1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright (C) 2020-2024 Microsoft Corporation. All rights reserved. 4 */ 5 6 #include <linux/dcache.h> 7 #include <linux/security.h> 8 9 #include "ipe.h" 10 #include "fs.h" 11 #include "eval.h" 12 #include "policy.h" 13 #include "audit.h" 14 15 static struct dentry *np __ro_after_init; 16 static struct dentry *root __ro_after_init; 17 struct dentry *policy_root __ro_after_init; 18 static struct dentry *audit_node __ro_after_init; 19 static struct dentry *enforce_node __ro_after_init; 20 21 /** 22 * setaudit() - Write handler for the securityfs node, "ipe/success_audit" 23 * @f: Supplies a file structure representing the securityfs node. 24 * @data: Supplies a buffer passed to the write syscall. 25 * @len: Supplies the length of @data. 26 * @offset: unused. 27 * 28 * Return: 29 * * Length of buffer written - Success 30 * * %-EPERM - Insufficient permission 31 */ 32 static ssize_t setaudit(struct file *f, const char __user *data, 33 size_t len, loff_t *offset) 34 { 35 int rc = 0; 36 bool value; 37 38 if (!file_ns_capable(f, &init_user_ns, CAP_MAC_ADMIN)) 39 return -EPERM; 40 41 rc = kstrtobool_from_user(data, len, &value); 42 if (rc) 43 return rc; 44 45 WRITE_ONCE(success_audit, value); 46 47 return len; 48 } 49 50 /** 51 * getaudit() - Read handler for the securityfs node, "ipe/success_audit" 52 * @f: Supplies a file structure representing the securityfs node. 53 * @data: Supplies a buffer passed to the read syscall. 54 * @len: Supplies the length of @data. 55 * @offset: unused. 56 * 57 * Return: Length of buffer written 58 */ 59 static ssize_t getaudit(struct file *f, char __user *data, 60 size_t len, loff_t *offset) 61 { 62 const char *result; 63 64 result = ((READ_ONCE(success_audit)) ? "1" : "0"); 65 66 return simple_read_from_buffer(data, len, offset, result, 1); 67 } 68 69 /** 70 * setenforce() - Write handler for the securityfs node, "ipe/enforce" 71 * @f: Supplies a file structure representing the securityfs node. 72 * @data: Supplies a buffer passed to the write syscall. 73 * @len: Supplies the length of @data. 74 * @offset: unused. 75 * 76 * Return: 77 * * Length of buffer written - Success 78 * * %-EPERM - Insufficient permission 79 */ 80 static ssize_t setenforce(struct file *f, const char __user *data, 81 size_t len, loff_t *offset) 82 { 83 int rc = 0; 84 bool new_value, old_value; 85 86 if (!file_ns_capable(f, &init_user_ns, CAP_MAC_ADMIN)) 87 return -EPERM; 88 89 old_value = READ_ONCE(enforce); 90 rc = kstrtobool_from_user(data, len, &new_value); 91 if (rc) 92 return rc; 93 94 if (new_value != old_value) { 95 ipe_audit_enforce(new_value, old_value); 96 WRITE_ONCE(enforce, new_value); 97 } 98 99 return len; 100 } 101 102 /** 103 * getenforce() - Read handler for the securityfs node, "ipe/enforce" 104 * @f: Supplies a file structure representing the securityfs node. 105 * @data: Supplies a buffer passed to the read syscall. 106 * @len: Supplies the length of @data. 107 * @offset: unused. 108 * 109 * Return: Length of buffer written 110 */ 111 static ssize_t getenforce(struct file *f, char __user *data, 112 size_t len, loff_t *offset) 113 { 114 const char *result; 115 116 result = ((READ_ONCE(enforce)) ? "1" : "0"); 117 118 return simple_read_from_buffer(data, len, offset, result, 1); 119 } 120 121 /** 122 * new_policy() - Write handler for the securityfs node, "ipe/new_policy". 123 * @f: Supplies a file structure representing the securityfs node. 124 * @data: Supplies a buffer passed to the write syscall. 125 * @len: Supplies the length of @data. 126 * @offset: unused. 127 * 128 * Return: 129 * * Length of buffer written - Success 130 * * %-EPERM - Insufficient permission 131 * * %-ENOMEM - Out of memory (OOM) 132 * * %-EBADMSG - Policy is invalid 133 * * %-ERANGE - Policy version number overflow 134 * * %-EINVAL - Policy version parsing error 135 * * %-EEXIST - Same name policy already deployed 136 */ 137 static ssize_t new_policy(struct file *f, const char __user *data, 138 size_t len, loff_t *offset) 139 { 140 struct ipe_policy *p = NULL; 141 char *copy = NULL; 142 int rc = 0; 143 144 if (!file_ns_capable(f, &init_user_ns, CAP_MAC_ADMIN)) 145 return -EPERM; 146 147 copy = memdup_user_nul(data, len); 148 if (IS_ERR(copy)) 149 return PTR_ERR(copy); 150 151 p = ipe_new_policy(NULL, 0, copy, len); 152 if (IS_ERR(p)) { 153 rc = PTR_ERR(p); 154 goto out; 155 } 156 157 rc = ipe_new_policyfs_node(p); 158 if (rc) 159 goto out; 160 161 ipe_audit_policy_load(p); 162 163 out: 164 if (rc < 0) 165 ipe_free_policy(p); 166 kfree(copy); 167 return (rc < 0) ? rc : len; 168 } 169 170 static const struct file_operations np_fops = { 171 .write = new_policy, 172 }; 173 174 static const struct file_operations audit_fops = { 175 .write = setaudit, 176 .read = getaudit, 177 }; 178 179 static const struct file_operations enforce_fops = { 180 .write = setenforce, 181 .read = getenforce, 182 }; 183 184 /** 185 * ipe_init_securityfs() - Initialize IPE's securityfs tree at fsinit. 186 * 187 * Return: %0 on success. If an error occurs, the function will return 188 * the -errno. 189 */ 190 static int __init ipe_init_securityfs(void) 191 { 192 int rc = 0; 193 struct ipe_policy *ap; 194 195 if (!ipe_enabled) 196 return -EOPNOTSUPP; 197 198 root = securityfs_create_dir("ipe", NULL); 199 if (IS_ERR(root)) { 200 rc = PTR_ERR(root); 201 goto err; 202 } 203 204 audit_node = securityfs_create_file("success_audit", 0600, root, 205 NULL, &audit_fops); 206 if (IS_ERR(audit_node)) { 207 rc = PTR_ERR(audit_node); 208 goto err; 209 } 210 211 enforce_node = securityfs_create_file("enforce", 0600, root, NULL, 212 &enforce_fops); 213 if (IS_ERR(enforce_node)) { 214 rc = PTR_ERR(enforce_node); 215 goto err; 216 } 217 218 policy_root = securityfs_create_dir("policies", root); 219 if (IS_ERR(policy_root)) { 220 rc = PTR_ERR(policy_root); 221 goto err; 222 } 223 224 ap = rcu_access_pointer(ipe_active_policy); 225 if (ap) { 226 rc = ipe_new_policyfs_node(ap); 227 if (rc) 228 goto err; 229 } 230 231 np = securityfs_create_file("new_policy", 0200, root, NULL, &np_fops); 232 if (IS_ERR(np)) { 233 rc = PTR_ERR(np); 234 goto err; 235 } 236 237 return 0; 238 err: 239 securityfs_remove(np); 240 securityfs_remove(policy_root); 241 securityfs_remove(enforce_node); 242 securityfs_remove(audit_node); 243 securityfs_remove(root); 244 return rc; 245 } 246 247 fs_initcall(ipe_init_securityfs); 248