Merge tag 'pinctrl-v5.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw...

[linux-2.6-microblaze.git] / security / security.c

diff --git a/security/security.c b/security/security.c
index 70a7ad3..7b09cfb 100644 (file)
--- a/security/security.c
+++ b/security/security.c
@@ -16,6 +16,7 @@
 #include <linux/export.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
+#include <linux/kernel_read_file.h>
 #include <linux/lsm_hooks.h>
 #include <linux/integrity.h>
 #include <linux/ima.h>
@@ -64,6 +65,7 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = {
        [LOCKDOWN_PERF] = "unsafe use of perf",
        [LOCKDOWN_TRACEFS] = "use of tracefs",
        [LOCKDOWN_XMON_RW] = "xmon read and write access",
+       [LOCKDOWN_XFRM_SECRET] = "xfrm SA secret",
        [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality",
 };
 
@@ -1671,14 +1673,15 @@ int security_kernel_module_request(char *kmod_name)
        return integrity_kernel_module_request(kmod_name);
 }
 
-int security_kernel_read_file(struct file *file, enum kernel_read_file_id id)
+int security_kernel_read_file(struct file *file, enum kernel_read_file_id id,
+                             bool contents)
 {
        int ret;
 
-       ret = call_int_hook(kernel_read_file, 0, file, id);
+       ret = call_int_hook(kernel_read_file, 0, file, id, contents);
        if (ret)
                return ret;
-       return ima_read_file(file, id);
+       return ima_read_file(file, id, contents);
 }
 EXPORT_SYMBOL_GPL(security_kernel_read_file);
 
@@ -1694,17 +1697,31 @@ int security_kernel_post_read_file(struct file *file, char *buf, loff_t size,
 }
 EXPORT_SYMBOL_GPL(security_kernel_post_read_file);
 
-int security_kernel_load_data(enum kernel_load_data_id id)
+int security_kernel_load_data(enum kernel_load_data_id id, bool contents)
 {
        int ret;
 
-       ret = call_int_hook(kernel_load_data, 0, id);
+       ret = call_int_hook(kernel_load_data, 0, id, contents);
        if (ret)
                return ret;
-       return ima_load_data(id);
+       return ima_load_data(id, contents);
 }
 EXPORT_SYMBOL_GPL(security_kernel_load_data);
 
+int security_kernel_post_load_data(char *buf, loff_t size,
+                                  enum kernel_load_data_id id,
+                                  char *description)
+{
+       int ret;
+
+       ret = call_int_hook(kernel_post_load_data, 0, buf, size, id,
+                           description);
+       if (ret)
+               return ret;
+       return ima_post_load_data(buf, size, id, description);
+}
+EXPORT_SYMBOL_GPL(security_kernel_post_load_data);
+
 int security_task_fix_setuid(struct cred *new, const struct cred *old,
                             int flags)
 {
@@ -2191,15 +2208,16 @@ void security_sk_clone(const struct sock *sk, struct sock *newsk)
 }
 EXPORT_SYMBOL(security_sk_clone);
 
-void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
+void security_sk_classify_flow(struct sock *sk, struct flowi_common *flic)
 {
-       call_void_hook(sk_getsecid, sk, &fl->flowi_secid);
+       call_void_hook(sk_getsecid, sk, &flic->flowic_secid);
 }
 EXPORT_SYMBOL(security_sk_classify_flow);
 
-void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
+void security_req_classify_flow(const struct request_sock *req,
+                               struct flowi_common *flic)
 {
-       call_void_hook(req_classify_flow, req, fl);
+       call_void_hook(req_classify_flow, req, flic);
 }
 EXPORT_SYMBOL(security_req_classify_flow);
 
@@ -2209,7 +2227,7 @@ void security_sock_graft(struct sock *sk, struct socket *parent)
 }
 EXPORT_SYMBOL(security_sock_graft);
 
-int security_inet_conn_request(struct sock *sk,
+int security_inet_conn_request(const struct sock *sk,
                        struct sk_buff *skb, struct request_sock *req)
 {
        return call_int_hook(inet_conn_request, 0, sk, skb, req);
@@ -2391,7 +2409,7 @@ int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
 
 int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
                                       struct xfrm_policy *xp,
-                                      const struct flowi *fl)
+                                      const struct flowi_common *flic)
 {
        struct security_hook_list *hp;
        int rc = LSM_RET_DEFAULT(xfrm_state_pol_flow_match);
@@ -2407,7 +2425,7 @@ int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
         */
        hlist_for_each_entry(hp, &security_hook_heads.xfrm_state_pol_flow_match,
                                list) {
-               rc = hp->hook.xfrm_state_pol_flow_match(x, xp, fl);
+               rc = hp->hook.xfrm_state_pol_flow_match(x, xp, flic);
                break;
        }
        return rc;
@@ -2418,9 +2436,9 @@ int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
        return call_int_hook(xfrm_decode_session, 0, skb, secid, 1);
 }
 
-void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl)
+void security_skb_classify_flow(struct sk_buff *skb, struct flowi_common *flic)
 {
-       int rc = call_int_hook(xfrm_decode_session, 0, skb, &fl->flowi_secid,
+       int rc = call_int_hook(xfrm_decode_session, 0, skb, &flic->flowic_secid,
                                0);
 
        BUG_ON(rc);