Re: [PATCH -next 8/9] Documentation/ABI: document the lockdown securityfs file

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] Documentation/ABI: securityfs-lockdown omits CONFIG_LSM activation path
--

commit a74113d4e117aa2187671cc1af3e2f7a75da9ede
Author: Cai Xinchen <caixinchen1@huawei.com>

Documentation/ABI: document the lockdown securityfs file

This patch adds ABI documentation for /sys/kernel/security/lockdown and
updates the LOCKDOWN SECURITY MODULE entry in MAINTAINERS.

> diff --git a/Documentation/ABI/testing/securityfs-lockdown b/Documentation/ABI/testing/securityfs-lockdown
> new file mode 100644
> index 0000000000000..490dc607492ce
> --- /dev/null
> +++ b/Documentation/ABI/testing/securityfs-lockdown
> @@ -0,0 +1,41 @@
> +What:		/sys/kernel/security/lockdown
> +Date:		August 2019
> +KernelVersion:	5.4
> +Contact:	linux-security-module@vger.kernel.org
> +Description:
> +		The lockdown securityfs file reports and controls the
> +		lockdown state of the running kernel.  It is provided by
> +		the lockdown LSM and is located at
> +		/sys/kernel/security/lockdown.
> +
> +		The file is present only when CONFIG_SECURITY_LOCKDOWN_LSM is
> +		enabled and the lockdown LSM is active: either
> +		CONFIG_SECURITY_LOCKDOWN_LSM_EARLY is set, or the LSM is
> +		listed in the "lsm=" kernel parameter.  Otherwise the node
> +		is absent, and userspace must handle its absence.

[Severity: Low]
Can the lockdown LSM also be activated at build time via CONFIG_LSM when
neither CONFIG_SECURITY_LOCKDOWN_LSM_EARLY is set nor the lsm= kernel
parameter is passed?

In security/lsm_init.c, security_init() falls back to lsm_order_builtin
(initialized from CONFIG_LSM) when lsm= is not specified on the command
line:

security/lsm_init.c:security_init() {
	...
	if (lsm_order_cmdline) {
		lsm_order_legacy = NULL;
		lsm_order_parse(lsm_order_cmdline, "cmdline");
	} else
		lsm_order_parse(lsm_order_builtin, "builtin");
	...
}

And security/Kconfig includes lockdown in the default CONFIG_LSM list,
which causes security_initcall_core() -> lockdown_secfs_init() to create
/sys/kernel/security/lockdown.

Should this paragraph also mention CONFIG_LSM as one of the ways the
lockdown LSM can be enabled?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103082421.3033195-1-caixinchen1@huawei.com?part=8