lsm_syscalls.c

  1// SPDX-License-Identifier: GPL-2.0-only
  2/*
  3 * System calls implementing the Linux Security Module API.
  4 *
  5 *  Copyright (C) 2022 Casey Schaufler <casey@schaufler-ca.com>
  6 *  Copyright (C) 2022 Intel Corporation
  7 */
  8
  9#include <asm/current.h>
 10#include <linux/compiler_types.h>
 11#include <linux/err.h>
 12#include <linux/errno.h>
 13#include <linux/security.h>
 14#include <linux/stddef.h>
 15#include <linux/syscalls.h>
 16#include <linux/types.h>
 17#include <linux/lsm_hooks.h>
 18#include <uapi/linux/lsm.h>
 19
 20#include "lsm.h"
 21
 22/**
 23 * lsm_name_to_attr - map an LSM attribute name to its ID
 24 * @name: name of the attribute
 25 *
 26 * Returns the LSM attribute value associated with @name, or 0 if
 27 * there is no mapping.
 28 */
 29u64 lsm_name_to_attr(const char *name)
 30{
 31	if (!strcmp(name, "current"))
 32		return LSM_ATTR_CURRENT;
 33	if (!strcmp(name, "exec"))
 34		return LSM_ATTR_EXEC;
 35	if (!strcmp(name, "fscreate"))
 36		return LSM_ATTR_FSCREATE;
 37	if (!strcmp(name, "keycreate"))
 38		return LSM_ATTR_KEYCREATE;
 39	if (!strcmp(name, "prev"))
 40		return LSM_ATTR_PREV;
 41	if (!strcmp(name, "sockcreate"))
 42		return LSM_ATTR_SOCKCREATE;
 43	return LSM_ATTR_UNDEF;
 44}
 45
 46/**
 47 * sys_lsm_set_self_attr - Set current task's security module attribute
 48 * @attr: which attribute to set
 49 * @ctx: the LSM contexts
 50 * @size: size of @ctx
 51 * @flags: reserved for future use
 52 *
 53 * Sets the calling task's LSM context. On success this function
 54 * returns 0. If the attribute specified cannot be set a negative
 55 * value indicating the reason for the error is returned.
 56 */
 57SYSCALL_DEFINE4(lsm_set_self_attr, unsigned int, attr, struct lsm_ctx __user *,
 58		ctx, u32, size, u32, flags)
 59{
 60	return security_setselfattr(attr, ctx, size, flags);
 61}
 62
 63/**
 64 * sys_lsm_get_self_attr - Return current task's security module attributes
 65 * @attr: which attribute to return
 66 * @ctx: the user-space destination for the information, or NULL
 67 * @size: pointer to the size of space available to receive the data
 68 * @flags: special handling options. LSM_FLAG_SINGLE indicates that only
 69 * attributes associated with the LSM identified in the passed @ctx be
 70 * reported.
 71 *
 72 * Returns the calling task's LSM contexts. On success this
 73 * function returns the number of @ctx array elements. This value
 74 * may be zero if there are no LSM contexts assigned. If @size is
 75 * insufficient to contain the return data -E2BIG is returned and
 76 * @size is set to the minimum required size. In all other cases
 77 * a negative value indicating the error is returned.
 78 */
 79SYSCALL_DEFINE4(lsm_get_self_attr, unsigned int, attr, struct lsm_ctx __user *,
 80		ctx, u32 __user *, size, u32, flags)
 81{
 82	return security_getselfattr(attr, ctx, size, flags);
 83}
 84
 85/**
 86 * sys_lsm_list_modules - Return a list of the active security modules
 87 * @ids: the LSM module ids
 88 * @size: pointer to size of @ids, updated on return
 89 * @flags: reserved for future use, must be zero
 90 *
 91 * Returns a list of the active LSM ids. On success this function
 92 * returns the number of @ids array elements. This value may be zero
 93 * if there are no LSMs active. If @size is insufficient to contain
 94 * the return data -E2BIG is returned and @size is set to the minimum
 95 * required size. In all other cases a negative value indicating the
 96 * error is returned.
 97 */
 98SYSCALL_DEFINE3(lsm_list_modules, u64 __user *, ids, u32 __user *, size,
 99		u32, flags)
100{
101	u32 total_size = lsm_active_cnt * sizeof(*ids);
102	u32 usize;
103	int i;
104
105	if (flags)
106		return -EINVAL;
107
108	if (get_user(usize, size))
109		return -EFAULT;
110
111	if (put_user(total_size, size) != 0)
112		return -EFAULT;
113
114	if (usize < total_size)
115		return -E2BIG;
116
117	for (i = 0; i < lsm_active_cnt; i++)
118		if (put_user(lsm_idlist[i]->id, ids++))
119			return -EFAULT;
120
121	return lsm_active_cnt;
122}