LSM: Infrastructure management of the file security

[linux-2.6-block.git] / include / linux / lsm_hooks.h

diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index c7f67341fd1dbb9054e1da74bf21a8cc25f36ca6..e8cef019b64586fe8c10b58c35e13018181fe7ea 100644 (file)
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -1461,10 +1461,10 @@ union security_list_options {
 
        int (*sb_alloc_security)(struct super_block *sb);
        void (*sb_free_security)(struct super_block *sb);
-       int (*sb_copy_data)(char *orig, char *copy);
-       int (*sb_remount)(struct super_block *sb, void *data);
-       int (*sb_kern_mount)(struct super_block *sb, int flags,
-                            struct security_mnt_opts *opts);
+       void (*sb_free_mnt_opts)(void *mnt_opts);
+       int (*sb_eat_lsm_opts)(char *orig, void **mnt_opts);
+       int (*sb_remount)(struct super_block *sb, void *mnt_opts);
+       int (*sb_kern_mount)(struct super_block *sb);
        int (*sb_show_options)(struct seq_file *m, struct super_block *sb);
        int (*sb_statfs)(struct dentry *dentry);
        int (*sb_mount)(const char *dev_name, const struct path *path,
@@ -1472,14 +1472,15 @@ union security_list_options {
        int (*sb_umount)(struct vfsmount *mnt, int flags);
        int (*sb_pivotroot)(const struct path *old_path, const struct path *new_path);
        int (*sb_set_mnt_opts)(struct super_block *sb,
-                               struct security_mnt_opts *opts,
+                               void *mnt_opts,
                                unsigned long kern_flags,
                                unsigned long *set_kern_flags);
        int (*sb_clone_mnt_opts)(const struct super_block *oldsb,
                                        struct super_block *newsb,
                                        unsigned long kern_flags,
                                        unsigned long *set_kern_flags);
-       int (*sb_parse_opts_str)(char *options, struct security_mnt_opts *opts);
+       int (*sb_add_mnt_opt)(const char *option, const char *val, int len,
+                             void **mnt_opts);
        int (*dentry_init_security)(struct dentry *dentry, int mode,
                                        const struct qstr *name, void **ctx,
                                        u32 *ctxlen);
@@ -1801,7 +1802,8 @@ struct security_hook_heads {
        struct hlist_head bprm_committed_creds;
        struct hlist_head sb_alloc_security;
        struct hlist_head sb_free_security;
-       struct hlist_head sb_copy_data;
+       struct hlist_head sb_free_mnt_opts;
+       struct hlist_head sb_eat_lsm_opts;
        struct hlist_head sb_remount;
        struct hlist_head sb_kern_mount;
        struct hlist_head sb_show_options;
@@ -1811,7 +1813,7 @@ struct security_hook_heads {
        struct hlist_head sb_pivotroot;
        struct hlist_head sb_set_mnt_opts;
        struct hlist_head sb_clone_mnt_opts;
-       struct hlist_head sb_parse_opts_str;
+       struct hlist_head sb_add_mnt_opt;
        struct hlist_head dentry_init_security;
        struct hlist_head dentry_create_files_as;
 #ifdef CONFIG_SECURITY_PATH
@@ -2025,6 +2027,14 @@ struct security_hook_list {
        char                            *lsm;
 } __randomize_layout;
 
+/*
+ * Security blob size or offset data.
+ */
+struct lsm_blob_sizes {
+       int     lbs_cred;
+       int     lbs_file;
+};
+
 /*
  * Initializing a security_hook_list structure takes
  * up a lot of space in a source file. This macro takes
@@ -2040,9 +2050,21 @@ extern char *lsm_names;
 extern void security_add_hooks(struct security_hook_list *hooks, int count,
                                char *lsm);
 
+#define LSM_FLAG_LEGACY_MAJOR  BIT(0)
+#define LSM_FLAG_EXCLUSIVE     BIT(1)
+
+enum lsm_order {
+       LSM_ORDER_FIRST = -1,   /* This is only for capabilities. */
+       LSM_ORDER_MUTABLE = 0,
+};
+
 struct lsm_info {
        const char *name;       /* Required. */
+       enum lsm_order order;   /* Optional: default is LSM_ORDER_MUTABLE */
+       unsigned long flags;    /* Optional: flags describing LSM */
+       int *enabled;           /* Optional: controlled by CONFIG_LSM */
        int (*init)(void);      /* Required. */
+       struct lsm_blob_sizes *blobs; /* Optional: for blob sharing. */
 };
 
 extern struct lsm_info __start_lsm_info[], __end_lsm_info[];
@@ -2082,17 +2104,8 @@ static inline void security_delete_hooks(struct security_hook_list *hooks,
 #define __lsm_ro_after_init    __ro_after_init
 #endif /* CONFIG_SECURITY_WRITABLE_HOOKS */
 
-extern int __init security_module_enable(const char *module);
-extern void __init capability_add_hooks(void);
-#ifdef CONFIG_SECURITY_YAMA
-extern void __init yama_add_hooks(void);
-#else
-static inline void __init yama_add_hooks(void) { }
-#endif
-#ifdef CONFIG_SECURITY_LOADPIN
-void __init loadpin_add_hooks(void);
-#else
-static inline void loadpin_add_hooks(void) { };
+#ifdef CONFIG_SECURITY
+void __init lsm_early_cred(struct cred *cred);
 #endif
 
 #endif /* ! __LINUX_LSM_HOOKS_H */