Re: [PATCH -v4 -mm] LSM: Add security= boot parameter

[James Morris <jmorris@namei.org>]

On Mon, 3 Mar 2008, Ahmed S. Darwish wrote:

>  static inline int verify(struct security_operations *ops)
>  {
>  	/* verify the security_operations structure exists */
> -	if (!ops)
> +	if (!ops || !ops->name)
>  		return -EINVAL;

verify() will now be called after ops->name has been referenced, so these 
checks won't be necessary now.

> +int security_module_enable(struct security_operations *ops)
> +{
> +	if (!ops || !ops->name) {
> +		BUG();
> +		return 0;
> +	}

It's not going to return after BUG(), and actually, you can probably just 
rely on the subsequent oops (i.e. no check needed).

> +
> +	if (!*chosen_lsm && atomic_inc_and_test(&security_ops_enabled))
> +		return 1;
> +
> +	if (!strncmp(ops->name, chosen_lsm, SECURITY_NAME_MAX))
> +		return 1;


I still think you should use a spinlock here to make the semantics 
simpler.  Dispense with the confusingly named security_ops_enabled, and 
fill chosen_lsm in with the first lsm to regsiter if none chosen at boot.


> +               printk(KERN_INFO "SELinux:  Another security module was chosen.\n");
> +               printk(KERN_INFO "SELinux:  Use security=%s to force loading "
> +                      "SELinux on boot.\n", selinux_ops.name);

These messages are not going to scale, e.g. what if there are 20 LSMs 
compiled in, and they all print this on boot? Just print the chosen LSM 
in security_module_enabled().


- James
-- 
James Morris
<jmorris@namei.org>