Line data    Source code

       1             : // SPDX-License-Identifier: GPL-2.0-only
       2             : /*
       3             :  * Landlock LSM - Credential hooks
       4             :  *
       5             :  * Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net>
       6             :  * Copyright © 2018-2020 ANSSI
       7             :  */
       8             : 
       9             : #include <linux/cred.h>
      10             : #include <linux/lsm_hooks.h>
      11             : 
      12             : #include "common.h"
      13             : #include "cred.h"
      14             : #include "ruleset.h"
      15             : #include "setup.h"
      16             : 
      17       10524 : static int hook_cred_prepare(struct cred *const new,
      18             :                 const struct cred *const old, const gfp_t gfp)
      19             : {
      20       10524 :         struct landlock_ruleset *const old_dom = landlock_cred(old)->domain;
      21             : 
      22       10524 :         if (old_dom) {
      23         112 :                 landlock_get_ruleset(old_dom);
      24         112 :                 landlock_cred(new)->domain = old_dom;
      25             :         }
      26       10524 :         return 0;
      27             : }
      28             : 
      29       10408 : static void hook_cred_free(struct cred *const cred)
      30             : {
      31       10408 :         struct landlock_ruleset *const dom = landlock_cred(cred)->domain;
      32             : 
      33       10408 :         if (dom)
      34         163 :                 landlock_put_ruleset_deferred(dom);
      35       10408 : }
      36             : 
      37             : static struct security_hook_list landlock_hooks[] __lsm_ro_after_init = {
      38             :         LSM_HOOK_INIT(cred_prepare, hook_cred_prepare),
      39             :         LSM_HOOK_INIT(cred_free, hook_cred_free),
      40             : };
      41             : 
      42           1 : __init void landlock_add_cred_hooks(void)
      43             : {
      44           1 :         security_add_hooks(landlock_hooks, ARRAY_SIZE(landlock_hooks),
      45             :                         LANDLOCK_NAME);
      46           1 : }