object.h 2.8 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091
  1. /* SPDX-License-Identifier: GPL-2.0-only */
  2. /*
  3. * Landlock LSM - Object management
  4. *
  5. * Copyright © 2016-2020 Mickaël Salaün <[email protected]>
  6. * Copyright © 2018-2020 ANSSI
  7. */
  8. #ifndef _SECURITY_LANDLOCK_OBJECT_H
  9. #define _SECURITY_LANDLOCK_OBJECT_H
  10. #include <linux/compiler_types.h>
  11. #include <linux/refcount.h>
  12. #include <linux/spinlock.h>
  13. struct landlock_object;
  14. /**
  15. * struct landlock_object_underops - Operations on an underlying object
  16. */
  17. struct landlock_object_underops {
  18. /**
  19. * @release: Releases the underlying object (e.g. iput() for an inode).
  20. */
  21. void (*release)(struct landlock_object *const object)
  22. __releases(object->lock);
  23. };
  24. /**
  25. * struct landlock_object - Security blob tied to a kernel object
  26. *
  27. * The goal of this structure is to enable to tie a set of ephemeral access
  28. * rights (pertaining to different domains) to a kernel object (e.g an inode)
  29. * in a safe way. This implies to handle concurrent use and modification.
  30. *
  31. * The lifetime of a &struct landlock_object depends on the rules referring to
  32. * it.
  33. */
  34. struct landlock_object {
  35. /**
  36. * @usage: This counter is used to tie an object to the rules matching
  37. * it or to keep it alive while adding a new rule. If this counter
  38. * reaches zero, this struct must not be modified, but this counter can
  39. * still be read from within an RCU read-side critical section. When
  40. * adding a new rule to an object with a usage counter of zero, we must
  41. * wait until the pointer to this object is set to NULL (or recycled).
  42. */
  43. refcount_t usage;
  44. /**
  45. * @lock: Protects against concurrent modifications. This lock must be
  46. * held from the time @usage drops to zero until any weak references
  47. * from @underobj to this object have been cleaned up.
  48. *
  49. * Lock ordering: inode->i_lock nests inside this.
  50. */
  51. spinlock_t lock;
  52. /**
  53. * @underobj: Used when cleaning up an object and to mark an object as
  54. * tied to its underlying kernel structure. This pointer is protected
  55. * by @lock. Cf. landlock_release_inodes() and release_inode().
  56. */
  57. void *underobj;
  58. union {
  59. /**
  60. * @rcu_free: Enables lockless use of @usage, @lock and
  61. * @underobj from within an RCU read-side critical section.
  62. * @rcu_free and @underops are only used by
  63. * landlock_put_object().
  64. */
  65. struct rcu_head rcu_free;
  66. /**
  67. * @underops: Enables landlock_put_object() to release the
  68. * underlying object (e.g. inode).
  69. */
  70. const struct landlock_object_underops *underops;
  71. };
  72. };
  73. struct landlock_object *
  74. landlock_create_object(const struct landlock_object_underops *const underops,
  75. void *const underobj);
  76. void landlock_put_object(struct landlock_object *const object);
  77. static inline void landlock_get_object(struct landlock_object *const object)
  78. {
  79. if (object)
  80. refcount_inc(&object->usage);
  81. }
  82. #endif /* _SECURITY_LANDLOCK_OBJECT_H */