security/landlock/cred.h

0001 /* SPDX-License-Identifier: GPL-2.0-only */
0002 /*
0003  * Landlock LSM - Credential hooks
0004  *
0005  * Copyright © 2019-2020 Mickaël Salaün <mic@digikod.net>
0006  * Copyright © 2019-2020 ANSSI
0007  */
0008
0009 #ifndef _SECURITY_LANDLOCK_CRED_H
0010 #define _SECURITY_LANDLOCK_CRED_H
0011
0012 #include <linux/cred.h>
0013 #include <linux/init.h>
0014 #include <linux/rcupdate.h>
0015
0016 #include "ruleset.h"
0017 #include "setup.h"
0018
0019 struct landlock_cred_security {
0020     struct landlock_ruleset *domain;
0021 };
0022
0023 static inline struct landlock_cred_security *
0024 landlock_cred(const struct cred *cred)
0025 {
0026     return cred->security + landlock_blob_sizes.lbs_cred;
0027 }
0028
0029 static inline const struct landlock_ruleset *landlock_get_current_domain(void)
0030 {
0031     return landlock_cred(current_cred())->domain;
0032 }
0033
0034 /*
0035  * The call needs to come from an RCU read-side critical section.
0036  */
0037 static inline const struct landlock_ruleset *
0038 landlock_get_task_domain(const struct task_struct *const task)
0039 {
0040     return landlock_cred(__task_cred(task))->domain;
0041 }
0042
0043 static inline bool landlocked(const struct task_struct *const task)
0044 {
0045     bool has_dom;
0046
0047     if (task == current)
0048         return !!landlock_get_current_domain();
0049
0050     rcu_read_lock();
0051     has_dom = !!landlock_get_task_domain(task);
0052     rcu_read_unlock();
0053     return has_dom;
0054 }
0055
0056 __init void landlock_add_cred_hooks(void);
0057
0058 #endif /* _SECURITY_LANDLOCK_CRED_H */