From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from frasgout11.his.huawei.com (frasgout11.his.huawei.com [14.137.139.23]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 052B52D9784; Tue, 2 Sep 2025 12:59:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=14.137.139.23 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756817996; cv=none; b=hR/xgvcDIkhjnjcV0HP0H/3maVj4Y4M5uPpCkOxJl2Mi6uHSjGx8SEY5NlowYVGmPTBoW8/EIOs68EOnqi9vNswbZlrJzF1dPsDWgNBkWHKZCXERniSctUf0hcFRoMq8wsg2JAD57b9mthzcM9DViE1KxUYgty2HKB9MYN10Y4U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756817996; c=relaxed/simple; bh=l7NMA9SCuOeZytQ1wMt0IZ0DxTjEV3/p7b8oa+JmsNg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Lyqu1Q9WxO9RcfyIuV+VUeROu0ERcY79aKaKicp1NuWkv8OcXfpqF9NOYlMDNbmbVjjjsrOkVKyK1qrZD5PXLrKsY5lM/DtTL/Zd0WNJtim2yKdF58gbuP5iCpNz0pUz/zX+AlKHsw+au7L5bx1Y+z1Kws3eThQ8WyEX0LDf7m8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com; spf=pass smtp.mailfrom=huaweicloud.com; arc=none smtp.client-ip=14.137.139.23 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huaweicloud.com Received: from mail.maildlp.com (unknown [172.18.186.29]) by frasgout11.his.huawei.com (SkyGuard) with ESMTPS id 4cGQlF3lMqz1HCj6; Tue, 2 Sep 2025 20:58:01 +0800 (CST) Received: from mail02.huawei.com (unknown [7.182.16.47]) by mail.maildlp.com (Postfix) with ESMTP id 894C6140157; Tue, 2 Sep 2025 20:58:46 +0800 (CST) Received: from huaweicloud.com (unknown [10.204.63.22]) by APP1 (Coremail) with SMTP id LxC2BwBHRqW26bZovoWeAA--.18504S2; Tue, 02 Sep 2025 13:57:36 +0100 (CET) From: Roberto Sassu To: paul@paul-moore.com, zohar@linux.ibm.com, roberto.sassu@huawei.com Cc: linux-security-module@vger.kernel.org, linux-integrity@vger.kernel.org, selinux@vger.kernel.org, john.johansen@canonical.com, wufan@kernel.org, mic@digikod.net, kees@kernel.org, mortonm@chromium.org, casey@schaufler-ca.com, penguin-kernel@i-love.sakura.ne.jp, nicolas.bouchinet@oss.cyber.gouv.fr, xiujianfeng@huawei.com Subject: [PATCH] ima,evm: move initcalls to the LSM framework Date: Tue, 2 Sep 2025 14:54:57 +0200 Message-ID: <20250902125457.2689519-1-roberto.sassu@huaweicloud.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <9f35539de7188c6b853c55b76958a286131f5928.camel@huaweicloud.com> References: <9f35539de7188c6b853c55b76958a286131f5928.camel@huaweicloud.com> Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CM-TRANSID:LxC2BwBHRqW26bZovoWeAA--.18504S2 X-Coremail-Antispam: 1UD129KBjvJXoW3Xw1kuFWrGr1DGw1kAF4fKrg_yoW7XF45pa 1qgay8Gr18AFWIkF97Aa43CFWfK3yFg34UWws8Cw1vyasxZr1UXr97AryUCr13WrW5tFyr twnIvw43Aw1DtFJanT9S1TB71UUUUUDqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUvFb4IE77IF4wAFF20E14v26r4j6ryUM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rwA2F7IY1VAKz4 vEj48ve4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_Jr0_JF4l84ACjcxK6xIIjxv20xvEc7Cj xVAFwI0_Gr0_Cr1l84ACjcxK6I8E87Iv67AKxVW8JVWxJwA2z4x0Y4vEx4A2jsIEc7CjxV AFwI0_Gr0_Gr1UM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40E x7xfMcIj6xIIjxv20xvE14v26r1Y6r17McIj6I8E87Iv67AKxVWUJVW8JwAm72CE4IkC6x 0Yz7v_Jr0_Gr1lF7xvr2IYc2Ij64vIr41lFIxGxcIEc7CjxVA2Y2ka0xkIwI1lc7CjxVAa w2AFwI0_Wrv_ZF1l42xK82IYc2Ij64vIr41l4I8I3I0E4IkC6x0Yz7v_Jr0_Gr1lx2IqxV Aqx4xG67AKxVWUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF1VAY17CE14v26r1q 6r43MIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcVC0I7IYx2IY6x kF7I0E14v26r4j6F4UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI42IY6I8E87Iv67AK xVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCTnIWIevJa73UjIFyTuYvj xUV-txDUUUU X-CM-SenderInfo: purev21wro2thvvxqx5xdzvxpfor3voofrz/1tbiAQATBGi2lUAE-wAAsm From: Paul Moore This patch converts IMA and EVM to use the LSM frameworks's initcall mechanism. It moved the integrity_fs_init() call to ima_fs_init() and evm_init_secfs(), to work around the fact that there is no "integrity" LSM, and introduced integrity_fs_fini() to remove the integrity directory, if empty. Both integrity_fs_init() and integrity_fs_fini() support the scenario of being called by both the IMA and EVM LSMs. It is worth mentioning that this patch does not touch any of the "platform certs" code that lives in the security/integrity/platform_certs directory as the IMA/EVM maintainers have assured me that this code is unrelated to IMA/EVM, despite the location, and will be moved to a more relevant subsystem in the future. Signed-off-by: Roberto Sassu --- security/integrity/evm/evm_main.c | 3 +-- security/integrity/evm/evm_secfs.c | 11 +++++++++-- security/integrity/iint.c | 14 ++++++++++++-- security/integrity/ima/ima_fs.c | 11 +++++++++-- security/integrity/ima/ima_main.c | 4 ++-- security/integrity/integrity.h | 2 ++ 6 files changed, 35 insertions(+), 10 deletions(-) diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c index db8e324ed4e6..73d500a375cb 100644 --- a/security/integrity/evm/evm_main.c +++ b/security/integrity/evm/evm_main.c @@ -1179,6 +1179,5 @@ DEFINE_LSM(evm) = { .init = init_evm_lsm, .order = LSM_ORDER_LAST, .blobs = &evm_blob_sizes, + .initcall_late = init_evm, }; - -late_initcall(init_evm); diff --git a/security/integrity/evm/evm_secfs.c b/security/integrity/evm/evm_secfs.c index b0d2aad27850..c26724690cec 100644 --- a/security/integrity/evm/evm_secfs.c +++ b/security/integrity/evm/evm_secfs.c @@ -302,10 +302,16 @@ int __init evm_init_secfs(void) int error = 0; struct dentry *dentry; - evm_dir = securityfs_create_dir("evm", integrity_dir); - if (IS_ERR(evm_dir)) + error = integrity_fs_init(); + if (error < 0) return -EFAULT; + evm_dir = securityfs_create_dir("evm", integrity_dir); + if (IS_ERR(evm_dir)) { + error = -EFAULT; + goto out; + } + dentry = securityfs_create_file("evm", 0660, evm_dir, NULL, &evm_key_ops); if (IS_ERR(dentry)) { @@ -329,5 +335,6 @@ int __init evm_init_secfs(void) out: securityfs_remove(evm_symlink); securityfs_remove(evm_dir); + integrity_fs_fini(); return error; } diff --git a/security/integrity/iint.c b/security/integrity/iint.c index 068ac6c2ae1e..8ec1a3436a71 100644 --- a/security/integrity/iint.c +++ b/security/integrity/iint.c @@ -42,8 +42,11 @@ void __init integrity_load_keys(void) evm_load_x509(); } -static int __init integrity_fs_init(void) +int __init integrity_fs_init(void) { + if (integrity_dir) + return 0; + integrity_dir = securityfs_create_dir("integrity", NULL); if (IS_ERR(integrity_dir)) { int ret = PTR_ERR(integrity_dir); @@ -58,4 +61,11 @@ static int __init integrity_fs_init(void) return 0; } -late_initcall(integrity_fs_init) +void __init integrity_fs_fini(void) +{ + if (!integrity_dir || !simple_empty(integrity_dir)) + return; + + securityfs_remove(integrity_dir); + integrity_dir = NULL; +} diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c index 87045b09f120..012a58959ff0 100644 --- a/security/integrity/ima/ima_fs.c +++ b/security/integrity/ima/ima_fs.c @@ -499,9 +499,15 @@ int __init ima_fs_init(void) struct dentry *dentry; int ret; + ret = integrity_fs_init(); + if (ret < 0) + return ret; + ima_dir = securityfs_create_dir("ima", integrity_dir); - if (IS_ERR(ima_dir)) - return PTR_ERR(ima_dir); + if (IS_ERR(ima_dir)) { + ret = PTR_ERR(ima_dir); + goto out; + } ima_symlink = securityfs_create_symlink("ima", NULL, "integrity/ima", NULL); @@ -555,6 +561,7 @@ int __init ima_fs_init(void) out: securityfs_remove(ima_symlink); securityfs_remove(ima_dir); + integrity_fs_fini(); return ret; } diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index eade8e1e3cb1..b703bfc2f470 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -1283,6 +1283,6 @@ DEFINE_LSM(ima) = { .init = init_ima_lsm, .order = LSM_ORDER_LAST, .blobs = &ima_blob_sizes, + /* Start IMA after the TPM is available */ + .initcall_late = init_ima, }; - -late_initcall(init_ima); /* Start IMA after the TPM is available */ diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h index c2c2da691123..7b388b66cf80 100644 --- a/security/integrity/integrity.h +++ b/security/integrity/integrity.h @@ -114,6 +114,8 @@ struct ima_file_id { int integrity_kernel_read(struct file *file, loff_t offset, void *addr, unsigned long count); +int __init integrity_fs_init(void); +void __init integrity_fs_fini(void); #define INTEGRITY_KEYRING_EVM 0 #define INTEGRITY_KEYRING_IMA 1 -- 2.43.0