.. | .. |
---|
| 1 | +/* SPDX-License-Identifier: GPL-2.0-only */ |
---|
1 | 2 | /* |
---|
2 | 3 | * Copyright (C) 2008 IBM Corporation |
---|
3 | 4 | * Author: Mimi Zohar <zohar@us.ibm.com> |
---|
4 | | - * |
---|
5 | | - * This program is free software; you can redistribute it and/or modify |
---|
6 | | - * it under the terms of the GNU General Public License as published by |
---|
7 | | - * the Free Software Foundation, version 2 of the License. |
---|
8 | 5 | */ |
---|
9 | 6 | |
---|
10 | 7 | #ifndef _LINUX_IMA_H |
---|
11 | 8 | #define _LINUX_IMA_H |
---|
12 | 9 | |
---|
| 10 | +#include <linux/kernel_read_file.h> |
---|
13 | 11 | #include <linux/fs.h> |
---|
14 | 12 | #include <linux/security.h> |
---|
15 | 13 | #include <linux/kexec.h> |
---|
.. | .. |
---|
18 | 16 | #ifdef CONFIG_IMA |
---|
19 | 17 | extern int ima_bprm_check(struct linux_binprm *bprm); |
---|
20 | 18 | extern int ima_file_check(struct file *file, int mask); |
---|
| 19 | +extern void ima_post_create_tmpfile(struct inode *inode); |
---|
21 | 20 | extern void ima_file_free(struct file *file); |
---|
22 | | -extern int ima_file_mmap(struct file *file, unsigned long prot); |
---|
23 | | -extern int ima_load_data(enum kernel_load_data_id id); |
---|
24 | | -extern int ima_read_file(struct file *file, enum kernel_read_file_id id); |
---|
| 21 | +extern int ima_file_mmap(struct file *file, unsigned long reqprot, |
---|
| 22 | + unsigned long prot, unsigned long flags); |
---|
| 23 | +extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot); |
---|
| 24 | +extern int ima_load_data(enum kernel_load_data_id id, bool contents); |
---|
| 25 | +extern int ima_post_load_data(char *buf, loff_t size, |
---|
| 26 | + enum kernel_load_data_id id, char *description); |
---|
| 27 | +extern int ima_read_file(struct file *file, enum kernel_read_file_id id, |
---|
| 28 | + bool contents); |
---|
25 | 29 | extern int ima_post_read_file(struct file *file, void *buf, loff_t size, |
---|
26 | 30 | enum kernel_read_file_id id); |
---|
27 | 31 | extern void ima_post_path_mknod(struct dentry *dentry); |
---|
| 32 | +extern int ima_file_hash(struct file *file, char *buf, size_t buf_size); |
---|
| 33 | +extern void ima_kexec_cmdline(int kernel_fd, const void *buf, int size); |
---|
28 | 34 | |
---|
29 | 35 | #ifdef CONFIG_IMA_KEXEC |
---|
30 | 36 | extern void ima_add_kexec_buffer(struct kimage *image); |
---|
| 37 | +#endif |
---|
| 38 | + |
---|
| 39 | +#ifdef CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT |
---|
| 40 | +extern bool arch_ima_get_secureboot(void); |
---|
| 41 | +extern const char * const *arch_get_ima_policy(void); |
---|
| 42 | +#else |
---|
| 43 | +static inline bool arch_ima_get_secureboot(void) |
---|
| 44 | +{ |
---|
| 45 | + return false; |
---|
| 46 | +} |
---|
| 47 | + |
---|
| 48 | +static inline const char * const *arch_get_ima_policy(void) |
---|
| 49 | +{ |
---|
| 50 | + return NULL; |
---|
| 51 | +} |
---|
31 | 52 | #endif |
---|
32 | 53 | |
---|
33 | 54 | #else |
---|
.. | .. |
---|
41 | 62 | return 0; |
---|
42 | 63 | } |
---|
43 | 64 | |
---|
| 65 | +static inline void ima_post_create_tmpfile(struct inode *inode) |
---|
| 66 | +{ |
---|
| 67 | +} |
---|
| 68 | + |
---|
44 | 69 | static inline void ima_file_free(struct file *file) |
---|
45 | 70 | { |
---|
46 | 71 | return; |
---|
47 | 72 | } |
---|
48 | 73 | |
---|
49 | | -static inline int ima_file_mmap(struct file *file, unsigned long prot) |
---|
| 74 | +static inline int ima_file_mmap(struct file *file, unsigned long reqprot, |
---|
| 75 | + unsigned long prot, unsigned long flags) |
---|
50 | 76 | { |
---|
51 | 77 | return 0; |
---|
52 | 78 | } |
---|
53 | 79 | |
---|
54 | | -static inline int ima_load_data(enum kernel_load_data_id id) |
---|
| 80 | +static inline int ima_file_mprotect(struct vm_area_struct *vma, |
---|
| 81 | + unsigned long prot) |
---|
55 | 82 | { |
---|
56 | 83 | return 0; |
---|
57 | 84 | } |
---|
58 | 85 | |
---|
59 | | -static inline int ima_read_file(struct file *file, enum kernel_read_file_id id) |
---|
| 86 | +static inline int ima_load_data(enum kernel_load_data_id id, bool contents) |
---|
| 87 | +{ |
---|
| 88 | + return 0; |
---|
| 89 | +} |
---|
| 90 | + |
---|
| 91 | +static inline int ima_post_load_data(char *buf, loff_t size, |
---|
| 92 | + enum kernel_load_data_id id, |
---|
| 93 | + char *description) |
---|
| 94 | +{ |
---|
| 95 | + return 0; |
---|
| 96 | +} |
---|
| 97 | + |
---|
| 98 | +static inline int ima_read_file(struct file *file, enum kernel_read_file_id id, |
---|
| 99 | + bool contents) |
---|
60 | 100 | { |
---|
61 | 101 | return 0; |
---|
62 | 102 | } |
---|
.. | .. |
---|
72 | 112 | return; |
---|
73 | 113 | } |
---|
74 | 114 | |
---|
| 115 | +static inline int ima_file_hash(struct file *file, char *buf, size_t buf_size) |
---|
| 116 | +{ |
---|
| 117 | + return -EOPNOTSUPP; |
---|
| 118 | +} |
---|
| 119 | + |
---|
| 120 | +static inline void ima_kexec_cmdline(int kernel_fd, const void *buf, int size) {} |
---|
75 | 121 | #endif /* CONFIG_IMA */ |
---|
76 | 122 | |
---|
77 | 123 | #ifndef CONFIG_IMA_KEXEC |
---|
.. | .. |
---|
80 | 126 | static inline void ima_add_kexec_buffer(struct kimage *image) |
---|
81 | 127 | {} |
---|
82 | 128 | #endif |
---|
| 129 | + |
---|
| 130 | +#ifdef CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS |
---|
| 131 | +extern void ima_post_key_create_or_update(struct key *keyring, |
---|
| 132 | + struct key *key, |
---|
| 133 | + const void *payload, size_t plen, |
---|
| 134 | + unsigned long flags, bool create); |
---|
| 135 | +#else |
---|
| 136 | +static inline void ima_post_key_create_or_update(struct key *keyring, |
---|
| 137 | + struct key *key, |
---|
| 138 | + const void *payload, |
---|
| 139 | + size_t plen, |
---|
| 140 | + unsigned long flags, |
---|
| 141 | + bool create) {} |
---|
| 142 | +#endif /* CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS */ |
---|
83 | 143 | |
---|
84 | 144 | #ifdef CONFIG_IMA_APPRAISE |
---|
85 | 145 | extern bool is_ima_appraise_enabled(void); |
---|
.. | .. |
---|
112 | 172 | return 0; |
---|
113 | 173 | } |
---|
114 | 174 | #endif /* CONFIG_IMA_APPRAISE */ |
---|
| 175 | + |
---|
| 176 | +#if defined(CONFIG_IMA_APPRAISE) && defined(CONFIG_INTEGRITY_TRUSTED_KEYRING) |
---|
| 177 | +extern bool ima_appraise_signature(enum kernel_read_file_id func); |
---|
| 178 | +#else |
---|
| 179 | +static inline bool ima_appraise_signature(enum kernel_read_file_id func) |
---|
| 180 | +{ |
---|
| 181 | + return false; |
---|
| 182 | +} |
---|
| 183 | +#endif /* CONFIG_IMA_APPRAISE && CONFIG_INTEGRITY_TRUSTED_KEYRING */ |
---|
115 | 184 | #endif /* _LINUX_IMA_H */ |
---|