Something went wrong. Try again.
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101// SPDX-License-Identifier: GPL-2.0/* * Copyright (C) 2020-2024 Microsoft Corporation. All rights reserved. */#include <uapi/linux/lsm.h>
#include "ipe.h"#include "eval.h"#include "hooks.h"
extern const char *const ipe_boot_policy;bool ipe_enabled;
static struct lsm_blob_sizes ipe_blobs __ro_after_init = { .lbs_superblock = sizeof(struct ipe_superblock),#ifdef CONFIG_IPE_PROP_DM_VERITY .lbs_bdev = sizeof(struct ipe_bdev),#endif /* CONFIG_IPE_PROP_DM_VERITY */#ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG .lbs_inode = sizeof(struct ipe_inode),#endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */};
static const struct lsm_id ipe_lsmid = { .name = "ipe", .id = LSM_ID_IPE,};
struct ipe_superblock *ipe_sb(const struct super_block *sb){ return sb->s_security + ipe_blobs.lbs_superblock;}
#ifdef CONFIG_IPE_PROP_DM_VERITYstruct ipe_bdev *ipe_bdev(struct block_device *b){ return b->bd_security + ipe_blobs.lbs_bdev;}#endif /* CONFIG_IPE_PROP_DM_VERITY */
#ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIGstruct ipe_inode *ipe_inode(const struct inode *inode){ return inode->i_security + ipe_blobs.lbs_inode;}#endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */
static struct security_hook_list ipe_hooks[] __ro_after_init = { LSM_HOOK_INIT(bprm_check_security, ipe_bprm_check_security), LSM_HOOK_INIT(bprm_creds_for_exec, ipe_bprm_creds_for_exec), LSM_HOOK_INIT(mmap_file, ipe_mmap_file), LSM_HOOK_INIT(file_mprotect, ipe_file_mprotect), LSM_HOOK_INIT(kernel_read_file, ipe_kernel_read_file), LSM_HOOK_INIT(kernel_load_data, ipe_kernel_load_data), LSM_HOOK_INIT(initramfs_populated, ipe_unpack_initramfs),#ifdef CONFIG_IPE_PROP_DM_VERITY LSM_HOOK_INIT(bdev_free_security, ipe_bdev_free_security), LSM_HOOK_INIT(bdev_setintegrity, ipe_bdev_setintegrity),#endif /* CONFIG_IPE_PROP_DM_VERITY */#ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG LSM_HOOK_INIT(inode_setintegrity, ipe_inode_setintegrity),#endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */};
/** * ipe_init() - Entry point of IPE. * * This is called at LSM init, which happens occurs early during kernel * start up. During this phase, IPE registers its hooks and loads the * builtin boot policy. * * Return: * * %0 - OK * * %-ENOMEM - Out of memory (OOM) */static int __init ipe_init(void){ struct ipe_policy *p = NULL;
security_add_hooks(ipe_hooks, ARRAY_SIZE(ipe_hooks), &ipe_lsmid); ipe_enabled = true;
if (ipe_boot_policy) { p = ipe_new_policy(ipe_boot_policy, strlen(ipe_boot_policy), NULL, 0); if (IS_ERR(p)) return PTR_ERR(p);
rcu_assign_pointer(ipe_active_policy, p); }
return 0;}
DEFINE_LSM(ipe) = { .id = &ipe_lsmid, .init = ipe_init, .blobs = &ipe_blobs, .initcall_fs = ipe_init_securityfs,};