| 1 |
|
| 2 | |
| 3 | * Copyright (C) 2020-2024 Microsoft Corporation. All rights reserved.
|
| 4 |
|
| 5 | #ifndef _IPE_HOOKS_H
|
| 6 | #define _IPE_HOOKS_H
|
| 7 |
|
| 8 | #include <linux/fs.h>
|
| 9 | #include <linux/binfmts.h>
|
| 10 | #include <linux/security.h>
|
| 11 | #include <linux/blk_types.h>
|
| 12 | #include <linux/fsverity.h>
|
| 13 |
|
| 14 | enum ipe_hook_type {
|
| 15 | IPE_HOOK_BPRM_CHECK = 0,
|
| 16 | IPE_HOOK_BPRM_CREDS_FOR_EXEC,
|
| 17 | IPE_HOOK_MMAP,
|
| 18 | IPE_HOOK_MPROTECT,
|
| 19 | IPE_HOOK_KERNEL_READ,
|
| 20 | IPE_HOOK_KERNEL_LOAD,
|
| 21 | __IPE_HOOK_MAX
|
| 22 | };
|
| 23 |
|
| 24 | #define IPE_HOOK_INVALID __IPE_HOOK_MAX
|
| 25 |
|
| 26 | int ipe_bprm_check_security(struct linux_binprm *bprm);
|
| 27 |
|
| 28 | int ipe_bprm_creds_for_exec(struct linux_binprm *bprm);
|
| 29 |
|
| 30 | int ipe_mmap_file(struct file *f, unsigned long reqprot, unsigned long prot,
|
| 31 | unsigned long flags);
|
| 32 |
|
| 33 | int ipe_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
|
| 34 | unsigned long prot);
|
| 35 |
|
| 36 | int ipe_kernel_read_file(struct file *file, enum kernel_read_file_id id,
|
| 37 | bool contents);
|
| 38 |
|
| 39 | int ipe_kernel_load_data(enum kernel_load_data_id id, bool contents);
|
| 40 |
|
| 41 | void ipe_unpack_initramfs(void);
|
| 42 |
|
| 43 | #ifdef CONFIG_IPE_PROP_DM_VERITY
|
| 44 | void ipe_bdev_free_security(struct block_device *bdev);
|
| 45 |
|
| 46 | int ipe_bdev_setintegrity(struct block_device *bdev, enum lsm_integrity_type type,
|
| 47 | const void *value, size_t len);
|
| 48 | #endif
|
| 49 |
|
| 50 | #ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG
|
| 51 | int ipe_inode_setintegrity(const struct inode *inode, enum lsm_integrity_type type,
|
| 52 | const void *value, size_t size);
|
| 53 | #endif
|
| 54 |
|
| 55 | #endif
|