security_file_ioctl(9)

💅 security_file_ioctl(9) 💅

okay so this page is from the Kernel API Manual, and it's all about checking whether an ioctl is allowed. Bestie, it's giving security-module gatekeeping energy, and we're gonna get every detail. ✨

---

🌸 NAME 🌸

security_file_ioctl — check if an ioctl is allowed, periodt.

🦋 SYNOPSIS 🦋

int security_file_ioctl (struct file *file , unsigned int cmd , unsigned
       long arg );

🎀 ARGUMENTS 🎀

• file — the associated file. Like, the file this whole ioctl situation is attached to. 🫶
• cmd — the ioctl cmd. The command identifier, no cap.
• arg — the ioctl arguments. Careful with this one, bestie, because it can be a user space pointer or just a simple integer value depending on the case.

💖 DESCRIPTION 💖

This one checks permission for an ioctl operation on file. That's the whole vibe: permission check, ioctl, file. Slay. 👑

Now the important little caveat, because this is where people get messy: arg sometimes represents a user space pointer; in other cases, it may be a simple integer value. When arg represents a user space pointer, it should never be used by the security module. Never ever. Not even a little. 🙈

🚨 bestie warning: if arg is a user space pointer, the security module must not use it. That's not a vibe check, that's a rule.

✨ RETURN ✨

Returns 0 if permission is granted. That's the return fact, and it's iconic in its simplicity. 💅

💜 SEE ALSO 💜

Okay bestie, this cross-ref list is LONG. Like, main-character-long. But every single reference is here, no cap, because I would never do you dirty like that. 🫶

Kernel file ./security/security.c lsm_file_alloc(9),
       lsm_backing_file_alloc(9), lsm_blob_alloc(9), lsm_cred_alloc(9),
       lsm_inode_alloc(9), lsm_task_alloc(9), lsm_ipc_alloc(9),
       lsm_key_alloc(9), lsm_msg_msg_alloc(9), lsm_bdev_alloc(9),
       lsm_bpf_map_alloc(9), lsm_bpf_prog_alloc(9), lsm_bpf_token_alloc(9),
       lsm_superblock_alloc(9), lsm_fill_user_ctx(9),
       security_binder_set_context_mgr(9), security_binder_transaction(9),
       security_binder_transfer_binder(9), security_binder_transfer_file(9),
       security_ptrace_access_check(9), security_ptrace_traceme(9),
       security_capget(9), security_capset(9), security_capable(9),
       security_quotactl(9), security_quota_on(9), security_syslog(9),
       security_settime64(9), security_vm_enough_memory_mm(9),
       security_bprm_creds_for_exec(9), security_bprm_creds_from_file(9),
       security_bprm_check(9), security_bprm_committing_creds(9),
       security_bprm_committed_creds(9), security_fs_context_submount(9),
       security_fs_context_dup(9), security_fs_context_parse_param(9),
       security_sb_alloc(9), security_sb_delete(9), security_sb_free(9),
       security_free_mnt_opts(9), security_sb_eat_lsm_opts(9),
       security_sb_mnt_opts_compat(9), security_sb_remount(9),
       security_sb_kern_mount(9), security_sb_show_options(9),
       security_sb_statfs(9), security_sb_mount(9), security_sb_umount(9),
       security_sb_pivotroot(9), security_sb_set_mnt_opts(9),
       security_sb_clone_mnt_opts(9), security_move_mount(9),
       security_path_notify(9), security_inode_alloc(9),
       security_inode_free(9), security_dentry_init_security(9),
       security_dentry_create_files_as(9), security_inode_init_security(9),
       security_inode_init_security_anon(9), security_path_mknod(9),
       security_path_post_mknod(9), security_path_mkdir(9),
       security_path_rmdir(9), security_path_unlink(9),
       security_path_symlink(9), security_path_link(9),
       security_path_rename(9), security_path_truncate(9),
       security_path_chmod(9), security_path_chown(9), security_path_chroot(9),
       security_inode_create(9), security_inode_post_create_tmpfile(9),
       security_inode_link(9), security_inode_unlink(9),
       security_inode_symlink(9), security_inode_mkdir(9),
       security_inode_rmdir(9), security_inode_mknod(9),
       security_inode_rename(9), security_inode_readlink(9),
       security_inode_follow_link(9), security_inode_permission(9),
       security_inode_setattr(9), security_inode_post_setattr(9),
       security_inode_getattr(9), security_inode_setxattr(9),
       security_inode_set_acl(9), security_inode_post_set_acl(9),
       security_inode_get_acl(9), security_inode_remove_acl(9),
       security_inode_post_remove_acl(9), security_inode_post_setxattr(9),
       security_inode_getxattr(9), security_inode_listxattr(9),
       security_inode_removexattr(9), security_inode_post_removexattr(9),
       security_inode_file_setattr(9), security_inode_file_getattr(9),
       security_inode_need_killpriv(9), security_inode_killpriv(9),
       security_inode_getsecurity(9), security_inode_setsecurity(9),
       security_inode_listsecurity(9), security_inode_getlsmprop(9),
       security_inode_copy_up(9), security_inode_copy_up_xattr(9),
       security_inode_setintegrity(9), security_kernfs_init_security(9),
       security_file_permission(9), security_file_alloc(9),
       security_file_release(9), security_file_free(9),
       security_backing_file_alloc(9), security_backing_file_free(9),
       security_file_ioctl_compat(9), security_mmap_file(9),
       security_mmap_backing_file(9), security_mmap_addr(9),
       security_file_mprotect(9), security_file_lock(9),
       security_file_fcntl(9), security_file_set_fowner(9),
       security_file_send_sigiotask(9), security_file_receive(9),
       security_file_open(9), security_file_post_open(9),
       security_file_truncate(9), security_task_alloc(9),
       security_task_free(9), security_cred_alloc_blank(9),
       security_cred_free(9), security_prepare_creds(9),
       security_transfer_creds(9), security_cred_getsecid(9),
       security_cred_getlsmprop(9), security_kernel_act_as(9),
       security_kernel_create_files_as(9), security_kernel_module_request(9),
       security_kernel_read_file(9), security_kernel_post_read_file(9),
       security_kernel_load_data(9), security_kernel_post_load_data(9),
       security_task_fix_setuid(9), security_task_fix_setgid(9),
       security_task_fix_setgroups(9), security_task_setpgid(9),
       security_task_getpgid(9), security_task_getsid(9),
       security_current_getlsmprop_subj(9), security_task_getlsmprop_obj(9),
       security_task_setnice(9), security_task_setioprio(9),
       security_task_getioprio(9), security_task_prlimit(9),
       security_task_setrlimit(9), security_task_setscheduler(9),
       security_task_getscheduler(9), security_task_movememory(9),
       security_task_kill(9), security_task_prctl(9),
       security_task_to_inode(9), security_create_user_ns(9),
       security_ipc_permission(9), security_ipc_getlsmprop(9),
       security_msg_msg_alloc(9), security_msg_msg_free(9),
       security_msg_queue_alloc(9), security_msg_queue_free(9),
       security_msg_queue_associate(9), security_msg_queue_msgctl(9),
       security_msg_queue_msgsnd(9), security_msg_queue_msgrcv(9),
       security_shm_alloc(9), security_shm_free(9), security_shm_associate(9),
       security_shm_shmctl(9), security_shm_shmat(9), security_sem_alloc(9),
       security_sem_free(9), security_sem_associate(9), security_sem_semctl(9),
       security_sem_semop(9), security_d_instantiate(9),
       security_getselfattr(9), security_setselfattr(9),
       security_getprocattr(9), security_setprocattr(9),
       security_ismaclabel(9), security_secid_to_secctx(9),
       security_lsmprop_to_secctx(9), security_secctx_to_secid(9),
       security_release_secctx(9), security_inode_invalidate_secctx(9),
       security_inode_notifysecctx(9), security_inode_setsecctx(9),
       security_inode_getsecctx(9), security_post_notification(9),
       security_watch_key(9), security_netlink_send(9),
       security_unix_stream_connect(9), security_unix_may_send(9),
       security_socket_create(9), security_socket_post_create(9),
       security_socket_socketpair(9), security_socket_bind(9),
       security_socket_connect(9), security_socket_listen(9),
       security_socket_accept(9), security_socket_sendmsg(9),
       security_socket_recvmsg(9), security_socket_getsockname(9),
       security_socket_getpeername(9), security_socket_getsockopt(9),
       security_socket_setsockopt(9), security_socket_shutdown(9),
       security_sock_rcv_skb(9), security_socket_getpeersec_stream(9),
       security_socket_getpeersec_dgram(9), lsm_sock_alloc(9),
       security_sk_alloc(9), security_sk_free(9), security_sk_clone(9),
       security_sk_classify_flow(9), security_req_classify_flow(9),
       security_sock_graft(9), security_inet_conn_request(9),
       security_inet_csk_clone(9), security_inet_conn_established(9),
       security_secmark_relabel_packet(9), security_secmark_refcount_inc(9),
       security_secmark_refcount_dec(9), security_tun_dev_alloc_security(9),
       security_tun_dev_free_security(9), security_tun_dev_create(9),
       security_tun_dev_attach_queue(9), security_tun_dev_attach(9),
       security_tun_dev_open(9), security_sctp_assoc_request(9),
       security_sctp_bind_connect(9), security_sctp_sk_clone(9),
       security_sctp_assoc_established(9), security_mptcp_add_subflow(9),
       security_unix_find(9), security_ib_pkey_access(9),
       security_ib_endport_manage_subnet(9), security_ib_alloc_security(9),
       security_ib_free_security(9), security_xfrm_policy_alloc(9),
       security_xfrm_policy_clone(9), security_xfrm_policy_free(9),
       security_xfrm_policy_delete(9), security_xfrm_state_alloc(9),
       security_xfrm_state_alloc_acquire(9), security_xfrm_state_delete(9),
       security_xfrm_state_free(9), security_xfrm_policy_lookup(9),
       security_xfrm_state_pol_flow_match(9), security_xfrm_decode_session(9),
       security_key_alloc(9), security_key_free(9), security_key_permission(9),
       security_key_getsecurity(9), security_key_post_create_or_update(9),
       security_audit_rule_init(9), security_audit_rule_known(9),
       security_audit_rule_free(9), security_audit_rule_match(9),
       security_bpf(9), security_bpf_map(9), security_bpf_prog(9),
       security_bpf_map_create(9), security_bpf_prog_load(9),
       security_bpf_token_create(9), security_bpf_token_cmd(9),
       security_bpf_token_capable(9), security_bpf_map_free(9),
       security_bpf_prog_free(9), security_bpf_token_free(9),
       security_locked_down(9), security_bdev_alloc(9), security_bdev_free(9),
       security_bdev_setintegrity(9), security_perf_event_open(9),
       security_perf_event_alloc(9), security_perf_event_free(9),
       security_perf_event_read(9), security_perf_event_write(9),
       security_uring_override_creds(9), security_uring_sqpoll(9),
       security_uring_cmd(9), security_uring_allowed(9),
       security_initramfs_populated(9)

iykyk, that's the whole guest list. 💅

🎀 cute sign-off: source/version is ./security, and this page is dated October 2026. Mwah, bestie. 💋