Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Landlock LSM - Security framework setup
4 *
5 * Copyright © 2016-2020 Mickaël Salaün <mic@digikod.net>
6 * Copyright © 2018-2020 ANSSI
7 */
8
9#include <linux/bits.h>
10#include <linux/init.h>
11#include <linux/lsm_hooks.h>
12#include <uapi/linux/lsm.h>
13
14#include "common.h"
15#include "cred.h"
16#include "errata.h"
17#include "fs.h"
18#include "id.h"
19#include "net.h"
20#include "setup.h"
21#include "task.h"
22
23bool landlock_initialized __ro_after_init = false;
24
25const struct lsm_id landlock_lsmid = {
26 .name = LANDLOCK_NAME,
27 .id = LSM_ID_LANDLOCK,
28};
29
30struct lsm_blob_sizes landlock_blob_sizes __ro_after_init = {
31 .lbs_cred = sizeof(struct landlock_cred_security),
32 .lbs_file = sizeof(struct landlock_file_security),
33 .lbs_inode = sizeof(struct landlock_inode_security),
34 .lbs_superblock = sizeof(struct landlock_superblock_security),
35};
36
37int landlock_errata __ro_after_init;
38
39static void __init compute_errata(void)
40{
41 size_t i;
42
43#ifndef __has_include
44 /*
45 * This is a safeguard to make sure the compiler implements
46 * __has_include (see errata.h).
47 */
48 WARN_ON_ONCE(1);
49 return;
50#endif
51
52 for (i = 0; landlock_errata_init[i].number; i++) {
53 const int prev_errata = landlock_errata;
54
55 if (WARN_ON_ONCE(landlock_errata_init[i].abi >
56 landlock_abi_version))
57 continue;
58
59 landlock_errata |= BIT(landlock_errata_init[i].number - 1);
60 WARN_ON_ONCE(prev_errata == landlock_errata);
61 }
62}
63
64static int __init landlock_init(void)
65{
66 compute_errata();
67 landlock_add_cred_hooks();
68 landlock_add_task_hooks();
69 landlock_add_fs_hooks();
70 landlock_add_net_hooks();
71 landlock_init_id();
72 landlock_initialized = true;
73 pr_info("Up and running.\n");
74 return 0;
75}
76
77DEFINE_LSM(LANDLOCK_NAME) = {
78 .id = &landlock_lsmid,
79 .init = landlock_init,
80 .blobs = &landlock_blob_sizes,
81};