* Re: [PATCH v2 0/7] fs/9p: Reuse inode based on path (in addition to qid)
From: Christian Schoenebeck @ 2025-09-17 9:52 UTC (permalink / raw)
To: Dominique Martinet, Tingmao Wang
Cc: Mickaël Salaün, Eric Van Hensbergen, Latchesar Ionkov,
v9fs, Günther Noack, linux-security-module, Jan Kara,
Amir Goldstein, Matthew Bobrowski, Al Viro, Christian Brauner,
linux-fsdevel
In-Reply-To: <f2c94b0a-2f1e-425a-bda1-f2d141acdede@maowtm.org>
On Wednesday, September 17, 2025 1:59:21 AM CEST Tingmao Wang wrote:
> On 9/16/25 20:22, Christian Schoenebeck wrote:
> > On Tuesday, September 16, 2025 4:01:40 PM CEST Tingmao Wang wrote:
[...]
> > I see that you are proposing an option for your proposed qid based
> > re-using of dentries. I don't think it should be on by default though,
> > considering what we already discussed (e.g. inodes recycled by ext4, but
> > also not all 9p servers handling inode collisions).
>
> Just to be clear, this approach (Landlock holding a fid reference, then
> using the qid as a key to search for rules when a Landlocked process
> accesses the previously remembered file, possibly after the file has been
> moved on the server) would only be in Landlock, and would only affect
> Landlock, not 9pfs (so not sure what you meant by "re-using of dentries").
>
> The idea behind holding a fid reference within Landlock is that, because
> we have the file open, the inode would not get recycled in ext4, and thus
> no other file will reuse the qid, until we close that reference (when the
> Landlock domain terminates, or when the 9p filesystem is unmounted)
So far I only had a glimpse on your kernel patches and had the impression that
they are changing behaviour for all users, since you are touching dentry
lookup.
> > For all open FIDs QEMU retains a descriptor to the file/directory.
> >
> > Which 9p message do you see sent to server, Trename or Trenameat?
> >
> > Does this always happen to you or just sometimes, i.e. under heavy load?
>
> Always happen, see log: (no Trename since the rename is done on the host)
[...]
> Somehow if I rename in the guest, it all works, even though it's using the
> same fid 2 (and it didn't ask QEMU to walk the new path)
Got it. Even though QEMU *should* hold a file descriptor (or a DIR* stream,
which should imply a file descriptor), there is still a path string stored at
V9fsFidState and that path being processed at some places, probably because
there are path based and FID based variants (e.g Trename vs. Trenameat). Maybe
that clashes somewhere, not sure. So I fear you would need to debug this.
/Christian
^ permalink raw reply
* Re: [PATCH] memfd,selinux: call security_inode_init_security_anon
From: Hugh Dickins @ 2025-09-17 1:08 UTC (permalink / raw)
To: Thiébaud Weksteen
Cc: Paul Moore, Hugh Dickins, James Morris, Stephen Smalley,
Jeff Vander Stoep, Nick Kralevich, Jeff Xu, Baolin Wang,
linux-kernel, linux-security-module, selinux, linux-mm
In-Reply-To: <CA+zpnLe8Z=2qY3rVCyZXyGPOaO2a0V2BVrdMkuwKs789igGCzw@mail.gmail.com>
[-- Attachment #1: Type: text/plain, Size: 1517 bytes --]
On Wed, 17 Sep 2025, Thiébaud Weksteen wrote:
> On Wed, Sep 17, 2025 at 1:26 AM Paul Moore <paul@paul-moore.com> wrote:
> > >
> > > So far as I can tell, seems okay to me:
> > > Acked-by: Hugh Dickins <hughd@google.com>
> > >
> > > If I'd responded earlier (sorry), I would have asked for it just to use
> > > &QSTR("[memfd]") directly in the call, rather than indirecting through
> > > unnecessary #define MEMFD_ANON_NAME "[memfd]"; never mind, that's all.
> > >
>
> Thanks for the review Hugh. In our case, it is necessary to expose
> MEMFD_ANON_NAME as there is a string comparison done in
> security/selinux/hooks.c (see selinux_inode_init_security_anon
> changes).
> I would argue it is cleaner to reference the same constant. The
> alternative here would be to have 2 copies of it, with the risk of
> them being out-of-sync at some point.
Oh, I'm sorry, I simply misread your patch, and thought that the
#define MEMFD_ANON_NAME "[memfd]" came at the start of mm/memfd.c,
whereas it's in include/linux/memfd.h just before mm/memfd.c.
Yes, you're perfectly correct to do it that way then, ignore me.
(I do have to reflect on why three instances of MEMFD_ANON_NAME
are safer than two instances of "[memfd]", but you are correct.)
That does lead me to look quickly at the security/selinux/hooks.c
end of the patch: I don't particularly love what I see there, but
that's none of my business, you and Paul have constraints to meet
there which I'm entirely unfamiliar with.
Hugh
^ permalink raw reply
* Re: [PATCH] memfd,selinux: call security_inode_init_security_anon
From: Thiébaud Weksteen @ 2025-09-17 0:34 UTC (permalink / raw)
To: Paul Moore, Hugh Dickins
Cc: James Morris, Stephen Smalley, Jeff Vander Stoep, Nick Kralevich,
Jeff Xu, Baolin Wang, linux-kernel, linux-security-module,
selinux, linux-mm
In-Reply-To: <CAHC9VhQejS05C8AExkh32GidBdzXjauKPP6T_3eSGZDEwfwDuA@mail.gmail.com>
On Wed, Sep 17, 2025 at 1:26 AM Paul Moore <paul@paul-moore.com> wrote:
>
> On Tue, Sep 16, 2025 at 1:07 AM Hugh Dickins <hughd@google.com> wrote:
> > On Wed, 3 Sep 2025, Paul Moore wrote:
> > > On Aug 25, 2025 "=?UTF-8?q?Thi=C3=A9baud=20Weksteen?=" <tweek@google.com> wrote:
> > > >
> > > > Prior to this change, no security hooks were called at the creation of a
> > > > memfd file. It means that, for SELinux as an example, it will receive
> > > > the default type of the filesystem that backs the in-memory inode. In
> > > > most cases, that would be tmpfs, but if MFD_HUGETLB is passed, it will
> > > > be hugetlbfs. Both can be considered implementation details of memfd.
> > > >
> > > > It also means that it is not possible to differentiate between a file
> > > > coming from memfd_create and a file coming from a standard tmpfs mount
> > > > point.
> > > >
> > > > Additionally, no permission is validated at creation, which differs from
> > > > the similar memfd_secret syscall.
> > > >
> > > > Call security_inode_init_security_anon during creation. This ensures
> > > > that the file is setup similarly to other anonymous inodes. On SELinux,
> > > > it means that the file will receive the security context of its task.
> > > >
> > > > The ability to limit fexecve on memfd has been of interest to avoid
> > > > potential pitfalls where /proc/self/exe or similar would be executed
> > > > [1][2]. Reuse the "execute_no_trans" and "entrypoint" access vectors,
> > > > similarly to the file class. These access vectors may not make sense for
> > > > the existing "anon_inode" class. Therefore, define and assign a new
> > > > class "memfd_file" to support such access vectors.
> > > >
> > > > Guard these changes behind a new policy capability named "memfd_class".
> > > >
> > > > [1] https://crbug.com/1305267
> > > > [2] https://lore.kernel.org/lkml/20221215001205.51969-1-jeffxu@google.com/
> > > >
> > > > Signed-off-by: Thiébaud Weksteen <tweek@google.com>
> > > > Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> > > > Tested-by: Stephen Smalley <stephen.smalley.work@gmail.com>
>
> ...
>
> > > Hugh, Baolin, and shmem/mm folks, are you okay with the changes above? If
> > > so it would be nice to get an ACK from one of you.
> >
> > So far as I can tell, seems okay to me:
> > Acked-by: Hugh Dickins <hughd@google.com>
> >
> > If I'd responded earlier (sorry), I would have asked for it just to use
> > &QSTR("[memfd]") directly in the call, rather than indirecting through
> > unnecessary #define MEMFD_ANON_NAME "[memfd]"; never mind, that's all.
> >
Thanks for the review Hugh. In our case, it is necessary to expose
MEMFD_ANON_NAME as there is a string comparison done in
security/selinux/hooks.c (see selinux_inode_init_security_anon
changes).
I would argue it is cleaner to reference the same constant. The
alternative here would be to have 2 copies of it, with the risk of
them being out-of-sync at some point.
> > Please do take this, along with the rest, through your security tree:
> > mm.git contains no conflicting change to mm/memfd.c at present.
>
> Thanks Hugh, it turns out we ended up having a discussion on the
> SELinux side (proper return values for error conditions) and I'm going
> to hold off on this until after the upcoming merge window to give time
> for that discussion to run its course. The good news is that gives
> Thiébaud an opportunity to do the qstr fixup you wanted.
>
> Thiébaud, are you okay with making the change Hugh has requested?
>
> --
> paul-moore.com
^ permalink raw reply
* Re: [PATCH v2 0/7] fs/9p: Reuse inode based on path (in addition to qid)
From: Tingmao Wang @ 2025-09-16 23:59 UTC (permalink / raw)
To: Christian Schoenebeck, Dominique Martinet
Cc: Mickaël Salaün, Eric Van Hensbergen, Latchesar Ionkov,
v9fs, Günther Noack, linux-security-module, Jan Kara,
Amir Goldstein, Matthew Bobrowski, Al Viro, Christian Brauner,
linux-fsdevel
In-Reply-To: <3070012.VW4agfvzBM@silver>
On 9/16/25 20:22, Christian Schoenebeck wrote:
> On Tuesday, September 16, 2025 4:01:40 PM CEST Tingmao Wang wrote:
>> On 9/16/25 14:35, Dominique Martinet wrote:
>>> Tingmao Wang wrote on Tue, Sep 16, 2025 at 01:44:27PM +0100:
>>>> [...]
>>>>
>>>> Note that in discussion with Mickaël (maintainer of Landlock) he
>>>> indicated
>>>> that he would be comfortable for Landlock to track a qid, instead of
>>>> holding a inode, specifically for 9pfs.
>>>
>>> Yes, I saw that, but what you pointed out about qid reuse make me
>>> somewhat uncomfortable with that direction -- you could allow a
>>> directory, delete it, create a new one somewhere else and if the
>>> underlying fs reuse the same inode number the rule would allow an
>>> intended directory instead so I'd rather not rely on qid for this
>>> either.
>>> But if you think that's not a problem in practice (because e.g. landlock
>>> would somehow detect the dir got deleted or another good reason it's not
>>> a problem) then I agree it's probably the simplest way forward
>>> implementation-wise.
>>
>> Sorry, I forgot to add that this idea would also involve Landlock holding
>> a reference to the fid (or dentry, but that's problematic due to breaking
>> unmount unless we can have a new hook) to keep the file open on the host
>> side so that the qid won't be reused (ignoring collisions caused by
>> different filesystems mounted under one 9pfs export when multidev mapping
>> is not enabled)
>
> I see that you are proposing an option for your proposed qid based re-using of
> dentries. I don't think it should be on by default though, considering what we
> already discussed (e.g. inodes recycled by ext4, but also not all 9p servers
> handling inode collisions).
Just to be clear, this approach (Landlock holding a fid reference, then
using the qid as a key to search for rules when a Landlocked process
accesses the previously remembered file, possibly after the file has been
moved on the server) would only be in Landlock, and would only affect
Landlock, not 9pfs (so not sure what you meant by "re-using of dentries").
The idea behind holding a fid reference within Landlock is that, because
we have the file open, the inode would not get recycled in ext4, and thus
no other file will reuse the qid, until we close that reference (when the
Landlock domain terminates, or when the 9p filesystem is unmounted)
>
>> (There's the separate issue of QEMU not seemingly keeping a directory open
>> on the host when the guest has a fid to it tho. I checked that if the dir
>> is renamed on the host side, any process in the guest that has a fd to it
>> (checked via cd in a shell) will not be able to use that fd to read it
>> anymore. This also means that another directory might be created with the
>> same qid.path)
>
> For all open FIDs QEMU retains a descriptor to the file/directory.
>
> Which 9p message do you see sent to server, Trename or Trenameat?
>
> Does this always happen to you or just sometimes, i.e. under heavy load?
Always happen, see log: (no Trename since the rename is done on the host)
qemu flags: -virtfs "local,path=/tmp/test,mount_tag=test,security_model=passthrough,readonly=off,multidevs=remap"
qemu version: QEMU emulator version 10.1.0 (Debian 1:10.1.0+ds-5)
guest kernel version: 6.17.0-rc5 (for the avoidance of doubt, this is clean 6.17-rc5 with no patches)
qemu pid: 511476
root@host # ls -la /proc/511476/fd | grep test
lr-x------ 1 root root 64 Sep 17 00:35 41 -> /tmp/test
root@guest # mount --mkdir -t 9p -o trans=virtio,cache=none,inodeident=qid,debug=13 test /tmp/test
root@guest # mkdir /tmp/test/dir1
root@guest # cd /tmp/test/dir1
9pnet: -- v9fs_vfs_getattr_dotl (183): dentry: ffff888102ed4d38
9pnet: -- v9fs_fid_find (183): dentry: / (ffff888102ed4d38) uid 0 any 0
9pnet: (00000183) >>> TGETATTR fid 1, request_mask 16383
9pnet: (00000183) >>> size=19 type: 24 tag: 0
9pnet: (00000183) <<< size=160 type: 25 tag: 0
9pnet: (00000183) <<< RGETATTR st_result_mask=6143
<<< qid=80.3.68c9c8a3
<<< st_mode=000043ff st_nlink=3
<<< st_uid=0 st_gid=0
<<< st_rdev=0 st_size=3c st_blksize=131072 st_blocks=0
<<< st_atime_sec=1758065706 st_atime_nsec=857221735
<<< st_mtime_sec=1758065827 st_mtime_nsec=745359877
<<< st_ctime_sec=1758065827 st_ctime_nsec=745359877
<<< st_btime_sec=0 st_btime_nsec=0
<<< st_gen=0 st_data_version=0
9pnet: -- v9fs_vfs_lookup (183): dir: ffff8881090e0000 dentry: (dir1) ffff888102e458f8 flags: 1
9pnet: -- v9fs_fid_find (183): dentry: / (ffff888102ed4d38) uid 0 any 0
9pnet: (00000183) >>> TWALK fids 1,2 nwname 1d wname[0] dir1
9pnet: (00000183) >>> size=23 type: 110 tag: 0
9pnet: (00000183) <<< size=22 type: 111 tag: 0
9pnet: (00000183) <<< RWALK nwqid 1:
9pnet: (00000183) <<< [0] 80.5.68c9dca3
9pnet: (00000183) >>> TGETATTR fid 2, request_mask 6143
9pnet: (00000183) >>> size=19 type: 24 tag: 0
9pnet: (00000183) <<< size=160 type: 25 tag: 0
9pnet: (00000183) <<< RGETATTR st_result_mask=6143
<<< qid=80.5.68c9dca3
<<< st_mode=000041ed st_nlink=2
<<< st_uid=0 st_gid=0
<<< st_rdev=0 st_size=28 st_blksize=131072 st_blocks=0
<<< st_atime_sec=1758065827 st_atime_nsec=745359877
<<< st_mtime_sec=1758065827 st_mtime_nsec=745359877
<<< st_ctime_sec=1758065827 st_ctime_nsec=749830521
<<< st_btime_sec=0 st_btime_nsec=0
<<< st_gen=0 st_data_version=0
9pnet: -- v9fs_vfs_getattr_dotl (183): dentry: ffff888102e458f8
9pnet: -- v9fs_fid_find (183): dentry: dir1 (ffff888102e458f8) uid 0 any 0
9pnet: (00000183) >>> TGETATTR fid 2, request_mask 16383
9pnet: (00000183) >>> size=19 type: 24 tag: 0
9pnet: (00000183) <<< size=160 type: 25 tag: 0
9pnet: (00000183) <<< RGETATTR st_result_mask=6143
<<< qid=80.5.68c9dca3
<<< st_mode=000041ed st_nlink=2
<<< st_uid=0 st_gid=0
<<< st_rdev=0 st_size=28 st_blksize=131072 st_blocks=0
<<< st_atime_sec=1758065827 st_atime_nsec=745359877
<<< st_mtime_sec=1758065827 st_mtime_nsec=745359877
<<< st_ctime_sec=1758065827 st_ctime_nsec=749830521
<<< st_btime_sec=0 st_btime_nsec=0
<<< st_gen=0 st_data_version=0
9pnet: -- v9fs_dentry_release (183): dentry: dir1 (ffff888102e458f8)
9pnet: (00000183) >>> TCLUNK fid 2 (try 0)
9pnet: (00000183) >>> size=11 type: 120 tag: 0
9pnet: (00000183) <<< size=7 type: 121 tag: 0
9pnet: (00000183) <<< RCLUNK fid 2
9pnet: -- v9fs_vfs_lookup (183): dir: ffff8881090e0000 dentry: (dir1) ffff888102e45a70 flags: 3
9pnet: -- v9fs_fid_find (183): dentry: / (ffff888102ed4d38) uid 0 any 0
9pnet: (00000183) >>> TWALK fids 1,2 nwname 1d wname[0] dir1
9pnet: (00000183) >>> size=23 type: 110 tag: 0
9pnet: (00000183) <<< size=22 type: 111 tag: 0
9pnet: (00000183) <<< RWALK nwqid 1:
9pnet: (00000183) <<< [0] 80.5.68c9dca3
9pnet: (00000183) >>> TGETATTR fid 2, request_mask 6143
9pnet: (00000183) >>> size=19 type: 24 tag: 0
9pnet: (00000183) <<< size=160 type: 25 tag: 0
9pnet: (00000183) <<< RGETATTR st_result_mask=6143
<<< qid=80.5.68c9dca3
<<< st_mode=000041ed st_nlink=2
<<< st_uid=0 st_gid=0
<<< st_rdev=0 st_size=28 st_blksize=131072 st_blocks=0
<<< st_atime_sec=1758065827 st_atime_nsec=745359877
<<< st_mtime_sec=1758065827 st_mtime_nsec=745359877
<<< st_ctime_sec=1758065827 st_ctime_nsec=749830521
<<< st_btime_sec=0 st_btime_nsec=0
<<< st_gen=0 st_data_version=0
(fid 2 is now a persistent handle pointing to /dir1, not sure why the
walk was done twice)
root@host # ls -la /proc/511476/fd | grep test
lr-x------ 1 root root 64 Sep 17 00:35 41 -> /tmp/test
(no fd points to dir1)
root@host # mv -v /tmp/test/dir1 /tmp/test/dir2
renamed '/tmp/test/dir1' -> '/tmp/test/dir2'
root@guest:/tmp/test/dir1# ls
9pnet: -- v9fs_vfs_getattr_dotl (183): dentry: ffff888102e45a70
9pnet: -- v9fs_fid_find (183): dentry: dir1 (ffff888102e45a70) uid 0 any 0
9pnet: (00000183) >>> TGETATTR fid 2, request_mask 16383
9pnet: (00000183) >>> size=19 type: 24 tag: 0
9pnet: (00000183) <<< size=11 type: 7 tag: 0
9pnet: (00000183) <<< RLERROR (-2)
9pnet: -- v9fs_file_open (188): inode: ffff888102e80640 file: ffff88810af45340
9pnet: -- v9fs_fid_find (188): dentry: dir1 (ffff888102e45a70) uid 0 any 0
9pnet: (00000188) >>> TWALK fids 2,3 nwname 0d wname[0] (null)
9pnet: (00000188) >>> size=17 type: 110 tag: 0
9pnet: (00000188) <<< size=11 type: 7 tag: 0
9pnet: (00000188) <<< RLERROR (-2)
ls: cannot open directory '.': No such file or directory
It looks like as soon as the directory was moved on the host, TGETATTR on
the guest-opened fid 2 fails, even though I would expect that if QEMU
opens a fd to the dir and use that fd whenever fid 2 is used, that
TGETATTR should succeed. The fact that I can't see anything pointing to
dir1 in /proc/511476/fd was also suspicious.
Also, if I remove the dir on the host, then repoen it in the guest, ls
starts working again:
root@host # mv -v /tmp/test/dir2 /tmp/test/dir1
renamed '/tmp/test/dir2' -> '/tmp/test/dir1'
root@guest:/tmp/test/dir1# ls
9pnet: -- v9fs_file_open (189): inode: ffff888102e80640 file: ffff88810af47100
9pnet: -- v9fs_fid_find (189): dentry: dir1 (ffff888102e45a70) uid 0 any 0
9pnet: (00000189) >>> TWALK fids 2,3 nwname 0d wname[0] (null)
9pnet: (00000189) >>> size=17 type: 110 tag: 0
9pnet: (00000189) <<< size=9 type: 111 tag: 0
9pnet: (00000189) <<< RWALK nwqid 0:
9pnet: (00000189) >>> TLOPEN fid 3 mode 100352
9pnet: (00000189) >>> size=15 type: 12 tag: 0
9pnet: (00000189) <<< size=24 type: 13 tag: 0
9pnet: (00000189) <<< RLOPEN qid 80.5.68c9dca3 iounit 0
9pnet: -- v9fs_vfs_getattr_dotl (189): dentry: ffff888102e45a70
9pnet: -- v9fs_fid_find (189): dentry: dir1 (ffff888102e45a70) uid 0 any 0
9pnet: (00000189) >>> TGETATTR fid 2, request_mask 16383
9pnet: (00000189) >>> size=19 type: 24 tag: 0
9pnet: (00000189) <<< size=160 type: 25 tag: 0
9pnet: (00000189) <<< RGETATTR st_result_mask=6143
<<< qid=80.5.68c9dca3
<<< st_mode=000041ed st_nlink=2
<<< st_uid=0 st_gid=0
<<< st_rdev=0 st_size=28 st_blksize=131072 st_blocks=0
<<< st_atime_sec=1758065827 st_atime_nsec=745359877
<<< st_mtime_sec=1758065827 st_mtime_nsec=745359877
<<< st_ctime_sec=1758066075 st_ctime_nsec=497687251
<<< st_btime_sec=0 st_btime_nsec=0
<<< st_gen=0 st_data_version=0
9pnet: -- v9fs_dir_readdir_dotl (189): name dir1
9pnet: (00000189) >>> TREADDIR fid 3 offset 0 count 131072
9pnet: (00000189) >>> size=23 type: 40 tag: 0
9pnet: (00000189) <<< size=62 type: 41 tag: 0
9pnet: (00000189) <<< RREADDIR count 51
9pnet: (00000189) >>> TREADDIR fid 3 offset 2147483647 count 131072
9pnet: (00000189) >>> size=23 type: 40 tag: 0
9pnet: (00000189) <<< size=11 type: 41 tag: 0
9pnet: (00000189) <<< RREADDIR count 0
9pnet: -- v9fs_dir_readdir_dotl (189): name dir1
9pnet: (00000189) >>> TREADDIR fid 3 offset 2147483647 count 131072
9pnet: (00000189) >>> size=23 type: 40 tag: 0
9pnet: (00000189) <<< size=11 type: 41 tag: 0
9pnet: (00000189) <<< RREADDIR count 0
9pnet: -- v9fs_dir_release (189): inode: ffff888102e80640 filp: ffff88810af47100 fid: 3
9pnet: (00000189) >>> TCLUNK fid 3 (try 0)
9pnet: (00000189) >>> size=11 type: 120 tag: 0
9pnet: (00000189) <<< size=7 type: 121 tag
root@guest:/tmp/test/dir1# echo $?
0
Somehow if I rename in the guest, it all works, even though it's using the
same fid 2 (and it didn't ask QEMU to walk the new path)
root@guest:/tmp/test/dir1# mv /tmp/test/dir1 /tmp/test/dir2
9pnet: -- v9fs_vfs_getattr_dotl (183): dentry: ffff888102e45a70
9pnet: -- v9fs_fid_find (183): dentry: dir1 (ffff888102e45a70) uid 0 any 0
9pnet: (00000183) >>> TGETATTR fid 2, request_mask 16383
9pnet: (00000183) >>> size=19 type: 24 tag: 0
9pnet: (00000183) <<< size=160 type: 25 tag: 0
9pnet: (00000183) <<< RGETATTR st_result_mask=6143
<<< qid=80.5.68c9dca3
<<< st_mode=000041ed st_nlink=2
<<< st_uid=0 st_gid=0
<<< st_rdev=0 st_size=28 st_blksize=131072 st_blocks=0
<<< st_atime_sec=1758066561 st_atime_nsec=442431580
<<< st_mtime_sec=1758065827 st_mtime_nsec=745359877
<<< st_ctime_sec=1758066559 st_ctime_nsec=570428555
<<< st_btime_sec=0 st_btime_nsec=0
<<< st_gen=0 st_data_version=0
9pnet: -- v9fs_vfs_lookup (194): dir: ffff8881090e0000 dentry: (dir2) ffff888102edca48 flags: e0000
9pnet: -- v9fs_fid_find (194): dentry: / (ffff888102ed4d38) uid 0 any 0
9pnet: (00000194) >>> TWALK fids 1,3 nwname 1d wname[0] dir2
9pnet: (00000194) >>> size=23 type: 110 tag: 0
9pnet: (00000194) <<< size=11 type: 7 tag: 0
9pnet: (00000194) <<< RLERROR (-2)
9pnet: -- v9fs_dentry_release (194): dentry: dir2 (ffff888102edca48)
9pnet: -- v9fs_vfs_lookup (194): dir: ffff8881090e0000 dentry: (dir2) ffff888102edcbc0 flags: 0
9pnet: -- v9fs_fid_find (194): dentry: / (ffff888102ed4d38) uid 0 any 0
9pnet: (00000194) >>> TWALK fids 1,3 nwname 1d wname[0] dir2
9pnet: (00000194) >>> size=23 type: 110 tag: 0
9pnet: (00000194) <<< size=11 type: 7 tag: 0
9pnet: (00000194) <<< RLERROR (-2)
9pnet: -- v9fs_dentry_release (194): dentry: dir2 (ffff888102edcbc0)
9pnet: -- v9fs_vfs_lookup (194): dir: ffff8881090e0000 dentry: (dir2) ffff888102edcd38 flags: a0000
9pnet: -- v9fs_fid_find (194): dentry: / (ffff888102ed4d38) uid 0 any 0
9pnet: (00000194) >>> TWALK fids 1,3 nwname 1d wname[0] dir2
9pnet: (00000194) >>> size=23 type: 110 tag: 0
9pnet: (00000194) <<< size=11 type: 7 tag: 0
9pnet: (00000194) <<< RLERROR (-2)
9pnet: -- v9fs_vfs_rename (194):
9pnet: -- v9fs_fid_find (194): dentry: dir1 (ffff888102e45a70) uid 0 any 0
9pnet: -- v9fs_fid_find (194): dentry: / (ffff888102ed4d38) uid 0 any 0
9pnet: (00000194) >>> TWALK fids 1,3 nwname 0d wname[0] (null)
9pnet: (00000194) >>> size=17 type: 110 tag: 0
9pnet: (00000194) <<< size=9 type: 111 tag: 0
9pnet: (00000194) <<< RWALK nwqid 0:
9pnet: -- v9fs_fid_find (194): dentry: / (ffff888102ed4d38) uid 0 any 0
9pnet: (00000194) >>> TWALK fids 1,4 nwname 0d wname[0] (null)
9pnet: (00000194) >>> size=17 type: 110 tag: 0
9pnet: (00000194) <<< size=9 type: 111 tag: 0
9pnet: (00000194) <<< RWALK nwqid 0:
9pnet: (00000194) >>> TRENAMEAT olddirfid 3 old name dir1 newdirfid 4 new name dir2
9pnet: (00000194) >>> size=27 type: 74 tag: 0
9pnet: (00000194) <<< size=7 type: 75 tag: 0
9pnet: (00000194) <<< RRENAMEAT newdirfid 4 new name dir2
9pnet: (00000194) >>> TCLUNK fid 4 (try 0)
9pnet: (00000194) >>> size=11 type: 120 tag: 0
9pnet: (00000194) <<< size=7 type: 121 tag: 0
9pnet: (00000194) <<< RCLUNK fid 4
9pnet: (00000194) >>> TCLUNK fid 3 (try 0)
9pnet: (00000194) >>> size=11 type: 120 tag: 0
9pnet: (00000194) <<< size=7 type: 121 tag: 0
9pnet: (00000194) <<< RCLUNK fid 3
9pnet: -- v9fs_dentry_release (194): dentry: dir2 (ffff888102edcd38)
root@guest:/tmp/test/dir1# ls
9pnet: -- v9fs_file_open (195): inode: ffff888102e80640 file: ffff88810b2b1500
9pnet: -- v9fs_fid_find (195): dentry: dir2 (ffff888102e45a70) uid 0 any 0
9pnet: (00000195) >>> TWALK fids 2,3 nwname 0d wname[0] (null)
9pnet: (00000195) >>> size=17 type: 110 tag: 0
9pnet: (00000195) <<< size=9 type: 111 tag: 0
9pnet: (00000195) <<< RWALK nwqid 0:
9pnet: (00000195) >>> TLOPEN fid 3 mode 100352
9pnet: (00000195) >>> size=15 type: 12 tag: 0
9pnet: (00000195) <<< size=24 type: 13 tag: 0
9pnet: (00000195) <<< RLOPEN qid 80.5.68c9dca3 iounit 0
9pnet: -- v9fs_vfs_getattr_dotl (195): dentry: ffff888102e45a70
9pnet: -- v9fs_fid_find (195): dentry: dir2 (ffff888102e45a70) uid 0 any 0
9pnet: (00000195) >>> TGETATTR fid 2, request_mask 16383
9pnet: (00000195) >>> size=19 type: 24 tag: 0
9pnet: (00000195) <<< size=160 type: 25 tag: 0
9pnet: (00000195) <<< RGETATTR st_result_mask=6143
<<< qid=80.5.68c9dca3
<<< st_mode=000041ed st_nlink=2
<<< st_uid=0 st_gid=0
<<< st_rdev=0 st_size=28 st_blksize=131072 st_blocks=0
<<< st_atime_sec=1758066561 st_atime_nsec=442431580
<<< st_mtime_sec=1758065827 st_mtime_nsec=745359877
<<< st_ctime_sec=1758066568 st_ctime_nsec=562443096
<<< st_btime_sec=0 st_btime_nsec=0
<<< st_gen=0 st_data_version=0
9pnet: -- v9fs_dir_readdir_dotl (195): name dir2
9pnet: (00000195) >>> TREADDIR fid 3 offset 0 count 131072
9pnet: (00000195) >>> size=23 type: 40 tag: 0
9pnet: (00000195) <<< size=62 type: 41 tag: 0
9pnet: (00000195) <<< RREADDIR count 51
9pnet: (00000195) >>> TREADDIR fid 3 offset 2147483647 count 131072
9pnet: (00000195) >>> size=23 type: 40 tag: 0
9pnet: (00000195) <<< size=11 type: 41 tag: 0
9pnet: (00000195) <<< RREADDIR count 0
9pnet: -- v9fs_dir_readdir_dotl (195): name dir2
9pnet: (00000195) >>> TREADDIR fid 3 offset 2147483647 count 131072
9pnet: (00000195) >>> size=23 type: 40 tag: 0
9pnet: (00000195) <<< size=11 type: 41 tag: 0
9pnet: (00000195) <<< RREADDIR count 0
9pnet: -- v9fs_dir_release (195): inode: ffff888102e80640 filp: ffff88810b2b1500 fid: 3
9pnet: (00000195) >>> TCLUNK fid 3 (try 0)
9pnet: (00000195) >>> size=11 type: 120 tag: 0
9pnet: (00000195) <<< size=7 type: 121 tag: 0
9pnet: (00000195) <<< RCLUNK fid 3
If this is surprising, I'm happy to take a deeper look over the weekend
(but I've never tried to debug QEMU itself :D)
> Because even though QEMU retains descriptors of open FIDs; when the QEMU
> process approaches host system's max. allowed number of open file descriptors
> then v9fs_reclaim_fd() [hw/9pfs/9p.c] is called, which closes some descriptors
> of older FIDs to (at least) keep the QEMU process alive.
>
> BTW: to prevent these descriptor reclaims to happen too often, I plan to do
> what many other files servers do: asking the host system on process start to
> increase the max. number of file descriptors.
Note that the above is reproduced with only 1 file open (the dir being
renamed around)
Kind regards,
Tingmao
>
> /Christian
>
>
^ permalink raw reply
* [PATCH v4 34/34] lsm: add a LSM_STARTED_ALL notification event
From: Paul Moore @ 2025-09-16 22:04 UTC (permalink / raw)
To: linux-security-module, linux-integrity, selinux
Cc: John Johansen, Mimi Zohar, Roberto Sassu, Fan Wu,
Mickaël Salaün, Günther Noack, Kees Cook,
Micah Morton, Casey Schaufler, Tetsuo Handa, Nicolas Bouchinet,
Xiu Jianfeng
In-Reply-To: <20250916220355.252592-36-paul@paul-moore.com>
Add a new LSM notifier event, LSM_STARTED_ALL, which is fired once at
boot when all of the LSMs have been started.
Reviewed-by: Kees Cook <kees@kernel.org>
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: John Johansen <john.johhansen@canonical.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
include/linux/security.h | 1 +
security/lsm_init.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/include/linux/security.h b/include/linux/security.h
index 8560c50edd2e..c13f0a849024 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -85,6 +85,7 @@ struct timezone;
enum lsm_event {
LSM_POLICY_CHANGE,
+ LSM_STARTED_ALL,
};
struct dm_verity_digest {
diff --git a/security/lsm_init.c b/security/lsm_init.c
index 2bd705836df8..af4046c5c581 100644
--- a/security/lsm_init.c
+++ b/security/lsm_init.c
@@ -556,6 +556,7 @@ static int __init security_initcall_late(void)
rc = lsm_initcall(late);
lsm_pr_dbg("all enabled LSMs fully activated\n");
+ call_blocking_lsm_notifier(LSM_STARTED_ALL, NULL);
return rc;
}
--
2.51.0
^ permalink raw reply related
* [PATCH v4 33/34] lsm: consolidate all of the LSM framework initcalls
From: Paul Moore @ 2025-09-16 22:04 UTC (permalink / raw)
To: linux-security-module, linux-integrity, selinux
Cc: John Johansen, Mimi Zohar, Roberto Sassu, Fan Wu,
Mickaël Salaün, Günther Noack, Kees Cook,
Micah Morton, Casey Schaufler, Tetsuo Handa, Nicolas Bouchinet,
Xiu Jianfeng
In-Reply-To: <20250916220355.252592-36-paul@paul-moore.com>
The LSM framework itself registers a small number of initcalls, this
patch converts these initcalls into the new initcall mechanism.
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: John Johansen <john.johhansen@canonical.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
security/inode.c | 3 +--
security/lsm.h | 4 ++++
security/lsm_init.c | 14 ++++++++++++--
security/min_addr.c | 5 +++--
4 files changed, 20 insertions(+), 6 deletions(-)
diff --git a/security/inode.c b/security/inode.c
index 6620c3e42af2..ab8d6a2acadb 100644
--- a/security/inode.c
+++ b/security/inode.c
@@ -368,7 +368,7 @@ static const struct file_operations lsm_ops = {
};
#endif
-static int __init securityfs_init(void)
+int __init securityfs_init(void)
{
int retval;
@@ -387,4 +387,3 @@ static int __init securityfs_init(void)
#endif
return 0;
}
-core_initcall(securityfs_init);
diff --git a/security/lsm.h b/security/lsm.h
index 8dc267977ae0..436219260376 100644
--- a/security/lsm.h
+++ b/security/lsm.h
@@ -35,4 +35,8 @@ extern struct kmem_cache *lsm_inode_cache;
int lsm_cred_alloc(struct cred *cred, gfp_t gfp);
int lsm_task_alloc(struct task_struct *task);
+/* LSM framework initializers */
+int securityfs_init(void);
+int min_addr_init(void);
+
#endif /* _LSM_H_ */
diff --git a/security/lsm_init.c b/security/lsm_init.c
index 697482a22a02..2bd705836df8 100644
--- a/security/lsm_init.c
+++ b/security/lsm_init.c
@@ -488,7 +488,12 @@ int __init security_init(void)
*/
static int __init security_initcall_pure(void)
{
- return lsm_initcall(pure);
+ int rc_adr, rc_lsm;
+
+ rc_adr = min_addr_init();
+ rc_lsm = lsm_initcall(pure);
+
+ return (rc_adr ? rc_adr : rc_lsm);
}
pure_initcall(security_initcall_pure);
@@ -506,7 +511,12 @@ early_initcall(security_initcall_early);
*/
static int __init security_initcall_core(void)
{
- return lsm_initcall(core);
+ int rc_sfs, rc_lsm;
+
+ rc_sfs = securityfs_init();
+ rc_lsm = lsm_initcall(core);
+
+ return (rc_sfs ? rc_sfs : rc_lsm);
}
core_initcall(security_initcall_core);
diff --git a/security/min_addr.c b/security/min_addr.c
index c55bb84b8632..0fde5ec9abc8 100644
--- a/security/min_addr.c
+++ b/security/min_addr.c
@@ -5,6 +5,8 @@
#include <linux/sysctl.h>
#include <linux/minmax.h>
+#include "lsm.h"
+
/* amount of vm to protect from userspace access by both DAC and the LSM*/
unsigned long mmap_min_addr;
/* amount of vm to protect from userspace using CAP_SYS_RAWIO (DAC) */
@@ -52,11 +54,10 @@ static const struct ctl_table min_addr_sysctl_table[] = {
},
};
-static int __init init_mmap_min_addr(void)
+int __init min_addr_init(void)
{
register_sysctl_init("vm", min_addr_sysctl_table);
update_mmap_min_addr();
return 0;
}
-pure_initcall(init_mmap_min_addr);
--
2.51.0
^ permalink raw reply related
* [PATCH v4 32/34] selinux: move initcalls to the LSM framework
From: Paul Moore @ 2025-09-16 22:03 UTC (permalink / raw)
To: linux-security-module, linux-integrity, selinux
Cc: John Johansen, Mimi Zohar, Roberto Sassu, Fan Wu,
Mickaël Salaün, Günther Noack, Kees Cook,
Micah Morton, Casey Schaufler, Tetsuo Handa, Nicolas Bouchinet,
Xiu Jianfeng
In-Reply-To: <20250916220355.252592-36-paul@paul-moore.com>
SELinux currently has a number of initcalls so we've created a new
function, selinux_initcall(), which wraps all of these initcalls so
that we have a single initcall function that can be registered with the
LSM framework.
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
security/selinux/Makefile | 2 +-
security/selinux/hooks.c | 9 +++--
security/selinux/ibpkey.c | 5 ++-
security/selinux/include/audit.h | 9 +++++
security/selinux/include/initcalls.h | 19 ++++++++++
security/selinux/initcalls.c | 52 ++++++++++++++++++++++++++++
security/selinux/netif.c | 5 ++-
security/selinux/netlink.c | 5 ++-
security/selinux/netnode.c | 5 ++-
security/selinux/netport.c | 5 ++-
security/selinux/selinuxfs.c | 5 ++-
security/selinux/ss/services.c | 26 ++++----------
12 files changed, 107 insertions(+), 40 deletions(-)
create mode 100644 security/selinux/include/initcalls.h
create mode 100644 security/selinux/initcalls.c
diff --git a/security/selinux/Makefile b/security/selinux/Makefile
index 66e56e9011df..72d3baf7900c 100644
--- a/security/selinux/Makefile
+++ b/security/selinux/Makefile
@@ -15,7 +15,7 @@ ccflags-y := -I$(srctree)/security/selinux -I$(srctree)/security/selinux/include
ccflags-$(CONFIG_SECURITY_SELINUX_DEBUG) += -DDEBUG
selinux-y := avc.o hooks.o selinuxfs.o netlink.o nlmsgtab.o netif.o \
- netnode.o netport.o status.o \
+ netnode.o netport.o status.o initcalls.o \
ss/ebitmap.o ss/hashtab.o ss/symtab.o ss/sidtab.o ss/avtab.o \
ss/policydb.o ss/services.o ss/conditional.o ss/mls.o ss/context.o
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index d94b1ff316ba..faa78d16e1b9 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -94,6 +94,7 @@
#include <linux/io_uring/cmd.h>
#include <uapi/linux/lsm.h>
+#include "initcalls.h"
#include "avc.h"
#include "objsec.h"
#include "netif.h"
@@ -7603,6 +7604,10 @@ static __init int selinux_init(void)
if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
panic("SELinux: Unable to register AVC LSM notifier callback\n");
+ if (avc_add_callback(selinux_audit_rule_avc_callback,
+ AVC_CALLBACK_RESET))
+ panic("SELinux: Unable to register AVC audit callback\n");
+
if (selinux_enforcing_boot)
pr_debug("SELinux: Starting in enforcing mode\n");
else
@@ -7635,6 +7640,7 @@ DEFINE_LSM(selinux) = {
.enabled = &selinux_enabled_boot,
.blobs = &selinux_blob_sizes,
.init = selinux_init,
+ .initcall_device = selinux_initcall,
};
#if defined(CONFIG_NETFILTER)
@@ -7696,7 +7702,7 @@ static struct pernet_operations selinux_net_ops = {
.exit = selinux_nf_unregister,
};
-static int __init selinux_nf_ip_init(void)
+int __init selinux_nf_ip_init(void)
{
int err;
@@ -7711,5 +7717,4 @@ static int __init selinux_nf_ip_init(void)
return 0;
}
-__initcall(selinux_nf_ip_init);
#endif /* CONFIG_NETFILTER */
diff --git a/security/selinux/ibpkey.c b/security/selinux/ibpkey.c
index 470481cfe0e8..ea1d9b2c7d2b 100644
--- a/security/selinux/ibpkey.c
+++ b/security/selinux/ibpkey.c
@@ -23,6 +23,7 @@
#include <linux/list.h>
#include <linux/spinlock.h>
+#include "initcalls.h"
#include "ibpkey.h"
#include "objsec.h"
@@ -218,7 +219,7 @@ void sel_ib_pkey_flush(void)
spin_unlock_irqrestore(&sel_ib_pkey_lock, flags);
}
-static __init int sel_ib_pkey_init(void)
+int __init sel_ib_pkey_init(void)
{
int iter;
@@ -232,5 +233,3 @@ static __init int sel_ib_pkey_init(void)
return 0;
}
-
-subsys_initcall(sel_ib_pkey_init);
diff --git a/security/selinux/include/audit.h b/security/selinux/include/audit.h
index d5b0425055e4..85a531ac737b 100644
--- a/security/selinux/include/audit.h
+++ b/security/selinux/include/audit.h
@@ -15,6 +15,15 @@
#include <linux/audit.h>
#include <linux/types.h>
+/**
+ * selinux_audit_rule_avc_callback - update the audit LSM rules on AVC events.
+ * @event: the AVC event
+ *
+ * Update any audit LSM rules based on the AVC event specified in @event.
+ * Returns 0 on success, negative values otherwise.
+ */
+int selinux_audit_rule_avc_callback(u32 event);
+
/**
* selinux_audit_rule_init - alloc/init an selinux audit rule structure.
* @field: the field this rule refers to
diff --git a/security/selinux/include/initcalls.h b/security/selinux/include/initcalls.h
new file mode 100644
index 000000000000..6674cf489473
--- /dev/null
+++ b/security/selinux/include/initcalls.h
@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * SELinux initcalls
+ */
+
+#ifndef _SELINUX_INITCALLS_H
+#define _SELINUX_INITCALLS_H
+
+int init_sel_fs(void);
+int sel_netport_init(void);
+int sel_netnode_init(void);
+int sel_netif_init(void);
+int sel_netlink_init(void);
+int sel_ib_pkey_init(void);
+int selinux_nf_ip_init(void);
+
+int selinux_initcall(void);
+
+#endif
diff --git a/security/selinux/initcalls.c b/security/selinux/initcalls.c
new file mode 100644
index 000000000000..f6716a1d38c1
--- /dev/null
+++ b/security/selinux/initcalls.c
@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * SELinux initcalls
+ */
+
+#include <linux/init.h>
+
+#include "initcalls.h"
+
+/**
+ * selinux_initcall - Perform the SELinux initcalls
+ *
+ * Used as a device initcall in the SELinux LSM definition.
+ */
+int __init selinux_initcall(void)
+{
+ int rc = 0, rc_tmp = 0;
+
+ rc_tmp = init_sel_fs();
+ if (!rc && rc_tmp)
+ rc = rc_tmp;
+
+ rc_tmp = sel_netport_init();
+ if (!rc && rc_tmp)
+ rc = rc_tmp;
+
+ rc_tmp = sel_netnode_init();
+ if (!rc && rc_tmp)
+ rc = rc_tmp;
+
+ rc_tmp = sel_netif_init();
+ if (!rc && rc_tmp)
+ rc = rc_tmp;
+
+ rc_tmp = sel_netlink_init();
+ if (!rc && rc_tmp)
+ rc = rc_tmp;
+
+#if defined(CONFIG_SECURITY_INFINIBAND)
+ rc_tmp = sel_ib_pkey_init();
+ if (!rc && rc_tmp)
+ rc = rc_tmp;
+#endif
+
+#if defined(CONFIG_NETFILTER)
+ rc_tmp = selinux_nf_ip_init();
+ if (!rc && rc_tmp)
+ rc = rc_tmp;
+#endif
+
+ return rc;
+}
diff --git a/security/selinux/netif.c b/security/selinux/netif.c
index 78afbecdbe57..e24b2cba28ea 100644
--- a/security/selinux/netif.c
+++ b/security/selinux/netif.c
@@ -22,6 +22,7 @@
#include <linux/rcupdate.h>
#include <net/net_namespace.h>
+#include "initcalls.h"
#include "security.h"
#include "objsec.h"
#include "netif.h"
@@ -265,7 +266,7 @@ static struct notifier_block sel_netif_netdev_notifier = {
.notifier_call = sel_netif_netdev_notifier_handler,
};
-static __init int sel_netif_init(void)
+int __init sel_netif_init(void)
{
int i;
@@ -280,5 +281,3 @@ static __init int sel_netif_init(void)
return 0;
}
-__initcall(sel_netif_init);
-
diff --git a/security/selinux/netlink.c b/security/selinux/netlink.c
index 1760aee712fd..eb40e4603475 100644
--- a/security/selinux/netlink.c
+++ b/security/selinux/netlink.c
@@ -17,6 +17,7 @@
#include <net/net_namespace.h>
#include <net/netlink.h>
+#include "initcalls.h"
#include "security.h"
static struct sock *selnl __ro_after_init;
@@ -105,7 +106,7 @@ void selnl_notify_policyload(u32 seqno)
selnl_notify(SELNL_MSG_POLICYLOAD, &seqno);
}
-static int __init selnl_init(void)
+int __init sel_netlink_init(void)
{
struct netlink_kernel_cfg cfg = {
.groups = SELNLGRP_MAX,
@@ -117,5 +118,3 @@ static int __init selnl_init(void)
panic("SELinux: Cannot create netlink socket.");
return 0;
}
-
-__initcall(selnl_init);
diff --git a/security/selinux/netnode.c b/security/selinux/netnode.c
index 5d0ed08d46e5..9b3da5ce8d39 100644
--- a/security/selinux/netnode.c
+++ b/security/selinux/netnode.c
@@ -30,6 +30,7 @@
#include <net/ip.h>
#include <net/ipv6.h>
+#include "initcalls.h"
#include "netnode.h"
#include "objsec.h"
@@ -290,7 +291,7 @@ void sel_netnode_flush(void)
spin_unlock_bh(&sel_netnode_lock);
}
-static __init int sel_netnode_init(void)
+int __init sel_netnode_init(void)
{
int iter;
@@ -304,5 +305,3 @@ static __init int sel_netnode_init(void)
return 0;
}
-
-__initcall(sel_netnode_init);
diff --git a/security/selinux/netport.c b/security/selinux/netport.c
index 6fd7da4b3576..9e62f7285e81 100644
--- a/security/selinux/netport.c
+++ b/security/selinux/netport.c
@@ -29,6 +29,7 @@
#include <net/ip.h>
#include <net/ipv6.h>
+#include "initcalls.h"
#include "netport.h"
#include "objsec.h"
@@ -218,7 +219,7 @@ void sel_netport_flush(void)
spin_unlock_bh(&sel_netport_lock);
}
-static __init int sel_netport_init(void)
+int __init sel_netport_init(void)
{
int iter;
@@ -232,5 +233,3 @@ static __init int sel_netport_init(void)
return 0;
}
-
-__initcall(sel_netport_init);
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 9aa1d03ab612..657e6ff65be7 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -35,6 +35,7 @@
/* selinuxfs pseudo filesystem for exporting the security policy API.
Based on the proc code and the fs/nfsd/nfsctl.c code. */
+#include "initcalls.h"
#include "flask.h"
#include "avc.h"
#include "avc_ss.h"
@@ -2130,7 +2131,7 @@ static struct file_system_type sel_fs_type = {
struct path selinux_null __ro_after_init;
-static int __init init_sel_fs(void)
+int __init init_sel_fs(void)
{
struct qstr null_name = QSTR_INIT(NULL_FILE_NAME,
sizeof(NULL_FILE_NAME)-1);
@@ -2174,5 +2175,3 @@ static int __init init_sel_fs(void)
return err;
}
-
-__initcall(init_sel_fs);
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 713130bd43c4..13fc712d5923 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -3570,6 +3570,13 @@ struct selinux_audit_rule {
struct context au_ctxt;
};
+int selinux_audit_rule_avc_callback(u32 event)
+{
+ if (event == AVC_CALLBACK_RESET)
+ return audit_update_lsm_rules();
+ return 0;
+}
+
void selinux_audit_rule_free(void *vrule)
{
struct selinux_audit_rule *rule = vrule;
@@ -3820,25 +3827,6 @@ int selinux_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op, void *vru
return match;
}
-static int aurule_avc_callback(u32 event)
-{
- if (event == AVC_CALLBACK_RESET)
- return audit_update_lsm_rules();
- return 0;
-}
-
-static int __init aurule_init(void)
-{
- int err;
-
- err = avc_add_callback(aurule_avc_callback, AVC_CALLBACK_RESET);
- if (err)
- panic("avc_add_callback() failed, error %d\n", err);
-
- return err;
-}
-__initcall(aurule_init);
-
#ifdef CONFIG_NETLABEL
/**
* security_netlbl_cache_add - Add an entry to the NetLabel cache
--
2.51.0
^ permalink raw reply related
* [PATCH v4 31/34] ima,evm: move initcalls to the LSM framework
From: Paul Moore @ 2025-09-16 22:03 UTC (permalink / raw)
To: linux-security-module, linux-integrity, selinux
Cc: John Johansen, Mimi Zohar, Roberto Sassu, Fan Wu,
Mickaël Salaün, Günther Noack, Kees Cook,
Micah Morton, Casey Schaufler, Tetsuo Handa, Nicolas Bouchinet,
Xiu Jianfeng
In-Reply-To: <20250916220355.252592-36-paul@paul-moore.com>
From: Roberto Sassu <roberto.sassu@huawei.com>
This patch converts IMA and EVM to use the LSM frameworks's initcall
mechanism. It moved the integrity_fs_init() call to ima_fs_init() and
evm_init_secfs(), to work around the fact that there is no "integrity" LSM,
and introduced integrity_fs_fini() to remove the integrity directory, if
empty. Both integrity_fs_init() and integrity_fs_fini() support the
scenario of being called by both the IMA and EVM LSMs.
This patch does not touch any of the platform certificate code that
lives under the security/integrity/platform_certs directory as the
IMA/EVM developers would prefer to address that in a future patchset.
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
[PM: adjust description as discussed over email]
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
security/integrity/evm/evm_main.c | 3 +--
security/integrity/evm/evm_secfs.c | 11 +++++++++--
security/integrity/iint.c | 14 ++++++++++++--
security/integrity/ima/ima_fs.c | 11 +++++++++--
security/integrity/ima/ima_main.c | 4 ++--
security/integrity/integrity.h | 2 ++
6 files changed, 35 insertions(+), 10 deletions(-)
diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index db8e324ed4e6..73d500a375cb 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -1179,6 +1179,5 @@ DEFINE_LSM(evm) = {
.init = init_evm_lsm,
.order = LSM_ORDER_LAST,
.blobs = &evm_blob_sizes,
+ .initcall_late = init_evm,
};
-
-late_initcall(init_evm);
diff --git a/security/integrity/evm/evm_secfs.c b/security/integrity/evm/evm_secfs.c
index b0d2aad27850..c26724690cec 100644
--- a/security/integrity/evm/evm_secfs.c
+++ b/security/integrity/evm/evm_secfs.c
@@ -302,10 +302,16 @@ int __init evm_init_secfs(void)
int error = 0;
struct dentry *dentry;
- evm_dir = securityfs_create_dir("evm", integrity_dir);
- if (IS_ERR(evm_dir))
+ error = integrity_fs_init();
+ if (error < 0)
return -EFAULT;
+ evm_dir = securityfs_create_dir("evm", integrity_dir);
+ if (IS_ERR(evm_dir)) {
+ error = -EFAULT;
+ goto out;
+ }
+
dentry = securityfs_create_file("evm", 0660,
evm_dir, NULL, &evm_key_ops);
if (IS_ERR(dentry)) {
@@ -329,5 +335,6 @@ int __init evm_init_secfs(void)
out:
securityfs_remove(evm_symlink);
securityfs_remove(evm_dir);
+ integrity_fs_fini();
return error;
}
diff --git a/security/integrity/iint.c b/security/integrity/iint.c
index 068ac6c2ae1e..8ec1a3436a71 100644
--- a/security/integrity/iint.c
+++ b/security/integrity/iint.c
@@ -42,8 +42,11 @@ void __init integrity_load_keys(void)
evm_load_x509();
}
-static int __init integrity_fs_init(void)
+int __init integrity_fs_init(void)
{
+ if (integrity_dir)
+ return 0;
+
integrity_dir = securityfs_create_dir("integrity", NULL);
if (IS_ERR(integrity_dir)) {
int ret = PTR_ERR(integrity_dir);
@@ -58,4 +61,11 @@ static int __init integrity_fs_init(void)
return 0;
}
-late_initcall(integrity_fs_init)
+void __init integrity_fs_fini(void)
+{
+ if (!integrity_dir || !simple_empty(integrity_dir))
+ return;
+
+ securityfs_remove(integrity_dir);
+ integrity_dir = NULL;
+}
diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index 87045b09f120..012a58959ff0 100644
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c
@@ -499,9 +499,15 @@ int __init ima_fs_init(void)
struct dentry *dentry;
int ret;
+ ret = integrity_fs_init();
+ if (ret < 0)
+ return ret;
+
ima_dir = securityfs_create_dir("ima", integrity_dir);
- if (IS_ERR(ima_dir))
- return PTR_ERR(ima_dir);
+ if (IS_ERR(ima_dir)) {
+ ret = PTR_ERR(ima_dir);
+ goto out;
+ }
ima_symlink = securityfs_create_symlink("ima", NULL, "integrity/ima",
NULL);
@@ -555,6 +561,7 @@ int __init ima_fs_init(void)
out:
securityfs_remove(ima_symlink);
securityfs_remove(ima_dir);
+ integrity_fs_fini();
return ret;
}
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index eade8e1e3cb1..b703bfc2f470 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -1283,6 +1283,6 @@ DEFINE_LSM(ima) = {
.init = init_ima_lsm,
.order = LSM_ORDER_LAST,
.blobs = &ima_blob_sizes,
+ /* Start IMA after the TPM is available */
+ .initcall_late = init_ima,
};
-
-late_initcall(init_ima); /* Start IMA after the TPM is available */
diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index c2c2da691123..7b388b66cf80 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -114,6 +114,8 @@ struct ima_file_id {
int integrity_kernel_read(struct file *file, loff_t offset,
void *addr, unsigned long count);
+int __init integrity_fs_init(void);
+void __init integrity_fs_fini(void);
#define INTEGRITY_KEYRING_EVM 0
#define INTEGRITY_KEYRING_IMA 1
--
2.51.0
^ permalink raw reply related
* [PATCH v4 30/34] lockdown: move initcalls to the LSM framework
From: Paul Moore @ 2025-09-16 22:03 UTC (permalink / raw)
To: linux-security-module, linux-integrity, selinux
Cc: John Johansen, Mimi Zohar, Roberto Sassu, Fan Wu,
Mickaël Salaün, Günther Noack, Kees Cook,
Micah Morton, Casey Schaufler, Tetsuo Handa, Nicolas Bouchinet,
Xiu Jianfeng
In-Reply-To: <20250916220355.252592-36-paul@paul-moore.com>
Reviewed-by: Kees Cook <kees@kernel.org>
Acked-by: Xiu Jianfeng <xiujianfeng@huawei.com>
Reviewed-by: John Johansen <john.johhansen@canonical.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
security/lockdown/lockdown.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
index 4813f168ff93..8d46886d2cca 100644
--- a/security/lockdown/lockdown.c
+++ b/security/lockdown/lockdown.c
@@ -161,8 +161,6 @@ static int __init lockdown_secfs_init(void)
return PTR_ERR_OR_ZERO(dentry);
}
-core_initcall(lockdown_secfs_init);
-
#ifdef CONFIG_SECURITY_LOCKDOWN_LSM_EARLY
DEFINE_EARLY_LSM(lockdown) = {
#else
@@ -170,4 +168,5 @@ DEFINE_LSM(lockdown) = {
#endif
.id = &lockdown_lsmid,
.init = lockdown_lsm_init,
+ .initcall_core = lockdown_secfs_init,
};
--
2.51.0
^ permalink raw reply related
* [PATCH v4 29/34] apparmor: move initcalls to the LSM framework
From: Paul Moore @ 2025-09-16 22:03 UTC (permalink / raw)
To: linux-security-module, linux-integrity, selinux
Cc: John Johansen, Mimi Zohar, Roberto Sassu, Fan Wu,
Mickaël Salaün, Günther Noack, Kees Cook,
Micah Morton, Casey Schaufler, Tetsuo Handa, Nicolas Bouchinet,
Xiu Jianfeng
In-Reply-To: <20250916220355.252592-36-paul@paul-moore.com>
Reviewed-by: Kees Cook <kees@kernel.org>
Acked-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
security/apparmor/apparmorfs.c | 4 +---
security/apparmor/crypto.c | 3 +--
security/apparmor/include/apparmorfs.h | 2 ++
security/apparmor/include/crypto.h | 1 +
security/apparmor/lsm.c | 9 ++++++++-
5 files changed, 13 insertions(+), 6 deletions(-)
diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index 391a586d0557..ee04c1ac9d6e 100644
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -2649,7 +2649,7 @@ static const struct inode_operations policy_link_iops = {
*
* Returns: error on failure
*/
-static int __init aa_create_aafs(void)
+int __init aa_create_aafs(void)
{
struct dentry *dent;
int error;
@@ -2728,5 +2728,3 @@ static int __init aa_create_aafs(void)
AA_ERROR("Error creating AppArmor securityfs\n");
return error;
}
-
-fs_initcall(aa_create_aafs);
diff --git a/security/apparmor/crypto.c b/security/apparmor/crypto.c
index 227d47c14907..d8a7bde94d79 100644
--- a/security/apparmor/crypto.c
+++ b/security/apparmor/crypto.c
@@ -53,10 +53,9 @@ int aa_calc_profile_hash(struct aa_profile *profile, u32 version, void *start,
return 0;
}
-static int __init init_profile_hash(void)
+int __init init_profile_hash(void)
{
if (apparmor_initialized)
aa_info_message("AppArmor sha256 policy hashing enabled");
return 0;
}
-late_initcall(init_profile_hash);
diff --git a/security/apparmor/include/apparmorfs.h b/security/apparmor/include/apparmorfs.h
index 1e94904f68d9..dd580594dfb7 100644
--- a/security/apparmor/include/apparmorfs.h
+++ b/security/apparmor/include/apparmorfs.h
@@ -104,6 +104,8 @@ enum aafs_prof_type {
#define prof_dir(X) ((X)->dents[AAFS_PROF_DIR])
#define prof_child_dir(X) ((X)->dents[AAFS_PROF_PROFS])
+int aa_create_aafs(void);
+
void __aa_bump_ns_revision(struct aa_ns *ns);
void __aafs_profile_rmdir(struct aa_profile *profile);
void __aafs_profile_migrate_dents(struct aa_profile *old,
diff --git a/security/apparmor/include/crypto.h b/security/apparmor/include/crypto.h
index 636a04e20d91..f3ffd388cc58 100644
--- a/security/apparmor/include/crypto.h
+++ b/security/apparmor/include/crypto.h
@@ -13,6 +13,7 @@
#include "policy.h"
#ifdef CONFIG_SECURITY_APPARMOR_HASH
+int init_profile_hash(void);
unsigned int aa_hash_size(void);
char *aa_calc_hash(void *data, size_t len);
int aa_calc_profile_hash(struct aa_profile *profile, u32 version, void *start,
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 45b3a304d525..647c13e13e63 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -32,6 +32,7 @@
#include "include/audit.h"
#include "include/capability.h"
#include "include/cred.h"
+#include "include/crypto.h"
#include "include/file.h"
#include "include/ipc.h"
#include "include/net.h"
@@ -2426,7 +2427,6 @@ static int __init apparmor_nf_ip_init(void)
return 0;
}
-__initcall(apparmor_nf_ip_init);
#endif
static char nulldfa_src[] __aligned(8) = {
@@ -2557,4 +2557,11 @@ DEFINE_LSM(apparmor) = {
.enabled = &apparmor_enabled,
.blobs = &apparmor_blob_sizes,
.init = apparmor_init,
+ .initcall_fs = aa_create_aafs,
+#if defined(CONFIG_NETFILTER) && defined(CONFIG_NETWORK_SECMARK)
+ .initcall_device = apparmor_nf_ip_init,
+#endif
+#ifdef CONFIG_SECURITY_APPARMOR_HASH
+ .initcall_late = init_profile_hash,
+#endif
};
--
2.51.0
^ permalink raw reply related
* [PATCH v4 28/34] safesetid: move initcalls to the LSM framework
From: Paul Moore @ 2025-09-16 22:03 UTC (permalink / raw)
To: linux-security-module, linux-integrity, selinux
Cc: John Johansen, Mimi Zohar, Roberto Sassu, Fan Wu,
Mickaël Salaün, Günther Noack, Kees Cook,
Micah Morton, Casey Schaufler, Tetsuo Handa, Nicolas Bouchinet,
Xiu Jianfeng
In-Reply-To: <20250916220355.252592-36-paul@paul-moore.com>
Reviewed-by: Kees Cook <kees@kernel.org>
Acked-by: Micah Morton <mortonm@chromium.org>
Reviewed-by: John Johansen <john.johhansen@canonical.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
security/safesetid/lsm.c | 1 +
security/safesetid/lsm.h | 2 ++
security/safesetid/securityfs.c | 3 +--
3 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/security/safesetid/lsm.c b/security/safesetid/lsm.c
index 9a7c68d4e642..d5fb949050dd 100644
--- a/security/safesetid/lsm.c
+++ b/security/safesetid/lsm.c
@@ -289,4 +289,5 @@ static int __init safesetid_security_init(void)
DEFINE_LSM(safesetid_security_init) = {
.id = &safesetid_lsmid,
.init = safesetid_security_init,
+ .initcall_fs = safesetid_init_securityfs,
};
diff --git a/security/safesetid/lsm.h b/security/safesetid/lsm.h
index d346f4849cea..bf5172e2c3f7 100644
--- a/security/safesetid/lsm.h
+++ b/security/safesetid/lsm.h
@@ -70,4 +70,6 @@ enum sid_policy_type _setid_policy_lookup(struct setid_ruleset *policy,
extern struct setid_ruleset __rcu *safesetid_setuid_rules;
extern struct setid_ruleset __rcu *safesetid_setgid_rules;
+int safesetid_init_securityfs(void);
+
#endif /* _SAFESETID_H */
diff --git a/security/safesetid/securityfs.c b/security/safesetid/securityfs.c
index 8e1ffd70b18a..ece259f75b0d 100644
--- a/security/safesetid/securityfs.c
+++ b/security/safesetid/securityfs.c
@@ -308,7 +308,7 @@ static const struct file_operations safesetid_gid_file_fops = {
.write = safesetid_gid_file_write,
};
-static int __init safesetid_init_securityfs(void)
+int __init safesetid_init_securityfs(void)
{
int ret;
struct dentry *policy_dir;
@@ -345,4 +345,3 @@ static int __init safesetid_init_securityfs(void)
securityfs_remove(policy_dir);
return ret;
}
-fs_initcall(safesetid_init_securityfs);
--
2.51.0
^ permalink raw reply related
* [PATCH v4 27/34] tomoyo: move initcalls to the LSM framework
From: Paul Moore @ 2025-09-16 22:03 UTC (permalink / raw)
To: linux-security-module, linux-integrity, selinux
Cc: John Johansen, Mimi Zohar, Roberto Sassu, Fan Wu,
Mickaël Salaün, Günther Noack, Kees Cook,
Micah Morton, Casey Schaufler, Tetsuo Handa, Nicolas Bouchinet,
Xiu Jianfeng
In-Reply-To: <20250916220355.252592-36-paul@paul-moore.com>
Reviewed-by: Kees Cook <kees@kernel.org>
Reviewed-by: John Johansen <john.johhansen@canonical.com>
Acked-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
security/tomoyo/common.h | 2 ++
security/tomoyo/securityfs_if.c | 4 +---
security/tomoyo/tomoyo.c | 1 +
3 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/security/tomoyo/common.h b/security/tomoyo/common.h
index 0e8e2e959aef..3b2a97d10a5d 100644
--- a/security/tomoyo/common.h
+++ b/security/tomoyo/common.h
@@ -924,6 +924,8 @@ struct tomoyo_task {
/********** Function prototypes. **********/
+int tomoyo_interface_init(void);
+
bool tomoyo_address_matches_group(const bool is_ipv6, const __be32 *address,
const struct tomoyo_group *group);
bool tomoyo_compare_number_union(const unsigned long value,
diff --git a/security/tomoyo/securityfs_if.c b/security/tomoyo/securityfs_if.c
index 7e69747b2f77..33933645f5b9 100644
--- a/security/tomoyo/securityfs_if.c
+++ b/security/tomoyo/securityfs_if.c
@@ -233,7 +233,7 @@ static void __init tomoyo_create_entry(const char *name, const umode_t mode,
*
* Returns 0.
*/
-static int __init tomoyo_interface_init(void)
+int __init tomoyo_interface_init(void)
{
struct tomoyo_domain_info *domain;
struct dentry *tomoyo_dir;
@@ -269,5 +269,3 @@ static int __init tomoyo_interface_init(void)
tomoyo_load_builtin_policy();
return 0;
}
-
-fs_initcall(tomoyo_interface_init);
diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c
index ed0f7b052a85..a015cf0c4a00 100644
--- a/security/tomoyo/tomoyo.c
+++ b/security/tomoyo/tomoyo.c
@@ -617,4 +617,5 @@ DEFINE_LSM(tomoyo) = {
.flags = LSM_FLAG_LEGACY_MAJOR,
.blobs = &tomoyo_blob_sizes,
.init = tomoyo_init,
+ .initcall_fs = tomoyo_interface_init,
};
--
2.51.0
^ permalink raw reply related
* [PATCH v4 26/34] smack: move initcalls to the LSM framework
From: Paul Moore @ 2025-09-16 22:03 UTC (permalink / raw)
To: linux-security-module, linux-integrity, selinux
Cc: John Johansen, Mimi Zohar, Roberto Sassu, Fan Wu,
Mickaël Salaün, Günther Noack, Kees Cook,
Micah Morton, Casey Schaufler, Tetsuo Handa, Nicolas Bouchinet,
Xiu Jianfeng
In-Reply-To: <20250916220355.252592-36-paul@paul-moore.com>
As the LSM framework only supports one LSM initcall callback for each
initcall type, the init_smk_fs() and smack_nf_ip_init() functions were
wrapped with a new function, smack_initcall() that is registered with
the LSM framework.
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: John Johansen <john.johhansen@canonical.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
security/smack/smack.h | 14 ++++++++++++++
security/smack/smack_lsm.c | 9 +++++++++
security/smack/smack_netfilter.c | 4 +---
security/smack/smackfs.c | 4 +---
4 files changed, 25 insertions(+), 6 deletions(-)
diff --git a/security/smack/smack.h b/security/smack/smack.h
index bf6a6ed3946c..c56e1e876f7c 100644
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -275,6 +275,20 @@ struct smk_audit_info {
#endif
};
+/*
+ * Initialization
+ */
+#if defined(CONFIG_SECURITY_SMACK_NETFILTER)
+int smack_nf_ip_init(void);
+#else
+static inline int smack_nf_ip_init(void)
+{
+ return 0;
+}
+#endif
+int init_smk_fs(void);
+int smack_initcall(void);
+
/*
* These functions are in smack_access.c
*/
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index e09490c75f59..f14d536c516b 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -5270,6 +5270,14 @@ static __init int smack_init(void)
return 0;
}
+int __init smack_initcall(void)
+{
+ int rc_fs = init_smk_fs();
+ int rc_nf = smack_nf_ip_init();
+
+ return rc_fs ? rc_fs : rc_nf;
+}
+
/*
* Smack requires early initialization in order to label
* all processes and objects when they are created.
@@ -5279,4 +5287,5 @@ DEFINE_LSM(smack) = {
.flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
.blobs = &smack_blob_sizes,
.init = smack_init,
+ .initcall_device = smack_initcall,
};
diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfilter.c
index 8fd747b3653a..17ba578b1308 100644
--- a/security/smack/smack_netfilter.c
+++ b/security/smack/smack_netfilter.c
@@ -68,7 +68,7 @@ static struct pernet_operations smack_net_ops = {
.exit = smack_nf_unregister,
};
-static int __init smack_nf_ip_init(void)
+int __init smack_nf_ip_init(void)
{
if (smack_enabled == 0)
return 0;
@@ -76,5 +76,3 @@ static int __init smack_nf_ip_init(void)
printk(KERN_DEBUG "Smack: Registering netfilter hooks\n");
return register_pernet_subsys(&smack_net_ops);
}
-
-__initcall(smack_nf_ip_init);
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index b1e5e62f5cbd..405ace6db109 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -2978,7 +2978,7 @@ static struct vfsmount *smackfs_mount;
* Returns true if we were not chosen on boot or if
* we were chosen and filesystem registration succeeded.
*/
-static int __init init_smk_fs(void)
+int __init init_smk_fs(void)
{
int err;
int rc;
@@ -3021,5 +3021,3 @@ static int __init init_smk_fs(void)
return err;
}
-
-__initcall(init_smk_fs);
--
2.51.0
^ permalink raw reply related
* [PATCH v4 25/34] ipe: move initcalls to the LSM framework
From: Paul Moore @ 2025-09-16 22:03 UTC (permalink / raw)
To: linux-security-module, linux-integrity, selinux
Cc: John Johansen, Mimi Zohar, Roberto Sassu, Fan Wu,
Mickaël Salaün, Günther Noack, Kees Cook,
Micah Morton, Casey Schaufler, Tetsuo Handa, Nicolas Bouchinet,
Xiu Jianfeng
In-Reply-To: <20250916220355.252592-36-paul@paul-moore.com>
Reviewed-by: Kees Cook <kees@kernel.org>
Tested-by: Fan Wu <wufan@kernel.org>
Acked-by: Fan Wu <wufan@kernel.org>
Reviewed-by: John Johansen <john.johhansen@canonical.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
security/ipe/fs.c | 4 +---
security/ipe/ipe.c | 1 +
security/ipe/ipe.h | 2 ++
3 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/security/ipe/fs.c b/security/ipe/fs.c
index 0bb9468b8026..076c111c85c8 100644
--- a/security/ipe/fs.c
+++ b/security/ipe/fs.c
@@ -193,7 +193,7 @@ static const struct file_operations enforce_fops = {
* Return: %0 on success. If an error occurs, the function will return
* the -errno.
*/
-static int __init ipe_init_securityfs(void)
+int __init ipe_init_securityfs(void)
{
int rc = 0;
struct ipe_policy *ap;
@@ -244,5 +244,3 @@ static int __init ipe_init_securityfs(void)
securityfs_remove(root);
return rc;
}
-
-fs_initcall(ipe_init_securityfs);
diff --git a/security/ipe/ipe.c b/security/ipe/ipe.c
index 2426441181dc..71644748ed56 100644
--- a/security/ipe/ipe.c
+++ b/security/ipe/ipe.c
@@ -95,4 +95,5 @@ DEFINE_LSM(ipe) = {
.id = &ipe_lsmid,
.init = ipe_init,
.blobs = &ipe_blobs,
+ .initcall_fs = ipe_init_securityfs,
};
diff --git a/security/ipe/ipe.h b/security/ipe/ipe.h
index fb37513812dd..25cfdb8f0c20 100644
--- a/security/ipe/ipe.h
+++ b/security/ipe/ipe.h
@@ -23,4 +23,6 @@ struct ipe_bdev *ipe_bdev(struct block_device *b);
struct ipe_inode *ipe_inode(const struct inode *inode);
#endif /* CONFIG_IPE_PROP_FS_VERITY_BUILTIN_SIG */
+int ipe_init_securityfs(void);
+
#endif /* _IPE_H */
--
2.51.0
^ permalink raw reply related
* [PATCH v4 24/34] loadpin: move initcalls to the LSM framework
From: Paul Moore @ 2025-09-16 22:03 UTC (permalink / raw)
To: linux-security-module, linux-integrity, selinux
Cc: John Johansen, Mimi Zohar, Roberto Sassu, Fan Wu,
Mickaël Salaün, Günther Noack, Kees Cook,
Micah Morton, Casey Schaufler, Tetsuo Handa, Nicolas Bouchinet,
Xiu Jianfeng
In-Reply-To: <20250916220355.252592-36-paul@paul-moore.com>
Acked-by: Kees Cook <kees@kernel.org>
Reviewed-by: John Johansen <john.johhansen@canonical.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
security/loadpin/loadpin.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/security/loadpin/loadpin.c b/security/loadpin/loadpin.c
index b9ddf05c5c16..273ffbd6defe 100644
--- a/security/loadpin/loadpin.c
+++ b/security/loadpin/loadpin.c
@@ -270,11 +270,6 @@ static int __init loadpin_init(void)
return 0;
}
-DEFINE_LSM(loadpin) = {
- .id = &loadpin_lsmid,
- .init = loadpin_init,
-};
-
#ifdef CONFIG_SECURITY_LOADPIN_VERITY
enum loadpin_securityfs_interface_index {
@@ -434,10 +429,16 @@ static int __init init_loadpin_securityfs(void)
return 0;
}
-fs_initcall(init_loadpin_securityfs);
-
#endif /* CONFIG_SECURITY_LOADPIN_VERITY */
+DEFINE_LSM(loadpin) = {
+ .id = &loadpin_lsmid,
+ .init = loadpin_init,
+#ifdef CONFIG_SECURITY_LOADPIN_VERITY
+ .initcall_fs = init_loadpin_securityfs,
+#endif /* CONFIG_SECURITY_LOADPIN_VERITY */
+};
+
/* Should not be mutable after boot, so not listed in sysfs (perm == 0). */
module_param(enforce, int, 0);
MODULE_PARM_DESC(enforce, "Enforce module/firmware pinning");
--
2.51.0
^ permalink raw reply related
* [PATCH v4 23/34] lsm: introduce an initcall mechanism into the LSM framework
From: Paul Moore @ 2025-09-16 22:03 UTC (permalink / raw)
To: linux-security-module, linux-integrity, selinux
Cc: John Johansen, Mimi Zohar, Roberto Sassu, Fan Wu,
Mickaël Salaün, Günther Noack, Kees Cook,
Micah Morton, Casey Schaufler, Tetsuo Handa, Nicolas Bouchinet,
Xiu Jianfeng
In-Reply-To: <20250916220355.252592-36-paul@paul-moore.com>
Currently the individual LSMs register their own initcalls, and while
this should be harmless, it can be wasteful in the case where a LSM
is disabled at boot as the initcall will still be executed. This
patch introduces support for managing the initcalls in the LSM
framework, and future patches will convert the existing LSMs over to
this new mechanism.
Only initcall types which are used by the current in-tree LSMs are
supported, additional initcall types can easily be added in the future
if needed.
Reviewed-by: Kees Cook <kees@kernel.org>
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: John Johansen <john.johhansen@canonical.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
include/linux/lsm_hooks.h | 33 ++++++++++++---
security/lsm_init.c | 89 +++++++++++++++++++++++++++++++++++++++
2 files changed, 117 insertions(+), 5 deletions(-)
diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index 86e457aa8809..b92008641242 100644
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -151,13 +151,36 @@ enum lsm_order {
LSM_ORDER_LAST = 1, /* This is only for integrity. */
};
+/**
+ * struct lsm_info - Define an individual LSM for the LSM framework.
+ * @id: LSM name/ID info
+ * @order: ordering with respect to other LSMs, optional
+ * @flags: descriptive flags, optional
+ * @blobs: LSM blob sharing, optional
+ * @enabled: controlled by CONFIG_LSM, optional
+ * @init: LSM specific initialization routine
+ * @initcall_pure: LSM callback for initcall_pure() setup, optional
+ * @initcall_early: LSM callback for early_initcall setup, optional
+ * @initcall_core: LSM callback for core_initcall() setup, optional
+ * @initcall_subsys: LSM callback for subsys_initcall() setup, optional
+ * @initcall_fs: LSM callback for fs_initcall setup, optional
+ * @nitcall_device: LSM callback for device_initcall() setup, optional
+ * @initcall_late: LSM callback for late_initcall() setup, optional
+ */
struct lsm_info {
const struct lsm_id *id;
- enum lsm_order order; /* Optional: default is LSM_ORDER_MUTABLE */
- unsigned long flags; /* Optional: flags describing LSM */
- int *enabled; /* Optional: controlled by CONFIG_LSM */
- int (*init)(void); /* Required. */
- struct lsm_blob_sizes *blobs; /* Optional: for blob sharing. */
+ enum lsm_order order;
+ unsigned long flags;
+ struct lsm_blob_sizes *blobs;
+ int *enabled;
+ int (*init)(void);
+ int (*initcall_pure)(void);
+ int (*initcall_early)(void);
+ int (*initcall_core)(void);
+ int (*initcall_subsys)(void);
+ int (*initcall_fs)(void);
+ int (*initcall_device)(void);
+ int (*initcall_late)(void);
};
#define DEFINE_LSM(lsm) \
diff --git a/security/lsm_init.c b/security/lsm_init.c
index 363aac92a8da..697482a22a02 100644
--- a/security/lsm_init.c
+++ b/security/lsm_init.c
@@ -39,6 +39,27 @@ static __initdata struct lsm_info *lsm_exclusive;
for ((iter) = __start_early_lsm_info; \
(iter) < __end_early_lsm_info; (iter)++)
+#define lsm_initcall(level) \
+ ({ \
+ int _r, _rc = 0; \
+ struct lsm_info **_lp, *_l; \
+ lsm_order_for_each(_lp) { \
+ _l = *_lp; \
+ if (!_l->initcall_##level) \
+ continue; \
+ lsm_pr_dbg("running %s %s initcall", \
+ _l->id->name, #level); \
+ _r = _l->initcall_##level(); \
+ if (_r) { \
+ pr_warn("failed LSM %s %s initcall with errno %d\n", \
+ _l->id->name, #level, _r); \
+ if (!_rc) \
+ _rc = _r; \
+ } \
+ } \
+ _rc; \
+ })
+
/**
* lsm_choose_security - Legacy "major" LSM selection
* @str: kernel command line parameter
@@ -461,3 +482,71 @@ int __init security_init(void)
return 0;
}
+
+/**
+ * security_initcall_pure - Run the LSM pure initcalls
+ */
+static int __init security_initcall_pure(void)
+{
+ return lsm_initcall(pure);
+}
+pure_initcall(security_initcall_pure);
+
+/**
+ * security_initcall_early - Run the LSM early initcalls
+ */
+static int __init security_initcall_early(void)
+{
+ return lsm_initcall(early);
+}
+early_initcall(security_initcall_early);
+
+/**
+ * security_initcall_core - Run the LSM core initcalls
+ */
+static int __init security_initcall_core(void)
+{
+ return lsm_initcall(core);
+}
+core_initcall(security_initcall_core);
+
+/**
+ * security_initcall_subsys - Run the LSM subsys initcalls
+ */
+static int __init security_initcall_subsys(void)
+{
+ return lsm_initcall(subsys);
+}
+subsys_initcall(security_initcall_subsys);
+
+/**
+ * security_initcall_fs - Run the LSM fs initcalls
+ */
+static int __init security_initcall_fs(void)
+{
+ return lsm_initcall(fs);
+}
+fs_initcall(security_initcall_fs);
+
+/**
+ * security_initcall_device - Run the LSM device initcalls
+ */
+static int __init security_initcall_device(void)
+{
+ return lsm_initcall(device);
+}
+device_initcall(security_initcall_device);
+
+/**
+ * security_initcall_late - Run the LSM late initcalls
+ */
+static int __init security_initcall_late(void)
+{
+ int rc;
+
+ rc = lsm_initcall(late);
+ lsm_pr_dbg("all enabled LSMs fully activated\n");
+
+ return rc;
+}
+late_initcall(security_initcall_late);
--
2.51.0
^ permalink raw reply related
* [PATCH v4 22/34] lsm: group lsm_order_parse() with the other lsm_order_*() functions
From: Paul Moore @ 2025-09-16 22:03 UTC (permalink / raw)
To: linux-security-module, linux-integrity, selinux
Cc: John Johansen, Mimi Zohar, Roberto Sassu, Fan Wu,
Mickaël Salaün, Günther Noack, Kees Cook,
Micah Morton, Casey Schaufler, Tetsuo Handa, Nicolas Bouchinet,
Xiu Jianfeng
In-Reply-To: <20250916220355.252592-36-paul@paul-moore.com>
Move the lsm_order_parse() function near the other lsm_order_*()
functions to improve readability.
No code changes.
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: John Johansen <john.johhansen@canonical.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
security/lsm_init.c | 140 ++++++++++++++++++++++----------------------
1 file changed, 70 insertions(+), 70 deletions(-)
diff --git a/security/lsm_init.c b/security/lsm_init.c
index c6aea57a01e6..363aac92a8da 100644
--- a/security/lsm_init.c
+++ b/security/lsm_init.c
@@ -169,6 +169,76 @@ static void __init lsm_order_append(struct lsm_info *lsm, const char *src)
lsm_pr_dbg("enabling LSM %s:%s\n", src, lsm->id->name);
}
+/**
+ * lsm_order_parse - Parse the comma delimited LSM list
+ * @list: LSM list
+ * @src: source of the list
+ */
+static void __init lsm_order_parse(const char *list, const char *src)
+{
+ struct lsm_info *lsm;
+ char *sep, *name, *next;
+
+ /* Handle any Legacy LSM exclusions if one was specified. */
+ if (lsm_order_legacy) {
+ /*
+ * To match the original "security=" behavior, this explicitly
+ * does NOT fallback to another Legacy Major if the selected
+ * one was separately disabled: disable all non-matching
+ * Legacy Major LSMs.
+ */
+ lsm_for_each_raw(lsm) {
+ if ((lsm->flags & LSM_FLAG_LEGACY_MAJOR) &&
+ strcmp(lsm->id->name, lsm_order_legacy)) {
+ lsm_enabled_set(lsm, false);
+ lsm_pr_dbg("skip legacy LSM conflict %s:%s\n",
+ src, lsm->id->name);
+ }
+ }
+ }
+
+ /* LSM_ORDER_FIRST */
+ lsm_for_each_raw(lsm) {
+ if (lsm->order == LSM_ORDER_FIRST)
+ lsm_order_append(lsm, "first");
+ }
+
+ /* Normal or "mutable" LSMs */
+ sep = kstrdup(list, GFP_KERNEL);
+ next = sep;
+ /* Walk the list, looking for matching LSMs. */
+ while ((name = strsep(&next, ",")) != NULL) {
+ lsm_for_each_raw(lsm) {
+ if (!strcmp(lsm->id->name, name) &&
+ lsm->order == LSM_ORDER_MUTABLE)
+ lsm_order_append(lsm, src);
+ }
+ }
+ kfree(sep);
+
+ /* Legacy LSM if specified. */
+ if (lsm_order_legacy) {
+ lsm_for_each_raw(lsm) {
+ if (!strcmp(lsm->id->name, lsm_order_legacy))
+ lsm_order_append(lsm, src);
+ }
+ }
+
+ /* LSM_ORDER_LAST */
+ lsm_for_each_raw(lsm) {
+ if (lsm->order == LSM_ORDER_LAST)
+ lsm_order_append(lsm, "last");
+ }
+
+ /* Disable all LSMs not previously enabled. */
+ lsm_for_each_raw(lsm) {
+ if (lsm_order_exists(lsm))
+ continue;
+ lsm_enabled_set(lsm, false);
+ lsm_pr_dbg("skip disabled LSM %s:%s\n", src, lsm->id->name);
+ }
+}
+
/**
* lsm_blob_size_update - Update the LSM blob size and offset information
* @sz_req: the requested additional blob size
@@ -241,76 +311,6 @@ static void __init lsm_init_single(struct lsm_info *lsm)
WARN(ret, "%s failed to initialize: %d\n", lsm->id->name, ret);
}
-/**
- * lsm_order_parse - Parse the comma delimited LSM list
- * @list: LSM list
- * @src: source of the list
- */
-static void __init lsm_order_parse(const char *list, const char *src)
-{
- struct lsm_info *lsm;
- char *sep, *name, *next;
-
- /* Handle any Legacy LSM exclusions if one was specified. */
- if (lsm_order_legacy) {
- /*
- * To match the original "security=" behavior, this explicitly
- * does NOT fallback to another Legacy Major if the selected
- * one was separately disabled: disable all non-matching
- * Legacy Major LSMs.
- */
- lsm_for_each_raw(lsm) {
- if ((lsm->flags & LSM_FLAG_LEGACY_MAJOR) &&
- strcmp(lsm->id->name, lsm_order_legacy)) {
- lsm_enabled_set(lsm, false);
- lsm_pr_dbg("skip legacy LSM conflict %s:%s\n",
- src, lsm->id->name);
- }
- }
- }
-
- /* LSM_ORDER_FIRST */
- lsm_for_each_raw(lsm) {
- if (lsm->order == LSM_ORDER_FIRST)
- lsm_order_append(lsm, "first");
- }
-
- /* Normal or "mutable" LSMs */
- sep = kstrdup(list, GFP_KERNEL);
- next = sep;
- /* Walk the list, looking for matching LSMs. */
- while ((name = strsep(&next, ",")) != NULL) {
- lsm_for_each_raw(lsm) {
- if (!strcmp(lsm->id->name, name) &&
- lsm->order == LSM_ORDER_MUTABLE)
- lsm_order_append(lsm, src);
- }
- }
- kfree(sep);
-
- /* Legacy LSM if specified. */
- if (lsm_order_legacy) {
- lsm_for_each_raw(lsm) {
- if (!strcmp(lsm->id->name, lsm_order_legacy))
- lsm_order_append(lsm, src);
- }
- }
-
- /* LSM_ORDER_LAST */
- lsm_for_each_raw(lsm) {
- if (lsm->order == LSM_ORDER_LAST)
- lsm_order_append(lsm, "last");
- }
-
- /* Disable all LSMs not previously enabled. */
- lsm_for_each_raw(lsm) {
- if (lsm_order_exists(lsm))
- continue;
- lsm_enabled_set(lsm, false);
- lsm_pr_dbg("skip disabled LSM %s:%s\n", src, lsm->id->name);
- }
-}
-
/**
* lsm_static_call_init - Initialize a LSM's static calls
* @hl: LSM hook list
--
2.51.0
^ permalink raw reply related
* [PATCH v4 21/34] lsm: output available LSMs when debugging
From: Paul Moore @ 2025-09-16 22:03 UTC (permalink / raw)
To: linux-security-module, linux-integrity, selinux
Cc: John Johansen, Mimi Zohar, Roberto Sassu, Fan Wu,
Mickaël Salaün, Günther Noack, Kees Cook,
Micah Morton, Casey Schaufler, Tetsuo Handa, Nicolas Bouchinet,
Xiu Jianfeng
In-Reply-To: <20250916220355.252592-36-paul@paul-moore.com>
This will display all of the LSMs built into the kernel, regardless
of if they are enabled or not.
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: John Johansen <john.johhansen@canonical.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
security/lsm_init.c | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
diff --git a/security/lsm_init.c b/security/lsm_init.c
index 2f7ae26fca0f..c6aea57a01e6 100644
--- a/security/lsm_init.c
+++ b/security/lsm_init.c
@@ -363,6 +363,8 @@ int __init early_security_init(void)
{
struct lsm_info *lsm;
+ /* NOTE: lsm_pr_dbg() doesn't work here as lsm_debug is not yet set */
+
lsm_early_for_each_raw(lsm) {
lsm_enabled_set(lsm, true);
lsm_order_append(lsm, "early");
@@ -385,9 +387,24 @@ int __init security_init(void)
struct lsm_info **lsm;
if (lsm_debug) {
- lsm_pr("built-in LSM list: %s\n", lsm_order_builtin);
+ struct lsm_info *i;
+
+ cnt = 0;
+ lsm_pr("available LSMs: ");
+ lsm_early_for_each_raw(i)
+ lsm_pr_cont("%s%s(E)", (cnt++ ? "," : ""), i->id->name);
+ lsm_for_each_raw(i)
+ lsm_pr_cont("%s%s", (cnt++ ? "," : ""), i->id->name);
+ lsm_pr_cont("\n");
+
+ lsm_pr("built-in LSM config: %s\n", lsm_order_builtin);
+
lsm_pr("legacy LSM parameter: %s\n", lsm_order_legacy);
lsm_pr("boot LSM parameter: %s\n", lsm_order_cmdline);
+
+ /* see the note about lsm_pr_dbg() in early_security_init() */
+ lsm_early_for_each_raw(i)
+ lsm_pr("enabled LSM early:%s\n", i->id->name);
}
if (lsm_order_cmdline) {
--
2.51.0
^ permalink raw reply related
* [PATCH v4 20/34] lsm: cleanup the debug and console output in lsm_init.c
From: Paul Moore @ 2025-09-16 22:03 UTC (permalink / raw)
To: linux-security-module, linux-integrity, selinux
Cc: John Johansen, Mimi Zohar, Roberto Sassu, Fan Wu,
Mickaël Salaün, Günther Noack, Kees Cook,
Micah Morton, Casey Schaufler, Tetsuo Handa, Nicolas Bouchinet,
Xiu Jianfeng
In-Reply-To: <20250916220355.252592-36-paul@paul-moore.com>
Move away from an init specific init_debug() macro to a more general
lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available
both before and after init. In the process we do a number of minor
changes to improve the LSM initialization output and cleanup the code
somewhat.
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: John Johansen <john.johhansen@canonical.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
security/lsm.h | 11 ++++
security/lsm_init.c | 123 +++++++++++++++++++-------------------------
security/security.c | 2 +
3 files changed, 66 insertions(+), 70 deletions(-)
diff --git a/security/lsm.h b/security/lsm.h
index dbe755c45e57..8dc267977ae0 100644
--- a/security/lsm.h
+++ b/security/lsm.h
@@ -6,9 +6,20 @@
#ifndef _LSM_H_
#define _LSM_H_
+#include <linux/printk.h>
#include <linux/lsm_hooks.h>
#include <linux/lsm_count.h>
+/* LSM debugging */
+extern bool lsm_debug;
+#define lsm_pr(...) pr_info(__VA_ARGS__)
+#define lsm_pr_cont(...) pr_cont(__VA_ARGS__)
+#define lsm_pr_dbg(...) \
+ do { \
+ if (lsm_debug) \
+ pr_info(__VA_ARGS__); \
+ } while (0)
+
/* List of configured LSMs */
extern unsigned int lsm_active_cnt;
extern const struct lsm_id *lsm_idlist[];
diff --git a/security/lsm_init.c b/security/lsm_init.c
index 37593805ba9e..2f7ae26fca0f 100644
--- a/security/lsm_init.c
+++ b/security/lsm_init.c
@@ -30,13 +30,6 @@ static __initdata const char *lsm_order_legacy;
static __initdata struct lsm_info *lsm_order[MAX_LSM_COUNT + 1];
static __initdata struct lsm_info *lsm_exclusive;
-static __initdata bool debug;
-#define init_debug(...) \
- do { \
- if (debug) \
- pr_info(__VA_ARGS__); \
- } while (0)
-
#define lsm_order_for_each(iter) \
for ((iter) = lsm_order; *(iter); (iter)++)
#define lsm_for_each_raw(iter) \
@@ -77,7 +70,7 @@ __setup("lsm=", lsm_choose_lsm);
*/
static int __init lsm_debug_enable(char *str)
{
- debug = true;
+ lsm_debug = true;
return 1;
}
__setup("lsm.debug", lsm_debug_enable);
@@ -143,22 +136,28 @@ static void __init lsm_order_append(struct lsm_info *lsm, const char *src)
return;
/* Skip explicitly disabled LSMs. */
- if (lsm->enabled && !lsm_is_enabled(lsm))
- goto out;
+ if (lsm->enabled && !lsm_is_enabled(lsm)) {
+ lsm_pr_dbg("skip previously disabled LSM %s:%s\n",
+ src, lsm->id->name);
+ return;
+ }
- if (WARN(lsm_active_cnt == MAX_LSM_COUNT,
- "%s: out of LSM static calls!?\n", src)) {
+ if (lsm_active_cnt == MAX_LSM_COUNT) {
+ pr_warn("exceeded maximum LSM count on %s:%s\n",
+ src, lsm->id->name);
lsm_enabled_set(lsm, false);
- goto out;
+ return;
}
if (lsm->flags & LSM_FLAG_EXCLUSIVE) {
if (lsm_exclusive) {
- init_debug("exclusive disabled: %s\n", lsm->id->name);
+ lsm_pr_dbg("skip exclusive LSM conflict %s:%s\n",
+ src, lsm->id->name);
lsm_enabled_set(lsm, false);
- goto out;
+ return;
} else {
- init_debug("exclusive chosen: %s\n", lsm->id->name);
+ lsm_pr_dbg("select exclusive LSM %s:%s\n",
+ src, lsm->id->name);
lsm_exclusive = lsm;
}
}
@@ -167,9 +166,7 @@ static void __init lsm_order_append(struct lsm_info *lsm, const char *src)
lsm_order[lsm_active_cnt] = lsm;
lsm_idlist[lsm_active_cnt++] = lsm->id;
-out:
- init_debug("%s ordered: %s (%s)\n", src, lsm->id->name,
- lsm_is_enabled(lsm) ? "enabled" : "disabled");
+ lsm_pr_dbg("enabling LSM %s:%s\n", src, lsm->id->name);
}
/**
@@ -239,7 +236,7 @@ static void __init lsm_init_single(struct lsm_info *lsm)
if (!lsm_is_enabled(lsm))
return;
- init_debug("initializing %s\n", lsm->id->name);
+ lsm_pr_dbg("initializing %s\n", lsm->id->name);
ret = lsm->init();
WARN(ret, "%s failed to initialize: %d\n", lsm->id->name, ret);
}
@@ -266,8 +263,8 @@ static void __init lsm_order_parse(const char *list, const char *src)
if ((lsm->flags & LSM_FLAG_LEGACY_MAJOR) &&
strcmp(lsm->id->name, lsm_order_legacy)) {
lsm_enabled_set(lsm, false);
- init_debug("security=%s disabled: %s (only one legacy major LSM)\n",
- lsm_order_legacy, lsm->id->name);
+ lsm_pr_dbg("skip legacy LSM conflict %s:%s\n",
+ src, lsm->id->name);
}
}
}
@@ -310,8 +307,7 @@ static void __init lsm_order_parse(const char *list, const char *src)
if (lsm_order_exists(lsm))
continue;
lsm_enabled_set(lsm, false);
- init_debug("%s skipped: %s (not in requested order)\n",
- src, lsm->id->name);
+ lsm_pr_dbg("skip disabled LSM %s:%s\n", src, lsm->id->name);
}
}
@@ -319,7 +315,7 @@ static void __init lsm_order_parse(const char *list, const char *src)
* lsm_static_call_init - Initialize a LSM's static calls
* @hl: LSM hook list
*/
-static void __init lsm_static_call_init(struct security_hook_list *hl)
+static int __init lsm_static_call_init(struct security_hook_list *hl)
{
struct lsm_static_call *scall = hl->scalls;
int i;
@@ -331,11 +327,12 @@ static void __init lsm_static_call_init(struct security_hook_list *hl)
hl->hook.lsm_func_addr);
scall->hl = hl;
static_branch_enable(scall->active);
- return;
+ return 0;
}
scall++;
}
- panic("%s - Ran out of static slots.\n", __func__);
+
+ return -ENOSPC;
}
/**
@@ -353,7 +350,9 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count,
for (i = 0; i < count; i++) {
hooks[i].lsmid = lsmid;
- lsm_static_call_init(&hooks[i]);
+ if (lsm_static_call_init(&hooks[i]))
+ panic("exhausted LSM callback slots with LSM %s\n",
+ lsmid->name);
}
}
@@ -384,19 +383,16 @@ int __init security_init(void)
{
unsigned int cnt;
struct lsm_info **lsm;
- struct lsm_info *early;
- unsigned int first = 0;
- init_debug("legacy security=%s\n", lsm_order_legacy ? : " *unspecified*");
- init_debug(" CONFIG_LSM=%s\n", lsm_order_builtin);
- init_debug("boot arg lsm=%s\n", lsm_order_cmdline ? : " *unspecified*");
+ if (lsm_debug) {
+ lsm_pr("built-in LSM list: %s\n", lsm_order_builtin);
+ lsm_pr("legacy LSM parameter: %s\n", lsm_order_legacy);
+ lsm_pr("boot LSM parameter: %s\n", lsm_order_cmdline);
+ }
if (lsm_order_cmdline) {
- if (lsm_order_legacy) {
- pr_warn("security=%s is ignored because it is superseded by lsm=%s\n",
- lsm_order_legacy, lsm_order_cmdline);
+ if (lsm_order_legacy)
lsm_order_legacy = NULL;
- }
lsm_order_parse(lsm_order_cmdline, "cmdline");
} else
lsm_order_parse(lsm_order_builtin, "builtin");
@@ -404,38 +400,25 @@ int __init security_init(void)
lsm_order_for_each(lsm)
lsm_prepare(*lsm);
- pr_info("initializing lsm=");
- lsm_early_for_each_raw(early) {
- if (lsm_is_enabled(early))
- pr_cont("%s%s",
- first++ == 0 ? "" : ",", early->id->name);
+ if (lsm_debug) {
+ lsm_pr("blob(cred) size %d\n", blob_sizes.lbs_cred);
+ lsm_pr("blob(file) size %d\n", blob_sizes.lbs_file);
+ lsm_pr("blob(ib) size %d\n", blob_sizes.lbs_ib);
+ lsm_pr("blob(inode) size %d\n", blob_sizes.lbs_inode);
+ lsm_pr("blob(ipc) size %d\n", blob_sizes.lbs_ipc);
+ lsm_pr("blob(key) size %d\n", blob_sizes.lbs_key);
+ lsm_pr("blob(msg_msg)_size %d\n", blob_sizes.lbs_msg_msg);
+ lsm_pr("blob(sock) size %d\n", blob_sizes.lbs_sock);
+ lsm_pr("blob(superblock) size %d\n", blob_sizes.lbs_superblock);
+ lsm_pr("blob(perf_event) size %d\n", blob_sizes.lbs_perf_event);
+ lsm_pr("blob(task) size %d\n", blob_sizes.lbs_task);
+ lsm_pr("blob(tun_dev) size %d\n", blob_sizes.lbs_tun_dev);
+ lsm_pr("blob(xattr) count %d\n", blob_sizes.lbs_xattr_count);
+ lsm_pr("blob(bdev) size %d\n", blob_sizes.lbs_bdev);
+ lsm_pr("blob(bpf_map) size %d\n", blob_sizes.lbs_bpf_map);
+ lsm_pr("blob(bpf_prog) size %d\n", blob_sizes.lbs_bpf_prog);
+ lsm_pr("blob(bpf_token) size %d\n", blob_sizes.lbs_bpf_token);
}
- lsm_order_for_each(lsm) {
- if (lsm_is_enabled(*lsm))
- pr_cont("%s%s",
- first++ == 0 ? "" : ",", (*lsm)->id->name);
- }
- pr_cont("\n");
-
- init_debug("cred blob size = %d\n", blob_sizes.lbs_cred);
- init_debug("file blob size = %d\n", blob_sizes.lbs_file);
- init_debug("ib blob size = %d\n", blob_sizes.lbs_ib);
- init_debug("inode blob size = %d\n", blob_sizes.lbs_inode);
- init_debug("ipc blob size = %d\n", blob_sizes.lbs_ipc);
-#ifdef CONFIG_KEYS
- init_debug("key blob size = %d\n", blob_sizes.lbs_key);
-#endif /* CONFIG_KEYS */
- init_debug("msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg);
- init_debug("sock blob size = %d\n", blob_sizes.lbs_sock);
- init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock);
- init_debug("perf event blob size = %d\n", blob_sizes.lbs_perf_event);
- init_debug("task blob size = %d\n", blob_sizes.lbs_task);
- init_debug("tun device blob size = %d\n", blob_sizes.lbs_tun_dev);
- init_debug("xattr slots = %d\n", blob_sizes.lbs_xattr_count);
- init_debug("bdev blob size = %d\n", blob_sizes.lbs_bdev);
- init_debug("bpf map blob size = %d\n", blob_sizes.lbs_bpf_map);
- init_debug("bpf prog blob size = %d\n", blob_sizes.lbs_bpf_prog);
- init_debug("bpf token blob size = %d\n", blob_sizes.lbs_bpf_token);
if (blob_sizes.lbs_file)
lsm_file_cache = kmem_cache_create("lsm_file_cache",
@@ -447,9 +430,9 @@ int __init security_init(void)
SLAB_PANIC, NULL);
if (lsm_cred_alloc((struct cred *)current->cred, GFP_KERNEL))
- panic("%s: early cred alloc failed.\n", __func__);
+ panic("early LSM cred alloc failed\n");
if (lsm_task_alloc(current))
- panic("%s: early task alloc failed.\n", __func__);
+ panic("early LSM task alloc failed\n");
cnt = 0;
lsm_order_for_each(lsm) {
diff --git a/security/security.c b/security/security.c
index add46073af0c..c9642020755e 100644
--- a/security/security.c
+++ b/security/security.c
@@ -73,6 +73,8 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX + 1] = {
[LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality",
};
+bool lsm_debug __ro_after_init;
+
unsigned int lsm_active_cnt __ro_after_init;
const struct lsm_id *lsm_idlist[MAX_LSM_COUNT];
--
2.51.0
^ permalink raw reply related
* [PATCH v4 19/34] lsm: add/tweak function header comment blocks in lsm_init.c
From: Paul Moore @ 2025-09-16 22:03 UTC (permalink / raw)
To: linux-security-module, linux-integrity, selinux
Cc: John Johansen, Mimi Zohar, Roberto Sassu, Fan Wu,
Mickaël Salaün, Günther Noack, Kees Cook,
Micah Morton, Casey Schaufler, Tetsuo Handa, Nicolas Bouchinet,
Xiu Jianfeng
In-Reply-To: <20250916220355.252592-36-paul@paul-moore.com>
Add function header comments for lsm_static_call_init() and
early_security_init(), tweak the existing comment block for
security_add_hooks().
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: John Johansen <john.johhansen@canonical.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
security/lsm_init.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/security/lsm_init.c b/security/lsm_init.c
index f87f5441617b..37593805ba9e 100644
--- a/security/lsm_init.c
+++ b/security/lsm_init.c
@@ -315,6 +315,10 @@ static void __init lsm_order_parse(const char *list, const char *src)
}
}
+/**
+ * lsm_static_call_init - Initialize a LSM's static calls
+ * @hl: LSM hook list
+ */
static void __init lsm_static_call_init(struct security_hook_list *hl)
{
struct lsm_static_call *scall = hl->scalls;
@@ -335,12 +339,12 @@ static void __init lsm_static_call_init(struct security_hook_list *hl)
}
/**
- * security_add_hooks - Add a modules hooks to the hook lists.
- * @hooks: the hooks to add
- * @count: the number of hooks to add
- * @lsmid: the identification information for the security module
+ * security_add_hooks - Add a LSM's hooks to the LSM framework's hook lists
+ * @hooks: LSM hooks to add
+ * @count: number of hooks to add
+ * @lsmid: identification information for the LSM
*
- * Each LSM has to register its hooks with the infrastructure.
+ * Each LSM has to register its hooks with the LSM framework.
*/
void __init security_add_hooks(struct security_hook_list *hooks, int count,
const struct lsm_id *lsmid)
@@ -353,6 +357,9 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count,
}
}
+/**
+ * early_security_init - Initialize the early LSMs
+ */
int __init early_security_init(void)
{
struct lsm_info *lsm;
--
2.51.0
^ permalink raw reply related
* [PATCH v4 18/34] lsm: fold lsm_init_ordered() into security_init()
From: Paul Moore @ 2025-09-16 22:03 UTC (permalink / raw)
To: linux-security-module, linux-integrity, selinux
Cc: John Johansen, Mimi Zohar, Roberto Sassu, Fan Wu,
Mickaël Salaün, Günther Noack, Kees Cook,
Micah Morton, Casey Schaufler, Tetsuo Handa, Nicolas Bouchinet,
Xiu Jianfeng
In-Reply-To: <20250916220355.252592-36-paul@paul-moore.com>
With only security_init() calling lsm_init_ordered, it makes little
sense to keep lsm_init_ordered() as a standalone function. Fold
lsm_init_ordered() into security_init().
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: John Johansen <john.johhansen@canonical.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
security/lsm_init.c | 159 ++++++++++++++++++++------------------------
1 file changed, 73 insertions(+), 86 deletions(-)
diff --git a/security/lsm_init.c b/security/lsm_init.c
index 1f64222925c1..f87f5441617b 100644
--- a/security/lsm_init.c
+++ b/security/lsm_init.c
@@ -18,6 +18,9 @@ static __initdata int lsm_enabled_false = 0;
extern struct lsm_info __start_lsm_info[], __end_lsm_info[];
extern struct lsm_info __start_early_lsm_info[], __end_early_lsm_info[];
+/* Number of "early" LSMs */
+static __initdata unsigned int lsm_count_early;
+
/* Build and boot-time LSM ordering. */
static __initconst const char *const lsm_order_builtin = CONFIG_LSM;
static __initdata const char *lsm_order_cmdline;
@@ -169,7 +172,6 @@ static void __init lsm_order_append(struct lsm_info *lsm, const char *src)
lsm_is_enabled(lsm) ? "enabled" : "disabled");
}
-
/**
* lsm_blob_size_update - Update the LSM blob size and offset information
* @sz_req: the requested additional blob size
@@ -313,14 +315,74 @@ static void __init lsm_order_parse(const char *list, const char *src)
}
}
-/**
- * lsm_init_ordered - Initialize the ordered LSMs
- */
-static void __init lsm_init_ordered(void)
+static void __init lsm_static_call_init(struct security_hook_list *hl)
{
- unsigned int first = 0;
+ struct lsm_static_call *scall = hl->scalls;
+ int i;
+
+ for (i = 0; i < MAX_LSM_COUNT; i++) {
+ /* Update the first static call that is not used yet */
+ if (!scall->hl) {
+ __static_call_update(scall->key, scall->trampoline,
+ hl->hook.lsm_func_addr);
+ scall->hl = hl;
+ static_branch_enable(scall->active);
+ return;
+ }
+ scall++;
+ }
+ panic("%s - Ran out of static slots.\n", __func__);
+}
+
+/**
+ * security_add_hooks - Add a modules hooks to the hook lists.
+ * @hooks: the hooks to add
+ * @count: the number of hooks to add
+ * @lsmid: the identification information for the security module
+ *
+ * Each LSM has to register its hooks with the infrastructure.
+ */
+void __init security_add_hooks(struct security_hook_list *hooks, int count,
+ const struct lsm_id *lsmid)
+{
+ int i;
+
+ for (i = 0; i < count; i++) {
+ hooks[i].lsmid = lsmid;
+ lsm_static_call_init(&hooks[i]);
+ }
+}
+
+int __init early_security_init(void)
+{
+ struct lsm_info *lsm;
+
+ lsm_early_for_each_raw(lsm) {
+ lsm_enabled_set(lsm, true);
+ lsm_order_append(lsm, "early");
+ lsm_prepare(lsm);
+ lsm_init_single(lsm);
+ lsm_count_early++;
+ }
+
+ return 0;
+}
+
+/**
+ * security_init - Initializes the LSM framework
+ *
+ * This should be called early in the kernel initialization sequence.
+ */
+int __init security_init(void)
+{
+ unsigned int cnt;
struct lsm_info **lsm;
struct lsm_info *early;
+ unsigned int first = 0;
+
+ init_debug("legacy security=%s\n", lsm_order_legacy ? : " *unspecified*");
+ init_debug(" CONFIG_LSM=%s\n", lsm_order_builtin);
+ init_debug("boot arg lsm=%s\n", lsm_order_cmdline ? : " *unspecified*");
if (lsm_order_cmdline) {
if (lsm_order_legacy) {
@@ -332,9 +394,8 @@ static void __init lsm_init_ordered(void)
} else
lsm_order_parse(lsm_order_builtin, "builtin");
- lsm_order_for_each(lsm) {
+ lsm_order_for_each(lsm)
lsm_prepare(*lsm);
- }
pr_info("initializing lsm=");
lsm_early_for_each_raw(early) {
@@ -383,87 +444,13 @@ static void __init lsm_init_ordered(void)
if (lsm_task_alloc(current))
panic("%s: early task alloc failed.\n", __func__);
+ cnt = 0;
lsm_order_for_each(lsm) {
+ /* skip the "early" LSMs as they have already been setup */
+ if (cnt++ < lsm_count_early)
+ continue;
lsm_init_single(*lsm);
}
-}
-
-static void __init lsm_static_call_init(struct security_hook_list *hl)
-{
- struct lsm_static_call *scall = hl->scalls;
- int i;
-
- for (i = 0; i < MAX_LSM_COUNT; i++) {
- /* Update the first static call that is not used yet */
- if (!scall->hl) {
- __static_call_update(scall->key, scall->trampoline,
- hl->hook.lsm_func_addr);
- scall->hl = hl;
- static_branch_enable(scall->active);
- return;
- }
- scall++;
- }
- panic("%s - Ran out of static slots.\n", __func__);
-}
-
-/**
- * security_add_hooks - Add a modules hooks to the hook lists.
- * @hooks: the hooks to add
- * @count: the number of hooks to add
- * @lsmid: the identification information for the security module
- *
- * Each LSM has to register its hooks with the infrastructure.
- */
-void __init security_add_hooks(struct security_hook_list *hooks, int count,
- const struct lsm_id *lsmid)
-{
- int i;
-
- for (i = 0; i < count; i++) {
- hooks[i].lsmid = lsmid;
- lsm_static_call_init(&hooks[i]);
- }
-}
-
-int __init early_security_init(void)
-{
- struct lsm_info *lsm;
-
- lsm_early_for_each_raw(lsm) {
- lsm_enabled_set(lsm, true);
- lsm_order_append(lsm, "early");
- lsm_prepare(lsm);
- lsm_init_single(lsm);
- }
-
- return 0;
-}
-
-/**
- * security_init - initializes the security framework
- *
- * This should be called early in the kernel initialization sequence.
- */
-int __init security_init(void)
-{
- struct lsm_info *lsm;
-
- init_debug("legacy security=%s\n", lsm_order_legacy ? : " *unspecified*");
- init_debug(" CONFIG_LSM=%s\n", lsm_order_builtin);
- init_debug("boot arg lsm=%s\n", lsm_order_cmdline ? : " *unspecified*");
-
- /*
- * Append the names of the early LSM modules now that kmalloc() is
- * available
- */
- lsm_early_for_each_raw(lsm) {
- init_debug(" early started: %s (%s)\n", lsm->id->name,
- lsm_is_enabled(lsm) ? "enabled" : "disabled");
- }
-
- /* Load LSMs in specified order. */
- lsm_init_ordered();
return 0;
}
--
2.51.0
^ permalink raw reply related
* [PATCH v4 17/34] lsm: cleanup initialize_lsm() and rename to lsm_init_single()
From: Paul Moore @ 2025-09-16 22:03 UTC (permalink / raw)
To: linux-security-module, linux-integrity, selinux
Cc: John Johansen, Mimi Zohar, Roberto Sassu, Fan Wu,
Mickaël Salaün, Günther Noack, Kees Cook,
Micah Morton, Casey Schaufler, Tetsuo Handa, Nicolas Bouchinet,
Xiu Jianfeng
In-Reply-To: <20250916220355.252592-36-paul@paul-moore.com>
Rename initialize_lsm() to be more consistent with the rest of the LSM
initialization changes and rework the function itself to better fit
with the "exit on fail" coding pattern.
Reviewed-by: Kees Cook <kees@kernel.org>
Reviewed-by: John Johansen <john.johansen@canonical.com>
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
security/lsm_init.c | 25 +++++++++++++++----------
1 file changed, 15 insertions(+), 10 deletions(-)
diff --git a/security/lsm_init.c b/security/lsm_init.c
index 5249aa044d9d..1f64222925c1 100644
--- a/security/lsm_init.c
+++ b/security/lsm_init.c
@@ -169,6 +169,7 @@ static void __init lsm_order_append(struct lsm_info *lsm, const char *src)
lsm_is_enabled(lsm) ? "enabled" : "disabled");
}
+
/**
* lsm_blob_size_update - Update the LSM blob size and offset information
* @sz_req: the requested additional blob size
@@ -225,16 +226,20 @@ static void __init lsm_prepare(struct lsm_info *lsm)
lsm_blob_size_update(&blobs->lbs_bpf_token, &blob_sizes.lbs_bpf_token);
}
-/* Initialize a given LSM, if it is enabled. */
-static void __init initialize_lsm(struct lsm_info *lsm)
+/**
+ * lsm_init_single - Initialize a given LSM
+ * @lsm: LSM definition
+ */
+static void __init lsm_init_single(struct lsm_info *lsm)
{
- if (lsm_is_enabled(lsm)) {
- int ret;
+ int ret;
- init_debug("initializing %s\n", lsm->id->name);
- ret = lsm->init();
- WARN(ret, "%s failed to initialize: %d\n", lsm->id->name, ret);
- }
+ if (!lsm_is_enabled(lsm))
+ return;
+
+ init_debug("initializing %s\n", lsm->id->name);
+ ret = lsm->init();
+ WARN(ret, "%s failed to initialize: %d\n", lsm->id->name, ret);
}
/**
@@ -379,7 +384,7 @@ static void __init lsm_init_ordered(void)
panic("%s: early task alloc failed.\n", __func__);
lsm_order_for_each(lsm) {
- initialize_lsm(*lsm);
+ lsm_init_single(*lsm);
}
}
@@ -429,7 +434,7 @@ int __init early_security_init(void)
lsm_enabled_set(lsm, true);
lsm_order_append(lsm, "early");
lsm_prepare(lsm);
- initialize_lsm(lsm);
+ lsm_init_single(lsm);
}
return 0;
--
2.51.0
^ permalink raw reply related
* [PATCH v4 16/34] lsm: cleanup the LSM blob size code
From: Paul Moore @ 2025-09-16 22:03 UTC (permalink / raw)
To: linux-security-module, linux-integrity, selinux
Cc: John Johansen, Mimi Zohar, Roberto Sassu, Fan Wu,
Mickaël Salaün, Günther Noack, Kees Cook,
Micah Morton, Casey Schaufler, Tetsuo Handa, Nicolas Bouchinet,
Xiu Jianfeng
In-Reply-To: <20250916220355.252592-36-paul@paul-moore.com>
Convert the lsm_blob_size fields to unsigned integers as there is no
current need for them to be negative, change "lsm_set_blob_size()" to
"lsm_blob_size_update()" to better reflect reality, and perform some
other minor cleanups to the associated code.
Reviewed-by: Kees Cook <kees@kernel.org>
Reviewed-by: John Johansen <john.johansen@canonical.com>
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
include/linux/lsm_hooks.h | 34 +++++++++++------------
security/lsm_init.c | 57 ++++++++++++++++++++++-----------------
2 files changed, 50 insertions(+), 41 deletions(-)
diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index 65a8227bece7..86e457aa8809 100644
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -102,23 +102,23 @@ struct security_hook_list {
* Security blob size or offset data.
*/
struct lsm_blob_sizes {
- int lbs_cred;
- int lbs_file;
- int lbs_ib;
- int lbs_inode;
- int lbs_sock;
- int lbs_superblock;
- int lbs_ipc;
- int lbs_key;
- int lbs_msg_msg;
- int lbs_perf_event;
- int lbs_task;
- int lbs_xattr_count; /* number of xattr slots in new_xattrs array */
- int lbs_tun_dev;
- int lbs_bdev;
- int lbs_bpf_map;
- int lbs_bpf_prog;
- int lbs_bpf_token;
+ unsigned int lbs_cred;
+ unsigned int lbs_file;
+ unsigned int lbs_ib;
+ unsigned int lbs_inode;
+ unsigned int lbs_sock;
+ unsigned int lbs_superblock;
+ unsigned int lbs_ipc;
+ unsigned int lbs_key;
+ unsigned int lbs_msg_msg;
+ unsigned int lbs_perf_event;
+ unsigned int lbs_task;
+ unsigned int lbs_xattr_count; /* num xattr slots in new_xattrs array */
+ unsigned int lbs_tun_dev;
+ unsigned int lbs_bdev;
+ unsigned int lbs_bpf_map;
+ unsigned int lbs_bpf_prog;
+ unsigned int lbs_bpf_token;
};
/*
diff --git a/security/lsm_init.c b/security/lsm_init.c
index 7b2491120fc8..5249aa044d9d 100644
--- a/security/lsm_init.c
+++ b/security/lsm_init.c
@@ -169,16 +169,22 @@ static void __init lsm_order_append(struct lsm_info *lsm, const char *src)
lsm_is_enabled(lsm) ? "enabled" : "disabled");
}
-static void __init lsm_set_blob_size(int *need, int *lbs)
+/**
+ * lsm_blob_size_update - Update the LSM blob size and offset information
+ * @sz_req: the requested additional blob size
+ * @sz_cur: the existing blob size
+ */
+static void __init lsm_blob_size_update(unsigned int *sz_req,
+ unsigned int *sz_cur)
{
- int offset;
+ unsigned int offset;
- if (*need <= 0)
+ if (*sz_req == 0)
return;
- offset = ALIGN(*lbs, sizeof(void *));
- *lbs = offset + *need;
- *need = offset;
+ offset = ALIGN(*sz_cur, sizeof(void *));
+ *sz_cur = offset + *sz_req;
+ *sz_req = offset;
}
/**
@@ -193,27 +199,30 @@ static void __init lsm_prepare(struct lsm_info *lsm)
return;
/* Register the LSM blob sizes. */
- lsm_set_blob_size(&blobs->lbs_cred, &blob_sizes.lbs_cred);
- lsm_set_blob_size(&blobs->lbs_file, &blob_sizes.lbs_file);
- lsm_set_blob_size(&blobs->lbs_ib, &blob_sizes.lbs_ib);
+ blobs = lsm->blobs;
+ lsm_blob_size_update(&blobs->lbs_cred, &blob_sizes.lbs_cred);
+ lsm_blob_size_update(&blobs->lbs_file, &blob_sizes.lbs_file);
+ lsm_blob_size_update(&blobs->lbs_ib, &blob_sizes.lbs_ib);
/* inode blob gets an rcu_head in addition to LSM blobs. */
if (blobs->lbs_inode && blob_sizes.lbs_inode == 0)
blob_sizes.lbs_inode = sizeof(struct rcu_head);
- lsm_set_blob_size(&blobs->lbs_inode, &blob_sizes.lbs_inode);
- lsm_set_blob_size(&blobs->lbs_ipc, &blob_sizes.lbs_ipc);
- lsm_set_blob_size(&blobs->lbs_key, &blob_sizes.lbs_key);
- lsm_set_blob_size(&blobs->lbs_msg_msg, &blob_sizes.lbs_msg_msg);
- lsm_set_blob_size(&blobs->lbs_perf_event, &blob_sizes.lbs_perf_event);
- lsm_set_blob_size(&blobs->lbs_sock, &blob_sizes.lbs_sock);
- lsm_set_blob_size(&blobs->lbs_superblock, &blob_sizes.lbs_superblock);
- lsm_set_blob_size(&blobs->lbs_task, &blob_sizes.lbs_task);
- lsm_set_blob_size(&blobs->lbs_tun_dev, &blob_sizes.lbs_tun_dev);
- lsm_set_blob_size(&blobs->lbs_xattr_count,
- &blob_sizes.lbs_xattr_count);
- lsm_set_blob_size(&blobs->lbs_bdev, &blob_sizes.lbs_bdev);
- lsm_set_blob_size(&blobs->lbs_bpf_map, &blob_sizes.lbs_bpf_map);
- lsm_set_blob_size(&blobs->lbs_bpf_prog, &blob_sizes.lbs_bpf_prog);
- lsm_set_blob_size(&blobs->lbs_bpf_token, &blob_sizes.lbs_bpf_token);
+ lsm_blob_size_update(&blobs->lbs_inode, &blob_sizes.lbs_inode);
+ lsm_blob_size_update(&blobs->lbs_ipc, &blob_sizes.lbs_ipc);
+ lsm_blob_size_update(&blobs->lbs_key, &blob_sizes.lbs_key);
+ lsm_blob_size_update(&blobs->lbs_msg_msg, &blob_sizes.lbs_msg_msg);
+ lsm_blob_size_update(&blobs->lbs_perf_event,
+ &blob_sizes.lbs_perf_event);
+ lsm_blob_size_update(&blobs->lbs_sock, &blob_sizes.lbs_sock);
+ lsm_blob_size_update(&blobs->lbs_superblock,
+ &blob_sizes.lbs_superblock);
+ lsm_blob_size_update(&blobs->lbs_task, &blob_sizes.lbs_task);
+ lsm_blob_size_update(&blobs->lbs_tun_dev, &blob_sizes.lbs_tun_dev);
+ lsm_blob_size_update(&blobs->lbs_xattr_count,
+ &blob_sizes.lbs_xattr_count);
+ lsm_blob_size_update(&blobs->lbs_bdev, &blob_sizes.lbs_bdev);
+ lsm_blob_size_update(&blobs->lbs_bpf_map, &blob_sizes.lbs_bpf_map);
+ lsm_blob_size_update(&blobs->lbs_bpf_prog, &blob_sizes.lbs_bpf_prog);
+ lsm_blob_size_update(&blobs->lbs_bpf_token, &blob_sizes.lbs_bpf_token);
}
/* Initialize a given LSM, if it is enabled. */
--
2.51.0
^ permalink raw reply related
* [PATCH v4 15/34] lsm: rename/rework ordered_lsm_parse() to lsm_order_parse()
From: Paul Moore @ 2025-09-16 22:03 UTC (permalink / raw)
To: linux-security-module, linux-integrity, selinux
Cc: John Johansen, Mimi Zohar, Roberto Sassu, Fan Wu,
Mickaël Salaün, Günther Noack, Kees Cook,
Micah Morton, Casey Schaufler, Tetsuo Handa, Nicolas Bouchinet,
Xiu Jianfeng
In-Reply-To: <20250916220355.252592-36-paul@paul-moore.com>
Rename ordered_lsm_parse() to lsm_order_parse() for the sake of
consistency with the other LSM initialization routines, and also
do some minor rework of the function. Aside from some minor style
decisions, the majority of the rework involved shuffling the order
of the LSM_FLAG_LEGACY and LSM_ORDER_FIRST code so that the
LSM_FLAG_LEGACY checks are handled first; it is important to note
that this doesn't affect the order in which the LSMs are registered.
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: John Johansen <john.johhansen@canonical.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
security/lsm_init.c | 82 ++++++++++++++++++++-------------------------
1 file changed, 37 insertions(+), 45 deletions(-)
diff --git a/security/lsm_init.c b/security/lsm_init.c
index a314484d7c2f..7b2491120fc8 100644
--- a/security/lsm_init.c
+++ b/security/lsm_init.c
@@ -228,83 +228,75 @@ static void __init initialize_lsm(struct lsm_info *lsm)
}
}
-/* Populate ordered LSMs list from comma-separated LSM name list. */
-static void __init ordered_lsm_parse(const char *order, const char *origin)
+/**
+ * lsm_order_parse - Parse the comma delimited LSM list
+ * @list: LSM list
+ * @src: source of the list
+ */
+static void __init lsm_order_parse(const char *list, const char *src)
{
struct lsm_info *lsm;
char *sep, *name, *next;
- /* LSM_ORDER_FIRST is always first. */
- lsm_for_each_raw(lsm) {
- if (lsm->order == LSM_ORDER_FIRST)
- lsm_order_append(lsm, " first");
- }
-
- /* Process "security=", if given. */
+ /* Handle any Legacy LSM exclusions if one was specified. */
if (lsm_order_legacy) {
- struct lsm_info *major;
-
/*
- * To match the original "security=" behavior, this
- * explicitly does NOT fallback to another Legacy Major
- * if the selected one was separately disabled: disable
- * all non-matching Legacy Major LSMs.
+ * To match the original "security=" behavior, this explicitly
+ * does NOT fallback to another Legacy Major if the selected
+ * one was separately disabled: disable all non-matching
+ * Legacy Major LSMs.
*/
- lsm_for_each_raw(major) {
- if ((major->flags & LSM_FLAG_LEGACY_MAJOR) &&
- strcmp(major->id->name, lsm_order_legacy) != 0) {
- lsm_enabled_set(major, false);
+ lsm_for_each_raw(lsm) {
+ if ((lsm->flags & LSM_FLAG_LEGACY_MAJOR) &&
+ strcmp(lsm->id->name, lsm_order_legacy)) {
+ lsm_enabled_set(lsm, false);
init_debug("security=%s disabled: %s (only one legacy major LSM)\n",
- lsm_order_legacy, major->id->name);
+ lsm_order_legacy, lsm->id->name);
}
}
}
- sep = kstrdup(order, GFP_KERNEL);
+ /* LSM_ORDER_FIRST */
+ lsm_for_each_raw(lsm) {
+ if (lsm->order == LSM_ORDER_FIRST)
+ lsm_order_append(lsm, "first");
+ }
+
+ /* Normal or "mutable" LSMs */
+ sep = kstrdup(list, GFP_KERNEL);
next = sep;
/* Walk the list, looking for matching LSMs. */
while ((name = strsep(&next, ",")) != NULL) {
- bool found = false;
-
lsm_for_each_raw(lsm) {
- if (strcmp(lsm->id->name, name) == 0) {
- if (lsm->order == LSM_ORDER_MUTABLE)
- lsm_order_append(lsm, origin);
- found = true;
- }
+ if (!strcmp(lsm->id->name, name) &&
+ lsm->order == LSM_ORDER_MUTABLE)
+ lsm_order_append(lsm, src);
}
-
- if (!found)
- init_debug("%s ignored: %s (not built into kernel)\n",
- origin, name);
}
+ kfree(sep);
- /* Process "security=", if given. */
+ /* Legacy LSM if specified. */
if (lsm_order_legacy) {
lsm_for_each_raw(lsm) {
- if (lsm_order_exists(lsm))
- continue;
- if (strcmp(lsm->id->name, lsm_order_legacy) == 0)
- lsm_order_append(lsm, "security=");
+ if (!strcmp(lsm->id->name, lsm_order_legacy))
+ lsm_order_append(lsm, src);
}
}
- /* LSM_ORDER_LAST is always last. */
+ /* LSM_ORDER_LAST */
lsm_for_each_raw(lsm) {
if (lsm->order == LSM_ORDER_LAST)
- lsm_order_append(lsm, " last");
+ lsm_order_append(lsm, "last");
}
- /* Disable all LSMs not in the ordered list. */
+ /* Disable all LSMs not previously enabled. */
lsm_for_each_raw(lsm) {
if (lsm_order_exists(lsm))
continue;
lsm_enabled_set(lsm, false);
init_debug("%s skipped: %s (not in requested order)\n",
- origin, lsm->id->name);
+ src, lsm->id->name);
}
-
- kfree(sep);
}
/**
@@ -322,9 +314,9 @@ static void __init lsm_init_ordered(void)
lsm_order_legacy, lsm_order_cmdline);
lsm_order_legacy = NULL;
}
- ordered_lsm_parse(lsm_order_cmdline, "cmdline");
+ lsm_order_parse(lsm_order_cmdline, "cmdline");
} else
- ordered_lsm_parse(lsm_order_builtin, "builtin");
+ lsm_order_parse(lsm_order_builtin, "builtin");
lsm_order_for_each(lsm) {
lsm_prepare(*lsm);
--
2.51.0
^ permalink raw reply related
* [PATCH v4 14/34] lsm: rename/rework append_ordered_lsm() into lsm_order_append()
From: Paul Moore @ 2025-09-16 22:03 UTC (permalink / raw)
To: linux-security-module, linux-integrity, selinux
Cc: John Johansen, Mimi Zohar, Roberto Sassu, Fan Wu,
Mickaël Salaün, Günther Noack, Kees Cook,
Micah Morton, Casey Schaufler, Tetsuo Handa, Nicolas Bouchinet,
Xiu Jianfeng
In-Reply-To: <20250916220355.252592-36-paul@paul-moore.com>
Rename append_ordered_lsm() to lsm_order_append() to better match
convention and do some rework. The rework includes moving the
LSM_FLAG_EXCLUSIVE logic from lsm_prepare() to lsm_order_append()
in order to consolidate the individual LSM append/activation code,
and adding logic to skip appending explicitly disabled LSMs to the
active LSM list.
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: John Johansen <john.johhansen@canonical.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
security/lsm_init.c | 76 +++++++++++++++++++++++++--------------------
1 file changed, 43 insertions(+), 33 deletions(-)
diff --git a/security/lsm_init.c b/security/lsm_init.c
index ec46ddb18e1e..a314484d7c2f 100644
--- a/security/lsm_init.c
+++ b/security/lsm_init.c
@@ -124,24 +124,48 @@ static bool __init lsm_order_exists(struct lsm_info *lsm)
return false;
}
-/* Append an LSM to the list of ordered LSMs to initialize. */
-static int last_lsm __initdata;
-static void __init append_ordered_lsm(struct lsm_info *lsm, const char *from)
+/**
+ * lsm_order_append - Append a LSM to the ordered list
+ * @lsm: LSM definition
+ * @src: source of the addition
+ *
+ * Append @lsm to the enabled LSM array after ensuring that it hasn't been
+ * explicitly disabled, is a duplicate entry, or would run afoul of the
+ * LSM_FLAG_EXCLUSIVE logic.
+ */
+static void __init lsm_order_append(struct lsm_info *lsm, const char *src)
{
/* Ignore duplicate selections. */
if (lsm_order_exists(lsm))
return;
- if (WARN(last_lsm == MAX_LSM_COUNT, "%s: out of LSM static calls!?\n", from))
- return;
+ /* Skip explicitly disabled LSMs. */
+ if (lsm->enabled && !lsm_is_enabled(lsm))
+ goto out;
- /* Enable this LSM, if it is not already set. */
- if (!lsm->enabled)
- lsm->enabled = &lsm_enabled_true;
- lsm_order[last_lsm] = lsm;
- lsm_idlist[last_lsm++] = lsm->id;
+ if (WARN(lsm_active_cnt == MAX_LSM_COUNT,
+ "%s: out of LSM static calls!?\n", src)) {
+ lsm_enabled_set(lsm, false);
+ goto out;
+ }
- init_debug("%s ordered: %s (%s)\n", from, lsm->id->name,
+ if (lsm->flags & LSM_FLAG_EXCLUSIVE) {
+ if (lsm_exclusive) {
+ init_debug("exclusive disabled: %s\n", lsm->id->name);
+ lsm_enabled_set(lsm, false);
+ goto out;
+ } else {
+ init_debug("exclusive chosen: %s\n", lsm->id->name);
+ lsm_exclusive = lsm;
+ }
+ }
+
+ lsm_enabled_set(lsm, true);
+ lsm_order[lsm_active_cnt] = lsm;
+ lsm_idlist[lsm_active_cnt++] = lsm->id;
+
+out:
+ init_debug("%s ordered: %s (%s)\n", src, lsm->id->name,
lsm_is_enabled(lsm) ? "enabled" : "disabled");
}
@@ -163,26 +187,12 @@ static void __init lsm_set_blob_size(int *need, int *lbs)
*/
static void __init lsm_prepare(struct lsm_info *lsm)
{
- struct lsm_blob_sizes *blobs;
+ struct lsm_blob_sizes *blobs = lsm->blobs;
- if (!lsm_is_enabled(lsm)) {
- lsm_enabled_set(lsm, false);
+ if (!blobs)
return;
- } else if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && lsm_exclusive) {
- init_debug("exclusive disabled: %s\n", lsm->id->name);
- lsm_enabled_set(lsm, false);
- return;
- }
-
- /* Mark the LSM as enabled. */
- lsm_enabled_set(lsm, true);
- if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && !lsm_exclusive) {
- init_debug("exclusive chosen: %s\n", lsm->id->name);
- lsm_exclusive = lsm;
- }
/* Register the LSM blob sizes. */
- blobs = lsm->blobs;
lsm_set_blob_size(&blobs->lbs_cred, &blob_sizes.lbs_cred);
lsm_set_blob_size(&blobs->lbs_file, &blob_sizes.lbs_file);
lsm_set_blob_size(&blobs->lbs_ib, &blob_sizes.lbs_ib);
@@ -227,7 +237,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
/* LSM_ORDER_FIRST is always first. */
lsm_for_each_raw(lsm) {
if (lsm->order == LSM_ORDER_FIRST)
- append_ordered_lsm(lsm, " first");
+ lsm_order_append(lsm, " first");
}
/* Process "security=", if given. */
@@ -259,7 +269,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
lsm_for_each_raw(lsm) {
if (strcmp(lsm->id->name, name) == 0) {
if (lsm->order == LSM_ORDER_MUTABLE)
- append_ordered_lsm(lsm, origin);
+ lsm_order_append(lsm, origin);
found = true;
}
}
@@ -275,14 +285,14 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
if (lsm_order_exists(lsm))
continue;
if (strcmp(lsm->id->name, lsm_order_legacy) == 0)
- append_ordered_lsm(lsm, "security=");
+ lsm_order_append(lsm, "security=");
}
}
/* LSM_ORDER_LAST is always last. */
lsm_for_each_raw(lsm) {
if (lsm->order == LSM_ORDER_LAST)
- append_ordered_lsm(lsm, " last");
+ lsm_order_append(lsm, " last");
}
/* Disable all LSMs not in the ordered list. */
@@ -415,8 +425,8 @@ int __init early_security_init(void)
struct lsm_info *lsm;
lsm_early_for_each_raw(lsm) {
- if (!lsm->enabled)
- lsm->enabled = &lsm_enabled_true;
+ lsm_enabled_set(lsm, true);
+ lsm_order_append(lsm, "early");
lsm_prepare(lsm);
initialize_lsm(lsm);
}
--
2.51.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox