diff options
| author | Deven Bowers <deven.desai@linux.microsoft.com> | 2024-08-02 23:08:18 -0700 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2024-08-20 14:01:33 -0400 |
| commit | 52443cb60c356707df494910fa134bbb0a8b1a66 (patch) | |
| tree | b53fe558511f276f891ecce8da6aa34b0d5e3ae1 /security/ipe/ipe.c | |
| parent | 05a351630b7463ce58668095f5683669c1295f65 (diff) | |
ipe: add LSM hooks on execution and kernel read
IPE's initial goal is to control both execution and the loading of
kernel modules based on the system's definition of trust. It
accomplishes this by plugging into the security hooks for
bprm_check_security, file_mprotect, mmap_file, kernel_load_data,
and kernel_read_data.
Signed-off-by: Deven Bowers <deven.desai@linux.microsoft.com>
Signed-off-by: Fan Wu <wufan@linux.microsoft.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security/ipe/ipe.c')
| -rw-r--r-- | security/ipe/ipe.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/security/ipe/ipe.c b/security/ipe/ipe.c index 8d4ea372873e..729334812636 100644 --- a/security/ipe/ipe.c +++ b/security/ipe/ipe.c @@ -5,6 +5,7 @@ #include <uapi/linux/lsm.h> #include "ipe.h" +#include "hooks.h" static struct lsm_blob_sizes ipe_blobs __ro_after_init = { }; @@ -15,6 +16,11 @@ static const struct lsm_id ipe_lsmid = { }; static struct security_hook_list ipe_hooks[] __ro_after_init = { + LSM_HOOK_INIT(bprm_check_security, ipe_bprm_check_security), + LSM_HOOK_INIT(mmap_file, ipe_mmap_file), + LSM_HOOK_INIT(file_mprotect, ipe_file_mprotect), + LSM_HOOK_INIT(kernel_read_file, ipe_kernel_read_file), + LSM_HOOK_INIT(kernel_load_data, ipe_kernel_load_data), }; /** |