projects/linux·blob master · refs

129 lines · 3.8 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * System calls implementing the Linux Security Module API.
4 *
5 * Copyright (C) 2022 Casey Schaufler <[email protected]>
6 * Copyright (C) 2022 Intel Corporation
7 */
8
9#include <asm/current.h>
10#include <linux/compiler_types.h>
11#include <linux/err.h>
12#include <linux/errno.h>
13#include <linux/security.h>
14#include <linux/stddef.h>
15#include <linux/syscalls.h>
16#include <linux/types.h>
17#include <linux/lsm_hooks.h>
18#include <uapi/linux/lsm.h>
19
20#include "lsm.h"
21
22/**
23 * lsm_name_to_attr - map an LSM attribute name to its ID
24 * @name: name of the attribute
25 *
26 * Returns the LSM attribute value associated with @name, or 0 if
27 * there is no mapping.
28 */
29u64 lsm_name_to_attr(const char *name)
30{
31 if (!strcmp(name, "current"))
32 return LSM_ATTR_CURRENT;
33 if (!strcmp(name, "exec"))
34 return LSM_ATTR_EXEC;
35 if (!strcmp(name, "fscreate"))
36 return LSM_ATTR_FSCREATE;
37 if (!strcmp(name, "keycreate"))
38 return LSM_ATTR_KEYCREATE;
39 if (!strcmp(name, "prev"))
40 return LSM_ATTR_PREV;
41 if (!strcmp(name, "sockcreate"))
42 return LSM_ATTR_SOCKCREATE;
43 return LSM_ATTR_UNDEF;
44}
45
46/**
47 * sys_lsm_set_self_attr - Set current task's security module attribute
48 * @attr: which attribute to set
49 * @ctx: the LSM contexts
50 * @size: size of @ctx
51 * @flags: reserved for future use
52 *
53 * Sets the calling task's LSM context. On success this function
54 * returns 0. If the attribute specified cannot be set a negative
55 * value indicating the reason for the error is returned.
56 */
57SYSCALL_DEFINE4(lsm_set_self_attr, unsigned int, attr, struct lsm_ctx __user *,
58 ctx, u32, size, u32, flags)
59{
60 int rc;
61
62 rc = mutex_lock_interruptible(&current->signal->cred_guard_mutex);
63 if (rc < 0)
64 return rc;
65 rc = security_setselfattr(attr, ctx, size, flags);
66 mutex_unlock(&current->signal->cred_guard_mutex);
67 return rc;
68}
69
70/**
71 * sys_lsm_get_self_attr - Return current task's security module attributes
72 * @attr: which attribute to return
73 * @ctx: the user-space destination for the information, or NULL
74 * @size: pointer to the size of space available to receive the data
75 * @flags: special handling options. LSM_FLAG_SINGLE indicates that only
76 * attributes associated with the LSM identified in the passed @ctx be
77 * reported.
78 *
79 * Returns the calling task's LSM contexts. On success this
80 * function returns the number of @ctx array elements. This value
81 * may be zero if there are no LSM contexts assigned. If @size is
82 * insufficient to contain the return data -E2BIG is returned and
83 * @size is set to the minimum required size. In all other cases
84 * a negative value indicating the error is returned.
85 */
86SYSCALL_DEFINE4(lsm_get_self_attr, unsigned int, attr, struct lsm_ctx __user *,
87 ctx, u32 __user *, size, u32, flags)
88{
89 return security_getselfattr(attr, ctx, size, flags);
90}
91
92/**
93 * sys_lsm_list_modules - Return a list of the active security modules
94 * @ids: the LSM module ids
95 * @size: pointer to size of @ids, updated on return
96 * @flags: reserved for future use, must be zero
97 *
98 * Returns a list of the active LSM ids. On success this function
99 * returns the number of @ids array elements. This value may be zero
100 * if there are no LSMs active. If @size is insufficient to contain
101 * the return data -E2BIG is returned and @size is set to the minimum
102 * required size. In all other cases a negative value indicating the
103 * error is returned.
104 */
105SYSCALL_DEFINE3(lsm_list_modules, u64 __user *, ids, u32 __user *, size,
106 u32, flags)
107{
108 u32 total_size = lsm_active_cnt * sizeof(*ids);
109 u32 usize;
110 int i;
111
112 if (flags)
113 return -EINVAL;
114
115 if (get_user(usize, size))
116 return -EFAULT;
117
118 if (put_user(total_size, size) != 0)
119 return -EFAULT;
120
121 if (usize < total_size)
122 return -E2BIG;
123
124 for (i = 0; i < lsm_active_cnt; i++)
125 if (put_user(lsm_idlist[i]->id, ids++))
126 return -EFAULT;
127
128 return lsm_active_cnt;
129}