Commit 55e85320 authored by Paul Moore's avatar Paul Moore

lsm: move the bpf hook comments to security/security.c

This patch relocates the LSM hook function comments to the function
definitions, in keeping with the current kernel conventions.  This
should make the hook descriptions more easily discoverable and easier
to maintain.

While formatting changes have been done to better fit the kernel-doc
style, content changes have been kept to a minimum and limited to
text which was obviously incorrect and/or outdated.  It is expected
the future patches will improve the quality of the function header
comments.
Acked-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent b14faf9c
...@@ -190,42 +190,6 @@ ...@@ -190,42 +190,6 @@
* @key: The key to watch. * @key: The key to watch.
* Return 0 if permission is granted. * Return 0 if permission is granted.
* *
* Security hooks for using the eBPF maps and programs functionalities through
* eBPF syscalls.
*
* @bpf:
* Do a initial check for all bpf syscalls after the attribute is copied
* into the kernel. The actual security module can implement their own
* rules to check the specific cmd they need.
* Return 0 if permission is granted.
*
* @bpf_map:
* Do a check when the kernel generate and return a file descriptor for
* eBPF maps.
* @map: bpf map that we want to access.
* @mask: the access flags.
* Return 0 if permission is granted.
*
* @bpf_prog:
* Do a check when the kernel generate and return a file descriptor for
* eBPF programs.
* @prog: bpf prog that userspace want to use.
* Return 0 if permission is granted.
*
* @bpf_map_alloc_security:
* Initialize the security field inside bpf map.
* Return 0 on success, error on failure.
*
* @bpf_map_free_security:
* Clean up the security information stored inside bpf map.
*
* @bpf_prog_alloc_security:
* Initialize the security field inside bpf program.
* Return 0 on success, error on failure.
*
* @bpf_prog_free_security:
* Clean up the security information stored inside bpf prog.
*
* @locked_down: * @locked_down:
* Determine whether a kernel feature that potentially enables arbitrary * Determine whether a kernel feature that potentially enables arbitrary
* code execution in kernel space should be permitted. * code execution in kernel space should be permitted.
......
...@@ -4825,30 +4825,95 @@ int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule) ...@@ -4825,30 +4825,95 @@ int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule)
#endif /* CONFIG_AUDIT */ #endif /* CONFIG_AUDIT */
#ifdef CONFIG_BPF_SYSCALL #ifdef CONFIG_BPF_SYSCALL
/**
* security_bpf() - Check if the bpf syscall operation is allowed
* @cmd: command
* @attr: bpf attribute
* @size: size
*
* Do a initial check for all bpf syscalls after the attribute is copied into
* the kernel. The actual security module can implement their own rules to
* check the specific cmd they need.
*
* Return: Returns 0 if permission is granted.
*/
int security_bpf(int cmd, union bpf_attr *attr, unsigned int size) int security_bpf(int cmd, union bpf_attr *attr, unsigned int size)
{ {
return call_int_hook(bpf, 0, cmd, attr, size); return call_int_hook(bpf, 0, cmd, attr, size);
} }
/**
* security_bpf_map() - Check if access to a bpf map is allowed
* @map: bpf map
* @fmode: mode
*
* Do a check when the kernel generates and returns a file descriptor for eBPF
* maps.
*
* Return: Returns 0 if permission is granted.
*/
int security_bpf_map(struct bpf_map *map, fmode_t fmode) int security_bpf_map(struct bpf_map *map, fmode_t fmode)
{ {
return call_int_hook(bpf_map, 0, map, fmode); return call_int_hook(bpf_map, 0, map, fmode);
} }
/**
* security_bpf_prog() - Check if access to a bpf program is allowed
* @prog: bpf program
*
* Do a check when the kernel generates and returns a file descriptor for eBPF
* programs.
*
* Return: Returns 0 if permission is granted.
*/
int security_bpf_prog(struct bpf_prog *prog) int security_bpf_prog(struct bpf_prog *prog)
{ {
return call_int_hook(bpf_prog, 0, prog); return call_int_hook(bpf_prog, 0, prog);
} }
/**
* security_bpf_map_alloc() - Allocate a bpf map LSM blob
* @map: bpf map
*
* Initialize the security field inside bpf map.
*
* Return: Returns 0 on success, error on failure.
*/
int security_bpf_map_alloc(struct bpf_map *map) int security_bpf_map_alloc(struct bpf_map *map)
{ {
return call_int_hook(bpf_map_alloc_security, 0, map); return call_int_hook(bpf_map_alloc_security, 0, map);
} }
/**
* security_bpf_prog_alloc() - Allocate a bpf program LSM blob
* @aux: bpf program aux info struct
*
* Initialize the security field inside bpf program.
*
* Return: Returns 0 on success, error on failure.
*/
int security_bpf_prog_alloc(struct bpf_prog_aux *aux) int security_bpf_prog_alloc(struct bpf_prog_aux *aux)
{ {
return call_int_hook(bpf_prog_alloc_security, 0, aux); return call_int_hook(bpf_prog_alloc_security, 0, aux);
} }
/**
* security_bpf_map_free() - Free a bpf map's LSM blob
* @map: bpf map
*
* Clean up the security information stored inside bpf map.
*/
void security_bpf_map_free(struct bpf_map *map) void security_bpf_map_free(struct bpf_map *map)
{ {
call_void_hook(bpf_map_free_security, map); call_void_hook(bpf_map_free_security, map);
} }
/**
* security_bpf_prog_free() - Free a bpf program's LSM blob
* @aux: bpf program aux info struct
*
* Clean up the security information stored inside bpf prog.
*/
void security_bpf_prog_free(struct bpf_prog_aux *aux) void security_bpf_prog_free(struct bpf_prog_aux *aux)
{ {
call_void_hook(bpf_prog_free_security, aux); call_void_hook(bpf_prog_free_security, aux);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment