security/loadpin/loadpin.c

Source file repositories/reference/linux-study-clean/security/loadpin/loadpin.c

File Facts

System
Linux kernel
Corpus path
security/loadpin/loadpin.c
Extension
.c
Size
11026 bytes
Lines
443
Domain
Core OS
Bucket
Security And Isolation
Inferred role
Core OS: operation-table or driver-model contract
Status
pattern implementation candidate

Why This File Exists

Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.

Dependency Surface

Detected Declarations

Annotated Snippet

static const struct file_operations loadpin_dm_verity_ops = {
	.unlocked_ioctl = dm_verity_ioctl,
	.compat_ioctl = compat_ptr_ioctl,
};

/**
 * init_loadpin_securityfs - create the securityfs directory for LoadPin
 *
 * We can not put this method normally under the loadpin_init() code path since
 * the security subsystem gets initialized before the vfs caches.
 *
 * Returns 0 if the securityfs directory creation was successful.
 */
static int __init init_loadpin_securityfs(void)
{
	struct dentry *loadpin_dir, *dentry;

	loadpin_dir = securityfs_create_dir("loadpin", NULL);
	if (IS_ERR(loadpin_dir)) {
		pr_err("LoadPin: could not create securityfs dir: %ld\n",
		       PTR_ERR(loadpin_dir));
		return PTR_ERR(loadpin_dir);
	}

	dentry = securityfs_create_file("dm-verity", 0600, loadpin_dir,
					(void *)LOADPIN_DM_VERITY, &loadpin_dm_verity_ops);
	if (IS_ERR(dentry)) {
		pr_err("LoadPin: could not create securityfs entry 'dm-verity': %ld\n",
		       PTR_ERR(dentry));
		return PTR_ERR(dentry);
	}

	return 0;
}

#endif /* CONFIG_SECURITY_LOADPIN_VERITY */

DEFINE_LSM(loadpin) = {
	.id = &loadpin_lsmid,
	.init = loadpin_init,
#ifdef CONFIG_SECURITY_LOADPIN_VERITY
	.initcall_fs = init_loadpin_securityfs,
#endif /* CONFIG_SECURITY_LOADPIN_VERITY */
};

/* Should not be mutable after boot, so not listed in sysfs (perm == 0). */
module_param(enforce, int, 0);
MODULE_PARM_DESC(enforce, "Enforce module/firmware pinning");
module_param_array_named(exclude, exclude_read_files, charp, NULL, 0);
MODULE_PARM_DESC(exclude, "Exclude pinning specific read file types");

Annotation

Implementation Notes