#define pr_fmt(fmt) "LSM: " fmt

#include <linux/bpf.h>

#include <linux/capability.h>

#include <linux/dcache.h>

#include <linux/export.h>

#include <linux/init.h>

#include <linux/kernel.h>

#include <linux/kernel_read_file.h>

#include <linux/lsm_hooks.h>

#include <linux/mman.h>

#include <linux/mount.h>

#include <linux/personality.h>

#include <linux/backing-dev.h>

#include <linux/string.h>

#include <linux/xattr.h>

#include <linux/msg.h>

#include <linux/overflow.h>

#include <linux/perf_event.h>

#include <linux/fs.h>

#include <net/flow.h>

#include <net/sock.h>

#define SECURITY_HOOK_ACTIVE_KEY(HOOK, IDX) security_hook_active_##HOOK##_##IDX

#define LSM_STATIC_CALL(HOOK, IDX) lsm_static_call_##HOOK##_##IDX

#define LSM_LOOP_UNROLL(M, ...) \

do { \

UNROLL(MAX_LSM_COUNT, M, __VA_ARGS__) \

} while (0)

#define LSM_DEFINE_UNROLL(M, ...) UNROLL(MAX_LSM_COUNT, M, __VA_ARGS__)

const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX + 1] = {

[LOCKDOWN_NONE] = "none",

[LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading",

[LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port",

[LOCKDOWN_EFI_TEST] = "/dev/efi_test access",

[LOCKDOWN_KEXEC] = "kexec of unsigned images",

[LOCKDOWN_HIBERNATION] = "hibernation",

[LOCKDOWN_PCI_ACCESS] = "direct PCI access",

[LOCKDOWN_IOPORT] = "raw io port access",

[LOCKDOWN_MSR] = "raw MSR access",

[LOCKDOWN_ACPI_TABLES] = "modifying ACPI tables",

[LOCKDOWN_DEVICE_TREE] = "modifying device tree contents",

[LOCKDOWN_PCMCIA_CIS] = "direct PCMCIA CIS storage",

[LOCKDOWN_TIOCSSERIAL] = "reconfiguration of serial port IO",

[LOCKDOWN_MODULE_PARAMETERS] = "unsafe module parameters",

[LOCKDOWN_MMIOTRACE] = "unsafe mmio",

[LOCKDOWN_DEBUGFS] = "debugfs access",

[LOCKDOWN_XMON_WR] = "xmon write access",

[LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM",

[LOCKDOWN_DBG_WRITE_KERNEL] = "use of kgdb/kdb to write kernel RAM",

[LOCKDOWN_RTAS_ERROR_INJECTION] = "RTAS error injection",

[LOCKDOWN_INTEGRITY_MAX] = "integrity",

[LOCKDOWN_KCORE] = "/proc/kcore access",

[LOCKDOWN_KPROBES] = "use of kprobes",

[LOCKDOWN_BPF_READ_KERNEL] = "use of bpf to read kernel RAM",

[LOCKDOWN_DBG_READ_KERNEL] = "use of kgdb/kdb to read kernel RAM",

[LOCKDOWN_PERF] = "unsafe use of perf",

[LOCKDOWN_TRACEFS] = "use of tracefs",

[LOCKDOWN_XMON_RW] = "xmon read and write access",

[LOCKDOWN_XFRM_SECRET] = "xfrm SA secret",

[LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality",

};

static BLOCKING_NOTIFIER_HEAD(blocking_lsm_notifier_chain);

static struct kmem_cache *lsm_file_cache;

static struct kmem_cache *lsm_inode_cache;

char *lsm_names;

static struct lsm_blob_sizes blob_sizes __ro_after_init;

static __initdata const char *chosen_lsm_order;

static __initdata const char *chosen_major_lsm;

static __initconst const char *const builtin_lsm_order = CONFIG_LSM;

static __initdata struct lsm_info *ordered_lsms[MAX_LSM_COUNT + 1];

static __initdata struct lsm_info *exclusive;

#ifdef CONFIG_HAVE_STATIC_CALL

#define LSM_HOOK_TRAMP(NAME, NUM) \

&STATIC_CALL_TRAMP(LSM_STATIC_CALL(NAME, NUM))

#define LSM_HOOK_TRAMP(NAME, NUM) NULL

#define DEFINE_LSM_STATIC_CALL(NUM, NAME, RET, ...) \

DEFINE_STATIC_CALL_NULL(LSM_STATIC_CALL(NAME, NUM), \

*((RET(*)(__VA_ARGS__))NULL)); \

DEFINE_STATIC_KEY_FALSE(SECURITY_HOOK_ACTIVE_KEY(NAME, NUM));

#define LSM_HOOK(RET, DEFAULT, NAME, ...) \

LSM_DEFINE_UNROLL(DEFINE_LSM_STATIC_CALL, NAME, RET, __VA_ARGS__)

#include <linux/lsm_hook_defs.h>

#undef LSM_HOOK

#undef DEFINE_LSM_STATIC_CALL

struct lsm_static_calls_table

static_calls_table __ro_after_init __aligned(sizeof(u64)) = {

#define INIT_LSM_STATIC_CALL(NUM, NAME) \

(struct lsm_static_call) { \

.key = &STATIC_CALL_KEY(LSM_STATIC_CALL(NAME, NUM)), \

.trampoline = LSM_HOOK_TRAMP(NAME, NUM), \

.active = &SECURITY_HOOK_ACTIVE_KEY(NAME, NUM), \

},

#define LSM_HOOK(RET, DEFAULT, NAME, ...) \

.NAME = { \

LSM_DEFINE_UNROLL(INIT_LSM_STATIC_CALL, NAME) \

},

#include <linux/lsm_hook_defs.h>

#undef LSM_HOOK

#undef INIT_LSM_STATIC_CALL

};

static __initdata bool debug;

#define init_debug(...) \

do { \

if (debug) \

pr_info(__VA_ARGS__); \

} while (0)

static bool __init is_enabled(struct lsm_info *lsm)

{

if (!lsm->enabled)

return false;

return *lsm->enabled;

}

static int lsm_enabled_true __initdata = 1;

static int lsm_enabled_false __initdata = 0;

static void __init set_enabled(struct lsm_info *lsm, bool enabled)

{

/*

if (!lsm->enabled) {

if (enabled)

lsm->enabled = &lsm_enabled_true;

else

lsm->enabled = &lsm_enabled_false;

} else if (lsm->enabled == &lsm_enabled_true) {

if (!enabled)

lsm->enabled = &lsm_enabled_false;

} else if (lsm->enabled == &lsm_enabled_false) {

if (enabled)

lsm->enabled = &lsm_enabled_true;

} else {

*lsm->enabled = enabled;

}

}

static bool __init exists_ordered_lsm(struct lsm_info *lsm)

{

struct lsm_info **check;

for (check = ordered_lsms; *check; check++)

if (*check == lsm)

return true;

return false;

}

static int last_lsm __initdata;

static void __init append_ordered_lsm(struct lsm_info *lsm, const char *from)

{

/* Ignore duplicate selections. */

if (exists_ordered_lsm(lsm))

return;

if (WARN(last_lsm == MAX_LSM_COUNT, "%s: out of LSM static calls!?\n", from))

return;

/* Enable this LSM, if it is not already set. */

if (!lsm->enabled)

lsm->enabled = &lsm_enabled_true;

ordered_lsms[last_lsm++] = lsm;

init_debug("%s ordered: %s (%s)\n", from, lsm->name,

is_enabled(lsm) ? "enabled" : "disabled");

}

static bool __init lsm_allowed(struct lsm_info *lsm)

{

/* Skip if the LSM is disabled. */

if (!is_enabled(lsm))

return false;

/* Not allowed if another exclusive LSM already initialized. */

if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && exclusive) {

init_debug("exclusive disabled: %s\n", lsm->name);

return false;

}

return true;

}

static void __init lsm_set_blob_size(int *need, int *lbs)

{

int offset;

if (*need <= 0)

return;

offset = ALIGN(*lbs, sizeof(void *));

*lbs = offset + *need;

*need = offset;

}

static void __init lsm_set_blob_sizes(struct lsm_blob_sizes *needed)

{

if (!needed)

return;

lsm_set_blob_size(&needed->lbs_cred, &blob_sizes.lbs_cred);

lsm_set_blob_size(&needed->lbs_file, &blob_sizes.lbs_file);

lsm_set_blob_size(&needed->lbs_ib, &blob_sizes.lbs_ib);

/*

if (needed->lbs_inode && blob_sizes.lbs_inode == 0)

blob_sizes.lbs_inode = sizeof(struct rcu_head);

lsm_set_blob_size(&needed->lbs_inode, &blob_sizes.lbs_inode);

lsm_set_blob_size(&needed->lbs_ipc, &blob_sizes.lbs_ipc);

lsm_set_blob_size(&needed->lbs_key, &blob_sizes.lbs_key);

lsm_set_blob_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg);

lsm_set_blob_size(&needed->lbs_perf_event, &blob_sizes.lbs_perf_event);

lsm_set_blob_size(&needed->lbs_sock, &blob_sizes.lbs_sock);

lsm_set_blob_size(&needed->lbs_superblock, &blob_sizes.lbs_superblock);

lsm_set_blob_size(&needed->lbs_task, &blob_sizes.lbs_task);

lsm_set_blob_size(&needed->lbs_tun_dev, &blob_sizes.lbs_tun_dev);

lsm_set_blob_size(&needed->lbs_xattr_count,

&blob_sizes.lbs_xattr_count);

lsm_set_blob_size(&needed->lbs_bdev, &blob_sizes.lbs_bdev);

}

static void __init prepare_lsm(struct lsm_info *lsm)

{

int enabled = lsm_allowed(lsm);

/* Record enablement (to handle any following exclusive LSMs). */

set_enabled(lsm, enabled);

/* If enabled, do pre-initialization work. */

if (enabled) {

if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && !exclusive) {

exclusive = lsm;

init_debug("exclusive chosen: %s\n", lsm->name);

}

lsm_set_blob_sizes(lsm->blobs);

}

}

static void __init initialize_lsm(struct lsm_info *lsm)

{

if (is_enabled(lsm)) {

int ret;

init_debug("initializing %s\n", lsm->name);

ret = lsm->init();

WARN(ret, "%s failed to initialize: %d\n", lsm->name, ret);

}

}

u32 lsm_active_cnt __ro_after_init;

const struct lsm_id *lsm_idlist[MAX_LSM_COUNT];

static void __init ordered_lsm_parse(const char *order, const char *origin)

{

struct lsm_info *lsm;

char *sep, *name, *next;

/* LSM_ORDER_FIRST is always first. */

for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {

if (lsm->order == LSM_ORDER_FIRST)

append_ordered_lsm(lsm, " first");

}

/* Process "security=", if given. */

if (chosen_major_lsm) {

struct lsm_info *major;

/*

for (major = __start_lsm_info; major < __end_lsm_info;

major++) {

if ((major->flags & LSM_FLAG_LEGACY_MAJOR) &&

strcmp(major->name, chosen_major_lsm) != 0) {

set_enabled(major, false);

init_debug("security=%s disabled: %s (only one legacy major LSM)\n",

chosen_major_lsm, major->name);

}

}

}

sep = kstrdup(order, GFP_KERNEL);

next = sep;

/* Walk the list, looking for matching LSMs. */

while ((name = strsep(&next, ",")) != NULL) {

bool found = false;

for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {

if (strcmp(lsm->name, name) == 0) {

if (lsm->order == LSM_ORDER_MUTABLE)

append_ordered_lsm(lsm, origin);

found = true;

}

}

if (!found)

init_debug("%s ignored: %s (not built into kernel)\n",

origin, name);

}

/* Process "security=", if given. */

if (chosen_major_lsm) {

for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {

if (exists_ordered_lsm(lsm))

continue;

if (strcmp(lsm->name, chosen_major_lsm) == 0)

append_ordered_lsm(lsm, "security=");

}

}

/* LSM_ORDER_LAST is always last. */

for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {

if (lsm->order == LSM_ORDER_LAST)

append_ordered_lsm(lsm, " last");

}

/* Disable all LSMs not in the ordered list. */

for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {

if (exists_ordered_lsm(lsm))

continue;

set_enabled(lsm, false);

init_debug("%s skipped: %s (not in requested order)\n",

origin, lsm->name);

}

kfree(sep);

}

static void __init lsm_static_call_init(struct security_hook_list *hl)

{

struct lsm_static_call *scall = hl->scalls;

int i;

for (i = 0; i < MAX_LSM_COUNT; i++) {

/* Update the first static call that is not used yet */

if (!scall->hl) {

__static_call_update(scall->key, scall->trampoline,

hl->hook.lsm_func_addr);

scall->hl = hl;

static_branch_enable(scall->active);

return;

}

scall++;

}

panic("%s - Ran out of static slots.\n", __func__);

}

static void __init lsm_early_cred(struct cred *cred);

static void __init lsm_early_task(struct task_struct *task);

static int lsm_append(const char *new, char **result);

static void __init report_lsm_order(void)

{

struct lsm_info **lsm, *early;

int first = 0;

pr_info("initializing lsm=");

/* Report each enabled LSM name, comma separated. */

for (early = __start_early_lsm_info;

early < __end_early_lsm_info; early++)

if (is_enabled(early))

pr_cont("%s%s", first++ == 0 ? "" : ",", early->name);

for (lsm = ordered_lsms; *lsm; lsm++)

if (is_enabled(*lsm))

pr_cont("%s%s", first++ == 0 ? "" : ",", (*lsm)->name);

pr_cont("\n");

}

static void __init ordered_lsm_init(void)

{

struct lsm_info **lsm;

if (chosen_lsm_order) {

if (chosen_major_lsm) {

pr_warn("security=%s is ignored because it is superseded by lsm=%s\n",

chosen_major_lsm, chosen_lsm_order);

chosen_major_lsm = NULL;

}

ordered_lsm_parse(chosen_lsm_order, "cmdline");

} else

ordered_lsm_parse(builtin_lsm_order, "builtin");

for (lsm = ordered_lsms; *lsm; lsm++)

prepare_lsm(*lsm);

report_lsm_order();

init_debug("cred blob size = %d\n", blob_sizes.lbs_cred);

init_debug("file blob size = %d\n", blob_sizes.lbs_file);

init_debug("ib blob size = %d\n", blob_sizes.lbs_ib);

init_debug("inode blob size = %d\n", blob_sizes.lbs_inode);

init_debug("ipc blob size = %d\n", blob_sizes.lbs_ipc);

#ifdef CONFIG_KEYS

init_debug("key blob size = %d\n", blob_sizes.lbs_key);

#endif /* CONFIG_KEYS */

init_debug("msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg);

init_debug("sock blob size = %d\n", blob_sizes.lbs_sock);

init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock);

init_debug("perf event blob size = %d\n", blob_sizes.lbs_perf_event);

init_debug("task blob size = %d\n", blob_sizes.lbs_task);

init_debug("tun device blob size = %d\n", blob_sizes.lbs_tun_dev);

init_debug("xattr slots = %d\n", blob_sizes.lbs_xattr_count);

init_debug("bdev blob size = %d\n", blob_sizes.lbs_bdev);

/*

if (blob_sizes.lbs_file)

lsm_file_cache = kmem_cache_create("lsm_file_cache",

blob_sizes.lbs_file, 0,

SLAB_PANIC, NULL);

if (blob_sizes.lbs_inode)

lsm_inode_cache = kmem_cache_create("lsm_inode_cache",

blob_sizes.lbs_inode, 0,

SLAB_PANIC, NULL);

lsm_early_cred((struct cred *) current->cred);

lsm_early_task(current);

for (lsm = ordered_lsms; *lsm; lsm++)

initialize_lsm(*lsm);

}

int __init early_security_init(void)

{

struct lsm_info *lsm;

for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) {

if (!lsm->enabled)

lsm->enabled = &lsm_enabled_true;

prepare_lsm(lsm);

initialize_lsm(lsm);

}

return 0;

}

int __init security_init(void)

{

struct lsm_info *lsm;

init_debug("legacy security=%s\n", chosen_major_lsm ? : " *unspecified*");

init_debug(" CONFIG_LSM=%s\n", builtin_lsm_order);

init_debug("boot arg lsm=%s\n", chosen_lsm_order ? : " *unspecified*");

/*

for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) {

init_debug(" early started: %s (%s)\n", lsm->name,

is_enabled(lsm) ? "enabled" : "disabled");

if (lsm->enabled)

lsm_append(lsm->name, &lsm_names);

}

/* Load LSMs in specified order. */

ordered_lsm_init();

return 0;

}

static int __init choose_major_lsm(char *str)

{

chosen_major_lsm = str;

return 1;

}

__setup("security=", choose_major_lsm);

static int __init choose_lsm_order(char *str)

{

chosen_lsm_order = str;

return 1;

}

__setup("lsm=", choose_lsm_order);

static int __init enable_debug(char *str)

{

debug = true;

return 1;

}

__setup("lsm.debug", enable_debug);

static bool match_last_lsm(const char *list, const char *lsm)

{

const char *last;

if (WARN_ON(!list || !lsm))

return false;

last = strrchr(list, ',');

if (last)

/* Pass the comma, strcmp() will check for '\0' */

last++;

else

last = list;

return !strcmp(last, lsm);

}

static int lsm_append(const char *new, char **result)

{

char *cp;

if (*result == NULL) {

*result = kstrdup(new, GFP_KERNEL);

if (*result == NULL)

return -ENOMEM;

} else {

/* Check if it is the last registered name */

if (match_last_lsm(*result, new))

return 0;

cp = kasprintf(GFP_KERNEL, "%s,%s", *result, new);

if (cp == NULL)

return -ENOMEM;

kfree(*result);

*result = cp;

}

return 0;

}

void __init security_add_hooks(struct security_hook_list *hooks, int count,

const struct lsm_id *lsmid)

{

int i;

/*

if (lsm_active_cnt == 0 || lsm_idlist[lsm_active_cnt - 1] != lsmid) {

if (lsm_active_cnt >= MAX_LSM_COUNT)

panic("%s Too many LSMs registered.\n", __func__);

lsm_idlist[lsm_active_cnt++] = lsmid;

}

for (i = 0; i < count; i++) {

hooks[i].lsmid = lsmid;

lsm_static_call_init(&hooks[i]);

}

/*

if (slab_is_available()) {

if (lsm_append(lsmid->name, &lsm_names) < 0)

panic("%s - Cannot get early memory.\n", __func__);

}

}

int call_blocking_lsm_notifier(enum lsm_event event, void *data)

{

return blocking_notifier_call_chain(&blocking_lsm_notifier_chain,

event, data);

}

EXPORT_SYMBOL(call_blocking_lsm_notifier);

int register_blocking_lsm_notifier(struct notifier_block *nb)

{

return blocking_notifier_chain_register(&blocking_lsm_notifier_chain,

nb);

}

EXPORT_SYMBOL(register_blocking_lsm_notifier);

int unregister_blocking_lsm_notifier(struct notifier_block *nb)

{

return blocking_notifier_chain_unregister(&blocking_lsm_notifier_chain,

nb);

}

EXPORT_SYMBOL(unregister_blocking_lsm_notifier);

static int lsm_blob_alloc(void **dest, size_t size, gfp_t gfp)

{

if (size == 0) {

*dest = NULL;

return 0;

}

*dest = kzalloc(size, gfp);

if (*dest == NULL)

return -ENOMEM;

return 0;

}

static int lsm_cred_alloc(struct cred *cred, gfp_t gfp)

{

return lsm_blob_alloc(&cred->security, blob_sizes.lbs_cred, gfp);

}

static void __init lsm_early_cred(struct cred *cred)

{

int rc = lsm_cred_alloc(cred, GFP_KERNEL);

if (rc)

panic("%s: Early cred alloc failed.\n", __func__);

}

static int lsm_file_alloc(struct file *file)

{

if (!lsm_file_cache) {

file->f_security = NULL;

return 0;

}

file->f_security = kmem_cache_zalloc(lsm_file_cache, GFP_KERNEL);

if (file->f_security == NULL)

return -ENOMEM;

return 0;

}

static int lsm_inode_alloc(struct inode *inode, gfp_t gfp)

{

if (!lsm_inode_cache) {

inode->i_security = NULL;

return 0;

}

inode->i_security = kmem_cache_zalloc(lsm_inode_cache, gfp);

if (inode->i_security == NULL)

return -ENOMEM;

return 0;

}

static int lsm_task_alloc(struct task_struct *task)

{

return lsm_blob_alloc(&task->security, blob_sizes.lbs_task, GFP_KERNEL);

}

static int lsm_ipc_alloc(struct kern_ipc_perm *kip)

{

return lsm_blob_alloc(&kip->security, blob_sizes.lbs_ipc, GFP_KERNEL);

}

#ifdef CONFIG_KEYS

static int lsm_key_alloc(struct key *key)

{

return lsm_blob_alloc(&key->security, blob_sizes.lbs_key, GFP_KERNEL);

}

#endif /* CONFIG_KEYS */

static int lsm_msg_msg_alloc(struct msg_msg *mp)

{

return lsm_blob_alloc(&mp->security, blob_sizes.lbs_msg_msg,

GFP_KERNEL);

}

static int lsm_bdev_alloc(struct block_device *bdev)

{

if (blob_sizes.lbs_bdev == 0) {

bdev->bd_security = NULL;

return 0;

}

bdev->bd_security = kzalloc(blob_sizes.lbs_bdev, GFP_KERNEL);

if (!bdev->bd_security)

return -ENOMEM;

return 0;

}

static void __init lsm_early_task(struct task_struct *task)

{

int rc = lsm_task_alloc(task);

if (rc)

panic("%s: Early task alloc failed.\n", __func__);

}

static int lsm_superblock_alloc(struct super_block *sb)

{

return lsm_blob_alloc(&sb->s_security, blob_sizes.lbs_superblock,

GFP_KERNEL);

}

int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 *uctx_len,

void *val, size_t val_len,

u64 id, u64 flags)

{

struct lsm_ctx *nctx = NULL;

size_t nctx_len;

int rc = 0;

nctx_len = ALIGN(struct_size(nctx, ctx, val_len), sizeof(void *));

if (nctx_len > *uctx_len) {

rc = -E2BIG;

goto out;

}

/* no buffer - return success/0 and set @uctx_len to the req size */

if (!uctx)

goto out;

nctx = kzalloc(nctx_len, GFP_KERNEL);

if (nctx == NULL) {

rc = -ENOMEM;

goto out;

}

nctx->id = id;

nctx->flags = flags;

nctx->len = nctx_len;

nctx->ctx_len = val_len;

memcpy(nctx->ctx, val, val_len);

if (copy_to_user(uctx, nctx, nctx_len))

rc = -EFAULT;

out:

kfree(nctx);

*uctx_len = nctx_len;

return rc;

}

#define LSM_RET_DEFAULT(NAME) (NAME##_default)

#define DECLARE_LSM_RET_DEFAULT_void(DEFAULT, NAME)

#define DECLARE_LSM_RET_DEFAULT_int(DEFAULT, NAME) \

static const int __maybe_unused LSM_RET_DEFAULT(NAME) = (DEFAULT);

#define LSM_HOOK(RET, DEFAULT, NAME, ...) \

DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME)

#include <linux/lsm_hook_defs.h>

#undef LSM_HOOK

#define __CALL_STATIC_VOID(NUM, HOOK, ...) \

do { \

if (static_branch_unlikely(&SECURITY_HOOK_ACTIVE_KEY(HOOK, NUM))) { \

static_call(LSM_STATIC_CALL(HOOK, NUM))(__VA_ARGS__); \

} \

} while (0);

#define call_void_hook(HOOK, ...) \

do { \

LSM_LOOP_UNROLL(__CALL_STATIC_VOID, HOOK, __VA_ARGS__); \

} while (0)

#define __CALL_STATIC_INT(NUM, R, HOOK, LABEL, ...) \

do { \

if (static_branch_unlikely(&SECURITY_HOOK_ACTIVE_KEY(HOOK, NUM))) { \

R = static_call(LSM_STATIC_CALL(HOOK, NUM))(__VA_ARGS__); \

if (R != LSM_RET_DEFAULT(HOOK)) \

goto LABEL; \

} \

} while (0);

#define call_int_hook(HOOK, ...) \

({ \

__label__ OUT; \

int RC = LSM_RET_DEFAULT(HOOK); \

\

LSM_LOOP_UNROLL(__CALL_STATIC_INT, RC, HOOK, OUT, __VA_ARGS__); \

OUT: \

RC; \

})

#define lsm_for_each_hook(scall, NAME) \

for (scall = static_calls_table.NAME; \

scall - static_calls_table.NAME < MAX_LSM_COUNT; scall++) \

if (static_key_enabled(&scall->active->key))

int security_binder_set_context_mgr(const struct cred *mgr)

{

return call_int_hook(binder_set_context_mgr, mgr);

}