1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Landlock - Credential hooks 4 * 5 * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net> 6 * Copyright © 2018-2020 ANSSI 7 * Copyright © 2024-2025 Microsoft Corporation 8 */ 9 10 #include <linux/binfmts.h> 11 #include <linux/cred.h> 12 #include <linux/lsm_hooks.h> 13 14 #include "common.h" 15 #include "cred.h" 16 #include "ruleset.h" 17 #include "setup.h" 18 19 static void hook_cred_transfer(struct cred *const new, 20 const struct cred *const old) 21 { 22 const struct landlock_cred_security *const old_llcred = 23 landlock_cred(old); 24 25 landlock_get_ruleset(old_llcred->domain); 26 *landlock_cred(new) = *old_llcred; 27 } 28 29 static int hook_cred_prepare(struct cred *const new, 30 const struct cred *const old, const gfp_t gfp) 31 { 32 hook_cred_transfer(new, old); 33 return 0; 34 } 35 36 static void hook_cred_free(struct cred *const cred) 37 { 38 struct landlock_ruleset *const dom = landlock_cred(cred)->domain; 39 40 if (dom) 41 landlock_put_ruleset_deferred(dom); 42 } 43 44 #ifdef CONFIG_AUDIT 45 46 static int hook_bprm_creds_for_exec(struct linux_binprm *const bprm) 47 { 48 /* Resets for each execution. */ 49 landlock_cred(bprm->cred)->domain_exec = 0; 50 return 0; 51 } 52 53 #endif /* CONFIG_AUDIT */ 54 55 static struct security_hook_list landlock_hooks[] __ro_after_init = { 56 LSM_HOOK_INIT(cred_prepare, hook_cred_prepare), 57 LSM_HOOK_INIT(cred_transfer, hook_cred_transfer), 58 LSM_HOOK_INIT(cred_free, hook_cred_free), 59 60 #ifdef CONFIG_AUDIT 61 LSM_HOOK_INIT(bprm_creds_for_exec, hook_bprm_creds_for_exec), 62 #endif /* CONFIG_AUDIT */ 63 }; 64 65 __init void landlock_add_cred_hooks(void) 66 { 67 security_add_hooks(landlock_hooks, ARRAY_SIZE(landlock_hooks), 68 &landlock_lsmid); 69 } 70