[PATCH] Remove ->rq_status from struct request

[safe/jmp/linux-2.6] / include / linux / security.h

diff --git a/include/linux/security.h b/include/linux/security.h
index f3909d1..9b5fea8 100644 (file)
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -90,6 +90,7 @@ extern int cap_netlink_recv(struct sk_buff *skb, int cap);
 struct nfsctl_arg;
 struct sched_param;
 struct swap_info_struct;
+struct request_sock;
 
 /* bprm_apply_creds unsafe reasons */
 #define LSM_UNSAFE_SHARE       1
@@ -819,6 +820,14 @@ struct swap_info_struct;
  * @sk_getsecid:
  *     Retrieve the LSM-specific secid for the sock to enable caching of network
  *     authorizations.
+ * @sock_graft:
+ *     Sets the socket's isec sid to the sock's sid.
+ * @inet_conn_request:
+ *     Sets the openreq's sid to socket's sid with MLS portion taken from peer sid.
+ * @inet_csk_clone:
+ *     Sets the new child socket's sid to the openreq sid.
+ * @req_classify_flow:
+ *     Sets the flow's sid to the openreq sid.
  *
  * Security hooks for XFRM operations.
  *
@@ -827,8 +836,10 @@ struct swap_info_struct;
  *     used by the XFRM system.
  *     @sec_ctx contains the security context information being provided by
  *     the user-level policy update program (e.g., setkey).
+ *     @sk refers to the sock from which to derive the security context.
  *     Allocate a security structure to the xp->security field; the security
- *     field is initialized to NULL when the xfrm_policy is allocated.
+ *     field is initialized to NULL when the xfrm_policy is allocated. Only
+ *     one of sec_ctx or sock can be specified.
  *     Return 0 if operation was successful (memory to allocate, legal context)
  * @xfrm_policy_clone_security:
  *     @old contains an existing xfrm_policy in the SPD.
@@ -1330,8 +1341,8 @@ struct security_operations {
        int (*unix_may_send) (struct socket * sock, struct socket * other);
 
        int (*socket_create) (int family, int type, int protocol, int kern);
-       void (*socket_post_create) (struct socket * sock, int family,
-                                   int type, int protocol, int kern);
+       int (*socket_post_create) (struct socket * sock, int family,
+                                  int type, int protocol, int kern);
        int (*socket_bind) (struct socket * sock,
                            struct sockaddr * address, int addrlen);
        int (*socket_connect) (struct socket * sock,
@@ -1356,10 +1367,16 @@ struct security_operations {
        void (*sk_free_security) (struct sock *sk);
        void (*sk_clone_security) (const struct sock *sk, struct sock *newsk);
        void (*sk_getsecid) (struct sock *sk, u32 *secid);
+       void (*sock_graft)(struct sock* sk, struct socket *parent);
+       int (*inet_conn_request)(struct sock *sk, struct sk_buff *skb,
+                                       struct request_sock *req);
+       void (*inet_csk_clone)(struct sock *newsk, const struct request_sock *req);
+       void (*req_classify_flow)(const struct request_sock *req, struct flowi *fl);
 #endif /* CONFIG_SECURITY_NETWORK */
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
-       int (*xfrm_policy_alloc_security) (struct xfrm_policy *xp, struct xfrm_user_sec_ctx *sec_ctx);
+       int (*xfrm_policy_alloc_security) (struct xfrm_policy *xp,
+                       struct xfrm_user_sec_ctx *sec_ctx, struct sock *sk);
        int (*xfrm_policy_clone_security) (struct xfrm_policy *old, struct xfrm_policy *new);
        void (*xfrm_policy_free_security) (struct xfrm_policy *xp);
        int (*xfrm_policy_delete_security) (struct xfrm_policy *xp);
@@ -1578,6 +1595,7 @@ static inline void security_sb_post_pivotroot (struct nameidata *old_nd,
 
 static inline int security_inode_alloc (struct inode *inode)
 {
+       inode->i_security = NULL;
        return security_ops->inode_alloc_security (inode);
 }
 
@@ -2807,13 +2825,13 @@ static inline int security_socket_create (int family, int type,
        return security_ops->socket_create(family, type, protocol, kern);
 }
 
-static inline void security_socket_post_create(struct socket * sock, 
-                                              int family,
-                                              int type, 
-                                              int protocol, int kern)
+static inline int security_socket_post_create(struct socket * sock,
+                                             int family,
+                                             int type,
+                                             int protocol, int kern)
 {
-       security_ops->socket_post_create(sock, family, type,
-                                        protocol, kern);
+       return security_ops->socket_post_create(sock, family, type,
+                                               protocol, kern);
 }
 
 static inline int security_socket_bind(struct socket * sock, 
@@ -2923,6 +2941,28 @@ static inline void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
 {
        security_ops->sk_getsecid(sk, &fl->secid);
 }
+
+static inline void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
+{
+       security_ops->req_classify_flow(req, fl);
+}
+
+static inline void security_sock_graft(struct sock* sk, struct socket *parent)
+{
+       security_ops->sock_graft(sk, parent);
+}
+
+static inline int security_inet_conn_request(struct sock *sk,
+                       struct sk_buff *skb, struct request_sock *req)
+{
+       return security_ops->inet_conn_request(sk, skb, req);
+}
+
+static inline void security_inet_csk_clone(struct sock *newsk,
+                       const struct request_sock *req)
+{
+       security_ops->inet_csk_clone(newsk, req);
+}
 #else  /* CONFIG_SECURITY_NETWORK */
 static inline int security_unix_stream_connect(struct socket * sock,
                                               struct socket * other, 
@@ -2943,11 +2983,12 @@ static inline int security_socket_create (int family, int type,
        return 0;
 }
 
-static inline void security_socket_post_create(struct socket * sock, 
-                                              int family,
-                                              int type, 
-                                              int protocol, int kern)
+static inline int security_socket_post_create(struct socket * sock,
+                                             int family,
+                                             int type,
+                                             int protocol, int kern)
 {
+       return 0;
 }
 
 static inline int security_socket_bind(struct socket * sock, 
@@ -3052,12 +3093,36 @@ static inline void security_sk_clone(const struct sock *sk, struct sock *newsk)
 static inline void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
 {
 }
+
+static inline void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
+{
+}
+
+static inline void security_sock_graft(struct sock* sk, struct socket *parent)
+{
+}
+
+static inline int security_inet_conn_request(struct sock *sk,
+                       struct sk_buff *skb, struct request_sock *req)
+{
+       return 0;
+}
+
+static inline void security_inet_csk_clone(struct sock *newsk,
+                       const struct request_sock *req)
+{
+}
 #endif /* CONFIG_SECURITY_NETWORK */
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
 static inline int security_xfrm_policy_alloc(struct xfrm_policy *xp, struct xfrm_user_sec_ctx *sec_ctx)
 {
-       return security_ops->xfrm_policy_alloc_security(xp, sec_ctx);
+       return security_ops->xfrm_policy_alloc_security(xp, sec_ctx, NULL);
+}
+
+static inline int security_xfrm_sock_policy_alloc(struct xfrm_policy *xp, struct sock *sk)
+{
+       return security_ops->xfrm_policy_alloc_security(xp, NULL, sk);
 }
 
 static inline int security_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new)
@@ -3132,6 +3197,11 @@ static inline int security_xfrm_policy_alloc(struct xfrm_policy *xp, struct xfrm
        return 0;
 }
 
+static inline int security_xfrm_sock_policy_alloc(struct xfrm_policy *xp, struct sock *sk)
+{
+       return 0;
+}
+
 static inline int security_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new)
 {
        return 0;