| 1 | // SPDX-License-Identifier: GPL-2.0-only |
|---|
| 2 | /* |
|---|
| 3 | * Landlock - Credential hooks |
|---|
| 4 | * |
|---|
| 5 | * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net> |
|---|
| 6 | * Copyright © 2018-2020 ANSSI |
|---|
| 7 | * Copyright © 2024-2025 Microsoft Corporation |
|---|
| 8 | */ |
|---|
| 9 | |
|---|
| 10 | #include <linux/binfmts.h> |
|---|
| 11 | #include <linux/cred.h> |
|---|
| 12 | #include <linux/lsm_hooks.h> |
|---|
| 13 | |
|---|
| 14 | #include "common.h" |
|---|
| 15 | #include "cred.h" |
|---|
| 16 | #include "ruleset.h" |
|---|
| 17 | #include "setup.h" |
|---|
| 18 | |
|---|
| 19 | static void hook_cred_transfer(struct cred *const new, |
|---|
| 20 | const struct cred *const old) |
|---|
| 21 | { |
|---|
| 22 | const struct landlock_cred_security *const old_llcred = |
|---|
| 23 | landlock_cred(cred: old); |
|---|
| 24 | |
|---|
| 25 | if (old_llcred->domain) { |
|---|
| 26 | landlock_get_ruleset(ruleset: old_llcred->domain); |
|---|
| 27 | *landlock_cred(cred: new) = *old_llcred; |
|---|
| 28 | } |
|---|
| 29 | } |
|---|
| 30 | |
|---|
| 31 | static int hook_cred_prepare(struct cred *const new, |
|---|
| 32 | const struct cred *const old, const gfp_t gfp) |
|---|
| 33 | { |
|---|
| 34 | hook_cred_transfer(new, old); |
|---|
| 35 | return 0; |
|---|
| 36 | } |
|---|
| 37 | |
|---|
| 38 | static void hook_cred_free(struct cred *const cred) |
|---|
| 39 | { |
|---|
| 40 | struct landlock_ruleset *const dom = landlock_cred(cred)->domain; |
|---|
| 41 | |
|---|
| 42 | if (dom) |
|---|
| 43 | landlock_put_ruleset_deferred(ruleset: dom); |
|---|
| 44 | } |
|---|
| 45 | |
|---|
| 46 | #ifdef CONFIG_AUDIT |
|---|
| 47 | |
|---|
| 48 | static int hook_bprm_creds_for_exec(struct linux_binprm *const bprm) |
|---|
| 49 | { |
|---|
| 50 | /* Resets for each execution. */ |
|---|
| 51 | landlock_cred(cred: bprm->cred)->domain_exec = 0; |
|---|
| 52 | return 0; |
|---|
| 53 | } |
|---|
| 54 | |
|---|
| 55 | #endif /* CONFIG_AUDIT */ |
|---|
| 56 | |
|---|
| 57 | static struct security_hook_list landlock_hooks[] __ro_after_init = { |
|---|
| 58 | LSM_HOOK_INIT(cred_prepare, hook_cred_prepare), |
|---|
| 59 | LSM_HOOK_INIT(cred_transfer, hook_cred_transfer), |
|---|
| 60 | LSM_HOOK_INIT(cred_free, hook_cred_free), |
|---|
| 61 | |
|---|
| 62 | #ifdef CONFIG_AUDIT |
|---|
| 63 | LSM_HOOK_INIT(bprm_creds_for_exec, hook_bprm_creds_for_exec), |
|---|
| 64 | #endif /* CONFIG_AUDIT */ |
|---|
| 65 | }; |
|---|
| 66 | |
|---|
| 67 | __init void landlock_add_cred_hooks(void) |
|---|
| 68 | { |
|---|
| 69 | security_add_hooks(hooks: landlock_hooks, ARRAY_SIZE(landlock_hooks), |
|---|
| 70 | lsmid: &landlock_lsmid); |
|---|
| 71 | } |
|---|
| 72 | |
|---|
