1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * System calls implementing the Linux Security Module API.
4 *
5 *  Copyright (C) 2022 Casey Schaufler <casey@schaufler-ca.com>
6 *  Copyright (C) 2022 Intel Corporation
7 */
8
9#include <asm/current.h>
10#include <linux/compiler_types.h>
11#include <linux/err.h>
12#include <linux/errno.h>
13#include <linux/security.h>
14#include <linux/stddef.h>
15#include <linux/syscalls.h>
16#include <linux/types.h>
17#include <linux/lsm_hooks.h>
18#include <uapi/linux/lsm.h>
19
20/**
21 * lsm_name_to_attr - map an LSM attribute name to its ID
22 * @name: name of the attribute
23 *
24 * Returns the LSM attribute value associated with @name, or 0 if
25 * there is no mapping.
26 */
27u64 lsm_name_to_attr(const char *name)
28{
29	if (!strcmp(name, "current"))
30		return LSM_ATTR_CURRENT;
31	if (!strcmp(name, "exec"))
32		return LSM_ATTR_EXEC;
33	if (!strcmp(name, "fscreate"))
34		return LSM_ATTR_FSCREATE;
35	if (!strcmp(name, "keycreate"))
36		return LSM_ATTR_KEYCREATE;
37	if (!strcmp(name, "prev"))
38		return LSM_ATTR_PREV;
39	if (!strcmp(name, "sockcreate"))
40		return LSM_ATTR_SOCKCREATE;
41	return LSM_ATTR_UNDEF;
42}
43
44/**
45 * sys_lsm_set_self_attr - Set current task's security module attribute
46 * @attr: which attribute to set
47 * @ctx: the LSM contexts
48 * @size: size of @ctx
49 * @flags: reserved for future use
50 *
51 * Sets the calling task's LSM context. On success this function
52 * returns 0. If the attribute specified cannot be set a negative
53 * value indicating the reason for the error is returned.
54 */
55SYSCALL_DEFINE4(lsm_set_self_attr, unsigned int, attr, struct lsm_ctx __user *,
56		ctx, u32, size, u32, flags)
57{
58	return security_setselfattr(attr, ctx, size, flags);
59}
60
61/**
62 * sys_lsm_get_self_attr - Return current task's security module attributes
63 * @attr: which attribute to return
64 * @ctx: the user-space destination for the information, or NULL
65 * @size: pointer to the size of space available to receive the data
66 * @flags: special handling options. LSM_FLAG_SINGLE indicates that only
67 * attributes associated with the LSM identified in the passed @ctx be
68 * reported.
69 *
70 * Returns the calling task's LSM contexts. On success this
71 * function returns the number of @ctx array elements. This value
72 * may be zero if there are no LSM contexts assigned. If @size is
73 * insufficient to contain the return data -E2BIG is returned and
74 * @size is set to the minimum required size. In all other cases
75 * a negative value indicating the error is returned.
76 */
77SYSCALL_DEFINE4(lsm_get_self_attr, unsigned int, attr, struct lsm_ctx __user *,
78		ctx, u32 __user *, size, u32, flags)
79{
80	return security_getselfattr(attr, ctx, size, flags);
81}
82
83/**
84 * sys_lsm_list_modules - Return a list of the active security modules
85 * @ids: the LSM module ids
86 * @size: pointer to size of @ids, updated on return
87 * @flags: reserved for future use, must be zero
88 *
89 * Returns a list of the active LSM ids. On success this function
90 * returns the number of @ids array elements. This value may be zero
91 * if there are no LSMs active. If @size is insufficient to contain
92 * the return data -E2BIG is returned and @size is set to the minimum
93 * required size. In all other cases a negative value indicating the
94 * error is returned.
95 */
96SYSCALL_DEFINE3(lsm_list_modules, u64 __user *, ids, u32 __user *, size,
97		u32, flags)
98{
99	u32 total_size = lsm_active_cnt * sizeof(*ids);
100	u32 usize;
101	int i;
102
103	if (flags)
104		return -EINVAL;
105
106	if (get_user(usize, size))
107		return -EFAULT;
108
109	if (put_user(total_size, size) != 0)
110		return -EFAULT;
111
112	if (usize < total_size)
113		return -E2BIG;
114
115	for (i = 0; i < lsm_active_cnt; i++)
116		if (put_user(lsm_idlist[i]->id, ids++))
117			return -EFAULT;
118
119	return lsm_active_cnt;
120}
121