[linux.git] / security / lsm_syscalls.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * System calls implementing the Linux Security Module API.
 *
 *  Copyright (C) 2022 Casey Schaufler <[email protected]>
 *  Copyright (C) 2022 Intel Corporation
 */

#include <asm/current.h>
#include <linux/compiler_types.h>
#include <linux/err.h>
#include <linux/errno.h>
#include <linux/security.h>
#include <linux/stddef.h>
#include <linux/syscalls.h>
#include <linux/types.h>
#include <linux/lsm_hooks.h>
#include <uapi/linux/lsm.h>

/**
 * lsm_name_to_attr - map an LSM attribute name to its ID
 * @name: name of the attribute
 *
 * Returns the LSM attribute value associated with @name, or 0 if
 * there is no mapping.
 */
u64 lsm_name_to_attr(const char *name)
{
	if (!strcmp(name, "current"))
		return LSM_ATTR_CURRENT;
	if (!strcmp(name, "exec"))
		return LSM_ATTR_EXEC;
	if (!strcmp(name, "fscreate"))
		return LSM_ATTR_FSCREATE;
	if (!strcmp(name, "keycreate"))
		return LSM_ATTR_KEYCREATE;
	if (!strcmp(name, "prev"))
		return LSM_ATTR_PREV;
	if (!strcmp(name, "sockcreate"))
		return LSM_ATTR_SOCKCREATE;
	return LSM_ATTR_UNDEF;
}

/**
 * sys_lsm_set_self_attr - Set current task's security module attribute
 * @attr: which attribute to set
 * @ctx: the LSM contexts
 * @size: size of @ctx
 * @flags: reserved for future use
 *
 * Sets the calling task's LSM context. On success this function
 * returns 0. If the attribute specified cannot be set a negative
 * value indicating the reason for the error is returned.
 */
SYSCALL_DEFINE4(lsm_set_self_attr, unsigned int, attr, struct lsm_ctx __user *,
		ctx, u32, size, u32, flags)
{
	return security_setselfattr(attr, ctx, size, flags);
}

/**
 * sys_lsm_get_self_attr - Return current task's security module attributes
 * @attr: which attribute to return
 * @ctx: the user-space destination for the information, or NULL
 * @size: pointer to the size of space available to receive the data
 * @flags: special handling options. LSM_FLAG_SINGLE indicates that only
 * attributes associated with the LSM identified in the passed @ctx be
 * reported.
 *
 * Returns the calling task's LSM contexts. On success this
 * function returns the number of @ctx array elements. This value
 * may be zero if there are no LSM contexts assigned. If @size is
 * insufficient to contain the return data -E2BIG is returned and
 * @size is set to the minimum required size. In all other cases
 * a negative value indicating the error is returned.
 */
SYSCALL_DEFINE4(lsm_get_self_attr, unsigned int, attr, struct lsm_ctx __user *,
		ctx, u32 __user *, size, u32, flags)
{
	return security_getselfattr(attr, ctx, size, flags);
}

/**
 * sys_lsm_list_modules - Return a list of the active security modules
 * @ids: the LSM module ids
 * @size: pointer to size of @ids, updated on return
 * @flags: reserved for future use, must be zero
 *
 * Returns a list of the active LSM ids. On success this function
 * returns the number of @ids array elements. This value may be zero
 * if there are no LSMs active. If @size is insufficient to contain
 * the return data -E2BIG is returned and @size is set to the minimum
 * required size. In all other cases a negative value indicating the
 * error is returned.
 */
SYSCALL_DEFINE3(lsm_list_modules, u64 __user *, ids, u32 __user *, size,
		u32, flags)
{
	u32 total_size = lsm_active_cnt * sizeof(*ids);
	u32 usize;
	int i;

	if (flags)
		return -EINVAL;

	if (get_user(usize, size))
		return -EFAULT;

	if (put_user(total_size, size) != 0)
		return -EFAULT;

	if (usize < total_size)
		return -E2BIG;

	for (i = 0; i < lsm_active_cnt; i++)
		if (put_user(lsm_idlist[i]->id, ids++))
			return -EFAULT;

	return lsm_active_cnt;
}
Commit	Line	Data
a04a1198 CS	1	// SPDX-License-Identifier: GPL-2.0-only
	2	/*
	3	* System calls implementing the Linux Security Module API.
	4	*
	5	* Copyright (C) 2022 Casey Schaufler <[email protected]>
	6	* Copyright (C) 2022 Intel Corporation
	7	*/
	8
	9	#include <asm/current.h>
	10	#include <linux/compiler_types.h>
	11	#include <linux/err.h>
	12	#include <linux/errno.h>
	13	#include <linux/security.h>
	14	#include <linux/stddef.h>
	15	#include <linux/syscalls.h>
	16	#include <linux/types.h>
	17	#include <linux/lsm_hooks.h>
	18	#include <uapi/linux/lsm.h>
	19
e1ca7129 CS	20	/**
	21	* lsm_name_to_attr - map an LSM attribute name to its ID
	22	* @name: name of the attribute
	23	*
	24	* Returns the LSM attribute value associated with @name, or 0 if
	25	* there is no mapping.
	26	*/
	27	u64 lsm_name_to_attr(const char *name)
	28	{
	29	if (!strcmp(name, "current"))
	30	return LSM_ATTR_CURRENT;
	31	if (!strcmp(name, "exec"))
	32	return LSM_ATTR_EXEC;
	33	if (!strcmp(name, "fscreate"))
	34	return LSM_ATTR_FSCREATE;
	35	if (!strcmp(name, "keycreate"))
	36	return LSM_ATTR_KEYCREATE;
	37	if (!strcmp(name, "prev"))
	38	return LSM_ATTR_PREV;
	39	if (!strcmp(name, "sockcreate"))
	40	return LSM_ATTR_SOCKCREATE;
	41	return LSM_ATTR_UNDEF;
	42	}
	43
a04a1198 CS	44	/**
	45	* sys_lsm_set_self_attr - Set current task's security module attribute
	46	* @attr: which attribute to set
	47	* @ctx: the LSM contexts
	48	* @size: size of @ctx
	49	* @flags: reserved for future use
	50	*
	51	* Sets the calling task's LSM context. On success this function
	52	* returns 0. If the attribute specified cannot be set a negative
	53	* value indicating the reason for the error is returned.
	54	*/
	55	SYSCALL_DEFINE4(lsm_set_self_attr, unsigned int, attr, struct lsm_ctx __user *,
a5a858f6	56	ctx, u32, size, u32, flags)
a04a1198 CS	57	{
	58	return security_setselfattr(attr, ctx, size, flags);
	59	}
	60
	61	/**
	62	* sys_lsm_get_self_attr - Return current task's security module attributes
	63	* @attr: which attribute to return
	64	* @ctx: the user-space destination for the information, or NULL
	65	* @size: pointer to the size of space available to receive the data
	66	* @flags: special handling options. LSM_FLAG_SINGLE indicates that only
	67	* attributes associated with the LSM identified in the passed @ctx be
	68	* reported.
	69	*
	70	* Returns the calling task's LSM contexts. On success this
	71	* function returns the number of @ctx array elements. This value
	72	* may be zero if there are no LSM contexts assigned. If @size is
	73	* insufficient to contain the return data -E2BIG is returned and
	74	* @size is set to the minimum required size. In all other cases
	75	* a negative value indicating the error is returned.
	76	*/
	77	SYSCALL_DEFINE4(lsm_get_self_attr, unsigned int, attr, struct lsm_ctx __user *,
a5a858f6	78	ctx, u32 __user *, size, u32, flags)
a04a1198 CS	79	{
	80	return security_getselfattr(attr, ctx, size, flags);
	81	}
ad4aff9e CS	82
	83	/**
	84	* sys_lsm_list_modules - Return a list of the active security modules
	85	* @ids: the LSM module ids
	86	* @size: pointer to size of @ids, updated on return
	87	* @flags: reserved for future use, must be zero
	88	*
	89	* Returns a list of the active LSM ids. On success this function
	90	* returns the number of @ids array elements. This value may be zero
	91	* if there are no LSMs active. If @size is insufficient to contain
	92	* the return data -E2BIG is returned and @size is set to the minimum
	93	* required size. In all other cases a negative value indicating the
	94	* error is returned.
	95	*/
a5a858f6	96	SYSCALL_DEFINE3(lsm_list_modules, u64 __user , ids, u32 __user , size,
ad4aff9e CS	97	u32, flags)
ad4aff9e CS	98	{
a5a858f6 CS	99	u32 total_size = lsm_active_cnt * sizeof(*ids);
a5a858f6 CS	100	u32 usize;
ad4aff9e CS	101	int i;
	102
	103	if (flags)
	104	return -EINVAL;
	105
	106	if (get_user(usize, size))
	107	return -EFAULT;
	108
	109	if (put_user(total_size, size) != 0)
	110	return -EFAULT;
	111
	112	if (usize < total_size)
	113	return -E2BIG;
	114
	115	for (i = 0; i < lsm_active_cnt; i++)
	116	if (put_user(lsm_idlist[i]->id, ids++))
	117	return -EFAULT;
	118
	119	return lsm_active_cnt;
	120	}