1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Landlock LSM - Security framework setup 4 * 5 * Copyright © 2016-2020 Mickaël Salaün <mic@digikod.net> 6 * Copyright © 2018-2020 ANSSI 7 */ 8 9 #include <linux/bits.h> 10 #include <linux/init.h> 11 #include <linux/lsm_hooks.h> 12 13 #include "common.h" 14 #include "cred.h" 15 #include "errata.h" 16 #include "fs.h" 17 #include "ptrace.h" 18 #include "setup.h" 19 20 bool landlock_initialized __ro_after_init = false; 21 22 struct lsm_blob_sizes landlock_blob_sizes __ro_after_init = { 23 .lbs_cred = sizeof(struct landlock_cred_security), 24 .lbs_file = sizeof(struct landlock_file_security), 25 .lbs_inode = sizeof(struct landlock_inode_security), 26 .lbs_superblock = sizeof(struct landlock_superblock_security), 27 }; 28 29 int landlock_errata __ro_after_init; 30 compute_errata(void)31static void __init compute_errata(void) 32 { 33 size_t i; 34 35 #ifndef __has_include 36 /* 37 * This is a safeguard to make sure the compiler implements 38 * __has_include (see errata.h). 39 */ 40 WARN_ON_ONCE(1); 41 return; 42 #endif 43 44 for (i = 0; landlock_errata_init[i].number; i++) { 45 const int prev_errata = landlock_errata; 46 47 if (WARN_ON_ONCE(landlock_errata_init[i].abi > 48 landlock_abi_version)) 49 continue; 50 51 landlock_errata |= BIT(landlock_errata_init[i].number - 1); 52 WARN_ON_ONCE(prev_errata == landlock_errata); 53 } 54 } 55 landlock_init(void)56static int __init landlock_init(void) 57 { 58 compute_errata(); 59 landlock_add_cred_hooks(); 60 landlock_add_ptrace_hooks(); 61 landlock_add_fs_hooks(); 62 landlock_initialized = true; 63 pr_info("Up and running.\n"); 64 return 0; 65 } 66 67 DEFINE_LSM(LANDLOCK_NAME) = { 68 .name = LANDLOCK_NAME, 69 .init = landlock_init, 70 .blobs = &landlock_blob_sizes, 71 }; 72