Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Copyright (C) 2020-2024 Microsoft Corporation. All rights reserved.
4 */
5#include <uapi/linux/lsm.h>
6
7#include "ipe.h"
8#include "eval.h"
9#include "hooks.h"
10
11extern const char *const ipe_boot_policy;
12bool ipe_enabled;
13
14static struct lsm_blob_sizes ipe_blobs __ro_after_init = {
15 .lbs_superblock = sizeof(struct ipe_superblock),
16#ifdef CONFIG_IPE_PROP_DM_VERITY
17 .lbs_bdev = sizeof(struct ipe_bdev),
18#endif /* CONFIG_IPE_PROP_DM_VERITY */
19#ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG
20 .lbs_inode = sizeof(struct ipe_inode),
21#endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */
22};
23
24static const struct lsm_id ipe_lsmid = {
25 .name = "ipe",
26 .id = LSM_ID_IPE,
27};
28
29struct ipe_superblock *ipe_sb(const struct super_block *sb)
30{
31 return sb->s_security + ipe_blobs.lbs_superblock;
32}
33
34#ifdef CONFIG_IPE_PROP_DM_VERITY
35struct ipe_bdev *ipe_bdev(struct block_device *b)
36{
37 return b->bd_security + ipe_blobs.lbs_bdev;
38}
39#endif /* CONFIG_IPE_PROP_DM_VERITY */
40
41#ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG
42struct ipe_inode *ipe_inode(const struct inode *inode)
43{
44 return inode->i_security + ipe_blobs.lbs_inode;
45}
46#endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */
47
48static struct security_hook_list ipe_hooks[] __ro_after_init = {
49 LSM_HOOK_INIT(bprm_check_security, ipe_bprm_check_security),
50 LSM_HOOK_INIT(bprm_creds_for_exec, ipe_bprm_creds_for_exec),
51 LSM_HOOK_INIT(mmap_file, ipe_mmap_file),
52 LSM_HOOK_INIT(file_mprotect, ipe_file_mprotect),
53 LSM_HOOK_INIT(kernel_read_file, ipe_kernel_read_file),
54 LSM_HOOK_INIT(kernel_load_data, ipe_kernel_load_data),
55 LSM_HOOK_INIT(initramfs_populated, ipe_unpack_initramfs),
56#ifdef CONFIG_IPE_PROP_DM_VERITY
57 LSM_HOOK_INIT(bdev_free_security, ipe_bdev_free_security),
58 LSM_HOOK_INIT(bdev_setintegrity, ipe_bdev_setintegrity),
59#endif /* CONFIG_IPE_PROP_DM_VERITY */
60#ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG
61 LSM_HOOK_INIT(inode_setintegrity, ipe_inode_setintegrity),
62#endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */
63};
64
65/**
66 * ipe_init() - Entry point of IPE.
67 *
68 * This is called at LSM init, which happens occurs early during kernel
69 * start up. During this phase, IPE registers its hooks and loads the
70 * builtin boot policy.
71 *
72 * Return:
73 * * %0 - OK
74 * * %-ENOMEM - Out of memory (OOM)
75 */
76static int __init ipe_init(void)
77{
78 struct ipe_policy *p = NULL;
79
80 security_add_hooks(ipe_hooks, ARRAY_SIZE(ipe_hooks), &ipe_lsmid);
81 ipe_enabled = true;
82
83 if (ipe_boot_policy) {
84 p = ipe_new_policy(ipe_boot_policy, strlen(ipe_boot_policy),
85 NULL, 0);
86 if (IS_ERR(p))
87 return PTR_ERR(p);
88
89 rcu_assign_pointer(ipe_active_policy, p);
90 }
91
92 return 0;
93}
94
95DEFINE_LSM(ipe) = {
96 .id = &ipe_lsmid,
97 .init = ipe_init,
98 .blobs = &ipe_blobs,
99 .initcall_fs = ipe_init_securityfs,
100};