1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Landlock - Credential hooks 4 * 5 * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net> 6 * Copyright © 2018-2020 ANSSI 7 * Copyright © 2024-2025 Microsoft Corporation 8 */ 9 10 #include <linux/binfmts.h> 11 #include <linux/cred.h> 12 #include <linux/lsm_hooks.h> 13 14 #include "common.h" 15 #include "cred.h" 16 #include "ruleset.h" 17 #include "setup.h" 18 19 static void hook_cred_transfer(struct cred *const new, 20 const struct cred *const old) 21 { 22 const struct landlock_cred_security *const old_llcred = 23 landlock_cred(old); 24 25 if (old_llcred->domain) { 26 landlock_get_ruleset(old_llcred->domain); 27 *landlock_cred(new) = *old_llcred; 28 } 29 } 30 31 static int hook_cred_prepare(struct cred *const new, 32 const struct cred *const old, const gfp_t gfp) 33 { 34 hook_cred_transfer(new, old); 35 return 0; 36 } 37 38 static void hook_cred_free(struct cred *const cred) 39 { 40 struct landlock_ruleset *const dom = landlock_cred(cred)->domain; 41 42 if (dom) 43 landlock_put_ruleset_deferred(dom); 44 } 45 46 #ifdef CONFIG_AUDIT 47 48 static int hook_bprm_creds_for_exec(struct linux_binprm *const bprm) 49 { 50 /* Resets for each execution. */ 51 landlock_cred(bprm->cred)->domain_exec = 0; 52 return 0; 53 } 54 55 #endif /* CONFIG_AUDIT */ 56 57 static struct security_hook_list landlock_hooks[] __ro_after_init = { 58 LSM_HOOK_INIT(cred_prepare, hook_cred_prepare), 59 LSM_HOOK_INIT(cred_transfer, hook_cred_transfer), 60 LSM_HOOK_INIT(cred_free, hook_cred_free), 61 62 #ifdef CONFIG_AUDIT 63 LSM_HOOK_INIT(bprm_creds_for_exec, hook_bprm_creds_for_exec), 64 #endif /* CONFIG_AUDIT */ 65 }; 66 67 __init void landlock_add_cred_hooks(void) 68 { 69 security_add_hooks(landlock_hooks, ARRAY_SIZE(landlock_hooks), 70 &landlock_lsmid); 71 } 72