1/*
2 * Linux Security Module interfaces
3 *
4 * Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com>
5 * Copyright (C) 2001 Greg Kroah-Hartman <greg@kroah.com>
6 * Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com>
7 * Copyright (C) 2001 James Morris <jmorris@intercode.com.au>
8 * Copyright (C) 2001 Silicon Graphics, Inc. (Trust Technology Group)
9 * Copyright (C) 2015 Intel Corporation.
10 * Copyright (C) 2015 Casey Schaufler <casey@schaufler-ca.com>
11 * Copyright (C) 2016 Mellanox Techonologies
12 *
13 *	This program is free software; you can redistribute it and/or modify
14 *	it under the terms of the GNU General Public License as published by
15 *	the Free Software Foundation; either version 2 of the License, or
16 *	(at your option) any later version.
17 *
18 *	Due to this file being licensed under the GPL there is controversy over
19 *	whether this permits you to write a module that #includes this file
20 *	without placing your module under the GPL.  Please consult a lawyer for
21 *	advice before doing this.
22 *
23 */
24
25#ifndef __LINUX_LSM_HOOKS_H
26#define __LINUX_LSM_HOOKS_H
27
28#include <uapi/linux/lsm.h>
29#include <linux/security.h>
30#include <linux/init.h>
31#include <linux/rculist.h>
32#include <linux/xattr.h>
33
34union security_list_options {
35	#define LSM_HOOK(RET, DEFAULT, NAME, ...) RET (*NAME)(__VA_ARGS__);
36	#include "lsm_hook_defs.h"
37	#undef LSM_HOOK
38};
39
40struct security_hook_heads {
41	#define LSM_HOOK(RET, DEFAULT, NAME, ...) struct hlist_head NAME;
42	#include "lsm_hook_defs.h"
43	#undef LSM_HOOK
44} __randomize_layout;
45
46/**
47 * struct lsm_id - Identify a Linux Security Module.
48 * @lsm: name of the LSM, must be approved by the LSM maintainers
49 * @id: LSM ID number from uapi/linux/lsm.h
50 *
51 * Contains the information that identifies the LSM.
52 */
53struct lsm_id {
54	const char	*name;
55	u64		id;
56};
57
58/*
59 * Security module hook list structure.
60 * For use with generic list macros for common operations.
61 */
62struct security_hook_list {
63	struct hlist_node		list;
64	struct hlist_head		*head;
65	union security_list_options	hook;
66	const struct lsm_id		*lsmid;
67} __randomize_layout;
68
69/*
70 * Security blob size or offset data.
71 */
72struct lsm_blob_sizes {
73	int	lbs_cred;
74	int	lbs_file;
75	int	lbs_inode;
76	int	lbs_superblock;
77	int	lbs_ipc;
78	int	lbs_msg_msg;
79	int	lbs_task;
80	int	lbs_xattr_count; /* number of xattr slots in new_xattrs array */
81};
82
83/**
84 * lsm_get_xattr_slot - Return the next available slot and increment the index
85 * @xattrs: array storing LSM-provided xattrs
86 * @xattr_count: number of already stored xattrs (updated)
87 *
88 * Retrieve the first available slot in the @xattrs array to fill with an xattr,
89 * and increment @xattr_count.
90 *
91 * Return: The slot to fill in @xattrs if non-NULL, NULL otherwise.
92 */
93static inline struct xattr *lsm_get_xattr_slot(struct xattr *xattrs,
94					       int *xattr_count)
95{
96	if (unlikely(!xattrs))
97		return NULL;
98	return &xattrs[(*xattr_count)++];
99}
100
101/*
102 * LSM_RET_VOID is used as the default value in LSM_HOOK definitions for void
103 * LSM hooks (in include/linux/lsm_hook_defs.h).
104 */
105#define LSM_RET_VOID ((void) 0)
106
107/*
108 * Initializing a security_hook_list structure takes
109 * up a lot of space in a source file. This macro takes
110 * care of the common case and reduces the amount of
111 * text involved.
112 */
113#define LSM_HOOK_INIT(HEAD, HOOK) \
114	{ .head = &security_hook_heads.HEAD, .hook = { .HEAD = HOOK } }
115
116extern struct security_hook_heads security_hook_heads;
117extern char *lsm_names;
118
119extern void security_add_hooks(struct security_hook_list *hooks, int count,
120			       const struct lsm_id *lsmid);
121
122#define LSM_FLAG_LEGACY_MAJOR	BIT(0)
123#define LSM_FLAG_EXCLUSIVE	BIT(1)
124
125enum lsm_order {
126	LSM_ORDER_FIRST = -1,	/* This is only for capabilities. */
127	LSM_ORDER_MUTABLE = 0,
128	LSM_ORDER_LAST = 1,	/* This is only for integrity. */
129};
130
131struct lsm_info {
132	const char *name;	/* Required. */
133	enum lsm_order order;	/* Optional: default is LSM_ORDER_MUTABLE */
134	unsigned long flags;	/* Optional: flags describing LSM */
135	int *enabled;		/* Optional: controlled by CONFIG_LSM */
136	int (*init)(void);	/* Required. */
137	struct lsm_blob_sizes *blobs; /* Optional: for blob sharing. */
138};
139
140extern struct lsm_info __start_lsm_info[], __end_lsm_info[];
141extern struct lsm_info __start_early_lsm_info[], __end_early_lsm_info[];
142
143#define DEFINE_LSM(lsm)							\
144	static struct lsm_info __lsm_##lsm				\
145		__used __section(".lsm_info.init")			\
146		__aligned(sizeof(unsigned long))
147
148#define DEFINE_EARLY_LSM(lsm)						\
149	static struct lsm_info __early_lsm_##lsm			\
150		__used __section(".early_lsm_info.init")		\
151		__aligned(sizeof(unsigned long))
152
153extern int lsm_inode_alloc(struct inode *inode);
154
155#endif /* ! __LINUX_LSM_HOOKS_H */
156