fs.h 2.1 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071
  1. /* SPDX-License-Identifier: GPL-2.0-only */
  2. /*
  3. * Landlock LSM - Filesystem management and hooks
  4. *
  5. * Copyright © 2017-2020 Mickaël Salaün <[email protected]>
  6. * Copyright © 2018-2020 ANSSI
  7. */
  8. #ifndef _SECURITY_LANDLOCK_FS_H
  9. #define _SECURITY_LANDLOCK_FS_H
  10. #include <linux/fs.h>
  11. #include <linux/init.h>
  12. #include <linux/rcupdate.h>
  13. #include "ruleset.h"
  14. #include "setup.h"
  15. /**
  16. * struct landlock_inode_security - Inode security blob
  17. *
  18. * Enable to reference a &struct landlock_object tied to an inode (i.e.
  19. * underlying object).
  20. */
  21. struct landlock_inode_security {
  22. /**
  23. * @object: Weak pointer to an allocated object. All assignments of a
  24. * new object are protected by the underlying inode->i_lock. However,
  25. * atomically disassociating @object from the inode is only protected
  26. * by @object->lock, from the time @object's usage refcount drops to
  27. * zero to the time this pointer is nulled out (cf. release_inode() and
  28. * hook_sb_delete()). Indeed, such disassociation doesn't require
  29. * inode->i_lock thanks to the careful rcu_access_pointer() check
  30. * performed by get_inode_object().
  31. */
  32. struct landlock_object __rcu *object;
  33. };
  34. /**
  35. * struct landlock_superblock_security - Superblock security blob
  36. *
  37. * Enable hook_sb_delete() to wait for concurrent calls to release_inode().
  38. */
  39. struct landlock_superblock_security {
  40. /**
  41. * @inode_refs: Number of pending inodes (from this superblock) that
  42. * are being released by release_inode().
  43. * Cf. struct super_block->s_fsnotify_inode_refs .
  44. */
  45. atomic_long_t inode_refs;
  46. };
  47. static inline struct landlock_inode_security *
  48. landlock_inode(const struct inode *const inode)
  49. {
  50. return inode->i_security + landlock_blob_sizes.lbs_inode;
  51. }
  52. static inline struct landlock_superblock_security *
  53. landlock_superblock(const struct super_block *const superblock)
  54. {
  55. return superblock->s_security + landlock_blob_sizes.lbs_superblock;
  56. }
  57. __init void landlock_add_fs_hooks(void);
  58. int landlock_append_fs_rule(struct landlock_ruleset *const ruleset,
  59. const struct path *const path,
  60. access_mask_t access_hierarchy);
  61. #endif /* _SECURITY_LANDLOCK_FS_H */