security/landlock/id.c

Source file repositories/reference/linux-study-clean/security/landlock/id.c

File Facts

System
Linux kernel
Corpus path
security/landlock/id.c
Extension
.c
Size
7526 bytes
Lines
296
Domain
Core OS
Bucket
Security And Isolation
Inferred role
Core OS: implementation source
Status
source implementation candidate

Why This File Exists

Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.

Dependency Surface

Detected Declarations

Annotated Snippet

// SPDX-License-Identifier: GPL-2.0-only
/*
 * Landlock - Unique identification number generator
 *
 * Copyright © 2024-2025 Microsoft Corporation
 */

#include <kunit/test.h>
#include <linux/atomic.h>
#include <linux/bitops.h>
#include <linux/random.h>
#include <linux/spinlock.h>

#include "common.h"
#include "id.h"

#define COUNTER_PRE_INIT 0

static atomic64_t next_id = ATOMIC64_INIT(COUNTER_PRE_INIT);

static void __init init_id(atomic64_t *const counter, const u32 random_32bits)
{
	u64 init;

	/*
	 * Ensures sure 64-bit values are always used by user space (or may
	 * fail with -EOVERFLOW), and makes this testable.
	 */
	init = BIT_ULL(32);

	/*
	 * Makes a large (2^32) boot-time value to limit ID collision in logs
	 * from different boots, and to limit info leak about the number of
	 * initially (relative to the reader) created elements (e.g. domains).
	 */
	init += random_32bits;

	/* Sets first or ignores.  This will be the first ID. */
	atomic64_cmpxchg(counter, COUNTER_PRE_INIT, init);
}

#ifdef CONFIG_SECURITY_LANDLOCK_KUNIT_TEST

static void __init test_init_min(struct kunit *const test)
{
	atomic64_t counter = ATOMIC64_INIT(COUNTER_PRE_INIT);

	init_id(&counter, 0);
	KUNIT_EXPECT_EQ(test, atomic64_read(&counter), 1ULL + U32_MAX);
}

static void __init test_init_max(struct kunit *const test)
{
	atomic64_t counter = ATOMIC64_INIT(COUNTER_PRE_INIT);

	init_id(&counter, ~0);
	KUNIT_EXPECT_EQ(test, atomic64_read(&counter), 1 + (2ULL * U32_MAX));
}

static void __init test_init_once(struct kunit *const test)
{
	const u64 first_init = 1ULL + U32_MAX;
	atomic64_t counter = ATOMIC64_INIT(COUNTER_PRE_INIT);

	init_id(&counter, 0);
	KUNIT_EXPECT_EQ(test, atomic64_read(&counter), first_init);

	init_id(&counter, ~0);
	KUNIT_EXPECT_EQ_MSG(
		test, atomic64_read(&counter), first_init,
		"Should still have the same value after the subsequent init_id()");
}

#endif /* CONFIG_SECURITY_LANDLOCK_KUNIT_TEST */

void __init landlock_init_id(void)
{
	return init_id(&next_id, get_random_u32());
}

/*
 * It's not worth it to try to hide the monotonic counter because it can still
 * be inferred (with N counter ranges), and if we are allowed to read the inode
 * number we should also be allowed to read the time creation anyway, and it
 * can be handy to store and sort domain IDs for user space.
 *
 * Returns the value of next_id and increment it to let some space for the next
 * one.
 */
static u64 get_id_range(size_t number_of_ids, atomic64_t *const counter,

Annotation

Implementation Notes