lua-lsm: expose kernel file load ids

[chenzongyao200127]

Lua-LSM currently leaves the file/load id arguments for kernel_load_data(), kernel_post_load_data(), kernel_read_file(), and kernel_post_read_file() as nil placeholders. This makes Lua policy unable to distinguish kernel modules, firmware, security policy loads, and other kernel file/load users without looking at unrelated context.

Expose those ids as the stable strings returned by kernel_load_data_id_str() and kernel_read_file_id_str(), and drop the separate Lua-visible size argument from the post hooks. The post hooks already expose the data as binary-safe Lua strings, so policy can use the Lua length operator instead.

Example Lua policy:

return {
    name = "file-load-policy",
    author = "Zongyao Chen",
    license = "GPL",

    kernel_load_data = function(id, contents)
        if id == "kernel-module" and not contents then
            return false, errno.EPERM
        end
        return true
    end,

    kernel_post_load_data = function(data, id, description)
        if id ~= "kernel-module" then
            return true
        end

        if #data < 4 or data:sub(1, 4) ~= "\127ELF" then
            return false, errno.EPERM
        end

        return true
    end,

    kernel_read_file = function(file, id, contents)
        return true
    end,

    kernel_post_read_file = function(file, data, id)
        if id == "kernel-module" and #data >= 4 then
            return data:sub(1, 4) == "\127ELF"
        end
        return true
    end,
}

The series contains these commits:

• lua-lsm: expose kernel file load ids to Lua hooks
• lua-lsm: drop redundant size args for file data hooks

Validation:

• ./scripts/checkpatch.pl --git origin/lua-lsm..lua-lsm-file-load-ids
• git diff --check origin/lua-lsm..lua-lsm-file-load-ids

Signed-off-by: Zongyao Chen ZongYao.Chen@linux.alibaba.com