security/ipe/ipe.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * Copyright (C) 2020-2024 Microsoft Corporation. All rights reserved.
   4  */
   5 #include <uapi/linux/lsm.h>
   6
   7 #include "ipe.h"
   8 #include "eval.h"
   9 #include "hooks.h"
  10
  11 extern const char *const ipe_boot_policy;
  12 bool ipe_enabled;
  13
  14 static struct lsm_blob_sizes ipe_blobs __ro_after_init = {
  15         .lbs_superblock = sizeof(struct ipe_superblock),
  16 #ifdef CONFIG_IPE_PROP_DM_VERITY
  17         .lbs_bdev = sizeof(struct ipe_bdev),
  18 #endif /* CONFIG_IPE_PROP_DM_VERITY */
  19 #ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG
  20         .lbs_inode = sizeof(struct ipe_inode),
  21 #endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */
  22 };
  23
  24 static const struct lsm_id ipe_lsmid = {
  25         .name = "ipe",
  26         .id = LSM_ID_IPE,
  27 };
  28
  29 struct ipe_superblock *ipe_sb(const struct super_block *sb)
  30 {
  31         return sb->s_security + ipe_blobs.lbs_superblock;
  32 }
  33
  34 #ifdef CONFIG_IPE_PROP_DM_VERITY
  35 struct ipe_bdev *ipe_bdev(struct block_device *b)
  36 {
  37         return b->bd_security + ipe_blobs.lbs_bdev;
  38 }
  39 #endif /* CONFIG_IPE_PROP_DM_VERITY */
  40
  41 #ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG
  42 struct ipe_inode *ipe_inode(const struct inode *inode)
  43 {
  44         return inode->i_security + ipe_blobs.lbs_inode;
  45 }
  46 #endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */
  47
  48 static struct security_hook_list ipe_hooks[] __ro_after_init = {
  49         LSM_HOOK_INIT(bprm_check_security, ipe_bprm_check_security),
  50         LSM_HOOK_INIT(mmap_file, ipe_mmap_file),
  51         LSM_HOOK_INIT(file_mprotect, ipe_file_mprotect),
  52         LSM_HOOK_INIT(kernel_read_file, ipe_kernel_read_file),
  53         LSM_HOOK_INIT(kernel_load_data, ipe_kernel_load_data),
  54         LSM_HOOK_INIT(initramfs_populated, ipe_unpack_initramfs),
  55 #ifdef CONFIG_IPE_PROP_DM_VERITY
  56         LSM_HOOK_INIT(bdev_free_security, ipe_bdev_free_security),
  57         LSM_HOOK_INIT(bdev_setintegrity, ipe_bdev_setintegrity),
  58 #endif /* CONFIG_IPE_PROP_DM_VERITY */
  59 #ifdef CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG
  60         LSM_HOOK_INIT(inode_setintegrity, ipe_inode_setintegrity),
  61 #endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */
  62 };
  63
  64 /**
  65  * ipe_init() - Entry point of IPE.
  66  *
  67  * This is called at LSM init, which happens occurs early during kernel
  68  * start up. During this phase, IPE registers its hooks and loads the
  69  * builtin boot policy.
  70  *
  71  * Return:
  72  * * %0         - OK
  73  * * %-ENOMEM   - Out of memory (OOM)
  74  */
  75 static int __init ipe_init(void)
  76 {
  77         struct ipe_policy *p = NULL;
  78
  79         security_add_hooks(ipe_hooks, ARRAY_SIZE(ipe_hooks), &ipe_lsmid);
  80         ipe_enabled = true;
  81
  82         if (ipe_boot_policy) {
  83                 p = ipe_new_policy(ipe_boot_policy, strlen(ipe_boot_policy),
  84                                    NULL, 0);
  85                 if (IS_ERR(p))
  86                         return PTR_ERR(p);
  87
  88                 rcu_assign_pointer(ipe_active_policy, p);
  89         }
  90
  91         return 0;
  92 }
  93
  94 DEFINE_LSM(ipe) = {
  95         .name = "ipe",
  96         .init = ipe_init,
  97         .blobs = &ipe_blobs,
  98 };