| 1 | |
| 2 | |
| 3 | * Copyright (C) 2020-2024 Microsoft Corporation. All rights reserved.
|
| 4 |
|
| 5 | #include <uapi/linux/lsm.h>
|
| 6 |
|
| 7 | #include "ipe.h"
|
| 8 | #include "eval.h"
|
| 9 | #include "hooks.h"
|
| 10 |
|
| 11 | extern const char *const ipe_boot_policy;
|
| 12 | bool ipe_enabled;
|
| 13 |
|
| 14 | static struct lsm_blob_sizes ipe_blobs __ro_after_init = {
|
| 15 | .lbs_superblock = sizeof(struct ipe_superblock),
|
| 16 | #ifdef CONFIG_IPE_PROP_DM_VERITY
|
| 17 | .lbs_bdev = sizeof(struct ipe_bdev),
|
| 18 | #endif
|
| 19 | #ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG
|
| 20 | .lbs_inode = sizeof(struct ipe_inode),
|
| 21 | #endif
|
| 22 | };
|
| 23 |
|
| 24 | static const struct lsm_id ipe_lsmid = {
|
| 25 | .name = "ipe",
|
| 26 | .id = LSM_ID_IPE,
|
| 27 | };
|
| 28 |
|
| 29 | struct ipe_superblock *ipe_sb(const struct super_block *sb)
|
| 30 | {
|
| 31 | return sb->s_security + ipe_blobs.lbs_superblock;
|
| 32 | }
|
| 33 |
|
| 34 | #ifdef CONFIG_IPE_PROP_DM_VERITY
|
| 35 | struct ipe_bdev *ipe_bdev(struct block_device *b)
|
| 36 | {
|
| 37 | return b->bd_security + ipe_blobs.lbs_bdev;
|
| 38 | }
|
| 39 | #endif
|
| 40 |
|
| 41 | #ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG
|
| 42 | struct ipe_inode *ipe_inode(const struct inode *inode)
|
| 43 | {
|
| 44 | return inode->i_security + ipe_blobs.lbs_inode;
|
| 45 | }
|
| 46 | #endif
|
| 47 |
|
| 48 | static struct security_hook_list ipe_hooks[] __ro_after_init = {
|
| 49 | LSM_HOOK_INIT(bprm_check_security, ipe_bprm_check_security),
|
| 50 | LSM_HOOK_INIT(bprm_creds_for_exec, ipe_bprm_creds_for_exec),
|
| 51 | LSM_HOOK_INIT(mmap_file, ipe_mmap_file),
|
| 52 | LSM_HOOK_INIT(file_mprotect, ipe_file_mprotect),
|
| 53 | LSM_HOOK_INIT(kernel_read_file, ipe_kernel_read_file),
|
| 54 | LSM_HOOK_INIT(kernel_load_data, ipe_kernel_load_data),
|
| 55 | LSM_HOOK_INIT(initramfs_populated, ipe_unpack_initramfs),
|
| 56 | #ifdef CONFIG_IPE_PROP_DM_VERITY
|
| 57 | LSM_HOOK_INIT(bdev_free_security, ipe_bdev_free_security),
|
| 58 | LSM_HOOK_INIT(bdev_setintegrity, ipe_bdev_setintegrity),
|
| 59 | #endif
|
| 60 | #ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG
|
| 61 | LSM_HOOK_INIT(inode_setintegrity, ipe_inode_setintegrity),
|
| 62 | #endif
|
| 63 | };
|
| 64 |
|
| 65 | |
| 66 | * ipe_init() - Entry point of IPE.
|
| 67 | *
|
| 68 | * This is called at LSM init, which happens occurs early during kernel
|
| 69 | * start up. During this phase, IPE registers its hooks and loads the
|
| 70 | * builtin boot policy.
|
| 71 | *
|
| 72 | * Return:
|
| 73 | * * %0 - OK
|
| 74 | * * %-ENOMEM - Out of memory (OOM)
|
| 75 |
|
| 76 | static int __init ipe_init(void)
|
| 77 | {
|
| 78 | struct ipe_policy *p = NULL;
|
| 79 |
|
| 80 | security_add_hooks(ipe_hooks, ARRAY_SIZE(ipe_hooks), &ipe_lsmid);
|
| 81 | ipe_enabled = true;
|
| 82 |
|
| 83 | if (ipe_boot_policy) {
|
| 84 | p = ipe_new_policy(ipe_boot_policy, strlen(ipe_boot_policy),
|
| 85 | NULL, 0);
|
| 86 | if (IS_ERR(p))
|
| 87 | return PTR_ERR(p);
|
| 88 |
|
| 89 | rcu_assign_pointer(ipe_active_policy, p);
|
| 90 | }
|
| 91 |
|
| 92 | return 0;
|
| 93 | }
|
| 94 |
|
| 95 | DEFINE_LSM(ipe) = {
|
| 96 | .id = &ipe_lsmid,
|
| 97 | .init = ipe_init,
|
| 98 | .blobs = &ipe_blobs,
|
| 99 | .initcall_fs = ipe_init_securityfs,
|
| 100 | };
|