1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright (C) 2020-2024 Microsoft Corporation. All rights reserved. 4 */ 5 #include <uapi/linux/lsm.h> 6 7 #include "ipe.h" 8 #include "eval.h" 9 #include "hooks.h" 10 #include "eval.h" 11 12 bool ipe_enabled; 13 14 static struct lsm_blob_sizes ipe_blobs __ro_after_init = { 15 .lbs_superblock = sizeof(struct ipe_superblock), 16 #ifdef CONFIG_IPE_PROP_DM_VERITY 17 .lbs_bdev = sizeof(struct ipe_bdev), 18 #endif /* CONFIG_IPE_PROP_DM_VERITY */ 19 }; 20 21 static const struct lsm_id ipe_lsmid = { 22 .name = "ipe", 23 .id = LSM_ID_IPE, 24 }; 25 26 struct ipe_superblock *ipe_sb(const struct super_block *sb) 27 { 28 return sb->s_security + ipe_blobs.lbs_superblock; 29 } 30 31 #ifdef CONFIG_IPE_PROP_DM_VERITY 32 struct ipe_bdev *ipe_bdev(struct block_device *b) 33 { 34 return b->bd_security + ipe_blobs.lbs_bdev; 35 } 36 #endif /* CONFIG_IPE_PROP_DM_VERITY */ 37 38 static struct security_hook_list ipe_hooks[] __ro_after_init = { 39 LSM_HOOK_INIT(bprm_check_security, ipe_bprm_check_security), 40 LSM_HOOK_INIT(mmap_file, ipe_mmap_file), 41 LSM_HOOK_INIT(file_mprotect, ipe_file_mprotect), 42 LSM_HOOK_INIT(kernel_read_file, ipe_kernel_read_file), 43 LSM_HOOK_INIT(kernel_load_data, ipe_kernel_load_data), 44 LSM_HOOK_INIT(initramfs_populated, ipe_unpack_initramfs), 45 #ifdef CONFIG_IPE_PROP_DM_VERITY 46 LSM_HOOK_INIT(bdev_free_security, ipe_bdev_free_security), 47 LSM_HOOK_INIT(bdev_setintegrity, ipe_bdev_setintegrity), 48 #endif /* CONFIG_IPE_PROP_DM_VERITY */ 49 }; 50 51 /** 52 * ipe_init() - Entry point of IPE. 53 * 54 * This is called at LSM init, which happens occurs early during kernel 55 * start up. During this phase, IPE registers its hooks and loads the 56 * builtin boot policy. 57 * 58 * Return: 59 * * %0 - OK 60 * * %-ENOMEM - Out of memory (OOM) 61 */ 62 static int __init ipe_init(void) 63 { 64 security_add_hooks(ipe_hooks, ARRAY_SIZE(ipe_hooks), &ipe_lsmid); 65 ipe_enabled = true; 66 67 return 0; 68 } 69 70 DEFINE_LSM(ipe) = { 71 .name = "ipe", 72 .init = ipe_init, 73 .blobs = &ipe_blobs, 74 }; 75