1 /* SPDX-License-Identifier: GPL-2.0 */
2
3 /*
4 * Copyright (C) 2020 Google LLC.
5 */
6
7 #ifndef _LINUX_BPF_LSM_H
8 #define _LINUX_BPF_LSM_H
9
10 #include <linux/sched.h>
11 #include <linux/bpf.h>
12 #include <linux/bpf_verifier.h>
13 #include <linux/lsm_hooks.h>
14
15 #ifdef CONFIG_BPF_LSM
16
17 extern bool bpf_lsm_initialized __ro_after_init;
18
19 #define LSM_HOOK(RET, DEFAULT, NAME, ...) \
20 RET bpf_lsm_##NAME(__VA_ARGS__);
21 #include <linux/lsm_hook_defs.h>
22 #undef LSM_HOOK
23
24 struct bpf_storage_blob {
25 struct bpf_local_storage __rcu *storage;
26 };
27
28 extern struct lsm_blob_sizes bpf_lsm_blob_sizes;
29
30 int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
31 const struct bpf_prog *prog);
32
33 bool bpf_lsm_is_sleepable_hook(u32 btf_id);
34 bool bpf_lsm_is_trusted(const struct bpf_prog *prog);
35
bpf_inode(const struct inode * inode)36 static inline struct bpf_storage_blob *bpf_inode(
37 const struct inode *inode)
38 {
39 if (unlikely(!inode->i_security))
40 return NULL;
41
42 return inode->i_security + bpf_lsm_blob_sizes.lbs_inode;
43 }
44
45 extern const struct bpf_func_proto bpf_inode_storage_get_proto;
46 extern const struct bpf_func_proto bpf_inode_storage_delete_proto;
47 void bpf_inode_storage_free(struct inode *inode);
48
49 void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog, bpf_func_t *bpf_func);
50
51 int bpf_lsm_get_retval_range(const struct bpf_prog *prog,
52 struct bpf_retval_range *range);
53 int bpf_set_dentry_xattr_locked(struct dentry *dentry, const char *name__str,
54 const struct bpf_dynptr *value_p, int flags);
55 int bpf_remove_dentry_xattr_locked(struct dentry *dentry, const char *name__str);
56 bool bpf_lsm_has_d_inode_locked(const struct bpf_prog *prog);
57 bool bpf_lsm_hook_returns_errno(u32 btf_id);
58
59 #else /* !CONFIG_BPF_LSM */
60
61 #define bpf_lsm_initialized false
62
bpf_lsm_is_sleepable_hook(u32 btf_id)63 static inline bool bpf_lsm_is_sleepable_hook(u32 btf_id)
64 {
65 return false;
66 }
67
bpf_lsm_is_trusted(const struct bpf_prog * prog)68 static inline bool bpf_lsm_is_trusted(const struct bpf_prog *prog)
69 {
70 return false;
71 }
72
bpf_lsm_verify_prog(struct bpf_verifier_log * vlog,const struct bpf_prog * prog)73 static inline int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog,
74 const struct bpf_prog *prog)
75 {
76 return -EOPNOTSUPP;
77 }
78
bpf_inode(const struct inode * inode)79 static inline struct bpf_storage_blob *bpf_inode(
80 const struct inode *inode)
81 {
82 return NULL;
83 }
84
bpf_inode_storage_free(struct inode * inode)85 static inline void bpf_inode_storage_free(struct inode *inode)
86 {
87 }
88
bpf_lsm_find_cgroup_shim(const struct bpf_prog * prog,bpf_func_t * bpf_func)89 static inline void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog,
90 bpf_func_t *bpf_func)
91 {
92 }
93
bpf_lsm_get_retval_range(const struct bpf_prog * prog,struct bpf_retval_range * range)94 static inline int bpf_lsm_get_retval_range(const struct bpf_prog *prog,
95 struct bpf_retval_range *range)
96 {
97 return -EOPNOTSUPP;
98 }
bpf_set_dentry_xattr_locked(struct dentry * dentry,const char * name__str,const struct bpf_dynptr * value_p,int flags)99 static inline int bpf_set_dentry_xattr_locked(struct dentry *dentry, const char *name__str,
100 const struct bpf_dynptr *value_p, int flags)
101 {
102 return -EOPNOTSUPP;
103 }
bpf_remove_dentry_xattr_locked(struct dentry * dentry,const char * name__str)104 static inline int bpf_remove_dentry_xattr_locked(struct dentry *dentry, const char *name__str)
105 {
106 return -EOPNOTSUPP;
107 }
bpf_lsm_has_d_inode_locked(const struct bpf_prog * prog)108 static inline bool bpf_lsm_has_d_inode_locked(const struct bpf_prog *prog)
109 {
110 return false;
111 }
112
bpf_lsm_hook_returns_errno(u32 btf_id)113 static inline bool bpf_lsm_hook_returns_errno(u32 btf_id)
114 {
115 return true;
116 }
117 #endif /* CONFIG_BPF_LSM */
118
119 #endif /* _LINUX_BPF_LSM_H */
120