1 // SPDX-License-Identifier: GPL-2.0 1 // SPDX-License-Identifier: GPL-2.0
2 /* 2 /*
3 * Copyright (C) 2020-2024 Microsoft Corporati 3 * Copyright (C) 2020-2024 Microsoft Corporation. All rights reserved.
4 */ 4 */
5 #include <uapi/linux/lsm.h> 5 #include <uapi/linux/lsm.h>
6 6
7 #include "ipe.h" 7 #include "ipe.h"
8 #include "eval.h" 8 #include "eval.h"
9 #include "hooks.h" 9 #include "hooks.h"
10 10
11 extern const char *const ipe_boot_policy; 11 extern const char *const ipe_boot_policy;
12 bool ipe_enabled; 12 bool ipe_enabled;
13 13
14 static struct lsm_blob_sizes ipe_blobs __ro_af 14 static struct lsm_blob_sizes ipe_blobs __ro_after_init = {
15 .lbs_superblock = sizeof(struct ipe_su 15 .lbs_superblock = sizeof(struct ipe_superblock),
16 #ifdef CONFIG_IPE_PROP_DM_VERITY 16 #ifdef CONFIG_IPE_PROP_DM_VERITY
17 .lbs_bdev = sizeof(struct ipe_bdev), 17 .lbs_bdev = sizeof(struct ipe_bdev),
18 #endif /* CONFIG_IPE_PROP_DM_VERITY */ 18 #endif /* CONFIG_IPE_PROP_DM_VERITY */
19 #ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG 19 #ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG
20 .lbs_inode = sizeof(struct ipe_inode), 20 .lbs_inode = sizeof(struct ipe_inode),
21 #endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SI 21 #endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */
22 }; 22 };
23 23
24 static const struct lsm_id ipe_lsmid = { 24 static const struct lsm_id ipe_lsmid = {
25 .name = "ipe", 25 .name = "ipe",
26 .id = LSM_ID_IPE, 26 .id = LSM_ID_IPE,
27 }; 27 };
28 28
29 struct ipe_superblock *ipe_sb(const struct sup 29 struct ipe_superblock *ipe_sb(const struct super_block *sb)
30 { 30 {
31 return sb->s_security + ipe_blobs.lbs_ 31 return sb->s_security + ipe_blobs.lbs_superblock;
32 } 32 }
33 33
34 #ifdef CONFIG_IPE_PROP_DM_VERITY 34 #ifdef CONFIG_IPE_PROP_DM_VERITY
35 struct ipe_bdev *ipe_bdev(struct block_device 35 struct ipe_bdev *ipe_bdev(struct block_device *b)
36 { 36 {
37 return b->bd_security + ipe_blobs.lbs_ 37 return b->bd_security + ipe_blobs.lbs_bdev;
38 } 38 }
39 #endif /* CONFIG_IPE_PROP_DM_VERITY */ 39 #endif /* CONFIG_IPE_PROP_DM_VERITY */
40 40
41 #ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG 41 #ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG
42 struct ipe_inode *ipe_inode(const struct inode 42 struct ipe_inode *ipe_inode(const struct inode *inode)
43 { 43 {
44 return inode->i_security + ipe_blobs.l 44 return inode->i_security + ipe_blobs.lbs_inode;
45 } 45 }
46 #endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SI 46 #endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */
47 47
48 static struct security_hook_list ipe_hooks[] _ 48 static struct security_hook_list ipe_hooks[] __ro_after_init = {
49 LSM_HOOK_INIT(bprm_check_security, ipe 49 LSM_HOOK_INIT(bprm_check_security, ipe_bprm_check_security),
50 LSM_HOOK_INIT(mmap_file, ipe_mmap_file 50 LSM_HOOK_INIT(mmap_file, ipe_mmap_file),
51 LSM_HOOK_INIT(file_mprotect, ipe_file_ 51 LSM_HOOK_INIT(file_mprotect, ipe_file_mprotect),
52 LSM_HOOK_INIT(kernel_read_file, ipe_ke 52 LSM_HOOK_INIT(kernel_read_file, ipe_kernel_read_file),
53 LSM_HOOK_INIT(kernel_load_data, ipe_ke 53 LSM_HOOK_INIT(kernel_load_data, ipe_kernel_load_data),
54 LSM_HOOK_INIT(initramfs_populated, ipe 54 LSM_HOOK_INIT(initramfs_populated, ipe_unpack_initramfs),
55 #ifdef CONFIG_IPE_PROP_DM_VERITY 55 #ifdef CONFIG_IPE_PROP_DM_VERITY
56 LSM_HOOK_INIT(bdev_free_security, ipe_ 56 LSM_HOOK_INIT(bdev_free_security, ipe_bdev_free_security),
57 LSM_HOOK_INIT(bdev_setintegrity, ipe_b 57 LSM_HOOK_INIT(bdev_setintegrity, ipe_bdev_setintegrity),
58 #endif /* CONFIG_IPE_PROP_DM_VERITY */ 58 #endif /* CONFIG_IPE_PROP_DM_VERITY */
59 #ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG 59 #ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG
60 LSM_HOOK_INIT(inode_setintegrity, ipe_ 60 LSM_HOOK_INIT(inode_setintegrity, ipe_inode_setintegrity),
61 #endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SI 61 #endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */
62 }; 62 };
63 63
64 /** 64 /**
65 * ipe_init() - Entry point of IPE. 65 * ipe_init() - Entry point of IPE.
66 * 66 *
67 * This is called at LSM init, which happens o 67 * This is called at LSM init, which happens occurs early during kernel
68 * start up. During this phase, IPE registers 68 * start up. During this phase, IPE registers its hooks and loads the
69 * builtin boot policy. 69 * builtin boot policy.
70 * 70 *
71 * Return: 71 * Return:
72 * * %0 - OK 72 * * %0 - OK
73 * * %-ENOMEM - Out of memory (OOM) 73 * * %-ENOMEM - Out of memory (OOM)
74 */ 74 */
75 static int __init ipe_init(void) 75 static int __init ipe_init(void)
76 { 76 {
77 struct ipe_policy *p = NULL; 77 struct ipe_policy *p = NULL;
78 78
79 security_add_hooks(ipe_hooks, ARRAY_SI 79 security_add_hooks(ipe_hooks, ARRAY_SIZE(ipe_hooks), &ipe_lsmid);
80 ipe_enabled = true; 80 ipe_enabled = true;
81 81
82 if (ipe_boot_policy) { 82 if (ipe_boot_policy) {
83 p = ipe_new_policy(ipe_boot_po 83 p = ipe_new_policy(ipe_boot_policy, strlen(ipe_boot_policy),
84 NULL, 0); 84 NULL, 0);
85 if (IS_ERR(p)) 85 if (IS_ERR(p))
86 return PTR_ERR(p); 86 return PTR_ERR(p);
87 87
88 rcu_assign_pointer(ipe_active_ 88 rcu_assign_pointer(ipe_active_policy, p);
89 } 89 }
90 90
91 return 0; 91 return 0;
92 } 92 }
93 93
94 DEFINE_LSM(ipe) = { 94 DEFINE_LSM(ipe) = {
95 .name = "ipe", 95 .name = "ipe",
96 .init = ipe_init, 96 .init = ipe_init,
97 .blobs = &ipe_blobs, 97 .blobs = &ipe_blobs,
98 }; 98 };
99 99
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.