Re: [PATCH v2 2/3] lsm: introduce security_lsm_config_*_policy hooks

[Randy Dunlap <rdunlap@infradead.org>]

On 6/19/25 11:15 AM, Maxime Bélair wrote:
> Define two new LSM hooks: security_lsm_config_self_policy and
> security_lsm_config_system_policy and wire them into the corresponding
> lsm_config_*_policy() syscalls so that LSMs can register a unified
> interface for policy management. This initial, minimal implementation
> only supports the LSM_POLICY_LOAD operation to limit changes.
> 
> Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
> ---
>  include/linux/lsm_hook_defs.h |  4 ++
>  include/linux/security.h      | 16 ++++++++
>  include/uapi/linux/lsm.h      |  8 ++++
>  security/Kconfig              | 22 +++++++++++
>  security/lsm_syscalls.c       | 17 ++++++++-
>  security/security.c           | 69 +++++++++++++++++++++++++++++++++++
>  6 files changed, 134 insertions(+), 2 deletions(-)
> 

> diff --git a/security/Kconfig b/security/Kconfig
> index 4816fc74f81e..958be7b49a9e 100644
> --- a/security/Kconfig
> +++ b/security/Kconfig
> @@ -220,6 +220,28 @@ config STATIC_USERMODEHELPER_PATH
>  	  If you wish for all usermode helper programs to be disabled,
>  	  specify an empty string here (i.e. "").
>  
> +config LSM_CONFIG_SELF_POLICY_MAX_BUFFER_SIZE
> +	int "Maximum buffer size for lsm_manage_policy"

Update function name.

> +	range 16384 1073741824
> +	depends on SECURITY
> +	default 4194304
> +	help
> +	  The maximum size of the buffer argument of lsm_config_self_policy.
> +
> +	  The default value of 4194304 (4MiB) is reasonable and should be large
> +	  enough to fit policies in for most cases.
> +
> +config LSM_CONFIG_SYSTEM_POLICY_MAX_BUFFER_SIZE
> +	int "Maximum buffer size for lsm_manage_policy"

same here.

> +	range 16384 1073741824
> +	depends on SECURITY
> +	default 4194304
> +	help
> +	  The maximum size of the buffer argument of lsm_config_system_policy.
> +
> +	  The default value of 4194304 (4MiB) is reasonable and should be large
> +	  enough to fit policies in for most cases
> +
>  source "security/selinux/Kconfig"
>  source "security/smack/Kconfig"
>  source "security/tomoyo/Kconfig"


> diff --git a/security/security.c b/security/security.c
> index fb57e8fddd91..8efea2b6e967 100644
> --- a/security/security.c
> +++ b/security/security.c
> @@ -5883,6 +5883,75 @@ int security_bdev_setintegrity(struct block_device *bdev,
>  }
>  EXPORT_SYMBOL(security_bdev_setintegrity);
>  
> +/**
> + * security_lsm_config_self_policy() - Manage caller's LSM policies
> + * @lsm_id: id of the LSM to target
> + * @op: Operation to perform (one of the LSM_POLICY_XXX values)
> + * @buf: userspace pointer to policy data
> + * @size: size of @buf
> + * @flags: lsm policy management flags
> + *
> + * Manage the policies of a LSM for the current domain/user. This notably allows
> + * to update them even when the lsmfs is unavailable is restricted. Currently,

                                                        or
?

> + * only LSM_POLICY_LOAD is supported.
> + *
> + * Return: Returns 0 on success, error on failure.
> + */
> +int security_lsm_config_self_policy(u32 lsm_id, u32 op, void __user *buf,
> +				 size_t size, u32 flags)
> +{
> +	int rc = LSM_RET_DEFAULT(lsm_config_self_policy);
> +	struct lsm_static_call *scall;
> +
> +	if (size > (CONFIG_LSM_CONFIG_SELF_POLICY_MAX_BUFFER_SIZE))
> +		return -E2BIG;
> +
> +	lsm_for_each_hook(scall, lsm_config_self_policy) {
> +		if ((scall->hl->lsmid->id) == lsm_id) {
> +			rc = scall->hl->hook.lsm_config_self_policy(lsm_id, op, buf, size, flags);
> +			break;
> +		}
> +	}
> +
> +	return rc;
> +}
> +EXPORT_SYMBOL(security_lsm_config_self_policy);
> +
> +/**
> + * security_lsm_config_system_policy() - Manage system LSM policies
> + * @lsm_id: id of the lsm to target
> + * @op: Operation to perform (one of the LSM_POLICY_XXX values)
> + * @buf: userspace pointer to policy data
> + * @size: size of @buf
> + * @flags: lsm policy management flags
> + *
> + * Manage the policies of a LSM for the whole system. This notably allows
> + * to update them even when the lsmfs is unavailable is restricted. Currently,

                                                        or
?

> + * only LSM_POLICY_LOAD is supported.
> + *
> + * Return: Returns 0 on success, error on failure.
> + */
> +int security_lsm_config_system_policy(u32 lsm_id, u32 op, void __user *buf,
> +				   size_t size, u32 flags)
> +{

[snip]

-- 
~Randy