@@ -1607,6 +1607,7 @@ struct security_hook_heads {
*/
struct lsm_id {
const char *lsm; /* Name of the LSM */
+ int id; /* LSM ID */
};
/*
new file mode 100644
@@ -0,0 +1,32 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Linus Security Modules (LSM) - User space API
+ *
+ * Copyright (C) 2022 Casey Schaufler <casey@schaufler-ca.com>
+ * Copyright (C) Intel Corporation
+ */
+
+#ifndef _UAPI_LINUX_LSM_H
+#define _UAPI_LINUX_LSM_H
+
+/*
+ * ID values to identify security modules.
+ * A system may use more than one security module.
+ *
+ * LSM_ID_XXX values 0 - 31 are reserved for future use
+ */
+#define LSM_ID_INVALID -1
+#define LSM_ID_CAPABILITY 32
+#define LSM_ID_SELINUX 33
+#define LSM_ID_SMACK 34
+#define LSM_ID_TOMOYO 35
+#define LSM_ID_IMA 36
+#define LSM_ID_APPARMOR 37
+#define LSM_ID_YAMA 38
+#define LSM_ID_LOADPIN 39
+#define LSM_ID_SAFESETID 40
+#define LSM_ID_LOCKDOWN 41
+#define LSM_ID_BPF 42
+#define LSM_ID_LANDLOCK 43
+
+#endif /* _UAPI_LINUX_LSM_H */
@@ -24,6 +24,7 @@
#include <linux/zlib.h>
#include <net/sock.h>
#include <uapi/linux/mount.h>
+#include <uapi/linux/lsm.h>
#include "include/apparmor.h"
#include "include/apparmorfs.h"
@@ -1204,6 +1205,7 @@ struct lsm_blob_sizes apparmor_blob_sizes __lsm_ro_after_init = {
static struct lsm_id apparmor_lsmid __lsm_ro_after_init = {
.lsm = "apparmor",
+ .id = LSM_ID_APPARMOR,
};
static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
@@ -5,6 +5,7 @@
*/
#include <linux/lsm_hooks.h>
#include <linux/bpf_lsm.h>
+#include <uapi/linux/lsm.h>
static struct security_hook_list bpf_lsm_hooks[] __lsm_ro_after_init = {
#define LSM_HOOK(RET, DEFAULT, NAME, ...) \
@@ -21,6 +22,7 @@ static struct security_hook_list bpf_lsm_hooks[] __lsm_ro_after_init = {
*/
struct lsm_id bpf_lsmid __lsm_ro_after_init = {
.lsm = "bpf",
+ .id = LSM_ID_BPF,
};
static int __init bpf_lsm_init(void)
@@ -25,6 +25,7 @@
#include <linux/binfmts.h>
#include <linux/personality.h>
#include <linux/mnt_idmapping.h>
+#include <uapi/linux/lsm.h>
/*
* If a non-root user executes a setuid-root binary in
@@ -1448,6 +1449,7 @@ int cap_mmap_file(struct file *file, unsigned long reqprot,
static struct lsm_id capability_lsmid __lsm_ro_after_init = {
.lsm = "capability",
+ .id = LSM_ID_CAPABILITY,
};
static struct security_hook_list capability_hooks[] __lsm_ro_after_init = {
@@ -8,6 +8,7 @@
#include <linux/init.h>
#include <linux/lsm_hooks.h>
+#include <uapi/linux/lsm.h>
#include "common.h"
#include "cred.h"
@@ -25,6 +26,7 @@ struct lsm_blob_sizes landlock_blob_sizes __lsm_ro_after_init = {
struct lsm_id landlock_lsmid __lsm_ro_after_init = {
.lsm = LANDLOCK_NAME,
+ .id = LSM_ID_LANDLOCK,
};
static int __init landlock_init(void)
@@ -20,6 +20,7 @@
#include <linux/string_helpers.h>
#include <linux/dm-verity-loadpin.h>
#include <uapi/linux/loadpin.h>
+#include <uapi/linux/lsm.h>
#define VERITY_DIGEST_FILE_HEADER "# LOADPIN_TRUSTED_VERITY_ROOT_DIGESTS"
@@ -199,6 +200,7 @@ static int loadpin_load_data(enum kernel_load_data_id id, bool contents)
static struct lsm_id loadpin_lsmid __lsm_ro_after_init = {
.lsm = "loadpin",
+ .id = LSM_ID_LOADPIN,
};
static struct security_hook_list loadpin_hooks[] __lsm_ro_after_init = {
@@ -13,6 +13,7 @@
#include <linux/security.h>
#include <linux/export.h>
#include <linux/lsm_hooks.h>
+#include <uapi/linux/lsm.h>
static enum lockdown_reason kernel_locked_down;
@@ -77,6 +78,7 @@ static struct security_hook_list lockdown_hooks[] __lsm_ro_after_init = {
static struct lsm_id lockdown_lsmid __lsm_ro_after_init = {
.lsm = "lockdown",
+ .id = LSM_ID_LOCKDOWN,
};
static int __init lockdown_lsm_init(void)
@@ -19,6 +19,7 @@
#include <linux/ptrace.h>
#include <linux/sched/task_stack.h>
#include <linux/security.h>
+#include <uapi/linux/lsm.h>
#include "lsm.h"
/* Flag indicating whether initialization completed */
@@ -263,6 +264,7 @@ static int safesetid_task_fix_setgroups(struct cred *new, const struct cred *old
static struct lsm_id safesetid_lsmid __lsm_ro_after_init = {
.lsm = "safesetid",
+ .id = LSM_ID_SAFESETID,
};
static struct security_hook_list safesetid_security_hooks[] = {
@@ -92,6 +92,7 @@
#include <linux/fsnotify.h>
#include <linux/fanotify.h>
#include <linux/io_uring.h>
+#include <uapi/linux/lsm.h>
#include "avc.h"
#include "objsec.h"
@@ -7016,6 +7017,7 @@ static int selinux_uring_cmd(struct io_uring_cmd *ioucmd)
static struct lsm_id selinux_lsmid __lsm_ro_after_init = {
.lsm = "selinux",
+ .id = LSM_ID_SELINUX,
};
/*
@@ -43,6 +43,7 @@
#include <linux/fs_parser.h>
#include <linux/watch_queue.h>
#include <linux/io_uring.h>
+#include <uapi/linux/lsm.h>
#include "smack.h"
#define TRANS_TRUE "TRUE"
@@ -4789,6 +4790,7 @@ struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init = {
static struct lsm_id smack_lsmid __lsm_ro_after_init = {
.lsm = "smack",
+ .id = LSM_ID_SMACK,
};
static struct security_hook_list smack_hooks[] __lsm_ro_after_init = {
@@ -6,6 +6,7 @@
*/
#include <linux/lsm_hooks.h>
+#include <uapi/linux/lsm.h>
#include "common.h"
/**
@@ -532,6 +533,7 @@ static void tomoyo_task_free(struct task_struct *task)
static struct lsm_id tomoyo_lsmid __lsm_ro_after_init = {
.lsm = "tomoyo",
+ .id = LSM_ID_TOMOYO,
};
/*
@@ -18,6 +18,7 @@
#include <linux/task_work.h>
#include <linux/sched.h>
#include <linux/spinlock.h>
+#include <uapi/linux/lsm.h>
#define YAMA_SCOPE_DISABLED 0
#define YAMA_SCOPE_RELATIONAL 1
@@ -423,6 +424,7 @@ static int yama_ptrace_traceme(struct task_struct *parent)
static struct lsm_id yama_lsmid __lsm_ro_after_init = {
.lsm = "yama",
+ .id = LSM_ID_YAMA,
};
static struct security_hook_list yama_hooks[] __lsm_ro_after_init = {