security_operations结构体

概述

Linux内核提供了一种灵活的安全模块框架，使得开发人员可以方便地实现自定义的安全策略。其中一个重要的数据结构就是"security_operations"。这个结构体定义在<linux/security.h>头文件中。

在Linux内核中，安全模块是一种动态加载的内核模块，用于实现自定义的安全策略。安全模块框架提供了一组安全钩子函数（security hooks），在内核执行关键操作时调用这些函数，以实现自定义安全策略的执行。

安全钩子函数是一组函数指针，它们指向安全模块所实现的自定义安全策略。当内核执行关键操作时，会调用相应的安全钩子函数，以检查是否允许该操作执行。如果安全钩子函数返回0，则表示允许该操作执行；如果返回非0，则表示拒绝该操作执行。

部分成员介绍

该结构体包含了多个安全钩子函数指针，这些指针用于注册安全模块的自定义安全策略。下面是部分成员的主要作用：

• “name”：表示安全模块的名称，类型是"char *"。这个名称将在内核中用于唯一标识安全模块，并与其他安全模块区分开来。

• “inode_permission”：表示对文件或目录进行权限检查时要执行的安全钩子函数，类型是"int (*inode_permission)(struct inode *, int)"。这个函数将在访问文件或目录时被调用，用于执行自定义的安全策略。

• “file_permission”：表示对文件进行权限检查时要执行的安全钩子函数，类型是"int (*file_permission)(struct file *, int)"。这个函数将在打开文件时被调用，用于执行自定义的安全策略。

• “task_create”：表示创建新进程时要执行的安全钩子函数，类型是"int (*task_create)(unsigned long)"。这个函数将在创建新进程时被调用，用于执行自定义的安全策略。

• “cred_prepare”：表示准备新的进程凭证时要执行的安全钩子函数，类型是"int (*cred_prepare)(struct cred *)"。这个函数将在新的进程凭证被创建时被调用，用于执行自定义的安全策略。

• “cred_transfer”：表示进程凭证转移时要执行的安全钩子函数，类型是"void (*cred_transfer)(struct cred *, struct cred *)"。这个函数将在进程凭证被转移时被调用，用于执行自定义的安全策略。

• “sb_mount”：表示挂载文件系统时要执行的安全钩子函数，类型是"int (*sb_mount)(const char *, const struct path *, const char *, unsigned long, void *)"。这个函数将在文件系统挂载时被调用，用于执行自定义的安全策略。

• “sb_umount”：表示卸载文件系统时要执行的安全钩子函数，类型是"int (*sb_umount)(struct vfsmount *, int)"。这个函数将在文件系统卸载时被调用，用于执行自定义的安全策略。

• “bprm_check_security”：表示在执行可执行文件时要执行的安全钩子函数，类型是"int (*bprm_check_security)(struct linux_binprm *)"。这个函数将在执行可执行文件时被调用，用于执行自定义的安全策略。

• “file_ioctl”：表示处理文件I/O控制命令时要执行的安全钩子函数，类型是"long (*file_ioctl)(struct file *, unsigned int, unsigned long)"。这个函数将在处理文件I/O控制命令时被调用，用于执行自定义的安全策略。

security_operations结构体源代码

1378 struct security_operations {
1379     char name[SECURITY_NAME_MAX + 1];
1380 
1381     int (*ptrace_access_check) (struct task_struct *child, unsigned int mode);
1382     int (*ptrace_traceme) (struct task_struct *parent);
1383     int (*capget) (struct task_struct *target,
1384                kernel_cap_t *effective,
1385                kernel_cap_t *inheritable, kernel_cap_t *permitted);
1386     int (*capset) (struct cred *new,
1387                const struct cred *old,
1388                const kernel_cap_t *effective,
1389                const kernel_cap_t *inheritable,
1390                const kernel_cap_t *permitted);
1391     int (*capable) (struct task_struct *tsk, const struct cred *cred,
1392             struct user_namespace *ns, int cap, int audit);
1393     int (*quotactl) (int cmds, int type, int id, struct super_block *sb);
1394     int (*quota_on) (struct dentry *dentry);
1395     int (*syslog) (int type);
1396     int (*settime) (const struct timespec *ts, const struct timezone *tz);
1397     int (*vm_enough_memory) (struct mm_struct *mm, long pages);
1398 
1399     int (*bprm_set_creds) (struct linux_binprm *bprm);
1400     int (*bprm_check_security) (struct linux_binprm *bprm);
1401     int (*bprm_secureexec) (struct linux_binprm *bprm);
1402     void (*bprm_committing_creds) (struct linux_binprm *bprm);
1403     void (*bprm_committed_creds) (struct linux_binprm *bprm);
1404 
1405     int (*sb_alloc_security) (struct super_block *sb);
1406     void (*sb_free_security) (struct super_block *sb);
1407     int (*sb_copy_data) (char *orig, char *copy);
1408     int (*sb_remount) (struct super_block *sb, void *data);
1409     int (*sb_kern_mount) (struct super_block *sb, int flags, void *data);
1410     int (*sb_show_options) (struct seq_file *m, struct super_block *sb);
1411     int (*sb_statfs) (struct dentry *dentry);
1412     int (*sb_mount) (char *dev_name, struct path *path,
1413              char *type, unsigned long flags, void *data);
1414     int (*sb_umount) (struct vfsmount *mnt, int flags);
1415     int (*sb_pivotroot) (struct path *old_path,
1416                  struct path *new_path);
1417     int (*sb_set_mnt_opts) (struct super_block *sb,
1418                 struct security_mnt_opts *opts);
1419     void (*sb_clone_mnt_opts) (const struct super_block *oldsb,
1420                    struct super_block *newsb);
1421     int (*sb_parse_opts_str) (char *options, struct security_mnt_opts *opts);
1422 
1423 #ifdef CONFIG_SECURITY_PATH
1424     int (*path_unlink) (struct path *dir, struct dentry *dentry);
1425     int (*path_mkdir) (struct path *dir, struct dentry *dentry, int mode);
1426     int (*path_rmdir) (struct path *dir, struct dentry *dentry);
1427     int (*path_mknod) (struct path *dir, struct dentry *dentry, int mode,
1428                unsigned int dev);
1429     int (*path_truncate) (struct path *path);
1430     int (*path_symlink) (struct path *dir, struct dentry *dentry,
1431                  const char *old_name);
1432     int (*path_link) (struct dentry *old_dentry, struct path *new_dir,
1433               struct dentry *new_dentry);
1434     int (*path_rename) (struct path *old_dir, struct dentry *old_dentry,
1435                 struct path *new_dir, struct dentry *new_dentry);
1436     int (*path_chmod) (struct dentry *dentry, struct vfsmount *mnt,
1437                mode_t mode);
1438     int (*path_chown) (struct path *path, uid_t uid, gid_t gid);
1439     int (*path_chroot) (struct path *path);
1440 #endif
1441 
1442     int (*inode_alloc_security) (struct inode *inode);
1443     void (*inode_free_security) (struct inode *inode);
1444     int (*inode_init_security) (struct inode *inode, struct inode *dir,
1445                     const struct qstr *qstr, char **name,
1446                     void **value, size_t *len);
1447     int (*inode_create) (struct inode *dir,
1448                  struct dentry *dentry, int mode);
1449     int (*inode_link) (struct dentry *old_dentry,
1450                struct inode *dir, struct dentry *new_dentry);
1451     int (*inode_unlink) (struct inode *dir, struct dentry *dentry);
1452     int (*inode_symlink) (struct inode *dir,
1453                   struct dentry *dentry, const char *old_name);
1454     int (*inode_mkdir) (struct inode *dir, struct dentry *dentry, int mode);
1455     int (*inode_rmdir) (struct inode *dir, struct dentry *dentry);
1456     int (*inode_mknod) (struct inode *dir, struct dentry *dentry,
1457                 int mode, dev_t dev);
1458     int (*inode_rename) (struct inode *old_dir, struct dentry *old_dentry,
1459                  struct inode *new_dir, struct dentry *new_dentry);
1460     int (*inode_readlink) (struct dentry *dentry);
1461     int (*inode_follow_link) (struct dentry *dentry, struct nameidata *nd);
1462     int (*inode_permission) (struct inode *inode, int mask, unsigned flags);
1463     int (*inode_setattr)    (struct dentry *dentry, struct iattr *attr);
1464     int (*inode_getattr) (struct vfsmount *mnt, struct dentry *dentry);
1465     int (*inode_setxattr) (struct dentry *dentry, const char *name,
1466                    const void *value, size_t size, int flags);
1467     void (*inode_post_setxattr) (struct dentry *dentry, const char *name,
1468                      const void *value, size_t size, int flags);
1469     int (*inode_getxattr) (struct dentry *dentry, const char *name);
1470     int (*inode_listxattr) (struct dentry *dentry);
1471     int (*inode_removexattr) (struct dentry *dentry, const char *name);
1472     int (*inode_need_killpriv) (struct dentry *dentry);
1473     int (*inode_killpriv) (struct dentry *dentry);
1474     int (*inode_getsecurity) (const struct inode *inode, const char *name, void **buffer, bool alloc);
1475     int (*inode_setsecurity) (struct inode *inode, const char *name, const void *value, size_t size, int fla     gs);
1476     int (*inode_listsecurity) (struct inode *inode, char *buffer, size_t buffer_size);
1477     void (*inode_getsecid) (const struct inode *inode, u32 *secid);
1478 
1479     int (*file_permission) (struct file *file, int mask);
1480     int (*file_alloc_security) (struct file *file);
1481     void (*file_free_security) (struct file *file);
1482     int (*file_ioctl) (struct file *file, unsigned int cmd,
1483                unsigned long arg);
1484     int (*file_mmap) (struct file *file,
1485               unsigned long reqprot, unsigned long prot,
1486               unsigned long flags, unsigned long addr,
1487               unsigned long addr_only);
1488     int (*file_mprotect) (struct vm_area_struct *vma,
1489                   unsigned long reqprot,
1490                   unsigned long prot);
1491     int (*file_lock) (struct file *file, unsigned int cmd);
1492     int (*file_fcntl) (struct file *file, unsigned int cmd,
1493                unsigned long arg);
1494     int (*file_set_fowner) (struct file *file);
1495     int (*file_send_sigiotask) (struct task_struct *tsk,
1496                     struct fown_struct *fown, int sig);
1497     int (*file_receive) (struct file *file);
1498     int (*dentry_open) (struct file *file, const struct cred *cred);
1499 
1500     int (*task_create) (unsigned long clone_flags);
1501     void (*task_free) (struct task_struct *task);
1502     int (*cred_alloc_blank) (struct cred *cred, gfp_t gfp);
1503     void (*cred_free) (struct cred *cred);
1504     int (*cred_prepare)(struct cred *new, const struct cred *old,
1505                 gfp_t gfp);
1506     void (*cred_transfer)(struct cred *new, const struct cred *old);
1507     int (*kernel_act_as)(struct cred *new, u32 secid);
1508     int (*kernel_create_files_as)(struct cred *new, struct inode *inode);
1509     int (*kernel_module_request)(char *kmod_name);
1510     int (*task_fix_setuid) (struct cred *new, const struct cred *old,
1511                 int flags);
1512     int (*task_setpgid) (struct task_struct *p, pid_t pgid);
1513     int (*task_getpgid) (struct task_struct *p);
1514     int (*task_getsid) (struct task_struct *p);
1515     void (*task_getsecid) (struct task_struct *p, u32 *secid);
1516     int (*task_setnice) (struct task_struct *p, int nice);
1517     int (*task_setioprio) (struct task_struct *p, int ioprio);
1518     int (*task_getioprio) (struct task_struct *p);
1519     int (*task_setrlimit) (struct task_struct *p, unsigned int resource,
1520             struct rlimit *new_rlim);
1521     int (*task_setscheduler) (struct task_struct *p);
1522     int (*task_getscheduler) (struct task_struct *p);
1523     int (*task_movememory) (struct task_struct *p);
1524     int (*task_kill) (struct task_struct *p,
1525               struct siginfo *info, int sig, u32 secid);
1526     int (*task_wait) (struct task_struct *p);
1527     int (*task_prctl) (int option, unsigned long arg2,
1528                unsigned long arg3, unsigned long arg4,
1529                unsigned long arg5);
1530     void (*task_to_inode) (struct task_struct *p, struct inode *inode);
1531 
1532     int (*ipc_permission) (struct kern_ipc_perm *ipcp, short flag);
1533     void (*ipc_getsecid) (struct kern_ipc_perm *ipcp, u32 *secid);
1534 
1535     int (*msg_msg_alloc_security) (struct msg_msg *msg);
1536     void (*msg_msg_free_security) (struct msg_msg *msg);
1537 
1538     int (*msg_queue_alloc_security) (struct msg_queue *msq);
1539     void (*msg_queue_free_security) (struct msg_queue *msq);
1540     int (*msg_queue_associate) (struct msg_queue *msq, int msqflg);
1541     int (*msg_queue_msgctl) (struct msg_queue *msq, int cmd);
1542     int (*msg_queue_msgsnd) (struct msg_queue *msq,
1543                  struct msg_msg *msg, int msqflg);
1544     int (*msg_queue_msgrcv) (struct msg_queue *msq,
1545                  struct msg_msg *msg,
1546                  struct task_struct *target,
1547                  long type, int mode);
1548 
1549     int (*shm_alloc_security) (struct shmid_kernel *shp);
1550     void (*shm_free_security) (struct shmid_kernel *shp);
1551     int (*shm_associate) (struct shmid_kernel *shp, int shmflg);
1552     int (*shm_shmctl) (struct shmid_kernel *shp, int cmd);
1553     int (*shm_shmat) (struct shmid_kernel *shp,
1554               char __user *shmaddr, int shmflg);
1555 
1556     int (*sem_alloc_security) (struct sem_array *sma);
1557     void (*sem_free_security) (struct sem_array *sma);
1558     int (*sem_associate) (struct sem_array *sma, int semflg);
1559     int (*sem_semctl) (struct sem_array *sma, int cmd);
1560     int (*sem_semop) (struct sem_array *sma,
1561               struct sembuf *sops, unsigned nsops, int alter);
1562 
1563     int (*netlink_send) (struct sock *sk, struct sk_buff *skb);
1564     int (*netlink_recv) (struct sk_buff *skb, int cap);
1565 
1566     void (*d_instantiate) (struct dentry *dentry, struct inode *inode);
1567 
1568     int (*getprocattr) (struct task_struct *p, char *name, char **value);
1569     int (*setprocattr) (struct task_struct *p, char *name, void *value, size_t size);
1570     int (*secid_to_secctx) (u32 secid, char **secdata, u32 *seclen);
1571     int (*secctx_to_secid) (const char *secdata, u32 seclen, u32 *secid);
1572     void (*release_secctx) (char *secdata, u32 seclen);
1573 
1574     int (*inode_notifysecctx)(struct inode *inode, void *ctx, u32 ctxlen);
1575     int (*inode_setsecctx)(struct dentry *dentry, void *ctx, u32 ctxlen);
1576     int (*inode_getsecctx)(struct inode *inode, void **ctx, u32 *ctxlen);
1577 
1578 #ifdef CONFIG_SECURITY_NETWORK
1579     int (*unix_stream_connect) (struct sock *sock, struct sock *other, struct sock *newsk);
1580     int (*unix_may_send) (struct socket *sock, struct socket *other);
1581 
1582     int (*socket_create) (int family, int type, int protocol, int kern);
1583     int (*socket_post_create) (struct socket *sock, int family,
1584                    int type, int protocol, int kern);
1585     int (*socket_bind) (struct socket *sock,
1586                 struct sockaddr *address, int addrlen);
1587     int (*socket_connect) (struct socket *sock,
1588                    struct sockaddr *address, int addrlen);
1589     int (*socket_listen) (struct socket *sock, int backlog);
1590     int (*socket_accept) (struct socket *sock, struct socket *newsock);
1591     int (*socket_sendmsg) (struct socket *sock,
1592                    struct msghdr *msg, int size);
1593     int (*socket_recvmsg) (struct socket *sock,
1594                    struct msghdr *msg, int size, int flags);
1595     int (*socket_getsockname) (struct socket *sock);
1596     int (*socket_getpeername) (struct socket *sock);
1597     int (*socket_getsockopt) (struct socket *sock, int level, int optname);
1598     int (*socket_setsockopt) (struct socket *sock, int level, int optname);
1599     int (*socket_shutdown) (struct socket *sock, int how);
1600     int (*socket_sock_rcv_skb) (struct sock *sk, struct sk_buff *skb);
1601     int (*socket_getpeersec_stream) (struct socket *sock, char __user *optval, int __user *optlen, unsigned      len);
1602     int (*socket_getpeersec_dgram) (struct socket *sock, struct sk_buff *skb, u32 *secid);
1603     int (*sk_alloc_security) (struct sock *sk, int family, gfp_t priority);
1604     void (*sk_free_security) (struct sock *sk);
1605     void (*sk_clone_security) (const struct sock *sk, struct sock *newsk);
1606     void (*sk_getsecid) (struct sock *sk, u32 *secid);
1607     void (*sock_graft) (struct sock *sk, struct socket *parent);
1608     int (*inet_conn_request) (struct sock *sk, struct sk_buff *skb,
1609                   struct request_sock *req);
1610     void (*inet_csk_clone) (struct sock *newsk, const struct request_sock *req);
1611     void (*inet_conn_established) (struct sock *sk, struct sk_buff *skb);
1612     int (*secmark_relabel_packet) (u32 secid);
1613     void (*secmark_refcount_inc) (void);
1614     void (*secmark_refcount_dec) (void);
1615     void (*req_classify_flow) (const struct request_sock *req, struct flowi *fl);
1616     int (*tun_dev_create)(void);
1617     void (*tun_dev_post_create)(struct sock *sk);
1618     int (*tun_dev_attach)(struct sock *sk);
1619 #endif  /* CONFIG_SECURITY_NETWORK */
1620 
1621 #ifdef CONFIG_SECURITY_NETWORK_XFRM
1622     int (*xfrm_policy_alloc_security) (struct xfrm_sec_ctx **ctxp,
1623             struct xfrm_user_sec_ctx *sec_ctx);
1624     int (*xfrm_policy_clone_security) (struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctx);
1625     void (*xfrm_policy_free_security) (struct xfrm_sec_ctx *ctx);
1626     int (*xfrm_policy_delete_security) (struct xfrm_sec_ctx *ctx);
1627     int (*xfrm_state_alloc_security) (struct xfrm_state *x,
1628         struct xfrm_user_sec_ctx *sec_ctx,
1629         u32 secid);
1630     void (*xfrm_state_free_security) (struct xfrm_state *x);
1631     int (*xfrm_state_delete_security) (struct xfrm_state *x);
1632     int (*xfrm_policy_lookup) (struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);
1633     int (*xfrm_state_pol_flow_match) (struct xfrm_state *x,
1634                       struct xfrm_policy *xp,
1635                       const struct flowi *fl);
1636     int (*xfrm_decode_session) (struct sk_buff *skb, u32 *secid, int ckall);
1637 #endif  /* CONFIG_SECURITY_NETWORK_XFRM */
1638 
1639     /* key management security hooks */
1640 #ifdef CONFIG_KEYS
1641     int (*key_alloc) (struct key *key, const struct cred *cred, unsigned long flags);
1642     void (*key_free) (struct key *key);
1643     int (*key_permission) (key_ref_t key_ref,
1644                    const struct cred *cred,
1645                    key_perm_t perm);
1646     int (*key_getsecurity)(struct key *key, char **_buffer);
1647 #endif  /* CONFIG_KEYS */
1648 
1649 #ifdef CONFIG_AUDIT
1650     int (*audit_rule_init) (u32 field, u32 op, char *rulestr, void **lsmrule);
1651     int (*audit_rule_known) (struct audit_krule *krule);
1652     int (*audit_rule_match) (u32 secid, u32 field, u32 op, void *lsmrule,
1653                  struct audit_context *actx);
1654     void (*audit_rule_free) (void *lsmrule);
1655 #endif /* CONFIG_AUDIT */
1656 };