1 // SPDX-License-Identifier: GPL-2.0-only
5 * Copyright (C) 2005 Greg Kroah-Hartman <gregkh@suse.de>
7 * Based on fs/debugfs/inode.c which had the following copyright notice:
8 * Copyright (C) 2004 Greg Kroah-Hartman <greg@kroah.com>
9 * Copyright (C) 2004 IBM Inc.
13 #include <linux/sysfs.h>
14 #include <linux/kobject.h>
16 #include <linux/mount.h>
17 #include <linux/pagemap.h>
18 #include <linux/init.h>
19 #include <linux/namei.h>
20 #include <linux/security.h>
21 #include <linux/lsm_hooks.h>
22 #include <linux/magic.h>
24 static struct vfsmount
*mount
;
25 static int mount_count
;
27 static void securityfs_free_inode(struct inode
*inode
)
29 if (S_ISLNK(inode
->i_mode
))
31 free_inode_nonrcu(inode
);
34 static const struct super_operations securityfs_super_operations
= {
35 .statfs
= simple_statfs
,
36 .free_inode
= securityfs_free_inode
,
39 static int fill_super(struct super_block
*sb
, void *data
, int silent
)
41 static const struct tree_descr files
[] = {{""}};
44 error
= simple_fill_super(sb
, SECURITYFS_MAGIC
, files
);
48 sb
->s_op
= &securityfs_super_operations
;
53 static struct dentry
*get_sb(struct file_system_type
*fs_type
,
54 int flags
, const char *dev_name
,
57 return mount_single(fs_type
, flags
, data
, fill_super
);
60 static struct file_system_type fs_type
= {
64 .kill_sb
= kill_litter_super
,
68 * securityfs_create_dentry - create a dentry in the securityfs filesystem
70 * @name: a pointer to a string containing the name of the file to create.
71 * @mode: the permission that the file should have
72 * @parent: a pointer to the parent dentry for this file. This should be a
73 * directory dentry if set. If this parameter is %NULL, then the
74 * file will be created in the root of the securityfs filesystem.
75 * @data: a pointer to something that the caller will want to get to later
76 * on. The inode.i_private pointer will point to this value on
78 * @fops: a pointer to a struct file_operations that should be used for
80 * @iops: a point to a struct of inode_operations that should be used for
83 * This is the basic "create a file/dir/symlink" function for
84 * securityfs. It allows for a wide range of flexibility in creating
85 * a file, or a directory (if you want to create a directory, the
86 * securityfs_create_dir() function is recommended to be used
89 * This function returns a pointer to a dentry if it succeeds. This
90 * pointer must be passed to the securityfs_remove() function when the
91 * file is to be removed (no automatic cleanup happens if your module
92 * is unloaded, you are responsible here). If an error occurs, the
93 * function will return the error value (via ERR_PTR).
95 * If securityfs is not enabled in the kernel, the value %-ENODEV is
98 static struct dentry
*securityfs_create_dentry(const char *name
, umode_t mode
,
99 struct dentry
*parent
, void *data
,
100 const struct file_operations
*fops
,
101 const struct inode_operations
*iops
)
103 struct dentry
*dentry
;
104 struct inode
*dir
, *inode
;
107 if (!(mode
& S_IFMT
))
108 mode
= (mode
& S_IALLUGO
) | S_IFREG
;
110 pr_debug("securityfs: creating file '%s'\n",name
);
112 error
= simple_pin_fs(&fs_type
, &mount
, &mount_count
);
114 return ERR_PTR(error
);
117 parent
= mount
->mnt_root
;
119 dir
= d_inode(parent
);
122 dentry
= lookup_one_len(name
, parent
, strlen(name
));
126 if (d_really_is_positive(dentry
)) {
131 inode
= new_inode(dir
->i_sb
);
137 inode
->i_ino
= get_next_ino();
138 inode
->i_mode
= mode
;
139 inode
->i_atime
= inode
->i_mtime
= inode
->i_ctime
= current_time(inode
);
140 inode
->i_private
= data
;
142 inode
->i_op
= &simple_dir_inode_operations
;
143 inode
->i_fop
= &simple_dir_operations
;
146 } else if (S_ISLNK(mode
)) {
147 inode
->i_op
= iops
? iops
: &simple_symlink_inode_operations
;
148 inode
->i_link
= data
;
152 d_instantiate(dentry
, inode
);
159 dentry
= ERR_PTR(error
);
162 simple_release_fs(&mount
, &mount_count
);
167 * securityfs_create_file - create a file in the securityfs filesystem
169 * @name: a pointer to a string containing the name of the file to create.
170 * @mode: the permission that the file should have
171 * @parent: a pointer to the parent dentry for this file. This should be a
172 * directory dentry if set. If this parameter is %NULL, then the
173 * file will be created in the root of the securityfs filesystem.
174 * @data: a pointer to something that the caller will want to get to later
175 * on. The inode.i_private pointer will point to this value on
177 * @fops: a pointer to a struct file_operations that should be used for
180 * This function creates a file in securityfs with the given @name.
182 * This function returns a pointer to a dentry if it succeeds. This
183 * pointer must be passed to the securityfs_remove() function when the file is
184 * to be removed (no automatic cleanup happens if your module is unloaded,
185 * you are responsible here). If an error occurs, the function will return
186 * the error value (via ERR_PTR).
188 * If securityfs is not enabled in the kernel, the value %-ENODEV is
191 struct dentry
*securityfs_create_file(const char *name
, umode_t mode
,
192 struct dentry
*parent
, void *data
,
193 const struct file_operations
*fops
)
195 return securityfs_create_dentry(name
, mode
, parent
, data
, fops
, NULL
);
197 EXPORT_SYMBOL_GPL(securityfs_create_file
);
200 * securityfs_create_dir - create a directory in the securityfs filesystem
202 * @name: a pointer to a string containing the name of the directory to
204 * @parent: a pointer to the parent dentry for this file. This should be a
205 * directory dentry if set. If this parameter is %NULL, then the
206 * directory will be created in the root of the securityfs filesystem.
208 * This function creates a directory in securityfs with the given @name.
210 * This function returns a pointer to a dentry if it succeeds. This
211 * pointer must be passed to the securityfs_remove() function when the file is
212 * to be removed (no automatic cleanup happens if your module is unloaded,
213 * you are responsible here). If an error occurs, the function will return
214 * the error value (via ERR_PTR).
216 * If securityfs is not enabled in the kernel, the value %-ENODEV is
219 struct dentry
*securityfs_create_dir(const char *name
, struct dentry
*parent
)
221 return securityfs_create_file(name
, S_IFDIR
| 0755, parent
, NULL
, NULL
);
223 EXPORT_SYMBOL_GPL(securityfs_create_dir
);
226 * securityfs_create_symlink - create a symlink in the securityfs filesystem
228 * @name: a pointer to a string containing the name of the symlink to
230 * @parent: a pointer to the parent dentry for the symlink. This should be a
231 * directory dentry if set. If this parameter is %NULL, then the
232 * directory will be created in the root of the securityfs filesystem.
233 * @target: a pointer to a string containing the name of the symlink's target.
234 * If this parameter is %NULL, then the @iops parameter needs to be
235 * setup to handle .readlink and .get_link inode_operations.
236 * @iops: a pointer to the struct inode_operations to use for the symlink. If
237 * this parameter is %NULL, then the default simple_symlink_inode
238 * operations will be used.
240 * This function creates a symlink in securityfs with the given @name.
242 * This function returns a pointer to a dentry if it succeeds. This
243 * pointer must be passed to the securityfs_remove() function when the file is
244 * to be removed (no automatic cleanup happens if your module is unloaded,
245 * you are responsible here). If an error occurs, the function will return
246 * the error value (via ERR_PTR).
248 * If securityfs is not enabled in the kernel, the value %-ENODEV is
251 struct dentry
*securityfs_create_symlink(const char *name
,
252 struct dentry
*parent
,
254 const struct inode_operations
*iops
)
260 link
= kstrdup(target
, GFP_KERNEL
);
262 return ERR_PTR(-ENOMEM
);
264 dent
= securityfs_create_dentry(name
, S_IFLNK
| 0444, parent
,
271 EXPORT_SYMBOL_GPL(securityfs_create_symlink
);
274 * securityfs_remove - removes a file or directory from the securityfs filesystem
276 * @dentry: a pointer to a the dentry of the file or directory to be removed.
278 * This function removes a file or directory in securityfs that was previously
279 * created with a call to another securityfs function (like
280 * securityfs_create_file() or variants thereof.)
282 * This function is required to be called in order for the file to be
283 * removed. No automatic cleanup of files will happen when a module is
284 * removed; you are responsible here.
286 void securityfs_remove(struct dentry
*dentry
)
290 if (!dentry
|| IS_ERR(dentry
))
293 dir
= d_inode(dentry
->d_parent
);
295 if (simple_positive(dentry
)) {
296 if (d_is_dir(dentry
))
297 simple_rmdir(dir
, dentry
);
299 simple_unlink(dir
, dentry
);
303 simple_release_fs(&mount
, &mount_count
);
305 EXPORT_SYMBOL_GPL(securityfs_remove
);
307 #ifdef CONFIG_SECURITY
308 static struct dentry
*lsm_dentry
;
309 static ssize_t
lsm_read(struct file
*filp
, char __user
*buf
, size_t count
,
312 return simple_read_from_buffer(buf
, count
, ppos
, lsm_names
,
316 static const struct file_operations lsm_ops
= {
318 .llseek
= generic_file_llseek
,
322 static int __init
securityfs_init(void)
326 retval
= sysfs_create_mount_point(kernel_kobj
, "security");
330 retval
= register_filesystem(&fs_type
);
332 sysfs_remove_mount_point(kernel_kobj
, "security");
335 #ifdef CONFIG_SECURITY
336 lsm_dentry
= securityfs_create_file("lsm", 0444, NULL
, NULL
,
341 core_initcall(securityfs_init
);