ipe.c

  1// SPDX-License-Identifier: GPL-2.0
  2/*
  3 * Copyright (C) 2020-2024 Microsoft Corporation. All rights reserved.
  4 */
  5#include <uapi/linux/lsm.h>
  6
  7#include "ipe.h"
  8#include "eval.h"
  9#include "hooks.h"
 10
 11extern const char *const ipe_boot_policy;
 12bool ipe_enabled;
 13
 14static struct lsm_blob_sizes ipe_blobs __ro_after_init = {
 15	.lbs_superblock = sizeof(struct ipe_superblock),
 16#ifdef CONFIG_IPE_PROP_DM_VERITY
 17	.lbs_bdev = sizeof(struct ipe_bdev),
 18#endif /* CONFIG_IPE_PROP_DM_VERITY */
 19#ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG
 20	.lbs_inode = sizeof(struct ipe_inode),
 21#endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */
 22};
 23
 24static const struct lsm_id ipe_lsmid = {
 25	.name = "ipe",
 26	.id = LSM_ID_IPE,
 27};
 28
 29struct ipe_superblock *ipe_sb(const struct super_block *sb)
 30{
 31	return sb->s_security + ipe_blobs.lbs_superblock;
 32}
 33
 34#ifdef CONFIG_IPE_PROP_DM_VERITY
 35struct ipe_bdev *ipe_bdev(struct block_device *b)
 36{
 37	return b->bd_security + ipe_blobs.lbs_bdev;
 38}
 39#endif /* CONFIG_IPE_PROP_DM_VERITY */
 40
 41#ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG
 42struct ipe_inode *ipe_inode(const struct inode *inode)
 43{
 44	return inode->i_security + ipe_blobs.lbs_inode;
 45}
 46#endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */
 47
 48static struct security_hook_list ipe_hooks[] __ro_after_init = {
 49	LSM_HOOK_INIT(bprm_check_security, ipe_bprm_check_security),
 50	LSM_HOOK_INIT(bprm_creds_for_exec, ipe_bprm_creds_for_exec),
 51	LSM_HOOK_INIT(mmap_file, ipe_mmap_file),
 52	LSM_HOOK_INIT(file_mprotect, ipe_file_mprotect),
 53	LSM_HOOK_INIT(kernel_read_file, ipe_kernel_read_file),
 54	LSM_HOOK_INIT(kernel_load_data, ipe_kernel_load_data),
 55	LSM_HOOK_INIT(initramfs_populated, ipe_unpack_initramfs),
 56#ifdef CONFIG_IPE_PROP_DM_VERITY
 57	LSM_HOOK_INIT(bdev_free_security, ipe_bdev_free_security),
 58	LSM_HOOK_INIT(bdev_setintegrity, ipe_bdev_setintegrity),
 59#endif /* CONFIG_IPE_PROP_DM_VERITY */
 60#ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG
 61	LSM_HOOK_INIT(inode_setintegrity, ipe_inode_setintegrity),
 62#endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */
 63};
 64
 65/**
 66 * ipe_init() - Entry point of IPE.
 67 *
 68 * This is called at LSM init, which happens occurs early during kernel
 69 * start up. During this phase, IPE registers its hooks and loads the
 70 * builtin boot policy.
 71 *
 72 * Return:
 73 * * %0		- OK
 74 * * %-ENOMEM	- Out of memory (OOM)
 75 */
 76static int __init ipe_init(void)
 77{
 78	struct ipe_policy *p = NULL;
 79
 80	security_add_hooks(ipe_hooks, ARRAY_SIZE(ipe_hooks), &ipe_lsmid);
 81	ipe_enabled = true;
 82
 83	if (ipe_boot_policy) {
 84		p = ipe_new_policy(ipe_boot_policy, strlen(ipe_boot_policy),
 85				   NULL, 0);
 86		if (IS_ERR(p))
 87			return PTR_ERR(p);
 88
 89		rcu_assign_pointer(ipe_active_policy, p);
 90	}
 91
 92	return 0;
 93}
 94
 95DEFINE_LSM(ipe) = {
 96	.id = &ipe_lsmid,
 97	.init = ipe_init,
 98	.blobs = &ipe_blobs,
 99	.initcall_fs = ipe_init_securityfs,
100};