(void *security)
  581. {
  582. }
  583. static int cap_tun_dev_create(void)
  584. {
  585. return 0;
  586. }
  587. static int cap_tun_dev_attach_queue(void *security)
  588. {
  589. return 0;
  590. }
  591. static int cap_tun_dev_attach(struct sock *sk, void *security)
  592. {
  593. return 0;
  594. }
  595. static int cap_tun_dev_open(void *security)
  596. {
  597. return 0;
  598. }
  599. static void cap_skb_owned_by(struct sk_buff *skb, struct sock *sk)
  600. {
  601. }
  602. #endif /* CONFIG_SECURITY_NETWORK */
  603. #ifdef CONFIG_SECURITY_NETWORK_XFRM
  604. static int cap_xfrm_policy_alloc_security(struct xfrm_sec_ctx **ctxp,
  605. struct xfrm_user_sec_ctx *sec_ctx)
  606. {
  607. return 0;
  608. }
  609. static int cap_xfrm_policy_clone_security(struct xfrm_sec_ctx *old_ctx,
  610. struct xfrm_sec_ctx **new_ctxp)
  611. {
  612. return 0;
  613. }
  614. static void cap_xfrm_policy_free_security(struct xfrm_sec_ctx *ctx)
  615. {
  616. }
  617. static int cap_xfrm_policy_delete_security(struct xfrm_sec_ctx *ctx)
  618. {
  619. return 0;
  620. }
  621. static int cap_xfrm_state_alloc_security(struct xfrm_state *x,
  622. struct xfrm_user_sec_ctx *sec_ctx,
  623. u32 secid)
  624. {
  625. return 0;
  626. }
  627. static void cap_xfrm_state_free_security(struct xfrm_state *x)
  628. {
  629. }
  630. static int cap_xfrm_state_delete_security(struct xfrm_state *x)
  631. {
  632. return 0;
  633. }
  634. static int cap_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 sk_sid, u8 dir)
  635. {
  636. return 0;
  637. }
  638. static int cap_xfrm_state_pol_flow_match(struct xfrm_state *x,
  639. struct xfrm_policy *xp,
  640. const struct flowi *fl)
  641. {
  642. return 1;
  643. }
  644. static int cap_xfrm_decode_session(struct sk_buff *skb, u32 *fl, int ckall)
  645. {
  646. return 0;
  647. }
  648. #endif /* CONFIG_SECURITY_NETWORK_XFRM */
  649. static void cap_d_instantiate(struct dentry *dentry, struct inode *inode)
  650. {
  651. }
  652. static int cap_getprocattr(struct task_struct *p, char *name, char **value)
  653. {
  654. return -EINVAL;
  655. }
  656. static int cap_setprocattr(struct task_struct *p, char *name, void *value,
  657. size_t size)
  658. {
  659. return -EINVAL;
  660. }
  661. static int cap_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
  662. {
  663. return -EOPNOTSUPP;
  664. }
  665. static int cap_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
  666. {
  667. *secid = 0;
  668. return 0;
  669. }
  670. static void cap_release_secctx(char *secdata, u32 seclen)
  671. {
  672. }
  673. static int cap_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
  674. {
  675. return 0;
  676. }
  677. static int cap_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
  678. {
  679. return 0;
  680. }
  681. static int cap_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
  682. {
  683. return 0;
  684. }
  685. #ifdef CONFIG_KEYS
  686. static int cap_key_alloc(struct key *key, const struct cred *cred,
  687. unsigned long flags)
  688. {
  689. return 0;
  690. }
  691. static void cap_key_free(struct key *key)
  692. {
  693. }
  694. static int cap_key_permission(key_ref_t key_ref, const struct cred *cred,
  695. key_perm_t perm)
  696. {
  697. return 0;
  698. }
  699. static int cap_key_getsecurity(struct key *key, char **_buffer)
  700. {
  701. *_buffer = NULL;
  702. return 0;
  703. }
  704. #endif /* CONFIG_KEYS */
  705. #ifdef CONFIG_AUDIT
  706. static int cap_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule)
  707. {
  708. return 0;
  709. }
  710. static int cap_audit_rule_known(struct audit_krule *krule)
  711. {
  712. return 0;
  713. }
  714. static int cap_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule,
  715. struct audit_context *actx)
  716. {
  717. return 0;
  718. }
  719. static void cap_audit_rule_free(void *lsmrule)
  720. {
  721. }
  722. #endif /* CONFIG_AUDIT */
  723. #define set_to_cap_if_null(ops, function) \
  724. do { \
  725. if (!ops->function) { \
  726. ops->function = cap_##function; \
  727. pr_debug("Had to override the " #function \
  728. " security operation with the default.\n");\
  729. } \
  730. } while (0)
  731. void __init security_fixup_ops(struct security_operations *ops)
  732. {
  733. set_to_cap_if_null(ops, ptrace_access_check);
  734. set_to_cap_if_null(ops, ptrace_traceme);
  735. set_to_cap_if_null(ops, capget);
  736. set_to_cap_if_null(ops, capset);
  737. set_to_cap_if_null(ops, capable);
  738. set_to_cap_if_null(ops, quotactl);
  739. set_to_cap_if_null(ops, quota_on);
  740. set_to_cap_if_null(ops, syslog);
  741. set_to_cap_if_null(ops, settime);
  742. set_to_cap_if_null(ops, vm_enough_memory);
  743. set_to_cap_if_null(ops, bprm_set_creds);
  744. set_to_cap_if_null(ops, bprm_committing_creds);
  745. set_to_cap_if_null(ops, bprm_committed_creds);
  746. set_to_cap_if_null(ops, bprm_check_security);
  747. set_to_cap_if_null(ops, bprm_secureexec);
  748. set_to_cap_if_null(ops, sb_alloc_security);
  749. set_to_cap_if_null(ops, sb_free_security);
  750. set_to_cap_if_null(ops, sb_copy_data);
  751. set_to_cap_if_null(ops, sb_remount);
  752. set_to_cap_if_null(ops, sb_kern_mount);
  753. set_to_cap_if_null(ops, sb_show_options);
  754. set_to_cap_if_null(ops, sb_statfs);
  755. set_to_cap_if_null(ops, sb_mount);
  756. set_to_cap_if_null(ops, sb_umount);
  757. set_to_cap_if_null(ops, sb_pivotroot);
  758. set_to_cap_if_null(ops, sb_set_mnt_opts);
  759. set_to_cap_if_null(ops, sb_clone_mnt_opts);
  760. set_to_cap_if_null(ops, sb_parse_opts_str);
  761. set_to_cap_if_null(ops, inode_alloc_security);
  762. set_to_cap_if_null(ops, inode_free_security);
  763. set_to_cap_if_null(ops, inode_init_security);
  764. set_to_cap_if_null(ops, inode_create);
  765. set_to_cap_if_null(ops, inode_link);
  766. set_to_cap_if_null(ops, inode_unlink);
  767. set_to_cap_if_null(ops, inode_symlink);
  768. set_to_cap_if_null(ops, inode_mkdir);
  769. set_to_cap_if_null(ops, inode_rmdir);
  770. set_to_cap_if_null(ops, inode_mknod);
  771. set_to_cap_if_null(ops, inode_rename);
  772. set_to_cap_if_null(ops, inode_readlink);
  773. set_to_cap_if_null(ops, inode_follow_link);
  774. set_to_cap_if_null(ops, inode_permission);
  775. set_to_cap_if_null(ops, inode_setattr);
  776. set_to_cap_if_null(ops, inode_getattr);
  777. set_to_cap_if_null(ops, inode_setxattr);
  778. set_to_cap_if_null(ops, inode_post_setxattr);
  779. set_to_cap_if_null(ops, inode_getxattr);
  780. set_to_cap_if_null(ops, inode_listxattr);
  781. set_to_cap_if_null(ops, inode_removexattr);
  782. set_to_cap_if_null(ops, inode_need_killpriv);
  783. set_to_cap_if_null(ops, inode_killpriv);
  784. set_to_cap_if_null(ops, inode_getsecurity);
  785. set_to_cap_if_null(ops, inode_setsecurity);
  786. set_to_cap_if_null(ops, inode_listsecurity);
  787. set_to_cap_if_null(ops, inode_getsecid);
  788. #ifdef CONFIG_SECURITY_PATH
  789. set_to_cap_if_null(ops, path_mknod);
  790. set_to_cap_if_null(ops, path_mkdir);
  791. set_to_cap_if_null(ops, path_rmdir);
  792. set_to_cap_if_null(ops, path_unlink);
  793. set_to_cap_if_null(ops, path_symlink);
  794. set_to_cap_if_null(ops, path_link);
  795. set_to_cap_if_null(ops, path_rename);
  796. set_to_cap_if_null(ops, path_truncate);
  797. set_to_cap_if_null(ops, path_chmod);
  798. set_to_cap_if_null(ops, path_chown);
  799. set_to_cap_if_null(ops, path_chroot);
  800. #endif
  801. set_to_cap_if_null(ops, file_permission);
  802. set_to_cap_if_null(ops, file_alloc_security);
  803. set_to_cap_if_null(ops, file_free_security);
  804. set_to_cap_if_null(ops, file_ioctl);
  805. set_to_cap_if_null(ops, mmap_addr);
  806. set_to_cap_if_null(ops, mmap_file);
  807. set_to_cap_if_null(ops, file_mprotect);
  808. set_to_cap_if_null(ops, file_lock);
  809. set_to_cap_if_null(ops, file_fcntl);
  810. set_to_cap_if_null(ops, file_set_fowner);
  811. set_to_cap_if_null(ops, file_send_sigiotask);
  812. set_to_cap_if_null(ops, file_receive);
  813. set_to_cap_if_null(ops, file_open);
  814. set_to_cap_if_null(ops, task_create);
  815. set_to_cap_if_null(ops, task_free);
  816. set_to_cap_if_null(ops, cred_alloc_blank);
  817. set_to_cap_if_null(ops, cred_free);
  818. set_to_cap_if_null(ops, cred_prepare);
  819. set_to_cap_if_null(ops, cred_transfer);
  820. set_to_cap_if_null(ops, kernel_act_as);
  821. set_to_cap_if_null(ops, kernel_create_files_as);
  822. set_to_cap_if_null(ops, kernel_module_request);
  823. set_to_cap_if_null(ops, kernel_module_from_file);
  824. set_to_cap_if_null(ops, task_fix_setuid);
  825. set_to_cap_if_null(ops, task_setpgid);
  826. set_to_cap_if_null(ops, task_getpgid);
  827. set_to_cap_if_null(ops, task_getsid);
  828. set_to_cap_if_null(ops, task_getsecid);
  829. set_to_cap_if_null(ops, task_setnice);
  830. set_to_cap_if_null(ops, task_setioprio);
  831. set_to_cap_if_null(ops, task_getioprio);
  832. set_to_cap_if_null(ops, task_setrlimit);
  833. set_to_cap_if_null(ops, task_setscheduler);
  834. set_to_cap_if_null(ops, task_getscheduler);
  835. set_to_cap_if_null(ops, task_movememory);
  836. set_to_cap_if_null(ops, task_wait);
  837. set_to_cap_if_null(ops, task_kill);
  838. set_to_cap_if_null(ops, task_prctl);
  839. set_to_cap_if_null(ops, task_to_inode);
  840. set_to_cap_if_null(ops, ipc_permission);
  841. set_to_cap_if_null(ops, ipc_getsecid);
  842. set_to_cap_if_null(ops, msg_msg_alloc_security);
  843. set_to_cap_if_null(ops, msg_msg_free_security);
  844. set_to_cap_if_null(ops, msg_queue_alloc_security);
  845. set_to_cap_if_null(ops, msg_queue_free_security);
  846. set_to_cap_if_null(ops, msg_queue_associate);
  847. set_to_cap_if_null(ops, msg_queue_msgctl);
  848. set_to_cap_if_null(ops, msg_queue_msgsnd);
  849. set_to_cap_if_null(ops, msg_queue_msgrcv);
  850. set_to_cap_if_null(ops, shm_alloc_security);
  851. set_to_cap_if_null(ops, shm_free_security);
  852. set_to_cap_if_null(ops, shm_associate);
  853. set_to_cap_if_null(ops, shm_shmctl);
  854. set_to_cap_if_null(ops, shm_shmat);
  855. set_to_cap_if_null(ops, sem_alloc_security);
  856. set_to_cap_if_null(ops, sem_free_security);
  857. set_to_cap_if_null(ops, sem_associate);
  858. set_to_cap_if_null(ops, sem_semctl);
  859. set_to_cap_if_null(ops, sem_semop);
  860. set_to_cap_if_null(ops, netlink_send);
  861. set_to_cap_if_null(ops, d_instantiate);
  862. set_to_cap_if_null(ops, getprocattr);
  863. set_to_cap_if_null(ops, setprocattr);
  864. set_to_cap_if_null(ops, secid_to_secctx);
  865. set_to_cap_if_null(ops, secctx_to_secid);
  866. set_to_cap_if_null(ops, release_secctx);
  867. set_to_cap_if_null(ops, inode_notifysecctx);
  868. set_to_cap_if_null(ops, inode_setsecctx);
  869. set_to_cap_if_null(ops, inode_getsecctx);
  870. #ifdef CONFIG_SECURITY_NETWORK
  871. set_to_cap_if_null(ops, unix_stream_connect);
  872. set_to_cap_if_null(ops, unix_may_send);
  873. set_to_cap_if_null(ops, socket_create);
  874. set_to_cap_if_null(ops, socket_post_create);
  875. set_to_cap_if_null(ops, socket_bind);
  876. set_to_cap_if_null(ops, socket_connect);
  877. set_to_cap_if_null(ops, socket_listen);
  878. set_to_cap_if_null(ops, socket_accept);
  879. set_to_cap_if_null(ops, socket_sendmsg);
  880. set_to_cap_if_null(ops, socket_recvmsg);
  881. set_to_cap_if_null(ops, socket_getsockname);
  882. set_to_cap_if_null(ops, socket_getpeername);
  883. set_to_cap_if_null(ops, socket_setsockopt);
  884. set_to_cap_if_null(ops, socket_getsockopt);
  885. set_to_cap_if_null(ops, socket_shutdown);
  886. set_to_cap_if_null(ops, socket_sock_rcv_skb);
  887. set_to_cap_if_null(ops, socket_getpeersec_stream);
  888. set_to_cap_if_null(ops, socket_getpeersec_dgram);
  889. set_to_cap_if_null(ops, sk_alloc_security);
  890. set_to_cap_if_null(ops, sk_free_security);
  891. set_to_cap_if_null(ops, sk_clone_security);
  892. set_to_cap_if_null(ops, sk_getsecid);
  893. set_to_cap_if_null(ops, sock_graft);
  894. set_to_cap_if_null(ops, inet_conn_request);
  895. set_to_cap_if_null(ops, inet_csk_clone);
  896. set_to_cap_if_null(ops, inet_conn_established);
  897. set_to_cap_if_null(ops, secmark_relabel_packet);
  898. set_to_cap_if_null(ops, secmark_refcount_inc);
  899. set_to_cap_if_null(ops, secmark_refcount_dec);
  900. set_to_cap_if_null(ops, req_classify_flow);
  901. set_to_cap_if_null(ops, tun_dev_alloc_security);
  902. set_to_cap_if_null(ops, tun_dev_free_security);
  903. set_to_cap_if_null(ops, tun_dev_create);
  904. set_to_cap_if_null(ops, tun_dev_open);
  905. set_to_cap_if_null(ops, tun_dev_attach_queue);
  906. set_to_cap_if_null(ops, tun_dev_attach);
  907. set_to_cap_if_null(ops, skb_owned_by);
  908. #endif /* CONFIG_SECURITY_NETWORK */
  909. #ifdef CONFIG_SECURITY_NETWORK_XFRM
  910. set_to_cap_if_null(ops, xfrm_policy_alloc_security);
  911. set_to_cap_if_null(ops, xfrm_policy_clone_security);
  912. set_to_cap_if_null(ops, xfrm_policy_free_security);
  913. set_to_cap_if_null(ops, xfrm_policy_delete_security);
  914. set_to_cap_if_null(ops, xfrm_state_alloc_security);
  915. set_to_cap_if_null(ops, xfrm_state_free_security);
  916. set_to_cap_if_null(ops, xfrm_state_delete_security);
  917. set_to_cap_if_null(ops, xfrm_policy_lookup);
  918. set_to_cap_if_null(ops, xfrm_state_pol_flow_match);
  919. set_to_cap_if_null(ops, xfrm_decode_session);
  920. #endif /* CONFIG_SECURITY_NETWORK_XFRM */
  921. #ifdef CONFIG_KEYS
  922. set_to_cap_if_null(ops, key_alloc);
  923. set_to_cap_if_null(ops, key_free);
  924. set_to_cap_if_null(ops, key_permission);
  925. set_to_cap_if_null(ops, key_getsecurity);
  926. #endif /* CONFIG_KEYS */
  927. #ifdef CONFIG_AUDIT
  928. set_to_cap_if_null(ops, audit_rule_init);
  929. set_to_cap_if_null(ops, audit_rule_known);
  930. set_to_cap_if_null(ops, audit_rule_match);
  931. set_to_cap_if_null(ops, audit_rule_free);
  932. #endif
  933. }