e24dd9ee53
Pull security layer updates from James Morris:
- a major update for AppArmor. From JJ:
* several bug fixes and cleanups
* the patch to add symlink support to securityfs that was floated
on the list earlier and the apparmorfs changes that make use of
securityfs symlinks
* it introduces the domain labeling base code that Ubuntu has been
carrying for several years, with several cleanups applied. And it
converts the current mediation over to using the domain labeling
base, which brings domain stacking support with it. This finally
will bring the base upstream code in line with Ubuntu and provide
a base to upstream the new feature work that Ubuntu carries.
* This does _not_ contain any of the newer apparmor mediation
features/controls (mount, signals, network, keys, ...) that
Ubuntu is currently carrying, all of which will be RFC'd on top
of this.
- Notable also is the Infiniband work in SELinux, and the new file:map
permission. From Paul:
"While we're down to 21 patches for v4.13 (it was 31 for v4.12),
the diffstat jumps up tremendously with over 2k of line changes.
Almost all of these changes are the SELinux/IB work done by
Daniel Jurgens; some other noteworthy changes include a NFS v4.2
labeling fix, a new file:map permission, and reporting of policy
capabilities on policy load"
There's also now genfscon labeling support for tracefs, which was
lost in v4.1 with the separation from debugfs.
- Smack incorporates a safer socket check in file_receive, and adds a
cap_capable call in privilege check.
- TPM as usual has a bunch of fixes and enhancements.
- Multiple calls to security_add_hooks() can now be made for the same
LSM, to allow LSMs to have hook declarations across multiple files.
- IMA now supports different "ima_appraise=" modes (eg. log, fix) from
the boot command line.
* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (126 commits)
apparmor: put back designators in struct initialisers
seccomp: Switch from atomic_t to recount_t
seccomp: Adjust selftests to avoid double-join
seccomp: Clean up core dump logic
IMA: update IMA policy documentation to include pcr= option
ima: Log the same audit cause whenever a file has no signature
ima: Simplify policy_func_show.
integrity: Small code improvements
ima: fix get_binary_runtime_size()
ima: use ima_parse_buf() to parse template data
ima: use ima_parse_buf() to parse measurements headers
ima: introduce ima_parse_buf()
ima: Add cgroups2 to the defaults list
ima: use memdup_user_nul
ima: fix up #endif comments
IMA: Correct Kconfig dependencies for hash selection
ima: define is_ima_appraise_enabled()
ima: define Kconfig IMA_APPRAISE_BOOTPARAM option
ima: define a set of appraisal rules requiring file signatures
ima: extend the "ima_policy" boot command line to support multiple policies
...
305 lines
8.9 KiB
C
305 lines
8.9 KiB
C
/*
|
|
* Copyright (c) 2004 Topspin Communications. All rights reserved.
|
|
*
|
|
* This software is available to you under a choice of one of two
|
|
* licenses. You may choose to be licensed under the terms of the GNU
|
|
* General Public License (GPL) Version 2, available from the file
|
|
* COPYING in the main directory of this source tree, or the
|
|
* OpenIB.org BSD license below:
|
|
*
|
|
* Redistribution and use in source and binary forms, with or
|
|
* without modification, are permitted provided that the following
|
|
* conditions are met:
|
|
*
|
|
* - Redistributions of source code must retain the above
|
|
* copyright notice, this list of conditions and the following
|
|
* disclaimer.
|
|
*
|
|
* - Redistributions in binary form must reproduce the above
|
|
* copyright notice, this list of conditions and the following
|
|
* disclaimer in the documentation and/or other materials
|
|
* provided with the distribution.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
|
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
|
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
|
|
* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
|
|
* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
|
|
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
* SOFTWARE.
|
|
*/
|
|
|
|
#ifndef _CORE_PRIV_H
|
|
#define _CORE_PRIV_H
|
|
|
|
#include <linux/list.h>
|
|
#include <linux/spinlock.h>
|
|
#include <linux/cgroup_rdma.h>
|
|
|
|
#include <rdma/ib_verbs.h>
|
|
#include <rdma/ib_mad.h>
|
|
#include "mad_priv.h"
|
|
|
|
struct pkey_index_qp_list {
|
|
struct list_head pkey_index_list;
|
|
u16 pkey_index;
|
|
/* Lock to hold while iterating the qp_list. */
|
|
spinlock_t qp_list_lock;
|
|
struct list_head qp_list;
|
|
};
|
|
|
|
#if IS_ENABLED(CONFIG_INFINIBAND_ADDR_TRANS_CONFIGFS)
|
|
int cma_configfs_init(void);
|
|
void cma_configfs_exit(void);
|
|
#else
|
|
static inline int cma_configfs_init(void)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline void cma_configfs_exit(void)
|
|
{
|
|
}
|
|
#endif
|
|
struct cma_device;
|
|
void cma_ref_dev(struct cma_device *cma_dev);
|
|
void cma_deref_dev(struct cma_device *cma_dev);
|
|
typedef bool (*cma_device_filter)(struct ib_device *, void *);
|
|
struct cma_device *cma_enum_devices_by_ibdev(cma_device_filter filter,
|
|
void *cookie);
|
|
int cma_get_default_gid_type(struct cma_device *cma_dev,
|
|
unsigned int port);
|
|
int cma_set_default_gid_type(struct cma_device *cma_dev,
|
|
unsigned int port,
|
|
enum ib_gid_type default_gid_type);
|
|
int cma_get_default_roce_tos(struct cma_device *cma_dev, unsigned int port);
|
|
int cma_set_default_roce_tos(struct cma_device *a_dev, unsigned int port,
|
|
u8 default_roce_tos);
|
|
struct ib_device *cma_get_ib_dev(struct cma_device *cma_dev);
|
|
|
|
int ib_device_register_sysfs(struct ib_device *device,
|
|
int (*port_callback)(struct ib_device *,
|
|
u8, struct kobject *));
|
|
void ib_device_unregister_sysfs(struct ib_device *device);
|
|
|
|
void ib_cache_setup(void);
|
|
void ib_cache_cleanup(void);
|
|
|
|
typedef void (*roce_netdev_callback)(struct ib_device *device, u8 port,
|
|
struct net_device *idev, void *cookie);
|
|
|
|
typedef int (*roce_netdev_filter)(struct ib_device *device, u8 port,
|
|
struct net_device *idev, void *cookie);
|
|
|
|
void ib_enum_roce_netdev(struct ib_device *ib_dev,
|
|
roce_netdev_filter filter,
|
|
void *filter_cookie,
|
|
roce_netdev_callback cb,
|
|
void *cookie);
|
|
void ib_enum_all_roce_netdevs(roce_netdev_filter filter,
|
|
void *filter_cookie,
|
|
roce_netdev_callback cb,
|
|
void *cookie);
|
|
|
|
enum ib_cache_gid_default_mode {
|
|
IB_CACHE_GID_DEFAULT_MODE_SET,
|
|
IB_CACHE_GID_DEFAULT_MODE_DELETE
|
|
};
|
|
|
|
int ib_cache_gid_parse_type_str(const char *buf);
|
|
|
|
const char *ib_cache_gid_type_str(enum ib_gid_type gid_type);
|
|
|
|
void ib_cache_gid_set_default_gid(struct ib_device *ib_dev, u8 port,
|
|
struct net_device *ndev,
|
|
unsigned long gid_type_mask,
|
|
enum ib_cache_gid_default_mode mode);
|
|
|
|
int ib_cache_gid_add(struct ib_device *ib_dev, u8 port,
|
|
union ib_gid *gid, struct ib_gid_attr *attr);
|
|
|
|
int ib_cache_gid_del(struct ib_device *ib_dev, u8 port,
|
|
union ib_gid *gid, struct ib_gid_attr *attr);
|
|
|
|
int ib_cache_gid_del_all_netdev_gids(struct ib_device *ib_dev, u8 port,
|
|
struct net_device *ndev);
|
|
|
|
int roce_gid_mgmt_init(void);
|
|
void roce_gid_mgmt_cleanup(void);
|
|
|
|
int roce_rescan_device(struct ib_device *ib_dev);
|
|
unsigned long roce_gid_type_mask_support(struct ib_device *ib_dev, u8 port);
|
|
|
|
int ib_cache_setup_one(struct ib_device *device);
|
|
void ib_cache_cleanup_one(struct ib_device *device);
|
|
void ib_cache_release_one(struct ib_device *device);
|
|
|
|
#ifdef CONFIG_CGROUP_RDMA
|
|
int ib_device_register_rdmacg(struct ib_device *device);
|
|
void ib_device_unregister_rdmacg(struct ib_device *device);
|
|
|
|
int ib_rdmacg_try_charge(struct ib_rdmacg_object *cg_obj,
|
|
struct ib_device *device,
|
|
enum rdmacg_resource_type resource_index);
|
|
|
|
void ib_rdmacg_uncharge(struct ib_rdmacg_object *cg_obj,
|
|
struct ib_device *device,
|
|
enum rdmacg_resource_type resource_index);
|
|
#else
|
|
static inline int ib_device_register_rdmacg(struct ib_device *device)
|
|
{ return 0; }
|
|
|
|
static inline void ib_device_unregister_rdmacg(struct ib_device *device)
|
|
{ }
|
|
|
|
static inline int ib_rdmacg_try_charge(struct ib_rdmacg_object *cg_obj,
|
|
struct ib_device *device,
|
|
enum rdmacg_resource_type resource_index)
|
|
{ return 0; }
|
|
|
|
static inline void ib_rdmacg_uncharge(struct ib_rdmacg_object *cg_obj,
|
|
struct ib_device *device,
|
|
enum rdmacg_resource_type resource_index)
|
|
{ }
|
|
#endif
|
|
|
|
static inline bool rdma_is_upper_dev_rcu(struct net_device *dev,
|
|
struct net_device *upper)
|
|
{
|
|
return netdev_has_upper_dev_all_rcu(dev, upper);
|
|
}
|
|
|
|
int addr_init(void);
|
|
void addr_cleanup(void);
|
|
|
|
int ib_mad_init(void);
|
|
void ib_mad_cleanup(void);
|
|
|
|
int ib_sa_init(void);
|
|
void ib_sa_cleanup(void);
|
|
|
|
int ibnl_init(void);
|
|
void ibnl_cleanup(void);
|
|
|
|
/**
|
|
* Check if there are any listeners to the netlink group
|
|
* @group: the netlink group ID
|
|
* Returns 0 on success or a negative for no listeners.
|
|
*/
|
|
int ibnl_chk_listeners(unsigned int group);
|
|
|
|
int ib_nl_handle_resolve_resp(struct sk_buff *skb,
|
|
struct netlink_callback *cb);
|
|
int ib_nl_handle_set_timeout(struct sk_buff *skb,
|
|
struct netlink_callback *cb);
|
|
int ib_nl_handle_ip_res_resp(struct sk_buff *skb,
|
|
struct netlink_callback *cb);
|
|
|
|
int ib_get_cached_subnet_prefix(struct ib_device *device,
|
|
u8 port_num,
|
|
u64 *sn_pfx);
|
|
|
|
#ifdef CONFIG_SECURITY_INFINIBAND
|
|
int ib_security_pkey_access(struct ib_device *dev,
|
|
u8 port_num,
|
|
u16 pkey_index,
|
|
void *sec);
|
|
|
|
void ib_security_destroy_port_pkey_list(struct ib_device *device);
|
|
|
|
void ib_security_cache_change(struct ib_device *device,
|
|
u8 port_num,
|
|
u64 subnet_prefix);
|
|
|
|
int ib_security_modify_qp(struct ib_qp *qp,
|
|
struct ib_qp_attr *qp_attr,
|
|
int qp_attr_mask,
|
|
struct ib_udata *udata);
|
|
|
|
int ib_create_qp_security(struct ib_qp *qp, struct ib_device *dev);
|
|
void ib_destroy_qp_security_begin(struct ib_qp_security *sec);
|
|
void ib_destroy_qp_security_abort(struct ib_qp_security *sec);
|
|
void ib_destroy_qp_security_end(struct ib_qp_security *sec);
|
|
int ib_open_shared_qp_security(struct ib_qp *qp, struct ib_device *dev);
|
|
void ib_close_shared_qp_security(struct ib_qp_security *sec);
|
|
int ib_mad_agent_security_setup(struct ib_mad_agent *agent,
|
|
enum ib_qp_type qp_type);
|
|
void ib_mad_agent_security_cleanup(struct ib_mad_agent *agent);
|
|
int ib_mad_enforce_security(struct ib_mad_agent_private *map, u16 pkey_index);
|
|
#else
|
|
static inline int ib_security_pkey_access(struct ib_device *dev,
|
|
u8 port_num,
|
|
u16 pkey_index,
|
|
void *sec)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline void ib_security_destroy_port_pkey_list(struct ib_device *device)
|
|
{
|
|
}
|
|
|
|
static inline void ib_security_cache_change(struct ib_device *device,
|
|
u8 port_num,
|
|
u64 subnet_prefix)
|
|
{
|
|
}
|
|
|
|
static inline int ib_security_modify_qp(struct ib_qp *qp,
|
|
struct ib_qp_attr *qp_attr,
|
|
int qp_attr_mask,
|
|
struct ib_udata *udata)
|
|
{
|
|
return qp->device->modify_qp(qp->real_qp,
|
|
qp_attr,
|
|
qp_attr_mask,
|
|
udata);
|
|
}
|
|
|
|
static inline int ib_create_qp_security(struct ib_qp *qp,
|
|
struct ib_device *dev)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline void ib_destroy_qp_security_begin(struct ib_qp_security *sec)
|
|
{
|
|
}
|
|
|
|
static inline void ib_destroy_qp_security_abort(struct ib_qp_security *sec)
|
|
{
|
|
}
|
|
|
|
static inline void ib_destroy_qp_security_end(struct ib_qp_security *sec)
|
|
{
|
|
}
|
|
|
|
static inline int ib_open_shared_qp_security(struct ib_qp *qp,
|
|
struct ib_device *dev)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline void ib_close_shared_qp_security(struct ib_qp_security *sec)
|
|
{
|
|
}
|
|
|
|
static inline int ib_mad_agent_security_setup(struct ib_mad_agent *agent,
|
|
enum ib_qp_type qp_type)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline void ib_mad_agent_security_cleanup(struct ib_mad_agent *agent)
|
|
{
|
|
}
|
|
|
|
static inline int ib_mad_enforce_security(struct ib_mad_agent_private *map,
|
|
u16 pkey_index)
|
|
{
|
|
return 0;
|
|
}
|
|
#endif
|
|
#endif /* _CORE_PRIV_H */
|