security/ cleanups

[firefly-linux-kernel-4.4.55.git] / include / linux / security.h

diff --git a/include/linux/security.h b/include/linux/security.h
index a300a3f2fe68f366653f8f1c031661fe454b7a26..9b0b63c50f445717c8645962c7a06c77042115d6 100644 (file)
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -51,8 +51,14 @@ extern void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe);
 extern int cap_bprm_secureexec(struct linux_binprm *bprm);
 extern int cap_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags);
 extern int cap_inode_removexattr(struct dentry *dentry, char *name);
+extern int cap_inode_need_killpriv(struct dentry *dentry);
+extern int cap_inode_killpriv(struct dentry *dentry);
 extern int cap_task_post_setuid (uid_t old_ruid, uid_t old_euid, uid_t old_suid, int flags);
 extern void cap_task_reparent_to_init (struct task_struct *p);
+extern int cap_task_kill(struct task_struct *p, struct siginfo *info, int sig, u32 secid);
+extern int cap_task_setscheduler (struct task_struct *p, int policy, struct sched_param *lp);
+extern int cap_task_setioprio (struct task_struct *p, int ioprio);
+extern int cap_task_setnice (struct task_struct *p, int nice);
 extern int cap_syslog (int type);
 extern int cap_vm_enough_memory(struct mm_struct *mm, long pages);
 
@@ -413,6 +419,18 @@ struct request_sock;
  *     is specified by @buffer_size.  @buffer may be NULL to request
  *     the size of the buffer required.
  *     Returns number of bytes used/required on success.
+ * @inode_need_killpriv:
+ *     Called when an inode has been changed.
+ *     @dentry is the dentry being changed.
+ *     Return <0 on error to abort the inode change operation.
+ *     Return 0 if inode_killpriv does not need to be called.
+ *     Return >0 if inode_killpriv does need to be called.
+ * @inode_killpriv:
+ *     The setuid bit is being removed.  Remove similar security labels.
+ *     Called with the dentry->d_inode->i_mutex held.
+ *     @dentry is the dentry being changed.
+ *     Return 0 on success.  If error is returned, then the operation
+ *     causing setuid bit removal is failed.
  *
  * Security hooks for file operations
  *
@@ -1140,10 +1158,6 @@ struct request_sock;
  *     allow module stacking.
  *     @name contains the name of the security module being stacked.
  *     @ops contains a pointer to the struct security_operations of the module to stack.
- * @unregister_security:
- *     remove a stacked module.
- *     @name contains the name of the security module being unstacked.
- *     @ops contains a pointer to the struct security_operations of the module to unstack.
  * 
  * @secid_to_secctx:
  *     Convert secid to security context.
@@ -1239,7 +1253,8 @@ struct security_operations {
        int (*inode_getxattr) (struct dentry *dentry, char *name);
        int (*inode_listxattr) (struct dentry *dentry);
        int (*inode_removexattr) (struct dentry *dentry, char *name);
-       const char *(*inode_xattr_getsuffix) (void);
+       int (*inode_need_killpriv) (struct dentry *dentry);
+       int (*inode_killpriv) (struct dentry *dentry);
        int (*inode_getsecurity)(const struct inode *inode, const char *name, void *buffer, size_t size, int err);
        int (*inode_setsecurity)(struct inode *inode, const char *name, const void *value, size_t size, int flags);
        int (*inode_listsecurity)(struct inode *inode, char *buffer, size_t buffer_size);
@@ -1330,8 +1345,6 @@ struct security_operations {
        /* allow module stacking */
        int (*register_security) (const char *name,
                                  struct security_operations *ops);
-       int (*unregister_security) (const char *name,
-                                   struct security_operations *ops);
 
        void (*d_instantiate) (struct dentry *dentry, struct inode *inode);
 
@@ -1412,9 +1425,7 @@ struct security_operations {
 /* prototypes */
 extern int security_init       (void);
 extern int register_security   (struct security_operations *ops);
-extern int unregister_security (struct security_operations *ops);
 extern int mod_reg_security    (const char *name, struct security_operations *ops);
-extern int mod_unreg_security  (const char *name, struct security_operations *ops);
 extern struct dentry *securityfs_create_file(const char *name, mode_t mode,
                                             struct dentry *parent, void *data,
                                             const struct file_operations *fops);
@@ -1496,7 +1507,8 @@ void security_inode_post_setxattr(struct dentry *dentry, char *name,
 int security_inode_getxattr(struct dentry *dentry, char *name);
 int security_inode_listxattr(struct dentry *dentry);
 int security_inode_removexattr(struct dentry *dentry, char *name);
-const char *security_inode_xattr_getsuffix(void);
+int security_inode_need_killpriv(struct dentry *dentry);
+int security_inode_killpriv(struct dentry *dentry);
 int security_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err);
 int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags);
 int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size);
@@ -1891,9 +1903,14 @@ static inline int security_inode_removexattr (struct dentry *dentry, char *name)
        return cap_inode_removexattr(dentry, name);
 }
 
-static inline const char *security_inode_xattr_getsuffix (void)
+static inline int security_inode_need_killpriv(struct dentry *dentry)
 {
-       return NULL ;
+       return cap_inode_need_killpriv(dentry);
+}
+
+static inline int security_inode_killpriv(struct dentry *dentry)
+{
+       return cap_inode_killpriv(dentry);
 }
 
 static inline int security_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
@@ -2035,12 +2052,12 @@ static inline int security_task_setgroups (struct group_info *group_info)
 
 static inline int security_task_setnice (struct task_struct *p, int nice)
 {
-       return 0;
+       return cap_task_setnice(p, nice);
 }
 
 static inline int security_task_setioprio (struct task_struct *p, int ioprio)
 {
-       return 0;
+       return cap_task_setioprio(p, ioprio);
 }
 
 static inline int security_task_getioprio (struct task_struct *p)
@@ -2058,7 +2075,7 @@ static inline int security_task_setscheduler (struct task_struct *p,
                                              int policy,
                                              struct sched_param *lp)
 {
-       return 0;
+       return cap_task_setscheduler(p, policy, lp);
 }
 
 static inline int security_task_getscheduler (struct task_struct *p)
@@ -2075,7 +2092,7 @@ static inline int security_task_kill (struct task_struct *p,
                                      struct siginfo *info, int sig,
                                      u32 secid)
 {
-       return 0;
+       return cap_task_kill(p, info, sig, secid);
 }
 
 static inline int security_task_wait (struct task_struct *p)