From: joeyli <jlee@suse.com>
To: KP Singh <kpsingh@kernel.org>
Cc: linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org, paul@paul-moore.com,
bp@alien8.de, sfr@canb.auug.org.au, peterz@infradead.org,
nathan@kernel.org, Jiri Kosina <JKosina@suse.cz>,
Michal Suchanek <msuchanek@suse.com>
Subject: Re: [PATCH] init/main.c: Initialize early LSMs after arch code
Date: Tue, 11 Mar 2025 21:37:31 +0800 [thread overview]
Message-ID: <20250311133731.GB17395@linux-l9pv.suse> (raw)
In-Reply-To: <20240801171747.3155893-1-kpsingh@kernel.org>
Hi KP,
On Thu, Aug 01, 2024 at 07:17:47PM +0200, KP Singh wrote:
> With LSMs using static calls, early_lsm_init needs to wait for setup_arch
> for architecture specific functionality which includes jump tables and
> static calls to be initialized.
>
> This only affects "early LSMs" i.e. only lockdown when
> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY is set.
>
> Fixes: 2732ad5ecd5b ("lsm: replace indirect LSM hook calls with static calls")
> Signed-off-by: KP Singh <kpsingh@kernel.org>
I have tested acpi table override function by
CONFIG_ACPI_TABLE_OVERRIDE_VIA_BUILTIN_INITRD option. As this patch
description, the early LSM can NOT lockdown acpi table override in early
boot stage now.
Do you have any plan to fix the early lockdown LSM? Or I missed any fix
patch in kernel mailing list?
Thanks a lot!
Joey Lee
next prev parent reply other threads:[~2025-03-11 13:37 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-08-01 17:17 [PATCH] init/main.c: Initialize early LSMs after arch code KP Singh
2024-08-05 19:57 ` Paul Moore
2024-08-05 23:29 ` KP Singh
2024-08-06 2:20 ` Nathan Chancellor
2024-08-06 21:41 ` Paul Moore
2024-08-07 20:44 ` Paul Moore
2024-08-07 22:45 ` KP Singh
2024-08-07 22:50 ` KP Singh
2024-08-07 23:43 ` Paul Moore
2024-08-08 0:30 ` KP Singh
2024-08-08 0:34 ` Guenter Roeck
2024-08-08 0:40 ` KP Singh
2024-08-08 1:20 ` Guenter Roeck
2024-08-08 1:18 ` Paul Moore
2024-08-08 1:40 ` Guenter Roeck
2024-08-08 2:13 ` Guenter Roeck
2024-08-08 4:07 ` Guenter Roeck
2024-08-08 9:57 ` KP Singh
2024-08-08 15:20 ` Guenter Roeck
2024-08-08 16:43 ` Guenter Roeck
2024-08-08 17:32 ` Paul Moore
2024-08-08 18:00 ` Guenter Roeck
2024-08-08 20:49 ` Paul Moore
2024-08-12 17:12 ` KP Singh
2024-08-12 19:33 ` Paul Moore
2024-08-12 21:14 ` KP Singh
2024-08-12 21:32 ` Paul Moore
2024-08-12 22:02 ` KP Singh
2024-08-13 4:07 ` Guenter Roeck
2024-08-13 15:56 ` KP Singh
2024-08-13 16:26 ` Guenter Roeck
2024-08-13 18:21 ` Paul Moore
2024-08-08 17:19 ` Paul Moore
2025-03-11 13:37 ` joeyli [this message]
2025-03-11 15:14 ` Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250311133731.GB17395@linux-l9pv.suse \
--to=jlee@suse.com \
--cc=JKosina@suse.cz \
--cc=bp@alien8.de \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=msuchanek@suse.com \
--cc=nathan@kernel.org \
--cc=paul@paul-moore.com \
--cc=peterz@infradead.org \
--cc=sfr@canb.auug.org.au \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox