linux-6.12.1/security/security.c

233 /* Is an LSM allowed to be initialized? */
240 	/* Not allowed if another exclusive LSM already initialized. */  in lsm_allowed()
992  * Check whether @mgr is allowed to be the binder context manager.
1002  * security_binder_transaction() - Check if a binder transaction is allowed
1006  * Check whether @from is allowed to invoke a binder transaction call to @to.
1017  * security_binder_transfer_binder() - Check if a binder transfer is allowed
1021  * Check whether @from is allowed to transfer a binder reference to @to.
1032  * security_binder_transfer_file() - Check if a binder file xfer is allowed
1037  * Check whether @from is allowed to transfer @file to @to.
1048  * security_ptrace_access_check() - Check if tracing is allowed
1067  * security_ptrace_traceme() - Check if tracing is allowed
1090  * if the current process is allowed to see the capability sets of the @target
1147  * security_quotactl() - Check if a quotactl() syscall is allowed for this fs
1153  * Check whether the quotactl syscall is allowed for this @sb.
1163  * security_quota_on() - Check if QUOTAON is allowed for a dentry
1166  * Check whether QUOTAON is allowed for @dentry.
1176  * security_syslog() - Check if accessing the kernel message ring is allowed
1191  * security_settime64() - Check if changing the system time is allowed
1206  * security_vm_enough_memory_mm() - Check if allocating a new mem map is allowed
1471  * security_sb_mnt_opts_compat() - Check if new mount options are allowed
1475  * Determine if the new mount options in @mnt_opts are allowed given the
1505  * security_sb_kern_mount() - Check if a kernel mount is allowed
1508  * Mount this @sb if allowed by permissions.
1532  * security_sb_statfs() - Check if accessing fs stats is allowed
1663  * security_path_notify() - Check if setting a watch is allowed
1879  * security_path_mknod() - Check if creating a special file is allowed
1914  * security_path_mkdir() - Check if creating a new directory is allowed
1933  * security_path_rmdir() - Check if removing a directory is allowed
1949  * security_path_unlink() - Check if removing a hard link is allowed
1966  * security_path_symlink() - Check if creating a symbolic link is allowed
1984  * security_path_link - Check if creating a hard link is allowed
2002  * security_path_rename() - Check if renaming a file is allowed
2028  * security_path_truncate() - Check if truncating a file is allowed
2045  * security_path_chmod() - Check if changing the file's mode is allowed
2063  * security_path_chown() - Check if changing the file's owner/group is allowed
2080  * security_path_chroot() - Check if changing the root directory is allowed
2094  * security_inode_create() - Check if creating a file is allowed
2128  * security_inode_link() - Check if creating a hard link is allowed
2146  * security_inode_unlink() - Check if removing a hard link is allowed
2162  * security_inode_symlink() - Check if creating a symbolic link is allowed
2180  * security_inode_mkdir() - Check if creation a new director is allowed
2199  * security_inode_rmdir() - Check if removing a directory is allowed
2215  * security_inode_mknod() - Check if creating a special file is allowed
2237  * security_inode_rename() - Check if renaming a file is allowed
2269  * security_inode_readlink() - Check if reading a symbolic link is allowed
2284  * security_inode_follow_link() - Check if following a symbolic link is allowed
2303  * security_inode_permission() - Check if accessing an inode is allowed
2324  * security_inode_setattr() - Check if setting file attributes is allowed
2362  * security_inode_getattr() - Check if getting file attributes is allowed
2377  * security_inode_setxattr() - Check if setting file xattrs is allowed
2423  * security_inode_set_acl() - Check if setting posix acls is allowed
2461  * security_inode_get_acl() - Check if reading posix acls is allowed
2480  * security_inode_remove_acl() - Check if removing a posix acl is allowed
2534  * security_inode_getxattr() - Check if xattr access is allowed
2551  * security_inode_listxattr() - Check if listing xattrs is allowed
2567  * security_inode_removexattr() - Check if removing an xattr is allowed
2896  * security_file_ioctl() - Check if an ioctl is allowed
2915  * security_file_ioctl_compat() - Check if an ioctl is allowed in compat mode
2966  * security_mmap_file() - Check if mmap'ing a file is allowed
2984  * security_mmap_addr() - Check if mmap'ing an address is allowed
2997  * security_file_mprotect() - Check if changing memory protections is allowed
3013  * security_file_lock() - Check if a file lock is allowed
3028  * security_file_fcntl() - Check if fcntl() op is allowed
3063  * security_file_send_sigiotask() - Check if sending SIGIO/SIGURG is allowed
3083  * security_file_receive() - Check if receiving a file via IPC is allowed
3134  * security_file_truncate() - Check if truncating a file is allowed
3310  * security_kernel_module_request() - Check if loading a module is allowed
3455  * security_task_setpgid() - Check if setting the pgid is allowed
3470  * security_task_getpgid() - Check if getting the pgid is allowed
3484  * security_task_getsid() - Check if getting the session id is allowed
3526  * security_task_setnice() - Check if setting a task's nice value is allowed
3540  * security_task_setioprio() - Check if setting a task's ioprio is allowed
3554  * security_task_getioprio() - Check if getting a task's ioprio is allowed
3567  * security_task_prlimit() - Check if get/setting resources limits is allowed
3584  * security_task_setrlimit() - Check if setting a new rlimit value is allowed
3602  * security_task_setscheduler() - Check if setting sched policy/param is allowed
3616  * security_task_getscheduler() - Check if getting scheduling info is allowed
3629  * security_task_movememory() - Check if moving memory is allowed
3642  * security_task_kill() - Check if sending a signal is allowed
3663  * security_task_prctl() - Check if a prctl op is allowed
3708  * security_create_user_ns() - Check if creating a new userns is allowed
3721  * security_ipc_permission() - Check if sysv ipc access is allowed
3817  * security_msg_queue_associate() - Check if a msg queue operation is allowed
3833  * security_msg_queue_msgctl() - Check if a msg queue operation is allowed
3848  * security_msg_queue_msgsnd() - Check if sending a sysv ipc message is allowed
3865  * security_msg_queue_msgrcv() - Check if receiving a sysv ipc msg is allowed
3920  * security_shm_associate() - Check if a sysv shm operation is allowed
3937  * security_shm_shmctl() - Check if a sysv shm operation is allowed
3952  * security_shm_shmat() - Check if a sysv shm attach operation is allowed
4004  * security_sem_associate() - Check if a sysv semaphore operation is allowed
4020  * security_sem_semctl() - Check if a sysv semaphore operation is allowed
4035  * security_sem_semop() - Check if a sysv semaphore operation is allowed
4057  * Fill in @inode security information for a @dentry if allowed.
4224  * Read attribute @name for task @p and store it into @value if allowed.
4249  * allowed.
4266  * security_netlink_send() - Save info and check if netlink sending is allowed
4276  *         allowed to be transmitted.
4440  * security_watch_key() - Check if a task is allowed to watch for key events
4443  * Check to see if a process is allowed to watch for event notifications from
4456  * security_unix_stream_connect() - Check if a AF_UNIX stream is allowed
4510  * security_socket_create() - Check if creating a new socket is allowed
4551  * security_socket_socketpair() - Check if creating a socketpair is allowed
4567  * security_socket_bind() - Check if a socket bind operation is allowed
4585  * security_socket_connect() - Check if a socket connect operation is allowed
4602  * security_socket_listen() - Check if a socket is allowed to listen
4616  * security_socket_accept() - Check if a socket is allowed to accept connections
4632  * security_socket_sendmsg() - Check if sending a message is allowed
4647  * security_socket_recvmsg() - Check if receiving a message is allowed
4664  * security_socket_getsockname() - Check if reading the socket addr is allowed
4678  * security_socket_getpeername() - Check if reading the peer's addr is allowed
4691  * security_socket_getsockopt() - Check if reading a socket option is allowed
4707  * security_socket_setsockopt() - Check if setting a socket option is allowed
4722  * security_socket_shutdown() - Checks if shutting down the socket is allowed
4737  * security_sock_rcv_skb() - Check if an incoming network packet is allowed
4946  * security_secmark_relabel_packet() - Check if setting a secmark is allowed
4949  * Check if the process should be allowed to relabel packets to @secid.
5020  * security_tun_dev_create() - Check if creating a TUN device is allowed
5033  * security_tun_dev_attach_queue() - Check if attaching a TUN queue is allowed
5169  * security_ib_pkey_access() - Check if access to an IB pkey is allowed
5185  * security_ib_endport_manage_subnet() - Check if SMPs traffic is allowed
5288  * security_xfrm_policy_delete() - Check if deleting a xfrm policy is allowed
5337  * security_xfrm_state_delete() - Check if deleting a xfrm state is allowed
5362  * security_xfrm_policy_lookup() - Check if using a xfrm policy is allowed
5473  * security_key_permission() - Check if a kernel key operation is allowed
5594  * security_bpf() - Check if the bpf syscall operation is allowed
5611  * security_bpf_map() - Check if access to a bpf map is allowed
5626  * security_bpf_prog() - Check if access to a bpf program is allowed
5640  * security_bpf_map_create() - Check if BPF map creation is allowed
5657  * security_bpf_prog_load() - Check if loading of BPF program is allowed
5675  * security_bpf_token_create() - Check if creating of BPF token is allowed
5692  * security_bpf_token_cmd() - Check if BPF token is allowed to delegate
5708  * security_bpf_token_capable() - Check if BPF token is allowed to delegate
5758  * security_locked_down() - Check if a kernel feature is allowed
5853  * security_perf_event_open() - Check if a perf event open is allowed
5857  * Check whether the @type of perf_event_open syscall is allowed.
5904  * security_perf_event_read() - Check if reading a perf event label is allowed
5907  * Read perf_event security info if allowed.
5917  * security_perf_event_write() - Check if writing a perf event label is allowed
5920  * Write perf_event security info if allowed.
5932  * security_uring_override_creds() - Check if overriding creds is allowed
5935  * Check if the current task, executing an io_uring operation, is allowed to
5946  * security_uring_sqpoll() - Check if IORING_SETUP_SQPOLL is allowed
5948  * Check whether the current task is allowed to spawn a io_uring polling thread
5959  * security_uring_cmd() - Check if a io_uring passthrough command is allowed
5962  * Check whether the file_operations uring_cmd is allowed to run.