[RFC PATCH bpf-next seccomp 06/12] lsm: New hook seccomp_extended
From: YiFei Zhu <hidden>
Date: 2021-05-10 17:23:17
Also in:
bpf
Subsystem:
security subsystem, the rest · Maintainers:
Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds
From: YiFei Zhu <redacted> This hooks takes no argument, and returns 0 if the current task is permitted to use extended seccomp-eBPF features, or -errno if it is not permitted. Signed-off-by: YiFei Zhu <redacted> --- include/linux/lsm_hook_defs.h | 4 ++++ include/linux/security.h | 13 +++++++++++++ security/security.c | 8 ++++++++ 3 files changed, 25 insertions(+)
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index 61f04f7dc1a4..94e18d95e1cc 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h@@ -391,6 +391,10 @@ LSM_HOOK(int, 0, bpf_map_alloc_security, struct bpf_map *map) LSM_HOOK(void, LSM_RET_VOID, bpf_map_free_security, struct bpf_map *map) LSM_HOOK(int, 0, bpf_prog_alloc_security, struct bpf_prog_aux *aux) LSM_HOOK(void, LSM_RET_VOID, bpf_prog_free_security, struct bpf_prog_aux *aux) + +#ifdef CONFIG_SECCOMP_FILTER_EXTENDED +LSM_HOOK(int, 0, seccomp_extended, void) +#endif /* CONFIG_SECCOMP_FILTER_EXTENDED */ #endif /* CONFIG_BPF_SYSCALL */ LSM_HOOK(int, 0, locked_down, enum lockdown_reason what)
diff --git a/include/linux/security.h b/include/linux/security.h
index 9aeda3f9e838..8e98dd98ac90 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h@@ -1960,6 +1960,11 @@ extern int security_bpf_map_alloc(struct bpf_map *map); extern void security_bpf_map_free(struct bpf_map *map); extern int security_bpf_prog_alloc(struct bpf_prog_aux *aux); extern void security_bpf_prog_free(struct bpf_prog_aux *aux); + +#ifdef CONFIG_SECCOMP_FILTER_EXTENDED +extern int security_seccomp_extended(void); +#endif /* CONFIG_SECCOMP_FILTER_EXTENDED */ + #else static inline int security_bpf(int cmd, union bpf_attr *attr, unsigned int size)
@@ -1992,6 +1997,14 @@ static inline int security_bpf_prog_alloc(struct bpf_prog_aux *aux) static inline void security_bpf_prog_free(struct bpf_prog_aux *aux) { } + +#ifdef CONFIG_SECCOMP_FILTER_EXTENDED +static inline int security_seccomp_extended(void) +{ + return 0; +} +#endif /* CONFIG_SECCOMP_FILTER_EXTENDED */ + #endif /* CONFIG_SECURITY */ #endif /* CONFIG_BPF_SYSCALL */
diff --git a/security/security.c b/security/security.c
index 94383f83ba42..301afe76ffb2 100644
--- a/security/security.c
+++ b/security/security.c@@ -2553,6 +2553,14 @@ void security_bpf_prog_free(struct bpf_prog_aux *aux) { call_void_hook(bpf_prog_free_security, aux); } + +#ifdef CONFIG_SECCOMP_FILTER_EXTENDED +int security_seccomp_extended(void) +{ + return call_int_hook(seccomp_extended, 0); +} +#endif + #endif /* CONFIG_BPF_SYSCALL */ int security_locked_down(enum lockdown_reason what)
--
2.31.1