1 /* 2 * Linux Security Module interfaces 3 * 4 * Copyright (C) 2001 WireX Communications, Inc <[email protected]> 5 * Copyright (C) 2001 Greg Kroah-Hartman <[email protected]> 6 * Copyright (C) 2001 Networks Associates Technology, Inc <[email protected]> 7 * Copyright (C) 2001 James Morris <[email protected]> 8 * Copyright (C) 2001 Silicon Graphics, Inc. (Trust Technology Group) 9 * Copyright (C) 2015 Intel Corporation. 10 * Copyright (C) 2015 Casey Schaufler <[email protected]> 11 * Copyright (C) 2016 Mellanox Techonologies 12 * 13 * This program is free software; you can redistribute it and/or modify 14 * it under the terms of the GNU General Public License as published by 15 * the Free Software Foundation; either version 2 of the License, or 16 * (at your option) any later version. 17 * 18 * Due to this file being licensed under the GPL there is controversy over 19 * whether this permits you to write a module that #includes this file 20 * without placing your module under the GPL. Please consult a lawyer for 21 * advice before doing this. 22 * 23 */ 24 25 #ifndef __LINUX_LSM_HOOKS_H 26 #define __LINUX_LSM_HOOKS_H 27 28 #include <uapi/linux/lsm.h> 29 #include <linux/security.h> 30 #include <linux/init.h> 31 #include <linux/rculist.h> 32 #include <linux/xattr.h> 33 34 union security_list_options { 35 #define LSM_HOOK(RET, DEFAULT, NAME, ...) RET (*NAME)(__VA_ARGS__); 36 #include "lsm_hook_defs.h" 37 #undef LSM_HOOK 38 }; 39 40 struct security_hook_heads { 41 #define LSM_HOOK(RET, DEFAULT, NAME, ...) struct hlist_head NAME; 42 #include "lsm_hook_defs.h" 43 #undef LSM_HOOK 44 } __randomize_layout; 45 46 /** 47 * struct lsm_id - Identify a Linux Security Module. 48 * @lsm: name of the LSM, must be approved by the LSM maintainers 49 * @id: LSM ID number from uapi/linux/lsm.h 50 * 51 * Contains the information that identifies the LSM. 52 */ 53 struct lsm_id { 54 const char *name; 55 u64 id; 56 }; 57 58 /* 59 * Security module hook list structure. 60 * For use with generic list macros for common operations. 61 */ 62 struct security_hook_list { 63 struct hlist_node list; 64 struct hlist_head *head; 65 union security_list_options hook; 66 const struct lsm_id *lsmid; 67 } __randomize_layout; 68 69 /* 70 * Security blob size or offset data. 71 */ 72 struct lsm_blob_sizes { 73 int lbs_cred; 74 int lbs_file; 75 int lbs_ib; 76 int lbs_inode; 77 int lbs_sock; 78 int lbs_superblock; 79 int lbs_ipc; 80 int lbs_key; 81 int lbs_msg_msg; 82 int lbs_perf_event; 83 int lbs_task; 84 int lbs_xattr_count; /* number of xattr slots in new_xattrs array */ 85 int lbs_tun_dev; 86 int lbs_bdev; 87 }; 88 89 /* 90 * LSM_RET_VOID is used as the default value in LSM_HOOK definitions for void 91 * LSM hooks (in include/linux/lsm_hook_defs.h). 92 */ 93 #define LSM_RET_VOID ((void) 0) 94 95 /* 96 * Initializing a security_hook_list structure takes 97 * up a lot of space in a source file. This macro takes 98 * care of the common case and reduces the amount of 99 * text involved. 100 */ 101 #define LSM_HOOK_INIT(HEAD, HOOK) \ 102 { .head = &security_hook_heads.HEAD, .hook = { .HEAD = HOOK } } 103 104 extern void security_add_hooks(struct security_hook_list *hooks, int count, 105 const struct lsm_id *lsmid); 106 107 #define LSM_FLAG_LEGACY_MAJOR BIT(0) 108 #define LSM_FLAG_EXCLUSIVE BIT(1) 109 110 enum lsm_order { 111 LSM_ORDER_FIRST = -1, /* This is only for capabilities. */ 112 LSM_ORDER_MUTABLE = 0, 113 LSM_ORDER_LAST = 1, /* This is only for integrity. */ 114 }; 115 116 struct lsm_info { 117 const char *name; /* Required. */ 118 enum lsm_order order; /* Optional: default is LSM_ORDER_MUTABLE */ 119 unsigned long flags; /* Optional: flags describing LSM */ 120 int *enabled; /* Optional: controlled by CONFIG_LSM */ 121 int (*init)(void); /* Required. */ 122 struct lsm_blob_sizes *blobs; /* Optional: for blob sharing. */ 123 }; 124 125 #define DEFINE_LSM(lsm) \ 126 static struct lsm_info __lsm_##lsm \ 127 __used __section(".lsm_info.init") \ 128 __aligned(sizeof(unsigned long)) 129 130 #define DEFINE_EARLY_LSM(lsm) \ 131 static struct lsm_info __early_lsm_##lsm \ 132 __used __section(".early_lsm_info.init") \ 133 __aligned(sizeof(unsigned long)) 134 135 /* DO NOT tamper with these variables outside of the LSM framework */ 136 extern char *lsm_names; 137 extern struct security_hook_heads security_hook_heads; 138 extern struct lsm_static_calls_table static_calls_table __ro_after_init; 139 extern struct lsm_info __start_lsm_info[], __end_lsm_info[]; 140 extern struct lsm_info __start_early_lsm_info[], __end_early_lsm_info[]; 141 142 /** 143 * lsm_get_xattr_slot - Return the next available slot and increment the index 144 * @xattrs: array storing LSM-provided xattrs 145 * @xattr_count: number of already stored xattrs (updated) 146 * 147 * Retrieve the first available slot in the @xattrs array to fill with an xattr, 148 * and increment @xattr_count. 149 * 150 * Return: The slot to fill in @xattrs if non-NULL, NULL otherwise. 151 */ 152 static inline struct xattr *lsm_get_xattr_slot(struct xattr *xattrs, 153 int *xattr_count) 154 { 155 if (unlikely(!xattrs)) 156 return NULL; 157 return &xattrs[(*xattr_count)++]; 158 } 159 160 #endif /* ! __LINUX_LSM_HOOKS_H */ 161