2 * Security plug functions
4 * Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com>
5 * Copyright (C) 2001-2002 Greg Kroah-Hartman <greg@kroah.com>
6 * Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com>
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
14 #include <linux/config.h>
15 #include <linux/module.h>
16 #include <linux/init.h>
17 #include <linux/kernel.h>
18 #include <linux/sched.h>
19 #include <linux/security.h>
21 #define SECURITY_SCAFFOLD_VERSION "1.0.0"
23 /* things that live in dummy.c */
24 extern struct security_operations dummy_security_ops
;
25 extern void security_fixup_ops (struct security_operations
*ops
);
27 struct security_operations
*security_ops
; /* Initialized to NULL */
29 static inline int verify (struct security_operations
*ops
)
31 /* verify the security_operations structure exists */
33 printk (KERN_INFO
"Passed a NULL security_operations "
34 "pointer, %s failed.\n", __FUNCTION__
);
37 security_fixup_ops (ops
);
42 * security_scaffolding_startup - initialzes the security scaffolding framework
44 * This should be called early in the kernel initialization sequence.
46 int security_scaffolding_startup (void)
48 printk (KERN_INFO
"Security Scaffold v" SECURITY_SCAFFOLD_VERSION
51 if (verify (&dummy_security_ops
)) {
52 printk (KERN_ERR
"%s could not verify "
53 "dummy_security_ops structure.\n", __FUNCTION__
);
57 security_ops
= &dummy_security_ops
;
63 * register_security - registers a security framework with the kernel
64 * @ops: a pointer to the struct security_options that is to be registered
66 * This function is to allow a security module to register itself with the
67 * kernel security subsystem. Some rudimentary checking is done on the @ops
68 * value passed to this function. A call to unregister_security() should be
69 * done to remove this security_options structure from the kernel.
71 * If the @ops structure does not contain function pointers for all hooks in
72 * the structure, or there is already a security module registered with the
73 * kernel, an error will be returned. Otherwise 0 is returned on success.
75 int register_security (struct security_operations
*ops
)
78 printk (KERN_INFO
"%s could not verify "
79 "security_operations structure.\n", __FUNCTION__
);
83 if (security_ops
!= &dummy_security_ops
) {
84 printk (KERN_INFO
"There is already a security "
85 "framework initialized, %s failed.\n", __FUNCTION__
);
95 * unregister_security - unregisters a security framework with the kernel
96 * @ops: a pointer to the struct security_options that is to be registered
98 * This function removes a struct security_operations variable that had
99 * previously been registered with a successful call to register_security().
101 * If @ops does not match the valued previously passed to register_security()
102 * an error is returned. Otherwise the default security options is set to the
103 * the dummy_security_ops structure, and 0 is returned.
105 int unregister_security (struct security_operations
*ops
)
107 if (ops
!= security_ops
) {
108 printk (KERN_INFO
"%s: trying to unregister "
109 "a security_opts structure that is not "
110 "registered, failing.\n", __FUNCTION__
);
114 security_ops
= &dummy_security_ops
;
120 * mod_reg_security - allows security modules to be "stacked"
121 * @name: a pointer to a string with the name of the security_options to be registered
122 * @ops: a pointer to the struct security_options that is to be registered
124 * This function allows security modules to be stacked if the currently loaded
125 * security module allows this to happen. It passes the @name and @ops to the
126 * register_security function of the currently loaded security module.
128 * The return value depends on the currently loaded security module, with 0 as
131 int mod_reg_security (const char *name
, struct security_operations
*ops
)
134 printk (KERN_INFO
"%s could not verify "
135 "security operations.\n", __FUNCTION__
);
139 if (ops
== security_ops
) {
140 printk (KERN_INFO
"%s security operations "
141 "already registered.\n", __FUNCTION__
);
145 return security_ops
->register_security (name
, ops
);
149 * mod_unreg_security - allows a security module registered with mod_reg_security() to be unloaded
150 * @name: a pointer to a string with the name of the security_options to be removed
151 * @ops: a pointer to the struct security_options that is to be removed
153 * This function allows security modules that have been successfully registered
154 * with a call to mod_reg_security() to be unloaded from the system.
155 * This calls the currently loaded security module's unregister_security() call
156 * with the @name and @ops variables.
158 * The return value depends on the currently loaded security module, with 0 as
161 int mod_unreg_security (const char *name
, struct security_operations
*ops
)
163 if (ops
== security_ops
) {
164 printk (KERN_INFO
"%s invalid attempt to unregister "
165 " primary security ops.\n", __FUNCTION__
);
169 return security_ops
->unregister_security (name
, ops
);
173 * capable - calls the currently loaded security module's capable() function with the specified capability
174 * @cap: the requested capability level.
176 * This function calls the currently loaded security module's cabable()
177 * function with a pointer to the current task and the specified @cap value.
179 * This allows the security module to implement the capable function call
180 * however it chooses to.
182 int capable (int cap
)
184 if (security_ops
->capable (current
, cap
)) {
185 /* capability denied */
189 /* capability granted */
190 current
->flags
|= PF_SUPERPRIV
;
194 EXPORT_SYMBOL_GPL(register_security
);
195 EXPORT_SYMBOL_GPL(unregister_security
);
196 EXPORT_SYMBOL_GPL(mod_reg_security
);
197 EXPORT_SYMBOL_GPL(mod_unreg_security
);
198 EXPORT_SYMBOL(capable
);
199 EXPORT_SYMBOL(security_ops
);