1 /* SPDX-License-Identifier: GPL-2.0 */ 2 3 /* 4 * Copyright (C) 2020 Google LLC. 5 */ 6 7 #ifndef _LINUX_BPF_LSM_H 8 #define _LINUX_BPF_LSM_H 9 10 #include <linux/sched.h> 11 #include <linux/bpf.h> 12 #include <linux/bpf_verifier.h> 13 #include <linux/lsm_hooks.h> 14 15 #ifdef CONFIG_BPF_LSM 16 17 #define LSM_HOOK(RET, DEFAULT, NAME, ...) \ 18 RET bpf_lsm_##NAME(__VA_ARGS__); 19 #include <linux/lsm_hook_defs.h> 20 #undef LSM_HOOK 21 22 struct bpf_storage_blob { 23 struct bpf_local_storage __rcu *storage; 24 }; 25 26 extern struct lsm_blob_sizes bpf_lsm_blob_sizes; 27 28 int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog, 29 const struct bpf_prog *prog); 30 31 bool bpf_lsm_is_sleepable_hook(u32 btf_id); 32 bool bpf_lsm_is_trusted(const struct bpf_prog *prog); 33 34 static inline struct bpf_storage_blob *bpf_inode( 35 const struct inode *inode) 36 { 37 if (unlikely(!inode->i_security)) 38 return NULL; 39 40 return inode->i_security + bpf_lsm_blob_sizes.lbs_inode; 41 } 42 43 extern const struct bpf_func_proto bpf_inode_storage_get_proto; 44 extern const struct bpf_func_proto bpf_inode_storage_delete_proto; 45 void bpf_inode_storage_free(struct inode *inode); 46 47 void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog, bpf_func_t *bpf_func); 48 49 int bpf_lsm_get_retval_range(const struct bpf_prog *prog, 50 struct bpf_retval_range *range); 51 int bpf_set_dentry_xattr_locked(struct dentry *dentry, const char *name__str, 52 const struct bpf_dynptr *value_p, int flags); 53 int bpf_remove_dentry_xattr_locked(struct dentry *dentry, const char *name__str); 54 bool bpf_lsm_has_d_inode_locked(const struct bpf_prog *prog); 55 56 #else /* !CONFIG_BPF_LSM */ 57 58 static inline bool bpf_lsm_is_sleepable_hook(u32 btf_id) 59 { 60 return false; 61 } 62 63 static inline bool bpf_lsm_is_trusted(const struct bpf_prog *prog) 64 { 65 return false; 66 } 67 68 static inline int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog, 69 const struct bpf_prog *prog) 70 { 71 return -EOPNOTSUPP; 72 } 73 74 static inline struct bpf_storage_blob *bpf_inode( 75 const struct inode *inode) 76 { 77 return NULL; 78 } 79 80 static inline void bpf_inode_storage_free(struct inode *inode) 81 { 82 } 83 84 static inline void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog, 85 bpf_func_t *bpf_func) 86 { 87 } 88 89 static inline int bpf_lsm_get_retval_range(const struct bpf_prog *prog, 90 struct bpf_retval_range *range) 91 { 92 return -EOPNOTSUPP; 93 } 94 static inline int bpf_set_dentry_xattr_locked(struct dentry *dentry, const char *name__str, 95 const struct bpf_dynptr *value_p, int flags) 96 { 97 return -EOPNOTSUPP; 98 } 99 static inline int bpf_remove_dentry_xattr_locked(struct dentry *dentry, const char *name__str) 100 { 101 return -EOPNOTSUPP; 102 } 103 static inline bool bpf_lsm_has_d_inode_locked(const struct bpf_prog *prog) 104 { 105 return false; 106 } 107 #endif /* CONFIG_BPF_LSM */ 108 109 #endif /* _LINUX_BPF_LSM_H */ 110