1 /* SPDX-License-Identifier: GPL-2.0-only */ 2 /* 3 * Copyright (C) 2008 IBM Corporation 4 * Author: Mimi Zohar <[email protected]> 5 */ 6 7 #ifndef _LINUX_IMA_H 8 #define _LINUX_IMA_H 9 10 #include <linux/kernel_read_file.h> 11 #include <linux/fs.h> 12 #include <linux/security.h> 13 #include <linux/kexec.h> 14 struct linux_binprm; 15 16 #ifdef CONFIG_IMA 17 extern int ima_bprm_check(struct linux_binprm *bprm); 18 extern int ima_file_check(struct file *file, int mask); 19 extern void ima_post_create_tmpfile(struct inode *inode); 20 extern void ima_file_free(struct file *file); 21 extern int ima_file_mmap(struct file *file, unsigned long prot); 22 extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot); 23 extern int ima_load_data(enum kernel_load_data_id id, bool contents); 24 extern int ima_post_load_data(char *buf, loff_t size, 25 enum kernel_load_data_id id, char *description); 26 extern int ima_read_file(struct file *file, enum kernel_read_file_id id, 27 bool contents); 28 extern int ima_post_read_file(struct file *file, void *buf, loff_t size, 29 enum kernel_read_file_id id); 30 extern void ima_post_path_mknod(struct dentry *dentry); 31 extern int ima_file_hash(struct file *file, char *buf, size_t buf_size); 32 extern int ima_inode_hash(struct inode *inode, char *buf, size_t buf_size); 33 extern void ima_kexec_cmdline(int kernel_fd, const void *buf, int size); 34 35 #ifdef CONFIG_IMA_KEXEC 36 extern void ima_add_kexec_buffer(struct kimage *image); 37 #endif 38 39 #ifdef CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT 40 extern bool arch_ima_get_secureboot(void); 41 extern const char * const *arch_get_ima_policy(void); 42 #else 43 static inline bool arch_ima_get_secureboot(void) 44 { 45 return false; 46 } 47 48 static inline const char * const *arch_get_ima_policy(void) 49 { 50 return NULL; 51 } 52 #endif 53 54 #else 55 static inline int ima_bprm_check(struct linux_binprm *bprm) 56 { 57 return 0; 58 } 59 60 static inline int ima_file_check(struct file *file, int mask) 61 { 62 return 0; 63 } 64 65 static inline void ima_post_create_tmpfile(struct inode *inode) 66 { 67 } 68 69 static inline void ima_file_free(struct file *file) 70 { 71 return; 72 } 73 74 static inline int ima_file_mmap(struct file *file, unsigned long prot) 75 { 76 return 0; 77 } 78 79 static inline int ima_file_mprotect(struct vm_area_struct *vma, 80 unsigned long prot) 81 { 82 return 0; 83 } 84 85 static inline int ima_load_data(enum kernel_load_data_id id, bool contents) 86 { 87 return 0; 88 } 89 90 static inline int ima_post_load_data(char *buf, loff_t size, 91 enum kernel_load_data_id id, 92 char *description) 93 { 94 return 0; 95 } 96 97 static inline int ima_read_file(struct file *file, enum kernel_read_file_id id, 98 bool contents) 99 { 100 return 0; 101 } 102 103 static inline int ima_post_read_file(struct file *file, void *buf, loff_t size, 104 enum kernel_read_file_id id) 105 { 106 return 0; 107 } 108 109 static inline void ima_post_path_mknod(struct dentry *dentry) 110 { 111 return; 112 } 113 114 static inline int ima_file_hash(struct file *file, char *buf, size_t buf_size) 115 { 116 return -EOPNOTSUPP; 117 } 118 119 static inline int ima_inode_hash(struct inode *inode, char *buf, size_t buf_size) 120 { 121 return -EOPNOTSUPP; 122 } 123 124 static inline void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) {} 125 #endif /* CONFIG_IMA */ 126 127 #ifndef CONFIG_IMA_KEXEC 128 struct kimage; 129 130 static inline void ima_add_kexec_buffer(struct kimage *image) 131 {} 132 #endif 133 134 #ifdef CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS 135 extern void ima_post_key_create_or_update(struct key *keyring, 136 struct key *key, 137 const void *payload, size_t plen, 138 unsigned long flags, bool create); 139 #else 140 static inline void ima_post_key_create_or_update(struct key *keyring, 141 struct key *key, 142 const void *payload, 143 size_t plen, 144 unsigned long flags, 145 bool create) {} 146 #endif /* CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS */ 147 148 #ifdef CONFIG_IMA_APPRAISE 149 extern bool is_ima_appraise_enabled(void); 150 extern void ima_inode_post_setattr(struct dentry *dentry); 151 extern int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name, 152 const void *xattr_value, size_t xattr_value_len); 153 extern int ima_inode_removexattr(struct dentry *dentry, const char *xattr_name); 154 #else 155 static inline bool is_ima_appraise_enabled(void) 156 { 157 return 0; 158 } 159 160 static inline void ima_inode_post_setattr(struct dentry *dentry) 161 { 162 return; 163 } 164 165 static inline int ima_inode_setxattr(struct dentry *dentry, 166 const char *xattr_name, 167 const void *xattr_value, 168 size_t xattr_value_len) 169 { 170 return 0; 171 } 172 173 static inline int ima_inode_removexattr(struct dentry *dentry, 174 const char *xattr_name) 175 { 176 return 0; 177 } 178 #endif /* CONFIG_IMA_APPRAISE */ 179 180 #if defined(CONFIG_IMA_APPRAISE) && defined(CONFIG_INTEGRITY_TRUSTED_KEYRING) 181 extern bool ima_appraise_signature(enum kernel_read_file_id func); 182 #else 183 static inline bool ima_appraise_signature(enum kernel_read_file_id func) 184 { 185 return false; 186 } 187 #endif /* CONFIG_IMA_APPRAISE && CONFIG_INTEGRITY_TRUSTED_KEYRING */ 188 #endif /* _LINUX_IMA_H */ 189