1	/*
2	* Linux Security plug
3	*
4	* Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com>
5	* Copyright (C) 2001 Greg Kroah-Hartman <greg@kroah.com>
6	* Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com>
7	* Copyright (C) 2001 James Morris <jmorris@intercode.com.au>
8	* Copyright (C) 2001 Silicon Graphics, Inc. (Trust Technology Group)
9	* Copyright (C) 2016 Mellanox Techonologies
10	*
11	* This program is free software; you can redistribute it and/or modify
12	* it under the terms of the GNU General Public License as published by
13	* the Free Software Foundation; either version 2 of the License, or
14	* (at your option) any later version.
15	*
16	* Due to this file being licensed under the GPL there is controversy over
17	* whether this permits you to write a module that #includes this file
18	* without placing your module under the GPL. Please consult a lawyer for
19	* advice before doing this.
20	*
21	*/
22
23	#ifndef __LINUX_SECURITY_H
24	#define __LINUX_SECURITY_H
25
26	#include <linux/kernel_read_file.h>
27	#include <linux/key.h>
28	#include <linux/capability.h>
29	#include <linux/fs.h>
30	#include <linux/slab.h>
31	#include <linux/err.h>
32	#include <linux/string.h>
33	#include <linux/mm.h>
34	#include <linux/sockptr.h>
35	#include <linux/bpf.h>
36	#include <uapi/linux/lsm.h>
37
38	struct linux_binprm;
39	struct cred;
40	struct rlimit;
41	struct kernel_siginfo;
42	struct sembuf;
43	struct kern_ipc_perm;
44	struct audit_context;
45	struct super_block;
46	struct inode;
47	struct dentry;
48	struct file;
49	struct vfsmount;
50	struct path;
51	struct qstr;
52	struct iattr;
53	struct fown_struct;
54	struct file_operations;
55	struct msg_msg;
56	struct xattr;
57	struct kernfs_node;
58	struct xfrm_sec_ctx;
59	struct mm_struct;
60	struct fs_context;
61	struct fs_parameter;
62	enum fs_value_type;
63	struct watch;
64	struct watch_notification;
65	struct lsm_ctx;
66
67	/* Default (no) options for the capable function */
68	#define CAP_OPT_NONE 0x0
69	/* If capable should audit the security request */
70	#define CAP_OPT_NOAUDIT BIT(1)
71	/* If capable is being called by a setid function */
72	#define CAP_OPT_INSETID BIT(2)
73
74	/* LSM Agnostic defines for security_sb_set_mnt_opts() flags */
75	#define SECURITY_LSM_NATIVE_LABELS 1
76
77	struct ctl_table;
78	struct audit_krule;
79	struct user_namespace;
80	struct timezone;
81
82	enum lsm_event {
83	LSM_POLICY_CHANGE,
84	};
85
86	/*
87	* These are reasons that can be passed to the security_locked_down()
88	* LSM hook. Lockdown reasons that protect kernel integrity (ie, the
89	* ability for userland to modify kernel code) are placed before
90	* LOCKDOWN_INTEGRITY_MAX. Lockdown reasons that protect kernel
91	* confidentiality (ie, the ability for userland to extract
92	* information from the running kernel that would otherwise be
93	* restricted) are placed before LOCKDOWN_CONFIDENTIALITY_MAX.
94	*
95	* LSM authors should note that the semantics of any given lockdown
96	* reason are not guaranteed to be stable - the same reason may block
97	* one set of features in one kernel release, and a slightly different
98	* set of features in a later kernel release. LSMs that seek to expose
99	* lockdown policy at any level of granularity other than "none",
100	* "integrity" or "confidentiality" are responsible for either
101	* ensuring that they expose a consistent level of functionality to
102	* userland, or ensuring that userland is aware that this is
103	* potentially a moving target. It is easy to misuse this information
104	* in a way that could break userspace. Please be careful not to do
105	* so.
106	*
107	* If you add to this, remember to extend lockdown_reasons in
108	* security/lockdown/lockdown.c.
109	*/
110	enum lockdown_reason {
111	LOCKDOWN_NONE,
112	LOCKDOWN_MODULE_SIGNATURE,
113	LOCKDOWN_DEV_MEM,
114	LOCKDOWN_EFI_TEST,
115	LOCKDOWN_KEXEC,
116	LOCKDOWN_HIBERNATION,
117	LOCKDOWN_PCI_ACCESS,
118	LOCKDOWN_IOPORT,
119	LOCKDOWN_MSR,
120	LOCKDOWN_ACPI_TABLES,
121	LOCKDOWN_DEVICE_TREE,
122	LOCKDOWN_PCMCIA_CIS,
123	LOCKDOWN_TIOCSSERIAL,
124	LOCKDOWN_MODULE_PARAMETERS,
125	LOCKDOWN_MMIOTRACE,
126	LOCKDOWN_DEBUGFS,
127	LOCKDOWN_XMON_WR,
128	LOCKDOWN_BPF_WRITE_USER,
129	LOCKDOWN_DBG_WRITE_KERNEL,
130	LOCKDOWN_RTAS_ERROR_INJECTION,
131	LOCKDOWN_INTEGRITY_MAX,
132	LOCKDOWN_KCORE,
133	LOCKDOWN_KPROBES,
134	LOCKDOWN_BPF_READ_KERNEL,
135	LOCKDOWN_DBG_READ_KERNEL,
136	LOCKDOWN_PERF,
137	LOCKDOWN_TRACEFS,
138	LOCKDOWN_XMON_RW,
139	LOCKDOWN_XFRM_SECRET,
140	LOCKDOWN_CONFIDENTIALITY_MAX,
141	};
142
143	extern const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1];
144	extern u32 lsm_active_cnt;
145	extern const struct lsm_id *lsm_idlist[];
146
147	/* These functions are in security/commoncap.c */
148	extern int cap_capable(const struct cred *cred, struct user_namespace *ns,
149	int cap, unsigned int opts);
150	extern int cap_settime(const struct timespec64 *ts, const struct timezone *tz);
151	extern int cap_ptrace_access_check(struct task_struct *child, unsigned int mode);
152	extern int cap_ptrace_traceme(struct task_struct *parent);
153	extern int cap_capget(const struct task_struct *target, kernel_cap_t *effective,
154	kernel_cap_t *inheritable, kernel_cap_t *permitted);
155	extern int cap_capset(struct cred *new, const struct cred *old,
156	const kernel_cap_t *effective,
157	const kernel_cap_t *inheritable,
158	const kernel_cap_t *permitted);
159	extern int cap_bprm_creds_from_file(struct linux_binprm *bprm, const struct file *file);
160	int cap_inode_setxattr(struct dentry *dentry, const char *name,
161	const void *value, size_t size, int flags);
162	int cap_inode_removexattr(struct mnt_idmap *idmap,
163	struct dentry *dentry, const char *name);
164	int cap_inode_need_killpriv(struct dentry *dentry);
165	int cap_inode_killpriv(struct mnt_idmap *idmap, struct dentry *dentry);
166	int cap_inode_getsecurity(struct mnt_idmap *idmap,
167	struct inode *inode, const char *name, void **buffer,
168	bool alloc);
169	extern int cap_mmap_addr(unsigned long addr);
170	extern int cap_mmap_file(struct file *file, unsigned long reqprot,
171	unsigned long prot, unsigned long flags);
172	extern int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags);
173	extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
174	unsigned long arg4, unsigned long arg5);
175	extern int cap_task_setscheduler(struct task_struct *p);
176	extern int cap_task_setioprio(struct task_struct *p, int ioprio);
177	extern int cap_task_setnice(struct task_struct *p, int nice);
178	extern int cap_vm_enough_memory(struct mm_struct *mm, long pages);
179
180	struct msghdr;
181	struct sk_buff;
182	struct sock;
183	struct sockaddr;
184	struct socket;
185	struct flowi_common;
186	struct dst_entry;
187	struct xfrm_selector;
188	struct xfrm_policy;
189	struct xfrm_state;
190	struct xfrm_user_sec_ctx;
191	struct seq_file;
192	struct sctp_association;
193
194	#ifdef CONFIG_MMU
195	extern unsigned long mmap_min_addr;
196	extern unsigned long dac_mmap_min_addr;
197	#else
198	#define mmap_min_addr 0UL
199	#define dac_mmap_min_addr 0UL
200	#endif
201
202	/*
203	* Values used in the task_security_ops calls
204	*/
205	/* setuid or setgid, id0 == uid or gid */
206	#define LSM_SETID_ID 1
207
208	/* setreuid or setregid, id0 == real, id1 == eff */
209	#define LSM_SETID_RE 2
210
211	/* setresuid or setresgid, id0 == real, id1 == eff, uid2 == saved */
212	#define LSM_SETID_RES 4
213
214	/* setfsuid or setfsgid, id0 == fsuid or fsgid */
215	#define LSM_SETID_FS 8
216
217	/* Flags for security_task_prlimit(). */
218	#define LSM_PRLIMIT_READ 1
219	#define LSM_PRLIMIT_WRITE 2
220
221	/* forward declares to avoid warnings */
222	struct sched_param;
223	struct request_sock;
224
225	/* bprm->unsafe reasons */
226	#define LSM_UNSAFE_SHARE 1
227	#define LSM_UNSAFE_PTRACE 2
228	#define LSM_UNSAFE_NO_NEW_PRIVS 4
229
230	#ifdef CONFIG_MMU
231	extern int mmap_min_addr_handler(struct ctl_table *table, int write,
232	void *buffer, size_t *lenp, loff_t *ppos);
233	#endif
234
235	/* security_inode_init_security callback function to write xattrs */
236	typedef int (*initxattrs) (struct inode *inode,
237	const struct xattr *xattr_array, void *fs_data);
238
239
240	/* Keep the kernel_load_data_id enum in sync with kernel_read_file_id */
241	#define __data_id_enumify(ENUM, dummy) LOADING_ ## ENUM,
242	#define __data_id_stringify(dummy, str) #str,
243
244	enum kernel_load_data_id {
245	__kernel_read_file_id(__data_id_enumify)
246	};
247
248	static const char * const kernel_load_data_str[] = {
249	__kernel_read_file_id(__data_id_stringify)
250	};
251
252	static inline const char *kernel_load_data_id_str(enum kernel_load_data_id id)
253	{
254	if ((unsigned)id >= LOADING_MAX_ID)
255	return kernel_load_data_str[LOADING_UNKNOWN];
256
257	return kernel_load_data_str[id];
258	}
259
260	#ifdef CONFIG_SECURITY
261
262	int call_blocking_lsm_notifier(enum lsm_event event, void *data);
263	int register_blocking_lsm_notifier(struct notifier_block *nb);
264	int unregister_blocking_lsm_notifier(struct notifier_block *nb);
265
266	/* prototypes */
267	extern int security_init(void);
268	extern int early_security_init(void);
269	extern u64 lsm_name_to_attr(const char *name);
270
271	/* Security operations */
272	int security_binder_set_context_mgr(const struct cred *mgr);
273	int security_binder_transaction(const struct cred *from,
274	const struct cred *to);
275	int security_binder_transfer_binder(const struct cred *from,
276	const struct cred *to);
277	int security_binder_transfer_file(const struct cred *from,
278	const struct cred *to, const struct file *file);
279	int security_ptrace_access_check(struct task_struct *child, unsigned int mode);
280	int security_ptrace_traceme(struct task_struct *parent);
281	int security_capget(const struct task_struct *target,
282	kernel_cap_t *effective,
283	kernel_cap_t *inheritable,
284	kernel_cap_t *permitted);
285	int security_capset(struct cred *new, const struct cred *old,
286	const kernel_cap_t *effective,
287	const kernel_cap_t *inheritable,
288	const kernel_cap_t *permitted);
289	int security_capable(const struct cred *cred,
290	struct user_namespace *ns,
291	int cap,
292	unsigned int opts);
293	int security_quotactl(int cmds, int type, int id, const struct super_block *sb);
294	int security_quota_on(struct dentry *dentry);
295	int security_syslog(int type);
296	int security_settime64(const struct timespec64 *ts, const struct timezone *tz);
297	int security_vm_enough_memory_mm(struct mm_struct *mm, long pages);
298	int security_bprm_creds_for_exec(struct linux_binprm *bprm);
299	int security_bprm_creds_from_file(struct linux_binprm *bprm, const struct file *file);
300	int security_bprm_check(struct linux_binprm *bprm);
301	void security_bprm_committing_creds(const struct linux_binprm *bprm);
302	void security_bprm_committed_creds(const struct linux_binprm *bprm);
303	int security_fs_context_submount(struct fs_context *fc, struct super_block *reference);
304	int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc);
305	int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param);
306	int security_sb_alloc(struct super_block *sb);
307	void security_sb_delete(struct super_block *sb);
308	void security_sb_free(struct super_block *sb);
309	void security_free_mnt_opts(void **mnt_opts);
310	int security_sb_eat_lsm_opts(char *options, void **mnt_opts);
311	int security_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts);
312	int security_sb_remount(struct super_block *sb, void *mnt_opts);
313	int security_sb_kern_mount(const struct super_block *sb);
314	int security_sb_show_options(struct seq_file *m, struct super_block *sb);
315	int security_sb_statfs(struct dentry *dentry);
316	int security_sb_mount(const char *dev_name, const struct path *path,
317	const char *type, unsigned long flags, void *data);
318	int security_sb_umount(struct vfsmount *mnt, int flags);
319	int security_sb_pivotroot(const struct path *old_path, const struct path *new_path);
320	int security_sb_set_mnt_opts(struct super_block *sb,
321	void *mnt_opts,
322	unsigned long kern_flags,
323	unsigned long *set_kern_flags);
324	int security_sb_clone_mnt_opts(const struct super_block *oldsb,
325	struct super_block *newsb,
326	unsigned long kern_flags,
327	unsigned long *set_kern_flags);
328	int security_move_mount(const struct path *from_path, const struct path *to_path);
329	int security_dentry_init_security(struct dentry *dentry, int mode,
330	const struct qstr *name,
331	const char **xattr_name, void **ctx,
332	u32 *ctxlen);
333	int security_dentry_create_files_as(struct dentry *dentry, int mode,
334	struct qstr *name,
335	const struct cred *old,
336	struct cred *new);
337	int security_path_notify(const struct path *path, u64 mask,
338	unsigned int obj_type);
339	int security_inode_alloc(struct inode *inode);
340	void security_inode_free(struct inode *inode);
341	int security_inode_init_security(struct inode *inode, struct inode *dir,
342	const struct qstr *qstr,
343	initxattrs initxattrs, void *fs_data);
344	int security_inode_init_security_anon(struct inode *inode,
345	const struct qstr *name,
346	const struct inode *context_inode);
347	int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode);
348	void security_inode_post_create_tmpfile(struct mnt_idmap *idmap,
349	struct inode *inode);
350	int security_inode_link(struct dentry *old_dentry, struct inode *dir,
351	struct dentry *new_dentry);
352	int security_inode_unlink(struct inode *dir, struct dentry *dentry);
353	int security_inode_symlink(struct inode *dir, struct dentry *dentry,
354	const char *old_name);
355	int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode);
356	int security_inode_rmdir(struct inode *dir, struct dentry *dentry);
357	int security_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev);
358	int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
359	struct inode *new_dir, struct dentry *new_dentry,
360	unsigned int flags);
361	int security_inode_readlink(struct dentry *dentry);
362	int security_inode_follow_link(struct dentry *dentry, struct inode *inode,
363	bool rcu);
364	int security_inode_permission(struct inode *inode, int mask);
365	int security_inode_setattr(struct mnt_idmap *idmap,
366	struct dentry *dentry, struct iattr *attr);
367	void security_inode_post_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
368	int ia_valid);
369	int security_inode_getattr(const struct path *path);
370	int security_inode_setxattr(struct mnt_idmap *idmap,
371	struct dentry *dentry, const char *name,
372	const void *value, size_t size, int flags);
373	int security_inode_set_acl(struct mnt_idmap *idmap,
374	struct dentry *dentry, const char *acl_name,
375	struct posix_acl *kacl);
376	void security_inode_post_set_acl(struct dentry *dentry, const char *acl_name,
377	struct posix_acl *kacl);
378	int security_inode_get_acl(struct mnt_idmap *idmap,
379	struct dentry *dentry, const char *acl_name);
380	int security_inode_remove_acl(struct mnt_idmap *idmap,
381	struct dentry *dentry, const char *acl_name);
382	void security_inode_post_remove_acl(struct mnt_idmap *idmap,
383	struct dentry *dentry,
384	const char *acl_name);
385	void security_inode_post_setxattr(struct dentry *dentry, const char *name,
386	const void *value, size_t size, int flags);
387	int security_inode_getxattr(struct dentry *dentry, const char *name);
388	int security_inode_listxattr(struct dentry *dentry);
389	int security_inode_removexattr(struct mnt_idmap *idmap,
390	struct dentry *dentry, const char *name);
391	void security_inode_post_removexattr(struct dentry *dentry, const char *name);
392	int security_inode_need_killpriv(struct dentry *dentry);
393	int security_inode_killpriv(struct mnt_idmap *idmap, struct dentry *dentry);
394	int security_inode_getsecurity(struct mnt_idmap *idmap,
395	struct inode *inode, const char *name,
396	void **buffer, bool alloc);
397	int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags);
398	int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size);
399	void security_inode_getsecid(struct inode *inode, u32 *secid);
400	int security_inode_copy_up(struct dentry *src, struct cred **new);
401	int security_inode_copy_up_xattr(const char *name);
402	int security_kernfs_init_security(struct kernfs_node *kn_dir,
403	struct kernfs_node *kn);
404	int security_file_permission(struct file *file, int mask);
405	int security_file_alloc(struct file *file);
406	void security_file_release(struct file *file);
407	void security_file_free(struct file *file);
408	int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
409	int security_file_ioctl_compat(struct file *file, unsigned int cmd,
410	unsigned long arg);
411	int security_mmap_file(struct file *file, unsigned long prot,
412	unsigned long flags);
413	int security_mmap_addr(unsigned long addr);
414	int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
415	unsigned long prot);
416	int security_file_lock(struct file *file, unsigned int cmd);
417	int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg);
418	void security_file_set_fowner(struct file *file);
419	int security_file_send_sigiotask(struct task_struct *tsk,
420	struct fown_struct *fown, int sig);
421	int security_file_receive(struct file *file);
422	int security_file_open(struct file *file);
423	int security_file_post_open(struct file *file, int mask);
424	int security_file_truncate(struct file *file);
425	int security_task_alloc(struct task_struct *task, unsigned long clone_flags);
426	void security_task_free(struct task_struct *task);
427	int security_cred_alloc_blank(struct cred *cred, gfp_t gfp);
428	void security_cred_free(struct cred *cred);
429	int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp);
430	void security_transfer_creds(struct cred *new, const struct cred *old);
431	void security_cred_getsecid(const struct cred *c, u32 *secid);
432	int security_kernel_act_as(struct cred *new, u32 secid);
433	int security_kernel_create_files_as(struct cred *new, struct inode *inode);
434	int security_kernel_module_request(char *kmod_name);
435	int security_kernel_load_data(enum kernel_load_data_id id, bool contents);
436	int security_kernel_post_load_data(char *buf, loff_t size,
437	enum kernel_load_data_id id,
438	char *description);
439	int security_kernel_read_file(struct file *file, enum kernel_read_file_id id,
440	bool contents);
441	int security_kernel_post_read_file(struct file *file, char *buf, loff_t size,
442	enum kernel_read_file_id id);
443	int security_task_fix_setuid(struct cred *new, const struct cred *old,
444	int flags);
445	int security_task_fix_setgid(struct cred *new, const struct cred *old,
446	int flags);
447	int security_task_fix_setgroups(struct cred *new, const struct cred *old);
448	int security_task_setpgid(struct task_struct *p, pid_t pgid);
449	int security_task_getpgid(struct task_struct *p);
450	int security_task_getsid(struct task_struct *p);
451	void security_current_getsecid_subj(u32 *secid);
452	void security_task_getsecid_obj(struct task_struct *p, u32 *secid);
453	int security_task_setnice(struct task_struct *p, int nice);
454	int security_task_setioprio(struct task_struct *p, int ioprio);
455	int security_task_getioprio(struct task_struct *p);
456	int security_task_prlimit(const struct cred *cred, const struct cred *tcred,
457	unsigned int flags);
458	int security_task_setrlimit(struct task_struct *p, unsigned int resource,
459	struct rlimit *new_rlim);
460	int security_task_setscheduler(struct task_struct *p);
461	int security_task_getscheduler(struct task_struct *p);
462	int security_task_movememory(struct task_struct *p);
463	int security_task_kill(struct task_struct *p, struct kernel_siginfo *info,
464	int sig, const struct cred *cred);
465	int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
466	unsigned long arg4, unsigned long arg5);
467	void security_task_to_inode(struct task_struct *p, struct inode *inode);
468	int security_create_user_ns(const struct cred *cred);
469	int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag);
470	void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid);
471	int security_msg_msg_alloc(struct msg_msg *msg);
472	void security_msg_msg_free(struct msg_msg *msg);
473	int security_msg_queue_alloc(struct kern_ipc_perm *msq);
474	void security_msg_queue_free(struct kern_ipc_perm *msq);
475	int security_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg);
476	int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd);
477	int security_msg_queue_msgsnd(struct kern_ipc_perm *msq,
478	struct msg_msg *msg, int msqflg);
479	int security_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
480	struct task_struct *target, long type, int mode);
481	int security_shm_alloc(struct kern_ipc_perm *shp);
482	void security_shm_free(struct kern_ipc_perm *shp);
483	int security_shm_associate(struct kern_ipc_perm *shp, int shmflg);
484	int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd);
485	int security_shm_shmat(struct kern_ipc_perm *shp, char __user *shmaddr, int shmflg);
486	int security_sem_alloc(struct kern_ipc_perm *sma);
487	void security_sem_free(struct kern_ipc_perm *sma);
488	int security_sem_associate(struct kern_ipc_perm *sma, int semflg);
489	int security_sem_semctl(struct kern_ipc_perm *sma, int cmd);
490	int security_sem_semop(struct kern_ipc_perm *sma, struct sembuf *sops,
491	unsigned nsops, int alter);
492	void security_d_instantiate(struct dentry *dentry, struct inode *inode);
493	int security_getselfattr(unsigned int attr, struct lsm_ctx __user *ctx,
494	u32 __user *size, u32 flags);
495	int security_setselfattr(unsigned int attr, struct lsm_ctx __user *ctx,
496	u32 size, u32 flags);
497	int security_getprocattr(struct task_struct *p, int lsmid, const char *name,
498	char **value);
499	int security_setprocattr(int lsmid, const char *name, void *value, size_t size);
500	int security_netlink_send(struct sock *sk, struct sk_buff *skb);
501	int security_ismaclabel(const char *name);
502	int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);
503	int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
504	void security_release_secctx(char *secdata, u32 seclen);
505	void security_inode_invalidate_secctx(struct inode *inode);
506	int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen);
507	int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
508	int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen);
509	int security_locked_down(enum lockdown_reason what);
510	int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 *uctx_len,
511	void *val, size_t val_len, u64 id, u64 flags);
512	#else /* CONFIG_SECURITY */
513
514	static inline int call_blocking_lsm_notifier(enum lsm_event event, void *data)
515	{
516	return 0;
517	}
518
519	static inline int register_blocking_lsm_notifier(struct notifier_block *nb)
520	{
521	return 0;
522	}
523
524	static inline int unregister_blocking_lsm_notifier(struct notifier_block *nb)
525	{
526	return 0;
527	}
528
529	static inline u64 lsm_name_to_attr(const char *name)
530	{
531	return LSM_ATTR_UNDEF;
532	}
533
534	static inline void security_free_mnt_opts(void **mnt_opts)
535	{
536	}
537
538	/*
539	* This is the default capabilities functionality. Most of these functions
540	* are just stubbed out, but a few must call the proper capable code.
541	*/
542
543	static inline int security_init(void)
544	{
545	return 0;
546	}
547
548	static inline int early_security_init(void)
549	{
550	return 0;
551	}
552
553	static inline int security_binder_set_context_mgr(const struct cred *mgr)
554	{
555	return 0;
556	}
557
558	static inline int security_binder_transaction(const struct cred *from,
559	const struct cred *to)
560	{
561	return 0;
562	}
563
564	static inline int security_binder_transfer_binder(const struct cred *from,
565	const struct cred *to)
566	{
567	return 0;
568	}
569
570	static inline int security_binder_transfer_file(const struct cred *from,
571	const struct cred *to,
572	const struct file *file)
573	{
574	return 0;
575	}
576
577	static inline int security_ptrace_access_check(struct task_struct *child,
578	unsigned int mode)
579	{
580	return cap_ptrace_access_check(child, mode);
581	}
582
583	static inline int security_ptrace_traceme(struct task_struct *parent)
584	{
585	return cap_ptrace_traceme(parent);
586	}
587
588	static inline int security_capget(const struct task_struct *target,
589	kernel_cap_t *effective,
590	kernel_cap_t *inheritable,
591	kernel_cap_t *permitted)
592	{
593	return cap_capget(target, effective, inheritable, permitted);
594	}
595
596	static inline int security_capset(struct cred *new,
597	const struct cred *old,
598	const kernel_cap_t *effective,
599	const kernel_cap_t *inheritable,
600	const kernel_cap_t *permitted)
601	{
602	return cap_capset(new, old, effective, inheritable, permitted);
603	}
604
605	static inline int security_capable(const struct cred *cred,
606	struct user_namespace *ns,
607	int cap,
608	unsigned int opts)
609	{
610	return cap_capable(cred, ns, cap, opts);
611	}
612
613	static inline int security_quotactl(int cmds, int type, int id,
614	const struct super_block *sb)
615	{
616	return 0;
617	}
618
619	static inline int security_quota_on(struct dentry *dentry)
620	{
621	return 0;
622	}
623
624	static inline int security_syslog(int type)
625	{
626	return 0;
627	}
628
629	static inline int security_settime64(const struct timespec64 *ts,
630	const struct timezone *tz)
631	{
632	return cap_settime(ts, tz);
633	}
634
635	static inline int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
636	{
637	return __vm_enough_memory(mm, pages, cap_vm_enough_memory(mm, pages));
638	}
639
640	static inline int security_bprm_creds_for_exec(struct linux_binprm *bprm)
641	{
642	return 0;
643	}
644
645	static inline int security_bprm_creds_from_file(struct linux_binprm *bprm,
646	const struct file *file)
647	{
648	return cap_bprm_creds_from_file(bprm, file);
649	}
650
651	static inline int security_bprm_check(struct linux_binprm *bprm)
652	{
653	return 0;
654	}
655
656	static inline void security_bprm_committing_creds(const struct linux_binprm *bprm)
657	{
658	}
659
660	static inline void security_bprm_committed_creds(const struct linux_binprm *bprm)
661	{
662	}
663
664	static inline int security_fs_context_submount(struct fs_context *fc,
665	struct super_block *reference)
666	{
667	return 0;
668	}
669	static inline int security_fs_context_dup(struct fs_context *fc,
670	struct fs_context *src_fc)
671	{
672	return 0;
673	}
674	static inline int security_fs_context_parse_param(struct fs_context *fc,
675	struct fs_parameter *param)
676	{
677	return -ENOPARAM;
678	}
679
680	static inline int security_sb_alloc(struct super_block *sb)
681	{
682	return 0;
683	}
684
685	static inline void security_sb_delete(struct super_block *sb)
686	{ }
687
688	static inline void security_sb_free(struct super_block *sb)
689	{ }
690
691	static inline int security_sb_eat_lsm_opts(char *options,
692	void **mnt_opts)
693	{
694	return 0;
695	}
696
697	static inline int security_sb_remount(struct super_block *sb,
698	void *mnt_opts)
699	{
700	return 0;
701	}
702
703	static inline int security_sb_mnt_opts_compat(struct super_block *sb,
704	void *mnt_opts)
705	{
706	return 0;
707	}
708
709
710	static inline int security_sb_kern_mount(struct super_block *sb)
711	{
712	return 0;
713	}
714
715	static inline int security_sb_show_options(struct seq_file *m,
716	struct super_block *sb)
717	{
718	return 0;
719	}
720
721	static inline int security_sb_statfs(struct dentry *dentry)
722	{
723	return 0;
724	}
725
726	static inline int security_sb_mount(const char *dev_name, const struct path *path,
727	const char *type, unsigned long flags,
728	void *data)
729	{
730	return 0;
731	}
732
733	static inline int security_sb_umount(struct vfsmount *mnt, int flags)
734	{
735	return 0;
736	}
737
738	static inline int security_sb_pivotroot(const struct path *old_path,
739	const struct path *new_path)
740	{
741	return 0;
742	}
743
744	static inline int security_sb_set_mnt_opts(struct super_block *sb,
745	void *mnt_opts,
746	unsigned long kern_flags,
747	unsigned long *set_kern_flags)
748	{
749	return 0;
750	}
751
752	static inline int security_sb_clone_mnt_opts(const struct super_block *oldsb,
753	struct super_block *newsb,
754	unsigned long kern_flags,
755	unsigned long *set_kern_flags)
756	{
757	return 0;
758	}
759
760	static inline int security_move_mount(const struct path *from_path,
761	const struct path *to_path)
762	{
763	return 0;
764	}
765
766	static inline int security_path_notify(const struct path *path, u64 mask,
767	unsigned int obj_type)
768	{
769	return 0;
770	}
771
772	static inline int security_inode_alloc(struct inode *inode)
773	{
774	return 0;
775	}
776
777	static inline void security_inode_free(struct inode *inode)
778	{ }
779
780	static inline int security_dentry_init_security(struct dentry *dentry,
781	int mode,
782	const struct qstr *name,
783	const char **xattr_name,
784	void **ctx,
785	u32 *ctxlen)
786	{
787	return -EOPNOTSUPP;
788	}
789
790	static inline int security_dentry_create_files_as(struct dentry *dentry,
791	int mode, struct qstr *name,
792	const struct cred *old,
793	struct cred *new)
794	{
795	return 0;
796	}
797
798
799	static inline int security_inode_init_security(struct inode *inode,
800	struct inode *dir,
801	const struct qstr *qstr,
802	const initxattrs xattrs,
803	void *fs_data)
804	{
805	return 0;
806	}
807
808	static inline int security_inode_init_security_anon(struct inode *inode,
809	const struct qstr *name,
810	const struct inode *context_inode)
811	{
812	return 0;
813	}
814
815	static inline int security_inode_create(struct inode *dir,
816	struct dentry *dentry,
817	umode_t mode)
818	{
819	return 0;
820	}
821
822	static inline void
823	security_inode_post_create_tmpfile(struct mnt_idmap *idmap, struct inode *inode)
824	{ }
825
826	static inline int security_inode_link(struct dentry *old_dentry,
827	struct inode *dir,
828	struct dentry *new_dentry)
829	{
830	return 0;
831	}
832
833	static inline int security_inode_unlink(struct inode *dir,
834	struct dentry *dentry)
835	{
836	return 0;
837	}
838
839	static inline int security_inode_symlink(struct inode *dir,
840	struct dentry *dentry,
841	const char *old_name)
842	{
843	return 0;
844	}
845
846	static inline int security_inode_mkdir(struct inode *dir,
847	struct dentry *dentry,
848	int mode)
849	{
850	return 0;
851	}
852
853	static inline int security_inode_rmdir(struct inode *dir,
854	struct dentry *dentry)
855	{
856	return 0;
857	}
858
859	static inline int security_inode_mknod(struct inode *dir,
860	struct dentry *dentry,
861	int mode, dev_t dev)
862	{
863	return 0;
864	}
865
866	static inline int security_inode_rename(struct inode *old_dir,
867	struct dentry *old_dentry,
868	struct inode *new_dir,
869	struct dentry *new_dentry,
870	unsigned int flags)
871	{
872	return 0;
873	}
874
875	static inline int security_inode_readlink(struct dentry *dentry)
876	{
877	return 0;
878	}
879
880	static inline int security_inode_follow_link(struct dentry *dentry,
881	struct inode *inode,
882	bool rcu)
883	{
884	return 0;
885	}
886
887	static inline int security_inode_permission(struct inode *inode, int mask)
888	{
889	return 0;
890	}
891
892	static inline int security_inode_setattr(struct mnt_idmap *idmap,
893	struct dentry *dentry,
894	struct iattr *attr)
895	{
896	return 0;
897	}
898
899	static inline void
900	security_inode_post_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
901	int ia_valid)
902	{ }
903
904	static inline int security_inode_getattr(const struct path *path)
905	{
906	return 0;
907	}
908
909	static inline int security_inode_setxattr(struct mnt_idmap *idmap,
910	struct dentry *dentry, const char *name, const void *value,
911	size_t size, int flags)
912	{
913	return cap_inode_setxattr(dentry, name, value, size, flags);
914	}
915
916	static inline int security_inode_set_acl(struct mnt_idmap *idmap,
917	struct dentry *dentry,
918	const char *acl_name,
919	struct posix_acl *kacl)
920	{
921	return 0;
922	}
923
924	static inline void security_inode_post_set_acl(struct dentry *dentry,
925	const char *acl_name,
926	struct posix_acl *kacl)
927	{ }
928
929	static inline int security_inode_get_acl(struct mnt_idmap *idmap,
930	struct dentry *dentry,
931	const char *acl_name)
932	{
933	return 0;
934	}
935
936	static inline int security_inode_remove_acl(struct mnt_idmap *idmap,
937	struct dentry *dentry,
938	const char *acl_name)
939	{
940	return 0;
941	}
942
943	static inline void security_inode_post_remove_acl(struct mnt_idmap *idmap,
944	struct dentry *dentry,
945	const char *acl_name)
946	{ }
947
948	static inline void security_inode_post_setxattr(struct dentry *dentry,
949	const char *name, const void *value, size_t size, int flags)
950	{ }
951
952	static inline int security_inode_getxattr(struct dentry *dentry,
953	const char *name)
954	{
955	return 0;
956	}
957
958	static inline int security_inode_listxattr(struct dentry *dentry)
959	{
960	return 0;
961	}
962
963	static inline int security_inode_removexattr(struct mnt_idmap *idmap,
964	struct dentry *dentry,
965	const char *name)
966	{
967	return cap_inode_removexattr(idmap, dentry, name);
968	}
969
970	static inline void security_inode_post_removexattr(struct dentry *dentry,
971	const char *name)
972	{ }
973
974	static inline int security_inode_need_killpriv(struct dentry *dentry)
975	{
976	return cap_inode_need_killpriv(dentry);
977	}
978
979	static inline int security_inode_killpriv(struct mnt_idmap *idmap,
980	struct dentry *dentry)
981	{
982	return cap_inode_killpriv(idmap, dentry);
983	}
984
985	static inline int security_inode_getsecurity(struct mnt_idmap *idmap,
986	struct inode *inode,
987	const char *name, void **buffer,
988	bool alloc)
989	{
990	return cap_inode_getsecurity(idmap, inode, name, buffer, alloc);
991	}
992
993	static inline int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
994	{
995	return -EOPNOTSUPP;
996	}
997
998	static inline int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
999	{
1000	return 0;
1001	}
1002
1003	static inline void security_inode_getsecid(struct inode *inode, u32 *secid)
1004	{
1005	*secid = 0;
1006	}
1007
1008	static inline int security_inode_copy_up(struct dentry *src, struct cred **new)
1009	{
1010	return 0;
1011	}
1012
1013	static inline int security_kernfs_init_security(struct kernfs_node *kn_dir,
1014	struct kernfs_node *kn)
1015	{
1016	return 0;
1017	}
1018
1019	static inline int security_inode_copy_up_xattr(const char *name)
1020	{
1021	return -EOPNOTSUPP;
1022	}
1023
1024	static inline int security_file_permission(struct file *file, int mask)
1025	{
1026	return 0;
1027	}
1028
1029	static inline int security_file_alloc(struct file *file)
1030	{
1031	return 0;
1032	}
1033
1034	static inline void security_file_release(struct file *file)
1035	{ }
1036
1037	static inline void security_file_free(struct file *file)
1038	{ }
1039
1040	static inline int security_file_ioctl(struct file *file, unsigned int cmd,
1041	unsigned long arg)
1042	{
1043	return 0;
1044	}
1045
1046	static inline int security_file_ioctl_compat(struct file *file,
1047	unsigned int cmd,
1048	unsigned long arg)
1049	{
1050	return 0;
1051	}
1052
1053	static inline int security_mmap_file(struct file *file, unsigned long prot,
1054	unsigned long flags)
1055	{
1056	return 0;
1057	}
1058
1059	static inline int security_mmap_addr(unsigned long addr)
1060	{
1061	return cap_mmap_addr(addr);
1062	}
1063
1064	static inline int security_file_mprotect(struct vm_area_struct *vma,
1065	unsigned long reqprot,
1066	unsigned long prot)
1067	{
1068	return 0;
1069	}
1070
1071	static inline int security_file_lock(struct file *file, unsigned int cmd)
1072	{
1073	return 0;
1074	}
1075
1076	static inline int security_file_fcntl(struct file *file, unsigned int cmd,
1077	unsigned long arg)
1078	{
1079	return 0;
1080	}
1081
1082	static inline void security_file_set_fowner(struct file *file)
1083	{
1084	return;
1085	}
1086
1087	static inline int security_file_send_sigiotask(struct task_struct *tsk,
1088	struct fown_struct *fown,
1089	int sig)
1090	{
1091	return 0;
1092	}
1093
1094	static inline int security_file_receive(struct file *file)
1095	{
1096	return 0;
1097	}
1098
1099	static inline int security_file_open(struct file *file)
1100	{
1101	return 0;
1102	}
1103
1104	static inline int security_file_post_open(struct file *file, int mask)
1105	{
1106	return 0;
1107	}
1108
1109	static inline int security_file_truncate(struct file *file)
1110	{
1111	return 0;
1112	}
1113
1114	static inline int security_task_alloc(struct task_struct *task,
1115	unsigned long clone_flags)
1116	{
1117	return 0;
1118	}
1119
1120	static inline void security_task_free(struct task_struct *task)
1121	{ }
1122
1123	static inline int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)
1124	{
1125	return 0;
1126	}
1127
1128	static inline void security_cred_free(struct cred *cred)
1129	{ }
1130
1131	static inline int security_prepare_creds(struct cred *new,
1132	const struct cred *old,
1133	gfp_t gfp)
1134	{
1135	return 0;
1136	}
1137
1138	static inline void security_transfer_creds(struct cred *new,
1139	const struct cred *old)
1140	{
1141	}
1142
1143	static inline void security_cred_getsecid(const struct cred *c, u32 *secid)
1144	{
1145	*secid = 0;
1146	}
1147
1148	static inline int security_kernel_act_as(struct cred *cred, u32 secid)
1149	{
1150	return 0;
1151	}
1152
1153	static inline int security_kernel_create_files_as(struct cred *cred,
1154	struct inode *inode)
1155	{
1156	return 0;
1157	}
1158
1159	static inline int security_kernel_module_request(char *kmod_name)
1160	{
1161	return 0;
1162	}
1163
1164	static inline int security_kernel_load_data(enum kernel_load_data_id id, bool contents)
1165	{
1166	return 0;
1167	}
1168
1169	static inline int security_kernel_post_load_data(char *buf, loff_t size,
1170	enum kernel_load_data_id id,
1171	char *description)
1172	{
1173	return 0;
1174	}
1175
1176	static inline int security_kernel_read_file(struct file *file,
1177	enum kernel_read_file_id id,
1178	bool contents)
1179	{
1180	return 0;
1181	}
1182
1183	static inline int security_kernel_post_read_file(struct file *file,
1184	char *buf, loff_t size,
1185	enum kernel_read_file_id id)
1186	{
1187	return 0;
1188	}
1189
1190	static inline int security_task_fix_setuid(struct cred *new,
1191	const struct cred *old,
1192	int flags)
1193	{
1194	return cap_task_fix_setuid(new, old, flags);
1195	}
1196
1197	static inline int security_task_fix_setgid(struct cred *new,
1198	const struct cred *old,
1199	int flags)
1200	{
1201	return 0;
1202	}
1203
1204	static inline int security_task_fix_setgroups(struct cred *new,
1205	const struct cred *old)
1206	{
1207	return 0;
1208	}
1209
1210	static inline int security_task_setpgid(struct task_struct *p, pid_t pgid)
1211	{
1212	return 0;
1213	}
1214
1215	static inline int security_task_getpgid(struct task_struct *p)
1216	{
1217	return 0;
1218	}
1219
1220	static inline int security_task_getsid(struct task_struct *p)
1221	{
1222	return 0;
1223	}
1224
1225	static inline void security_current_getsecid_subj(u32 *secid)
1226	{
1227	*secid = 0;
1228	}
1229
1230	static inline void security_task_getsecid_obj(struct task_struct *p, u32 *secid)
1231	{
1232	*secid = 0;
1233	}
1234
1235	static inline int security_task_setnice(struct task_struct *p, int nice)
1236	{
1237	return cap_task_setnice(p, nice);
1238	}
1239
1240	static inline int security_task_setioprio(struct task_struct *p, int ioprio)
1241	{
1242	return cap_task_setioprio(p, ioprio);
1243	}
1244
1245	static inline int security_task_getioprio(struct task_struct *p)
1246	{
1247	return 0;
1248	}
1249
1250	static inline int security_task_prlimit(const struct cred *cred,
1251	const struct cred *tcred,
1252	unsigned int flags)
1253	{
1254	return 0;
1255	}
1256
1257	static inline int security_task_setrlimit(struct task_struct *p,
1258	unsigned int resource,
1259	struct rlimit *new_rlim)
1260	{
1261	return 0;
1262	}
1263
1264	static inline int security_task_setscheduler(struct task_struct *p)
1265	{
1266	return cap_task_setscheduler(p);
1267	}
1268
1269	static inline int security_task_getscheduler(struct task_struct *p)
1270	{
1271	return 0;
1272	}
1273
1274	static inline int security_task_movememory(struct task_struct *p)
1275	{
1276	return 0;
1277	}
1278
1279	static inline int security_task_kill(struct task_struct *p,
1280	struct kernel_siginfo *info, int sig,
1281	const struct cred *cred)
1282	{
1283	return 0;
1284	}
1285
1286	static inline int security_task_prctl(int option, unsigned long arg2,
1287	unsigned long arg3,
1288	unsigned long arg4,
1289	unsigned long arg5)
1290	{
1291	return cap_task_prctl(option, arg2, arg3, arg4, arg5);
1292	}
1293
1294	static inline void security_task_to_inode(struct task_struct *p, struct inode *inode)
1295	{ }
1296
1297	static inline int security_create_user_ns(const struct cred *cred)
1298	{
1299	return 0;
1300	}
1301
1302	static inline int security_ipc_permission(struct kern_ipc_perm *ipcp,
1303	short flag)
1304	{
1305	return 0;
1306	}
1307
1308	static inline void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
1309	{
1310	*secid = 0;
1311	}
1312
1313	static inline int security_msg_msg_alloc(struct msg_msg *msg)
1314	{
1315	return 0;
1316	}
1317
1318	static inline void security_msg_msg_free(struct msg_msg *msg)
1319	{ }
1320
1321	static inline int security_msg_queue_alloc(struct kern_ipc_perm *msq)
1322	{
1323	return 0;
1324	}
1325
1326	static inline void security_msg_queue_free(struct kern_ipc_perm *msq)
1327	{ }
1328
1329	static inline int security_msg_queue_associate(struct kern_ipc_perm *msq,
1330	int msqflg)
1331	{
1332	return 0;
1333	}
1334
1335	static inline int security_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
1336	{
1337	return 0;
1338	}
1339
1340	static inline int security_msg_queue_msgsnd(struct kern_ipc_perm *msq,
1341	struct msg_msg *msg, int msqflg)
1342	{
1343	return 0;
1344	}
1345
1346	static inline int security_msg_queue_msgrcv(struct kern_ipc_perm *msq,
1347	struct msg_msg *msg,
1348	struct task_struct *target,
1349	long type, int mode)
1350	{
1351	return 0;
1352	}
1353
1354	static inline int security_shm_alloc(struct kern_ipc_perm *shp)
1355	{
1356	return 0;
1357	}
1358
1359	static inline void security_shm_free(struct kern_ipc_perm *shp)
1360	{ }
1361
1362	static inline int security_shm_associate(struct kern_ipc_perm *shp,
1363	int shmflg)
1364	{
1365	return 0;
1366	}
1367
1368	static inline int security_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
1369	{
1370	return 0;
1371	}
1372
1373	static inline int security_shm_shmat(struct kern_ipc_perm *shp,
1374	char __user *shmaddr, int shmflg)
1375	{
1376	return 0;
1377	}
1378
1379	static inline int security_sem_alloc(struct kern_ipc_perm *sma)
1380	{
1381	return 0;
1382	}
1383
1384	static inline void security_sem_free(struct kern_ipc_perm *sma)
1385	{ }
1386
1387	static inline int security_sem_associate(struct kern_ipc_perm *sma, int semflg)
1388	{
1389	return 0;
1390	}
1391
1392	static inline int security_sem_semctl(struct kern_ipc_perm *sma, int cmd)
1393	{
1394	return 0;
1395	}
1396
1397	static inline int security_sem_semop(struct kern_ipc_perm *sma,
1398	struct sembuf *sops, unsigned nsops,
1399	int alter)
1400	{
1401	return 0;
1402	}
1403
1404	static inline void security_d_instantiate(struct dentry *dentry,
1405	struct inode *inode)
1406	{ }
1407
1408	static inline int security_getselfattr(unsigned int attr,
1409	struct lsm_ctx __user *ctx,
1410	size_t __user *size, u32 flags)
1411	{
1412	return -EOPNOTSUPP;
1413	}
1414
1415	static inline int security_setselfattr(unsigned int attr,
1416	struct lsm_ctx __user *ctx,
1417	size_t size, u32 flags)
1418	{
1419	return -EOPNOTSUPP;
1420	}
1421
1422	static inline int security_getprocattr(struct task_struct *p, int lsmid,
1423	const char *name, char **value)
1424	{
1425	return -EINVAL;
1426	}
1427
1428	static inline int security_setprocattr(int lsmid, char *name, void *value,
1429	size_t size)
1430	{
1431	return -EINVAL;
1432	}
1433
1434	static inline int security_netlink_send(struct sock *sk, struct sk_buff *skb)
1435	{
1436	return 0;
1437	}
1438
1439	static inline int security_ismaclabel(const char *name)
1440	{
1441	return 0;
1442	}
1443
1444	static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
1445	{
1446	return -EOPNOTSUPP;
1447	}
1448
1449	static inline int security_secctx_to_secid(const char *secdata,
1450	u32 seclen,
1451	u32 *secid)
1452	{
1453	return -EOPNOTSUPP;
1454	}
1455
1456	static inline void security_release_secctx(char *secdata, u32 seclen)
1457	{
1458	}
1459
1460	static inline void security_inode_invalidate_secctx(struct inode *inode)
1461	{
1462	}
1463
1464	static inline int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
1465	{
1466	return -EOPNOTSUPP;
1467	}
1468	static inline int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
1469	{
1470	return -EOPNOTSUPP;
1471	}
1472	static inline int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
1473	{
1474	return -EOPNOTSUPP;
1475	}
1476	static inline int security_locked_down(enum lockdown_reason what)
1477	{
1478	return 0;
1479	}
1480	static inline int lsm_fill_user_ctx(struct lsm_ctx __user *uctx,
1481	u32 *uctx_len, void *val, size_t val_len,
1482	u64 id, u64 flags)
1483	{
1484	return -EOPNOTSUPP;
1485	}
1486	#endif /* CONFIG_SECURITY */
1487
1488	#if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE)
1489	int security_post_notification(const struct cred *w_cred,
1490	const struct cred *cred,
1491	struct watch_notification *n);
1492	#else
1493	static inline int security_post_notification(const struct cred *w_cred,
1494	const struct cred *cred,
1495	struct watch_notification *n)
1496	{
1497	return 0;
1498	}
1499	#endif
1500
1501	#if defined(CONFIG_SECURITY) && defined(CONFIG_KEY_NOTIFICATIONS)
1502	int security_watch_key(struct key *key);
1503	#else
1504	static inline int security_watch_key(struct key *key)
1505	{
1506	return 0;
1507	}
1508	#endif
1509
1510	#ifdef CONFIG_SECURITY_NETWORK
1511
1512	int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk);
1513	int security_unix_may_send(struct socket *sock, struct socket *other);
1514	int security_socket_create(int family, int type, int protocol, int kern);
1515	int security_socket_post_create(struct socket *sock, int family,
1516	int type, int protocol, int kern);
1517	int security_socket_socketpair(struct socket *socka, struct socket *sockb);
1518	int security_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen);
1519	int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen);
1520	int security_socket_listen(struct socket *sock, int backlog);
1521	int security_socket_accept(struct socket *sock, struct socket *newsock);
1522	int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size);
1523	int security_socket_recvmsg(struct socket *sock, struct msghdr *msg,
1524	int size, int flags);
1525	int security_socket_getsockname(struct socket *sock);
1526	int security_socket_getpeername(struct socket *sock);
1527	int security_socket_getsockopt(struct socket *sock, int level, int optname);
1528	int security_socket_setsockopt(struct socket *sock, int level, int optname);
1529	int security_socket_shutdown(struct socket *sock, int how);
1530	int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb);
1531	int security_socket_getpeersec_stream(struct socket *sock, sockptr_t optval,
1532	sockptr_t optlen, unsigned int len);
1533	int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid);
1534	int security_sk_alloc(struct sock *sk, int family, gfp_t priority);
1535	void security_sk_free(struct sock *sk);
1536	void security_sk_clone(const struct sock *sk, struct sock *newsk);
1537	void security_sk_classify_flow(const struct sock *sk,
1538	struct flowi_common *flic);
1539	void security_req_classify_flow(const struct request_sock *req,
1540	struct flowi_common *flic);
1541	void security_sock_graft(struct sock*sk, struct socket *parent);
1542	int security_inet_conn_request(const struct sock *sk,
1543	struct sk_buff *skb, struct request_sock *req);
1544	void security_inet_csk_clone(struct sock *newsk,
1545	const struct request_sock *req);
1546	void security_inet_conn_established(struct sock *sk,
1547	struct sk_buff *skb);
1548	int security_secmark_relabel_packet(u32 secid);
1549	void security_secmark_refcount_inc(void);
1550	void security_secmark_refcount_dec(void);
1551	int security_tun_dev_alloc_security(void **security);
1552	void security_tun_dev_free_security(void *security);
1553	int security_tun_dev_create(void);
1554	int security_tun_dev_attach_queue(void *security);
1555	int security_tun_dev_attach(struct sock *sk, void *security);
1556	int security_tun_dev_open(void *security);
1557	int security_sctp_assoc_request(struct sctp_association *asoc, struct sk_buff *skb);
1558	int security_sctp_bind_connect(struct sock *sk, int optname,
1559	struct sockaddr *address, int addrlen);
1560	void security_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk,
1561	struct sock *newsk);
1562	int security_sctp_assoc_established(struct sctp_association *asoc,
1563	struct sk_buff *skb);
1564	int security_mptcp_add_subflow(struct sock *sk, struct sock *ssk);
1565
1566	#else /* CONFIG_SECURITY_NETWORK */
1567	static inline int security_unix_stream_connect(struct sock *sock,
1568	struct sock *other,
1569	struct sock *newsk)
1570	{
1571	return 0;
1572	}
1573
1574	static inline int security_unix_may_send(struct socket *sock,
1575	struct socket *other)
1576	{
1577	return 0;
1578	}
1579
1580	static inline int security_socket_create(int family, int type,
1581	int protocol, int kern)
1582	{
1583	return 0;
1584	}
1585
1586	static inline int security_socket_post_create(struct socket *sock,
1587	int family,
1588	int type,
1589	int protocol, int kern)
1590	{
1591	return 0;
1592	}
1593
1594	static inline int security_socket_socketpair(struct socket *socka,
1595	struct socket *sockb)
1596	{
1597	return 0;
1598	}
1599
1600	static inline int security_socket_bind(struct socket *sock,
1601	struct sockaddr *address,
1602	int addrlen)
1603	{
1604	return 0;
1605	}
1606
1607	static inline int security_socket_connect(struct socket *sock,
1608	struct sockaddr *address,
1609	int addrlen)
1610	{
1611	return 0;
1612	}
1613
1614	static inline int security_socket_listen(struct socket *sock, int backlog)
1615	{
1616	return 0;
1617	}
1618
1619	static inline int security_socket_accept(struct socket *sock,
1620	struct socket *newsock)
1621	{
1622	return 0;
1623	}
1624
1625	static inline int security_socket_sendmsg(struct socket *sock,
1626	struct msghdr *msg, int size)
1627	{
1628	return 0;
1629	}
1630
1631	static inline int security_socket_recvmsg(struct socket *sock,
1632	struct msghdr *msg, int size,
1633	int flags)
1634	{
1635	return 0;
1636	}
1637
1638	static inline int security_socket_getsockname(struct socket *sock)
1639	{
1640	return 0;
1641	}
1642
1643	static inline int security_socket_getpeername(struct socket *sock)
1644	{
1645	return 0;
1646	}
1647
1648	static inline int security_socket_getsockopt(struct socket *sock,
1649	int level, int optname)
1650	{
1651	return 0;
1652	}
1653
1654	static inline int security_socket_setsockopt(struct socket *sock,
1655	int level, int optname)
1656	{
1657	return 0;
1658	}
1659
1660	static inline int security_socket_shutdown(struct socket *sock, int how)
1661	{
1662	return 0;
1663	}
1664	static inline int security_sock_rcv_skb(struct sock *sk,
1665	struct sk_buff *skb)
1666	{
1667	return 0;
1668	}
1669
1670	static inline int security_socket_getpeersec_stream(struct socket *sock,
1671	sockptr_t optval,
1672	sockptr_t optlen,
1673	unsigned int len)
1674	{
1675	return -ENOPROTOOPT;
1676	}
1677
1678	static inline int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
1679	{
1680	return -ENOPROTOOPT;
1681	}
1682
1683	static inline int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
1684	{
1685	return 0;
1686	}
1687
1688	static inline void security_sk_free(struct sock *sk)
1689	{
1690	}
1691
1692	static inline void security_sk_clone(const struct sock *sk, struct sock *newsk)
1693	{
1694	}
1695
1696	static inline void security_sk_classify_flow(const struct sock *sk,
1697	struct flowi_common *flic)
1698	{
1699	}
1700
1701	static inline void security_req_classify_flow(const struct request_sock *req,
1702	struct flowi_common *flic)
1703	{
1704	}
1705
1706	static inline void security_sock_graft(struct sock *sk, struct socket *parent)
1707	{
1708	}
1709
1710	static inline int security_inet_conn_request(const struct sock *sk,
1711	struct sk_buff *skb, struct request_sock *req)
1712	{
1713	return 0;
1714	}
1715
1716	static inline void security_inet_csk_clone(struct sock *newsk,
1717	const struct request_sock *req)
1718	{
1719	}
1720
1721	static inline void security_inet_conn_established(struct sock *sk,
1722	struct sk_buff *skb)
1723	{
1724	}
1725
1726	static inline int security_secmark_relabel_packet(u32 secid)
1727	{
1728	return 0;
1729	}
1730
1731	static inline void security_secmark_refcount_inc(void)
1732	{
1733	}
1734
1735	static inline void security_secmark_refcount_dec(void)
1736	{
1737	}
1738
1739	static inline int security_tun_dev_alloc_security(void **security)
1740	{
1741	return 0;
1742	}
1743
1744	static inline void security_tun_dev_free_security(void *security)
1745	{
1746	}
1747
1748	static inline int security_tun_dev_create(void)
1749	{
1750	return 0;
1751	}
1752
1753	static inline int security_tun_dev_attach_queue(void *security)
1754	{
1755	return 0;
1756	}
1757
1758	static inline int security_tun_dev_attach(struct sock *sk, void *security)
1759	{
1760	return 0;
1761	}
1762
1763	static inline int security_tun_dev_open(void *security)
1764	{
1765	return 0;
1766	}
1767
1768	static inline int security_sctp_assoc_request(struct sctp_association *asoc,
1769	struct sk_buff *skb)
1770	{
1771	return 0;
1772	}
1773
1774	static inline int security_sctp_bind_connect(struct sock *sk, int optname,
1775	struct sockaddr *address,
1776	int addrlen)
1777	{
1778	return 0;
1779	}
1780
1781	static inline void security_sctp_sk_clone(struct sctp_association *asoc,
1782	struct sock *sk,
1783	struct sock *newsk)
1784	{
1785	}
1786
1787	static inline int security_sctp_assoc_established(struct sctp_association *asoc,
1788	struct sk_buff *skb)
1789	{
1790	return 0;
1791	}
1792
1793	static inline int security_mptcp_add_subflow(struct sock *sk, struct sock *ssk)
1794	{
1795	return 0;
1796	}
1797	#endif /* CONFIG_SECURITY_NETWORK */
1798
1799	#ifdef CONFIG_SECURITY_INFINIBAND
1800	int security_ib_pkey_access(void *sec, u64 subnet_prefix, u16 pkey);
1801	int security_ib_endport_manage_subnet(void *sec, const char *name, u8 port_num);
1802	int security_ib_alloc_security(void **sec);
1803	void security_ib_free_security(void *sec);
1804	#else /* CONFIG_SECURITY_INFINIBAND */
1805	static inline int security_ib_pkey_access(void *sec, u64 subnet_prefix, u16 pkey)
1806	{
1807	return 0;
1808	}
1809
1810	static inline int security_ib_endport_manage_subnet(void *sec, const char *dev_name, u8 port_num)
1811	{
1812	return 0;
1813	}
1814
1815	static inline int security_ib_alloc_security(void **sec)
1816	{
1817	return 0;
1818	}
1819
1820	static inline void security_ib_free_security(void *sec)
1821	{
1822	}
1823	#endif /* CONFIG_SECURITY_INFINIBAND */
1824
1825	#ifdef CONFIG_SECURITY_NETWORK_XFRM
1826
1827	int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
1828	struct xfrm_user_sec_ctx *sec_ctx, gfp_t gfp);
1829	int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctxp);
1830	void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
1831	int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx);
1832	int security_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx);
1833	int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
1834	struct xfrm_sec_ctx *polsec, u32 secid);
1835	int security_xfrm_state_delete(struct xfrm_state *x);
1836	void security_xfrm_state_free(struct xfrm_state *x);
1837	int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid);
1838	int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
1839	struct xfrm_policy *xp,
1840	const struct flowi_common *flic);
1841	int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid);
1842	void security_skb_classify_flow(struct sk_buff *skb, struct flowi_common *flic);
1843
1844	#else /* CONFIG_SECURITY_NETWORK_XFRM */
1845
1846	static inline int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
1847	struct xfrm_user_sec_ctx *sec_ctx,
1848	gfp_t gfp)
1849	{
1850	return 0;
1851	}
1852
1853	static inline int security_xfrm_policy_clone(struct xfrm_sec_ctx *old, struct xfrm_sec_ctx **new_ctxp)
1854	{
1855	return 0;
1856	}
1857
1858	static inline void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
1859	{
1860	}
1861
1862	static inline int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
1863	{
1864	return 0;
1865	}
1866
1867	static inline int security_xfrm_state_alloc(struct xfrm_state *x,
1868	struct xfrm_user_sec_ctx *sec_ctx)
1869	{
1870	return 0;
1871	}
1872
1873	static inline int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
1874	struct xfrm_sec_ctx *polsec, u32 secid)
1875	{
1876	return 0;
1877	}
1878
1879	static inline void security_xfrm_state_free(struct xfrm_state *x)
1880	{
1881	}
1882
1883	static inline int security_xfrm_state_delete(struct xfrm_state *x)
1884	{
1885	return 0;
1886	}
1887
1888	static inline int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid)
1889	{
1890	return 0;
1891	}
1892
1893	static inline int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
1894	struct xfrm_policy *xp,
1895	const struct flowi_common *flic)
1896	{
1897	return 1;
1898	}
1899
1900	static inline int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
1901	{
1902	return 0;
1903	}
1904
1905	static inline void security_skb_classify_flow(struct sk_buff *skb,
1906	struct flowi_common *flic)
1907	{
1908	}
1909
1910	#endif /* CONFIG_SECURITY_NETWORK_XFRM */
1911
1912	#ifdef CONFIG_SECURITY_PATH
1913	int security_path_unlink(const struct path *dir, struct dentry *dentry);
1914	int security_path_mkdir(const struct path *dir, struct dentry *dentry, umode_t mode);
1915	int security_path_rmdir(const struct path *dir, struct dentry *dentry);
1916	int security_path_mknod(const struct path *dir, struct dentry *dentry, umode_t mode,
1917	unsigned int dev);
1918	void security_path_post_mknod(struct mnt_idmap *idmap, struct dentry *dentry);
1919	int security_path_truncate(const struct path *path);
1920	int security_path_symlink(const struct path *dir, struct dentry *dentry,
1921	const char *old_name);
1922	int security_path_link(struct dentry *old_dentry, const struct path *new_dir,
1923	struct dentry *new_dentry);
1924	int security_path_rename(const struct path *old_dir, struct dentry *old_dentry,
1925	const struct path *new_dir, struct dentry *new_dentry,
1926	unsigned int flags);
1927	int security_path_chmod(const struct path *path, umode_t mode);
1928	int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid);
1929	int security_path_chroot(const struct path *path);
1930	#else /* CONFIG_SECURITY_PATH */
1931	static inline int security_path_unlink(const struct path *dir, struct dentry *dentry)
1932	{
1933	return 0;
1934	}
1935
1936	static inline int security_path_mkdir(const struct path *dir, struct dentry *dentry,
1937	umode_t mode)
1938	{
1939	return 0;
1940	}
1941
1942	static inline int security_path_rmdir(const struct path *dir, struct dentry *dentry)
1943	{
1944	return 0;
1945	}
1946
1947	static inline int security_path_mknod(const struct path *dir, struct dentry *dentry,
1948	umode_t mode, unsigned int dev)
1949	{
1950	return 0;
1951	}
1952
1953	static inline void security_path_post_mknod(struct mnt_idmap *idmap,
1954	struct dentry *dentry)
1955	{ }
1956
1957	static inline int security_path_truncate(const struct path *path)
1958	{
1959	return 0;
1960	}
1961
1962	static inline int security_path_symlink(const struct path *dir, struct dentry *dentry,
1963	const char *old_name)
1964	{
1965	return 0;
1966	}
1967
1968	static inline int security_path_link(struct dentry *old_dentry,
1969	const struct path *new_dir,
1970	struct dentry *new_dentry)
1971	{
1972	return 0;
1973	}
1974
1975	static inline int security_path_rename(const struct path *old_dir,
1976	struct dentry *old_dentry,
1977	const struct path *new_dir,
1978	struct dentry *new_dentry,
1979	unsigned int flags)
1980	{
1981	return 0;
1982	}
1983
1984	static inline int security_path_chmod(const struct path *path, umode_t mode)
1985	{
1986	return 0;
1987	}
1988
1989	static inline int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
1990	{
1991	return 0;
1992	}
1993
1994	static inline int security_path_chroot(const struct path *path)
1995	{
1996	return 0;
1997	}
1998	#endif /* CONFIG_SECURITY_PATH */
1999
2000	#ifdef CONFIG_KEYS
2001	#ifdef CONFIG_SECURITY
2002
2003	int security_key_alloc(struct key *key, const struct cred *cred, unsigned long flags);
2004	void security_key_free(struct key *key);
2005	int security_key_permission(key_ref_t key_ref, const struct cred *cred,
2006	enum key_need_perm need_perm);
2007	int security_key_getsecurity(struct key *key, char **_buffer);
2008	void security_key_post_create_or_update(struct key *keyring, struct key *key,
2009	const void *payload, size_t payload_len,
2010	unsigned long flags, bool create);
2011
2012	#else
2013
2014	static inline int security_key_alloc(struct key *key,
2015	const struct cred *cred,
2016	unsigned long flags)
2017	{
2018	return 0;
2019	}
2020
2021	static inline void security_key_free(struct key *key)
2022	{
2023	}
2024
2025	static inline int security_key_permission(key_ref_t key_ref,
2026	const struct cred *cred,
2027	enum key_need_perm need_perm)
2028	{
2029	return 0;
2030	}
2031
2032	static inline int security_key_getsecurity(struct key *key, char **_buffer)
2033	{
2034	*_buffer = NULL;
2035	return 0;
2036	}
2037
2038	static inline void security_key_post_create_or_update(struct key *keyring,
2039	struct key *key,
2040	const void *payload,
2041	size_t payload_len,
2042	unsigned long flags,
2043	bool create)
2044	{ }
2045
2046	#endif
2047	#endif /* CONFIG_KEYS */
2048
2049	#ifdef CONFIG_AUDIT
2050	#ifdef CONFIG_SECURITY
2051	int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule);
2052	int security_audit_rule_known(struct audit_krule *krule);
2053	int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule);
2054	void security_audit_rule_free(void *lsmrule);
2055
2056	#else
2057
2058	static inline int security_audit_rule_init(u32 field, u32 op, char *rulestr,
2059	void **lsmrule)
2060	{
2061	return 0;
2062	}
2063
2064	static inline int security_audit_rule_known(struct audit_krule *krule)
2065	{
2066	return 0;
2067	}
2068
2069	static inline int security_audit_rule_match(u32 secid, u32 field, u32 op,
2070	void *lsmrule)
2071	{
2072	return 0;
2073	}
2074
2075	static inline void security_audit_rule_free(void *lsmrule)
2076	{ }
2077
2078	#endif /* CONFIG_SECURITY */
2079	#endif /* CONFIG_AUDIT */
2080
2081	#ifdef CONFIG_SECURITYFS
2082
2083	extern struct dentry *securityfs_create_file(const char *name, umode_t mode,
2084	struct dentry *parent, void *data,
2085	const struct file_operations *fops);
2086	extern struct dentry *securityfs_create_dir(const char *name, struct dentry *parent);
2087	struct dentry *securityfs_create_symlink(const char *name,
2088	struct dentry *parent,
2089	const char *target,
2090	const struct inode_operations *iops);
2091	extern void securityfs_remove(struct dentry *dentry);
2092
2093	#else /* CONFIG_SECURITYFS */
2094
2095	static inline struct dentry *securityfs_create_dir(const char *name,
2096	struct dentry *parent)
2097	{
2098	return ERR_PTR(-ENODEV);
2099	}
2100
2101	static inline struct dentry *securityfs_create_file(const char *name,
2102	umode_t mode,
2103	struct dentry *parent,
2104	void *data,
2105	const struct file_operations *fops)
2106	{
2107	return ERR_PTR(-ENODEV);
2108	}
2109
2110	static inline struct dentry *securityfs_create_symlink(const char *name,
2111	struct dentry *parent,
2112	const char *target,
2113	const struct inode_operations *iops)
2114	{
2115	return ERR_PTR(-ENODEV);
2116	}
2117
2118	static inline void securityfs_remove(struct dentry *dentry)
2119	{}
2120
2121	#endif
2122
2123	#ifdef CONFIG_BPF_SYSCALL
2124	union bpf_attr;
2125	struct bpf_map;
2126	struct bpf_prog;
2127	struct bpf_token;
2128	#ifdef CONFIG_SECURITY
2129	extern int security_bpf(int cmd, union bpf_attr *attr, unsigned int size);
2130	extern int security_bpf_map(struct bpf_map *map, fmode_t fmode);
2131	extern int security_bpf_prog(struct bpf_prog *prog);
2132	extern int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
2133	struct bpf_token *token);
2134	extern void security_bpf_map_free(struct bpf_map *map);
2135	extern int security_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,
2136	struct bpf_token *token);
2137	extern void security_bpf_prog_free(struct bpf_prog *prog);
2138	extern int security_bpf_token_create(struct bpf_token *token, union bpf_attr *attr,
2139	struct path *path);
2140	extern void security_bpf_token_free(struct bpf_token *token);
2141	extern int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cmd);
2142	extern int security_bpf_token_capable(const struct bpf_token *token, int cap);
2143	#else
2144	static inline int security_bpf(int cmd, union bpf_attr *attr,
2145	unsigned int size)
2146	{
2147	return 0;
2148	}
2149
2150	static inline int security_bpf_map(struct bpf_map *map, fmode_t fmode)
2151	{
2152	return 0;
2153	}
2154
2155	static inline int security_bpf_prog(struct bpf_prog *prog)
2156	{
2157	return 0;
2158	}
2159
2160	static inline int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
2161	struct bpf_token *token)
2162	{
2163	return 0;
2164	}
2165
2166	static inline void security_bpf_map_free(struct bpf_map *map)
2167	{ }
2168
2169	static inline int security_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,
2170	struct bpf_token *token)
2171	{
2172	return 0;
2173	}
2174
2175	static inline void security_bpf_prog_free(struct bpf_prog *prog)
2176	{ }
2177
2178	static inline int security_bpf_token_create(struct bpf_token *token, union bpf_attr *attr,
2179	struct path *path)
2180	{
2181	return 0;
2182	}
2183
2184	static inline void security_bpf_token_free(struct bpf_token *token)
2185	{ }
2186
2187	static inline int security_bpf_token_cmd(const struct bpf_token *token, enum bpf_cmd cmd)
2188	{
2189	return 0;
2190	}
2191
2192	static inline int security_bpf_token_capable(const struct bpf_token *token, int cap)
2193	{
2194	return 0;
2195	}
2196	#endif /* CONFIG_SECURITY */
2197	#endif /* CONFIG_BPF_SYSCALL */
2198
2199	#ifdef CONFIG_PERF_EVENTS
2200	struct perf_event_attr;
2201	struct perf_event;
2202
2203	#ifdef CONFIG_SECURITY
2204	extern int security_perf_event_open(struct perf_event_attr *attr, int type);
2205	extern int security_perf_event_alloc(struct perf_event *event);
2206	extern void security_perf_event_free(struct perf_event *event);
2207	extern int security_perf_event_read(struct perf_event *event);
2208	extern int security_perf_event_write(struct perf_event *event);
2209	#else
2210	static inline int security_perf_event_open(struct perf_event_attr *attr,
2211	int type)
2212	{
2213	return 0;
2214	}
2215
2216	static inline int security_perf_event_alloc(struct perf_event *event)
2217	{
2218	return 0;
2219	}
2220
2221	static inline void security_perf_event_free(struct perf_event *event)
2222	{
2223	}
2224
2225	static inline int security_perf_event_read(struct perf_event *event)
2226	{
2227	return 0;
2228	}
2229
2230	static inline int security_perf_event_write(struct perf_event *event)
2231	{
2232	return 0;
2233	}
2234	#endif /* CONFIG_SECURITY */
2235	#endif /* CONFIG_PERF_EVENTS */
2236
2237	#ifdef CONFIG_IO_URING
2238	#ifdef CONFIG_SECURITY
2239	extern int security_uring_override_creds(const struct cred *new);
2240	extern int security_uring_sqpoll(void);
2241	extern int security_uring_cmd(struct io_uring_cmd *ioucmd);
2242	#else
2243	static inline int security_uring_override_creds(const struct cred *new)
2244	{
2245	return 0;
2246	}
2247	static inline int security_uring_sqpoll(void)
2248	{
2249	return 0;
2250	}
2251	static inline int security_uring_cmd(struct io_uring_cmd *ioucmd)
2252	{
2253	return 0;
2254	}
2255	#endif /* CONFIG_SECURITY */
2256	#endif /* CONFIG_IO_URING */
2257
2258	#endif /* ! __LINUX_SECURITY_H */
2259