1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* |
3 | * System calls implementing the Linux Security Module API. |
4 | * |
5 | * Copyright (C) 2022 Casey Schaufler <casey@schaufler-ca.com> |
6 | * Copyright (C) 2022 Intel Corporation |
7 | */ |
8 | |
9 | #include <asm/current.h> |
10 | #include <linux/compiler_types.h> |
11 | #include <linux/err.h> |
12 | #include <linux/errno.h> |
13 | #include <linux/security.h> |
14 | #include <linux/stddef.h> |
15 | #include <linux/syscalls.h> |
16 | #include <linux/types.h> |
17 | #include <linux/lsm_hooks.h> |
18 | #include <uapi/linux/lsm.h> |
19 | |
20 | /** |
21 | * lsm_name_to_attr - map an LSM attribute name to its ID |
22 | * @name: name of the attribute |
23 | * |
24 | * Returns the LSM attribute value associated with @name, or 0 if |
25 | * there is no mapping. |
26 | */ |
27 | u64 lsm_name_to_attr(const char *name) |
28 | { |
29 | if (!strcmp(name, "current" )) |
30 | return LSM_ATTR_CURRENT; |
31 | if (!strcmp(name, "exec" )) |
32 | return LSM_ATTR_EXEC; |
33 | if (!strcmp(name, "fscreate" )) |
34 | return LSM_ATTR_FSCREATE; |
35 | if (!strcmp(name, "keycreate" )) |
36 | return LSM_ATTR_KEYCREATE; |
37 | if (!strcmp(name, "prev" )) |
38 | return LSM_ATTR_PREV; |
39 | if (!strcmp(name, "sockcreate" )) |
40 | return LSM_ATTR_SOCKCREATE; |
41 | return LSM_ATTR_UNDEF; |
42 | } |
43 | |
44 | /** |
45 | * sys_lsm_set_self_attr - Set current task's security module attribute |
46 | * @attr: which attribute to set |
47 | * @ctx: the LSM contexts |
48 | * @size: size of @ctx |
49 | * @flags: reserved for future use |
50 | * |
51 | * Sets the calling task's LSM context. On success this function |
52 | * returns 0. If the attribute specified cannot be set a negative |
53 | * value indicating the reason for the error is returned. |
54 | */ |
55 | SYSCALL_DEFINE4(lsm_set_self_attr, unsigned int, attr, struct lsm_ctx __user *, |
56 | ctx, u32, size, u32, flags) |
57 | { |
58 | return security_setselfattr(attr, ctx, size, flags); |
59 | } |
60 | |
61 | /** |
62 | * sys_lsm_get_self_attr - Return current task's security module attributes |
63 | * @attr: which attribute to return |
64 | * @ctx: the user-space destination for the information, or NULL |
65 | * @size: pointer to the size of space available to receive the data |
66 | * @flags: special handling options. LSM_FLAG_SINGLE indicates that only |
67 | * attributes associated with the LSM identified in the passed @ctx be |
68 | * reported. |
69 | * |
70 | * Returns the calling task's LSM contexts. On success this |
71 | * function returns the number of @ctx array elements. This value |
72 | * may be zero if there are no LSM contexts assigned. If @size is |
73 | * insufficient to contain the return data -E2BIG is returned and |
74 | * @size is set to the minimum required size. In all other cases |
75 | * a negative value indicating the error is returned. |
76 | */ |
77 | SYSCALL_DEFINE4(lsm_get_self_attr, unsigned int, attr, struct lsm_ctx __user *, |
78 | ctx, u32 __user *, size, u32, flags) |
79 | { |
80 | return security_getselfattr(attr, ctx, size, flags); |
81 | } |
82 | |
83 | /** |
84 | * sys_lsm_list_modules - Return a list of the active security modules |
85 | * @ids: the LSM module ids |
86 | * @size: pointer to size of @ids, updated on return |
87 | * @flags: reserved for future use, must be zero |
88 | * |
89 | * Returns a list of the active LSM ids. On success this function |
90 | * returns the number of @ids array elements. This value may be zero |
91 | * if there are no LSMs active. If @size is insufficient to contain |
92 | * the return data -E2BIG is returned and @size is set to the minimum |
93 | * required size. In all other cases a negative value indicating the |
94 | * error is returned. |
95 | */ |
96 | SYSCALL_DEFINE3(lsm_list_modules, u64 __user *, ids, u32 __user *, size, |
97 | u32, flags) |
98 | { |
99 | u32 total_size = lsm_active_cnt * sizeof(*ids); |
100 | u32 usize; |
101 | int i; |
102 | |
103 | if (flags) |
104 | return -EINVAL; |
105 | |
106 | if (get_user(usize, size)) |
107 | return -EFAULT; |
108 | |
109 | if (put_user(total_size, size) != 0) |
110 | return -EFAULT; |
111 | |
112 | if (usize < total_size) |
113 | return -E2BIG; |
114 | |
115 | for (i = 0; i < lsm_active_cnt; i++) |
116 | if (put_user(lsm_idlist[i]->id, ids++)) |
117 | return -EFAULT; |
118 | |
119 | return lsm_active_cnt; |
120 | } |
121 | |