| access.h (622e2f5954763385c4fa1f9a11a11366952a9b60) | access.h (d6c7cf84a24fff332ff65ffe236302216474b834) |
|---|---|
| 1/* SPDX-License-Identifier: GPL-2.0-only */ 2/* 3 * Landlock LSM - Access types and helpers 4 * 5 * Copyright © 2016-2020 Mickaël Salaün <mic@digikod.net> 6 * Copyright © 2018-2020 ANSSI 7 * Copyright © 2024-2025 Microsoft Corporation 8 */ --- 6 unchanged lines hidden (view full) --- 15#include <linux/kernel.h> 16#include <uapi/linux/landlock.h> 17 18#include "limits.h" 19 20/* 21 * All access rights that are denied by default whether they are handled or not 22 * by a ruleset/layer. This must be ORed with all ruleset->access_masks[] | 1/* SPDX-License-Identifier: GPL-2.0-only */ 2/* 3 * Landlock LSM - Access types and helpers 4 * 5 * Copyright © 2016-2020 Mickaël Salaün <mic@digikod.net> 6 * Copyright © 2018-2020 ANSSI 7 * Copyright © 2024-2025 Microsoft Corporation 8 */ --- 6 unchanged lines hidden (view full) --- 15#include <linux/kernel.h> 16#include <uapi/linux/landlock.h> 17 18#include "limits.h" 19 20/* 21 * All access rights that are denied by default whether they are handled or not 22 * by a ruleset/layer. This must be ORed with all ruleset->access_masks[] |
| 23 * entries when we need to get the absolute handled access masks. | 23 * entries when we need to get the absolute handled access masks, see 24 * landlock_upgrade_handled_access_masks(). |
| 24 */ 25/* clang-format off */ 26#define _LANDLOCK_ACCESS_FS_INITIALLY_DENIED ( \ 27 LANDLOCK_ACCESS_FS_REFER) 28/* clang-format on */ 29 30typedef u16 access_mask_t; 31 --- 22 unchanged lines hidden (view full) --- 54static_assert(sizeof(typeof_member(union access_masks_all, masks)) == 55 sizeof(typeof_member(union access_masks_all, all))); 56 57typedef u16 layer_mask_t; 58 59/* Makes sure all layers can be checked. */ 60static_assert(BITS_PER_TYPE(layer_mask_t) >= LANDLOCK_MAX_NUM_LAYERS); 61 | 25 */ 26/* clang-format off */ 27#define _LANDLOCK_ACCESS_FS_INITIALLY_DENIED ( \ 28 LANDLOCK_ACCESS_FS_REFER) 29/* clang-format on */ 30 31typedef u16 access_mask_t; 32 --- 22 unchanged lines hidden (view full) --- 55static_assert(sizeof(typeof_member(union access_masks_all, masks)) == 56 sizeof(typeof_member(union access_masks_all, all))); 57 58typedef u16 layer_mask_t; 59 60/* Makes sure all layers can be checked. */ 61static_assert(BITS_PER_TYPE(layer_mask_t) >= LANDLOCK_MAX_NUM_LAYERS); 62 |
| 63/* Upgrades with all initially denied by default access rights. */ 64static inline struct access_masks 65landlock_upgrade_handled_access_masks(struct access_masks access_masks) 66{ 67 /* 68 * All access rights that are denied by default whether they are 69 * explicitly handled or not. 70 */ 71 if (access_masks.fs) 72 access_masks.fs |= _LANDLOCK_ACCESS_FS_INITIALLY_DENIED; 73 74 return access_masks; 75} 76 |
|
| 62#endif /* _SECURITY_LANDLOCK_ACCESS_H */ | 77#endif /* _SECURITY_LANDLOCK_ACCESS_H */ |