1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * System calls implementing the Linux Security Module API. 4 * 5 * Copyright (C) 2022 Casey Schaufler <casey@schaufler-ca.com> 6 * Copyright (C) 2022 Intel Corporation 7 */ 8 9 #include <asm/current.h> 10 #include <linux/compiler_types.h> 11 #include <linux/err.h> 12 #include <linux/errno.h> 13 #include <linux/security.h> 14 #include <linux/stddef.h> 15 #include <linux/syscalls.h> 16 #include <linux/types.h> 17 #include <linux/lsm_hooks.h> 18 #include <uapi/linux/lsm.h> 19 20 #include "lsm.h" 21 22 /** 23 * lsm_name_to_attr - map an LSM attribute name to its ID 24 * @name: name of the attribute 25 * 26 * Returns the LSM attribute value associated with @name, or 0 if 27 * there is no mapping. 28 */ 29 u64 lsm_name_to_attr(const char *name) 30 { 31 if (!strcmp(name, "current")) 32 return LSM_ATTR_CURRENT; 33 if (!strcmp(name, "exec")) 34 return LSM_ATTR_EXEC; 35 if (!strcmp(name, "fscreate")) 36 return LSM_ATTR_FSCREATE; 37 if (!strcmp(name, "keycreate")) 38 return LSM_ATTR_KEYCREATE; 39 if (!strcmp(name, "prev")) 40 return LSM_ATTR_PREV; 41 if (!strcmp(name, "sockcreate")) 42 return LSM_ATTR_SOCKCREATE; 43 return LSM_ATTR_UNDEF; 44 } 45 46 /** 47 * sys_lsm_set_self_attr - Set current task's security module attribute 48 * @attr: which attribute to set 49 * @ctx: the LSM contexts 50 * @size: size of @ctx 51 * @flags: reserved for future use 52 * 53 * Sets the calling task's LSM context. On success this function 54 * returns 0. If the attribute specified cannot be set a negative 55 * value indicating the reason for the error is returned. 56 */ 57 SYSCALL_DEFINE4(lsm_set_self_attr, unsigned int, attr, struct lsm_ctx __user *, 58 ctx, u32, size, u32, flags) 59 { 60 int rc; 61 62 rc = mutex_lock_interruptible(¤t->signal->cred_guard_mutex); 63 if (rc < 0) 64 return rc; 65 rc = security_setselfattr(attr, ctx, size, flags); 66 mutex_unlock(¤t->signal->cred_guard_mutex); 67 return rc; 68 } 69 70 /** 71 * sys_lsm_get_self_attr - Return current task's security module attributes 72 * @attr: which attribute to return 73 * @ctx: the user-space destination for the information, or NULL 74 * @size: pointer to the size of space available to receive the data 75 * @flags: special handling options. LSM_FLAG_SINGLE indicates that only 76 * attributes associated with the LSM identified in the passed @ctx be 77 * reported. 78 * 79 * Returns the calling task's LSM contexts. On success this 80 * function returns the number of @ctx array elements. This value 81 * may be zero if there are no LSM contexts assigned. If @size is 82 * insufficient to contain the return data -E2BIG is returned and 83 * @size is set to the minimum required size. In all other cases 84 * a negative value indicating the error is returned. 85 */ 86 SYSCALL_DEFINE4(lsm_get_self_attr, unsigned int, attr, struct lsm_ctx __user *, 87 ctx, u32 __user *, size, u32, flags) 88 { 89 return security_getselfattr(attr, ctx, size, flags); 90 } 91 92 /** 93 * sys_lsm_list_modules - Return a list of the active security modules 94 * @ids: the LSM module ids 95 * @size: pointer to size of @ids, updated on return 96 * @flags: reserved for future use, must be zero 97 * 98 * Returns a list of the active LSM ids. On success this function 99 * returns the number of @ids array elements. This value may be zero 100 * if there are no LSMs active. If @size is insufficient to contain 101 * the return data -E2BIG is returned and @size is set to the minimum 102 * required size. In all other cases a negative value indicating the 103 * error is returned. 104 */ 105 SYSCALL_DEFINE3(lsm_list_modules, u64 __user *, ids, u32 __user *, size, 106 u32, flags) 107 { 108 u32 total_size = lsm_active_cnt * sizeof(*ids); 109 u32 usize; 110 int i; 111 112 if (flags) 113 return -EINVAL; 114 115 if (get_user(usize, size)) 116 return -EFAULT; 117 118 if (put_user(total_size, size) != 0) 119 return -EFAULT; 120 121 if (usize < total_size) 122 return -E2BIG; 123 124 for (i = 0; i < lsm_active_cnt; i++) 125 if (put_user(lsm_idlist[i]->id, ids++)) 126 return -EFAULT; 127 128 return lsm_active_cnt; 129 } 130