1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2023 Huawei Device Co., Ltd.
4 */
5
6 #include <internal.h>
7 #include <linux/security.h>
8 #include <linux/seq_file.h>
9 #include <linux/mm_types.h>
10 #include <linux/mm.h>
11 #include <linux/mm_inline.h>
12 #include <linux/hck/lite_hck_hideaddr.h>
13 #include <linux/hck/lite_vendor_hooks.h>
14 #include <linux/init.h>
15 #include <linux/module.h>
16
17 #include "avc.h"
18 #include "objsec.h"
19 #include "hideaddr.h"
20
is_anon_exec(struct vm_area_struct * vma)21 static bool is_anon_exec(struct vm_area_struct *vma)
22 {
23 const char *name = NULL;
24 vm_flags_t flags = vma->vm_flags;
25
26 if (!(flags & VM_EXEC))
27 return false;
28
29 name = arch_vma_name(vma);
30 if (!name) {
31 struct anon_vma_name *anon_name;
32 anon_name = anon_vma_name(vma);
33 if (!anon_name)
34 return false;
35 }
36 return true;
37 }
38
hideaddr_avc_has_perm(u16 tclass,u32 requested,struct seq_file * m)39 static int hideaddr_avc_has_perm(u16 tclass, u32 requested, struct seq_file *m)
40 {
41 struct av_decision avd;
42 struct inode *inode_task = file_inode(m->file);
43 struct task_struct *task = get_proc_task(inode_task);
44 u32 secid;
45
46 security_cred_getsecid(task->cred, &secid);
47 return avc_has_perm_noaudit(&selinux_state, secid, secid, tclass, requested,
48 AVC_STRICT, &avd);
49 }
50
hideaddr_header_prefix(unsigned long * start,unsigned long * end,vm_flags_t * flags,struct seq_file * m,struct vm_area_struct * vma)51 static void hideaddr_header_prefix(unsigned long *start, unsigned long *end,
52 vm_flags_t *flags, struct seq_file *m, struct vm_area_struct *vma)
53 {
54 if (!is_anon_exec(vma))
55 return;
56
57 if (hideaddr_avc_has_perm(SECCLASS_HIDEADDR, HIDEADDR__HIDE_EXEC_ANON_MEM, m))
58 return;
59
60 if (!hideaddr_avc_has_perm(SECCLASS_HIDEADDR, HIDEADDR__HIDE_EXEC_ANON_MEM_DEBUG, m))
61 return;
62
63 *start = 0;
64 *end = 0;
65 *flags = 0;
66 }
67
hideaddr_header_prefix_lhck_register(void)68 void hideaddr_header_prefix_lhck_register(void)
69 {
70 REGISTER_HCK_LITE_HOOK(hideaddr_header_prefix_lhck, hideaddr_header_prefix);
71 }