1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright (C) 2020-2024 Microsoft Corporation. All rights reserved. 4 */ 5 #include <uapi/linux/lsm.h> 6 7 #include "ipe.h" 8 #include "eval.h" 9 #include "hooks.h" 10 11 extern const char *const ipe_boot_policy; 12 bool ipe_enabled; 13 14 static struct lsm_blob_sizes ipe_blobs __ro_after_init = { 15 .lbs_superblock = sizeof(struct ipe_superblock), 16 #ifdef CONFIG_IPE_PROP_DM_VERITY 17 .lbs_bdev = sizeof(struct ipe_bdev), 18 #endif /* CONFIG_IPE_PROP_DM_VERITY */ 19 #ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG 20 .lbs_inode = sizeof(struct ipe_inode), 21 #endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */ 22 }; 23 24 static const struct lsm_id ipe_lsmid = { 25 .name = "ipe", 26 .id = LSM_ID_IPE, 27 }; 28 29 struct ipe_superblock *ipe_sb(const struct super_block *sb) 30 { 31 return sb->s_security + ipe_blobs.lbs_superblock; 32 } 33 34 #ifdef CONFIG_IPE_PROP_DM_VERITY 35 struct ipe_bdev *ipe_bdev(struct block_device *b) 36 { 37 return b->bd_security + ipe_blobs.lbs_bdev; 38 } 39 #endif /* CONFIG_IPE_PROP_DM_VERITY */ 40 41 #ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG 42 struct ipe_inode *ipe_inode(const struct inode *inode) 43 { 44 return inode->i_security + ipe_blobs.lbs_inode; 45 } 46 #endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */ 47 48 static struct security_hook_list ipe_hooks[] __ro_after_init = { 49 LSM_HOOK_INIT(bprm_check_security, ipe_bprm_check_security), 50 LSM_HOOK_INIT(bprm_creds_for_exec, ipe_bprm_creds_for_exec), 51 LSM_HOOK_INIT(mmap_file, ipe_mmap_file), 52 LSM_HOOK_INIT(file_mprotect, ipe_file_mprotect), 53 LSM_HOOK_INIT(kernel_read_file, ipe_kernel_read_file), 54 LSM_HOOK_INIT(kernel_load_data, ipe_kernel_load_data), 55 LSM_HOOK_INIT(initramfs_populated, ipe_unpack_initramfs), 56 #ifdef CONFIG_IPE_PROP_DM_VERITY 57 LSM_HOOK_INIT(bdev_free_security, ipe_bdev_free_security), 58 LSM_HOOK_INIT(bdev_setintegrity, ipe_bdev_setintegrity), 59 #endif /* CONFIG_IPE_PROP_DM_VERITY */ 60 #ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG 61 LSM_HOOK_INIT(inode_setintegrity, ipe_inode_setintegrity), 62 #endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */ 63 }; 64 65 /** 66 * ipe_init() - Entry point of IPE. 67 * 68 * This is called at LSM init, which happens occurs early during kernel 69 * start up. During this phase, IPE registers its hooks and loads the 70 * builtin boot policy. 71 * 72 * Return: 73 * * %0 - OK 74 * * %-ENOMEM - Out of memory (OOM) 75 */ 76 static int __init ipe_init(void) 77 { 78 struct ipe_policy *p = NULL; 79 80 security_add_hooks(ipe_hooks, ARRAY_SIZE(ipe_hooks), &ipe_lsmid); 81 ipe_enabled = true; 82 83 if (ipe_boot_policy) { 84 p = ipe_new_policy(ipe_boot_policy, strlen(ipe_boot_policy), 85 NULL, 0); 86 if (IS_ERR(p)) 87 return PTR_ERR(p); 88 89 rcu_assign_pointer(ipe_active_policy, p); 90 } 91 92 return 0; 93 } 94 95 DEFINE_LSM(ipe) = { 96 .id = &ipe_lsmid, 97 .init = ipe_init, 98 .blobs = &ipe_blobs, 99 .initcall_fs = ipe_init_securityfs, 100 }; 101