security/integrity/evm/evm_secfs.c
Source file repositories/reference/linux-study-clean/security/integrity/evm/evm_secfs.c
File Facts
- System
- Linux kernel
- Corpus path
security/integrity/evm/evm_secfs.c- Extension
.c- Size
- 7670 bytes
- Lines
- 347
- Domain
- Core OS
- Bucket
- Security And Isolation
- Inferred role
- Core OS: operation-table or driver-model contract
- Status
- pattern implementation candidate
Why This File Exists
Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.
- Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.
- Defines an operation table; this is where Linux turns generic core objects into subsystem-specific behavior.
- Uses kernel synchronization; read lock ordering, sleepability, and interrupt context assumptions before translating.
- Allocates kernel memory; connect allocation flags and lifetime to context constraints.
- Defines or uses C structs; map object ownership, embedded links, reference counts, and lock ownership.
Dependency Surface
linux/audit.hlinux/uaccess.hlinux/init.hlinux/mutex.hevm.h
Detected Declarations
function evm_read_keyfunction evm_write_keyfunction evm_read_xattrsfunction list_for_each_entryfunction evm_write_xattrsfunction evm_init_xattrsfunction evm_init_xattrsfunction evm_init_secfs
Annotated Snippet
static const struct file_operations evm_key_ops = {
.read = evm_read_key,
.write = evm_write_key,
};
#ifdef CONFIG_EVM_ADD_XATTRS
/**
* evm_read_xattrs - read() for <securityfs>/evm_xattrs
*
* @filp: file pointer, not actually used
* @buf: where to put the result
* @count: maximum to send along
* @ppos: where to start
*
* Returns number of bytes read or error code, as appropriate
*/
static ssize_t evm_read_xattrs(struct file *filp, char __user *buf,
size_t count, loff_t *ppos)
{
char *temp;
size_t offset = 0, size = 0;
ssize_t rc;
struct xattr_list *xattr;
if (*ppos != 0)
return 0;
rc = mutex_lock_interruptible(&xattr_list_mutex);
if (rc)
return -ERESTARTSYS;
list_for_each_entry(xattr, &evm_config_xattrnames, list) {
if (!xattr->enabled)
continue;
size += strlen(xattr->name) + 1;
}
temp = kmalloc(size + 1, GFP_KERNEL);
if (!temp) {
mutex_unlock(&xattr_list_mutex);
return -ENOMEM;
}
temp[size] = '\0';
/*
* No truncation possible: size is computed over the same enabled
* xattrs under xattr_list_mutex, so offset never exceeds size.
*/
list_for_each_entry(xattr, &evm_config_xattrnames, list) {
if (!xattr->enabled)
continue;
offset += snprintf(temp + offset, size + 1 - offset, "%s\n",
xattr->name);
}
mutex_unlock(&xattr_list_mutex);
rc = simple_read_from_buffer(buf, count, ppos, temp, offset);
kfree(temp);
return rc;
}
/**
* evm_write_xattrs - write() for <securityfs>/evm_xattrs
* @file: file pointer, not actually used
* @buf: where to get the data from
* @count: bytes sent
* @ppos: where to start
*
* Returns number of bytes written or error code, as appropriate
*/
static ssize_t evm_write_xattrs(struct file *file, const char __user *buf,
size_t count, loff_t *ppos)
{
int len, err;
struct xattr_list *xattr, *tmp;
struct audit_buffer *ab;
struct iattr newattrs;
struct inode *inode;
if (!capable(CAP_SYS_ADMIN) || evm_xattrs_locked)
return -EPERM;
if (*ppos != 0)
return -EINVAL;
Annotation
- Immediate include surface: `linux/audit.h`, `linux/uaccess.h`, `linux/init.h`, `linux/mutex.h`, `evm.h`.
- Detected declarations: `function evm_read_key`, `function evm_write_key`, `function evm_read_xattrs`, `function list_for_each_entry`, `function evm_write_xattrs`, `function evm_init_xattrs`, `function evm_init_xattrs`, `function evm_init_secfs`.
- Atlas domain: Core OS / Security And Isolation.
- Implementation status: pattern implementation candidate.
- Synchronization appears in or near this file; preserve lock ordering, sleepability, and interrupt-context constraints.
Implementation Notes
- This generated page is the file-by-file coverage layer; curated subsystem chapters should link here when they synthesize a multi-file control flow.
- Core OS pages should be promoted from atlas-only to deep-reviewed when they explain data structures, invariants, locking, lifecycle, and C implementation snippets.
- Driver-family pages are intentionally pattern-oriented unless they are part of the selected PCIe/NVMe representative device path.