bpf_lsm.h

  1/* SPDX-License-Identifier: GPL-2.0 */
  2
  3/*
  4 * Copyright (C) 2020 Google LLC.
  5 */
  6
  7#ifndef _LINUX_BPF_LSM_H
  8#define _LINUX_BPF_LSM_H
  9
 10#include <linux/sched.h>
 11#include <linux/bpf.h>
 12#include <linux/bpf_verifier.h>
 13#include <linux/lsm_hooks.h>
 14
 15#ifdef CONFIG_BPF_LSM
 16
 17#define LSM_HOOK(RET, DEFAULT, NAME, ...) \
 18	RET bpf_lsm_##NAME(__VA_ARGS__);
 19#include <linux/lsm_hook_defs.h>
 20#undef LSM_HOOK
 21
 22struct bpf_storage_blob {
 23	struct bpf_local_storage __rcu *storage;
 24};
 25
 26extern struct lsm_blob_sizes bpf_lsm_blob_sizes;
 27
 28int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
 29			const struct bpf_prog *prog);
 30
 31bool bpf_lsm_is_sleepable_hook(u32 btf_id);
 32bool bpf_lsm_is_trusted(const struct bpf_prog *prog);
 33
 34static inline struct bpf_storage_blob *bpf_inode(
 35	const struct inode *inode)
 36{
 37	if (unlikely(!inode->i_security))
 38		return NULL;
 39
 40	return inode->i_security + bpf_lsm_blob_sizes.lbs_inode;
 41}
 42
 43extern const struct bpf_func_proto bpf_inode_storage_get_proto;
 44extern const struct bpf_func_proto bpf_inode_storage_delete_proto;
 45void bpf_inode_storage_free(struct inode *inode);
 46
 47void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog, bpf_func_t *bpf_func);
 48
 49int bpf_lsm_get_retval_range(const struct bpf_prog *prog,
 50			     struct bpf_retval_range *range);
 51int bpf_set_dentry_xattr_locked(struct dentry *dentry, const char *name__str,
 52				const struct bpf_dynptr *value_p, int flags);
 53int bpf_remove_dentry_xattr_locked(struct dentry *dentry, const char *name__str);
 54bool bpf_lsm_has_d_inode_locked(const struct bpf_prog *prog);
 55
 56#else /* !CONFIG_BPF_LSM */
 57
 58static inline bool bpf_lsm_is_sleepable_hook(u32 btf_id)
 59{
 60	return false;
 61}
 62
 63static inline bool bpf_lsm_is_trusted(const struct bpf_prog *prog)
 64{
 65	return false;
 66}
 67
 68static inline int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
 69				      const struct bpf_prog *prog)
 70{
 71	return -EOPNOTSUPP;
 72}
 73
 74static inline struct bpf_storage_blob *bpf_inode(
 75	const struct inode *inode)
 76{
 77	return NULL;
 78}
 79
 80static inline void bpf_inode_storage_free(struct inode *inode)
 81{
 82}
 83
 84static inline void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog,
 85					   bpf_func_t *bpf_func)
 86{
 87}
 88
 89static inline int bpf_lsm_get_retval_range(const struct bpf_prog *prog,
 90					   struct bpf_retval_range *range)
 91{
 92	return -EOPNOTSUPP;
 93}
 94static inline int bpf_set_dentry_xattr_locked(struct dentry *dentry, const char *name__str,
 95					      const struct bpf_dynptr *value_p, int flags)
 96{
 97	return -EOPNOTSUPP;
 98}
 99static inline int bpf_remove_dentry_xattr_locked(struct dentry *dentry, const char *name__str)
100{
101	return -EOPNOTSUPP;
102}
103static inline bool bpf_lsm_has_d_inode_locked(const struct bpf_prog *prog)
104{
105	return false;
106}
107#endif /* CONFIG_BPF_LSM */
108
109#endif /* _LINUX_BPF_LSM_H */