1f3b8788cSCasey Schaufler /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ 2f3b8788cSCasey Schaufler /* 3f3b8788cSCasey Schaufler * Linux Security Modules (LSM) - User space API 4f3b8788cSCasey Schaufler * 5f3b8788cSCasey Schaufler * Copyright (C) 2022 Casey Schaufler <casey@schaufler-ca.com> 6f3b8788cSCasey Schaufler * Copyright (C) 2022 Intel Corporation 7f3b8788cSCasey Schaufler */ 8f3b8788cSCasey Schaufler 9f3b8788cSCasey Schaufler #ifndef _UAPI_LINUX_LSM_H 10f3b8788cSCasey Schaufler #define _UAPI_LINUX_LSM_H 11f3b8788cSCasey Schaufler 12ea67677dSMark Brown #include <linux/stddef.h> 13a04a1198SCasey Schaufler #include <linux/types.h> 14a04a1198SCasey Schaufler #include <linux/unistd.h> 15a04a1198SCasey Schaufler 16a04a1198SCasey Schaufler /** 17a04a1198SCasey Schaufler * struct lsm_ctx - LSM context information 18a04a1198SCasey Schaufler * @id: the LSM id number, see LSM_ID_XXX 19a04a1198SCasey Schaufler * @flags: LSM specific flags 20a04a1198SCasey Schaufler * @len: length of the lsm_ctx struct, @ctx and any other data or padding 21a04a1198SCasey Schaufler * @ctx_len: the size of @ctx 22a04a1198SCasey Schaufler * @ctx: the LSM context value 23a04a1198SCasey Schaufler * 24a04a1198SCasey Schaufler * The @len field MUST be equal to the size of the lsm_ctx struct 25a04a1198SCasey Schaufler * plus any additional padding and/or data placed after @ctx. 26a04a1198SCasey Schaufler * 27a04a1198SCasey Schaufler * In all cases @ctx_len MUST be equal to the length of @ctx. 28a04a1198SCasey Schaufler * If @ctx is a string value it should be nul terminated with 29a04a1198SCasey Schaufler * @ctx_len equal to `strlen(@ctx) + 1`. Binary values are 30a04a1198SCasey Schaufler * supported. 31a04a1198SCasey Schaufler * 32a04a1198SCasey Schaufler * The @flags and @ctx fields SHOULD only be interpreted by the 33a04a1198SCasey Schaufler * LSM specified by @id; they MUST be set to zero/0 when not used. 34a04a1198SCasey Schaufler */ 35a04a1198SCasey Schaufler struct lsm_ctx { 36a04a1198SCasey Schaufler __u64 id; 37a04a1198SCasey Schaufler __u64 flags; 38a04a1198SCasey Schaufler __u64 len; 39a04a1198SCasey Schaufler __u64 ctx_len; 40ea67677dSMark Brown __u8 ctx[] __counted_by(ctx_len); 41a04a1198SCasey Schaufler }; 42a04a1198SCasey Schaufler 43f3b8788cSCasey Schaufler /* 44f3b8788cSCasey Schaufler * ID tokens to identify Linux Security Modules (LSMs) 45f3b8788cSCasey Schaufler * 46f3b8788cSCasey Schaufler * These token values are used to uniquely identify specific LSMs 47f3b8788cSCasey Schaufler * in the kernel as well as in the kernel's LSM userspace API. 48f3b8788cSCasey Schaufler * 49f3b8788cSCasey Schaufler * A value of zero/0 is considered undefined and should not be used 50f3b8788cSCasey Schaufler * outside the kernel. Values 1-99 are reserved for potential 51f3b8788cSCasey Schaufler * future use. 52f3b8788cSCasey Schaufler */ 53f3b8788cSCasey Schaufler #define LSM_ID_UNDEF 0 54f3b8788cSCasey Schaufler #define LSM_ID_CAPABILITY 100 55f3b8788cSCasey Schaufler #define LSM_ID_SELINUX 101 56f3b8788cSCasey Schaufler #define LSM_ID_SMACK 102 57f3b8788cSCasey Schaufler #define LSM_ID_TOMOYO 103 58edd71f8eSPaul Moore #define LSM_ID_APPARMOR 104 59edd71f8eSPaul Moore #define LSM_ID_YAMA 105 60edd71f8eSPaul Moore #define LSM_ID_LOADPIN 106 61edd71f8eSPaul Moore #define LSM_ID_SAFESETID 107 62edd71f8eSPaul Moore #define LSM_ID_LOCKDOWN 108 63edd71f8eSPaul Moore #define LSM_ID_BPF 109 64edd71f8eSPaul Moore #define LSM_ID_LANDLOCK 110 65cd3cec0aSRoberto Sassu #define LSM_ID_IMA 111 66*92383111SRoberto Sassu #define LSM_ID_EVM 112 67f3b8788cSCasey Schaufler 68f3b8788cSCasey Schaufler /* 69f3b8788cSCasey Schaufler * LSM_ATTR_XXX definitions identify different LSM attributes 70f3b8788cSCasey Schaufler * which are used in the kernel's LSM userspace API. Support 71f3b8788cSCasey Schaufler * for these attributes vary across the different LSMs. None 72f3b8788cSCasey Schaufler * are required. 73f3b8788cSCasey Schaufler * 74f3b8788cSCasey Schaufler * A value of zero/0 is considered undefined and should not be used 75f3b8788cSCasey Schaufler * outside the kernel. Values 1-99 are reserved for potential 76f3b8788cSCasey Schaufler * future use. 77f3b8788cSCasey Schaufler */ 78f3b8788cSCasey Schaufler #define LSM_ATTR_UNDEF 0 79f3b8788cSCasey Schaufler #define LSM_ATTR_CURRENT 100 80f3b8788cSCasey Schaufler #define LSM_ATTR_EXEC 101 81f3b8788cSCasey Schaufler #define LSM_ATTR_FSCREATE 102 82f3b8788cSCasey Schaufler #define LSM_ATTR_KEYCREATE 103 83f3b8788cSCasey Schaufler #define LSM_ATTR_PREV 104 84f3b8788cSCasey Schaufler #define LSM_ATTR_SOCKCREATE 105 85f3b8788cSCasey Schaufler 86a04a1198SCasey Schaufler /* 87a04a1198SCasey Schaufler * LSM_FLAG_XXX definitions identify special handling instructions 88a04a1198SCasey Schaufler * for the API. 89a04a1198SCasey Schaufler */ 90a04a1198SCasey Schaufler #define LSM_FLAG_SINGLE 0x0001 91a04a1198SCasey Schaufler 92f3b8788cSCasey Schaufler #endif /* _UAPI_LINUX_LSM_H */ 93