diff options
| author | Deven Bowers <deven.desai@linux.microsoft.com> | 2024-08-02 23:08:31 -0700 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2024-08-20 14:03:39 -0400 |
| commit | ba199dc909a20fe62270ae4e93f263987bb9d119 (patch) | |
| tree | 497a4893e9b186438a37fbcab53cb1900480065f /security/ipe/fs.c | |
| parent | 31f8c8682f30720be25e9b1021caa43c64e8d9ce (diff) | |
| download | linux-stable-ba199dc909a20fe62270ae4e93f263987bb9d119.tar.gz linux-stable-ba199dc909a20fe62270ae4e93f263987bb9d119.tar.bz2 linux-stable-ba199dc909a20fe62270ae4e93f263987bb9d119.zip | |
scripts: add boot policy generation program
Enables an IPE policy to be enforced from kernel start, enabling access
control based on trust from kernel startup. This is accomplished by
transforming an IPE policy indicated by CONFIG_IPE_BOOT_POLICY into a
c-string literal that is parsed at kernel startup as an unsigned policy.
Signed-off-by: Deven Bowers <deven.desai@linux.microsoft.com>
Signed-off-by: Fan Wu <wufan@linux.microsoft.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security/ipe/fs.c')
| -rw-r--r-- | security/ipe/fs.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/security/ipe/fs.c b/security/ipe/fs.c index b52fb6023904..5b6d19fb844a 100644 --- a/security/ipe/fs.c +++ b/security/ipe/fs.c @@ -190,6 +190,7 @@ static const struct file_operations enforce_fops = { static int __init ipe_init_securityfs(void) { int rc = 0; + struct ipe_policy *ap; if (!ipe_enabled) return -EOPNOTSUPP; @@ -220,6 +221,13 @@ static int __init ipe_init_securityfs(void) goto err; } + ap = rcu_access_pointer(ipe_active_policy); + if (ap) { + rc = ipe_new_policyfs_node(ap); + if (rc) + goto err; + } + np = securityfs_create_file("new_policy", 0200, root, NULL, &np_fops); if (IS_ERR(np)) { rc = PTR_ERR(np); |