1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Landlock LSM - Security framework setup
4  *
5  * Copyright © 2016-2020 Mickaël Salaün <[email protected]>
6  * Copyright © 2018-2020 ANSSI
7  */
8 
9 #include <linux/bits.h>
10 #include <linux/init.h>
11 #include <linux/lsm_hooks.h>
12 #include <uapi/linux/lsm.h>
13 
14 #include "common.h"
15 #include "cred.h"
16 #include "errata.h"
17 #include "fs.h"
18 #include "net.h"
19 #include "setup.h"
20 #include "task.h"
21 
22 bool landlock_initialized __ro_after_init = false;
23 
24 const struct lsm_id landlock_lsmid = {
25 	.name = LANDLOCK_NAME,
26 	.id = LSM_ID_LANDLOCK,
27 };
28 
29 struct lsm_blob_sizes landlock_blob_sizes __ro_after_init = {
30 	.lbs_cred = sizeof(struct landlock_cred_security),
31 	.lbs_file = sizeof(struct landlock_file_security),
32 	.lbs_inode = sizeof(struct landlock_inode_security),
33 	.lbs_superblock = sizeof(struct landlock_superblock_security),
34 };
35 
36 int landlock_errata __ro_after_init;
37 
compute_errata(void)38 static void __init compute_errata(void)
39 {
40 	size_t i;
41 
42 #ifndef __has_include
43 	/*
44 	 * This is a safeguard to make sure the compiler implements
45 	 * __has_include (see errata.h).
46 	 */
47 	WARN_ON_ONCE(1);
48 	return;
49 #endif
50 
51 	for (i = 0; landlock_errata_init[i].number; i++) {
52 		const int prev_errata = landlock_errata;
53 
54 		if (WARN_ON_ONCE(landlock_errata_init[i].abi >
55 				 landlock_abi_version))
56 			continue;
57 
58 		landlock_errata |= BIT(landlock_errata_init[i].number - 1);
59 		WARN_ON_ONCE(prev_errata == landlock_errata);
60 	}
61 }
62 
landlock_init(void)63 static int __init landlock_init(void)
64 {
65 	compute_errata();
66 	landlock_add_cred_hooks();
67 	landlock_add_task_hooks();
68 	landlock_add_fs_hooks();
69 	landlock_add_net_hooks();
70 	landlock_initialized = true;
71 	pr_info("Up and running.\n");
72 	return 0;
73 }
74 
75 DEFINE_LSM(LANDLOCK_NAME) = {
76 	.name = LANDLOCK_NAME,
77 	.init = landlock_init,
78 	.blobs = &landlock_blob_sizes,
79 };
80