1/* SPDX-License-Identifier: GPL-2.0 */
2/*
3 * Copyright (C) 2020-2024 Microsoft Corporation. All rights reserved.
4 */
5#ifndef _IPE_POLICY_H
6#define _IPE_POLICY_H
7
8#include <linux/list.h>
9#include <linux/types.h>
10#include <linux/fs.h>
11
12enum ipe_op_type {
13 IPE_OP_EXEC = 0,
14 IPE_OP_FIRMWARE,
15 IPE_OP_KERNEL_MODULE,
16 IPE_OP_KEXEC_IMAGE,
17 IPE_OP_KEXEC_INITRAMFS,
18 IPE_OP_POLICY,
19 IPE_OP_X509,
20 __IPE_OP_MAX,
21};
22
23#define IPE_OP_INVALID __IPE_OP_MAX
24
25enum ipe_action_type {
26 IPE_ACTION_ALLOW = 0,
27 IPE_ACTION_DENY,
28 __IPE_ACTION_MAX
29};
30
31#define IPE_ACTION_INVALID __IPE_ACTION_MAX
32
33enum ipe_prop_type {
34 IPE_PROP_BOOT_VERIFIED_FALSE,
35 IPE_PROP_BOOT_VERIFIED_TRUE,
36 IPE_PROP_DMV_ROOTHASH,
37 IPE_PROP_DMV_SIG_FALSE,
38 IPE_PROP_DMV_SIG_TRUE,
39 IPE_PROP_FSV_DIGEST,
40 IPE_PROP_FSV_SIG_FALSE,
41 IPE_PROP_FSV_SIG_TRUE,
42 __IPE_PROP_MAX
43};
44
45#define IPE_PROP_INVALID __IPE_PROP_MAX
46
47struct ipe_prop {
48 struct list_head next;
49 enum ipe_prop_type type;
50 void *value;
51};
52
53struct ipe_rule {
54 enum ipe_op_type op;
55 enum ipe_action_type action;
56 struct list_head props;
57 struct list_head next;
58};
59
60struct ipe_op_table {
61 struct list_head rules;
62 enum ipe_action_type default_action;
63};
64
65struct ipe_parsed_policy {
66 const char *name;
67 struct {
68 u16 major;
69 u16 minor;
70 u16 rev;
71 } version;
72
73 enum ipe_action_type global_default_action;
74
75 struct ipe_op_table rules[__IPE_OP_MAX];
76};
77
78struct ipe_policy {
79 const char *pkcs7;
80 size_t pkcs7len;
81
82 const char *text;
83 size_t textlen;
84
85 struct ipe_parsed_policy *parsed;
86
87 struct dentry *policyfs;
88};
89
90struct ipe_policy *ipe_new_policy(const char *text, size_t textlen,
91 const char *pkcs7, size_t pkcs7len);
92void ipe_free_policy(struct ipe_policy *pol);
93int ipe_update_policy(struct inode *root, const char *text, size_t textlen,
94 const char *pkcs7, size_t pkcs7len);
95int ipe_set_active_pol(const struct ipe_policy *p);
96extern struct mutex ipe_policy_lock;
97
98#endif /* _IPE_POLICY_H */
99

source code of linux/security/ipe/policy.h