1 /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ 2 /* 3 * Linux Security Modules (LSM) - User space API 4 * 5 * Copyright (C) 2022 Casey Schaufler <[email protected]> 6 * Copyright (C) 2022 Intel Corporation 7 */ 8 9 #ifndef _UAPI_LINUX_LSM_H 10 #define _UAPI_LINUX_LSM_H 11 12 #include <linux/types.h> 13 #include <linux/unistd.h> 14 15 /** 16 * struct lsm_ctx - LSM context information 17 * @id: the LSM id number, see LSM_ID_XXX 18 * @flags: LSM specific flags 19 * @len: length of the lsm_ctx struct, @ctx and any other data or padding 20 * @ctx_len: the size of @ctx 21 * @ctx: the LSM context value 22 * 23 * The @len field MUST be equal to the size of the lsm_ctx struct 24 * plus any additional padding and/or data placed after @ctx. 25 * 26 * In all cases @ctx_len MUST be equal to the length of @ctx. 27 * If @ctx is a string value it should be nul terminated with 28 * @ctx_len equal to `strlen(@ctx) + 1`. Binary values are 29 * supported. 30 * 31 * The @flags and @ctx fields SHOULD only be interpreted by the 32 * LSM specified by @id; they MUST be set to zero/0 when not used. 33 */ 34 struct lsm_ctx { 35 __u64 id; 36 __u64 flags; 37 __u64 len; 38 __u64 ctx_len; 39 __u8 ctx[]; 40 }; 41 42 /* 43 * ID tokens to identify Linux Security Modules (LSMs) 44 * 45 * These token values are used to uniquely identify specific LSMs 46 * in the kernel as well as in the kernel's LSM userspace API. 47 * 48 * A value of zero/0 is considered undefined and should not be used 49 * outside the kernel. Values 1-99 are reserved for potential 50 * future use. 51 */ 52 #define LSM_ID_UNDEF 0 53 #define LSM_ID_CAPABILITY 100 54 #define LSM_ID_SELINUX 101 55 #define LSM_ID_SMACK 102 56 #define LSM_ID_TOMOYO 103 57 #define LSM_ID_APPARMOR 104 58 #define LSM_ID_YAMA 105 59 #define LSM_ID_LOADPIN 106 60 #define LSM_ID_SAFESETID 107 61 #define LSM_ID_LOCKDOWN 108 62 #define LSM_ID_BPF 109 63 #define LSM_ID_LANDLOCK 110 64 65 /* 66 * LSM_ATTR_XXX definitions identify different LSM attributes 67 * which are used in the kernel's LSM userspace API. Support 68 * for these attributes vary across the different LSMs. None 69 * are required. 70 * 71 * A value of zero/0 is considered undefined and should not be used 72 * outside the kernel. Values 1-99 are reserved for potential 73 * future use. 74 */ 75 #define LSM_ATTR_UNDEF 0 76 #define LSM_ATTR_CURRENT 100 77 #define LSM_ATTR_EXEC 101 78 #define LSM_ATTR_FSCREATE 102 79 #define LSM_ATTR_KEYCREATE 103 80 #define LSM_ATTR_PREV 104 81 #define LSM_ATTR_SOCKCREATE 105 82 83 /* 84 * LSM_FLAG_XXX definitions identify special handling instructions 85 * for the API. 86 */ 87 #define LSM_FLAG_SINGLE 0x0001 88 89 #endif /* _UAPI_LINUX_LSM_H */ 90