* Re: [PATCH v5 2/3] bpf: add bpf_init_inode_xattr kfunc for atomic inode labeling
From: Paul Moore @ 2026-07-20 22:47 UTC (permalink / raw)
To: Kumar Kartikeya Dwivedi
Cc: David Windsor, Alexei Starovoitov, Daniel Borkmann,
Andrii Nakryiko, Martin KaFai Lau, Eduard Zingerman, Song Liu,
Yonghong Song, John Fastabend, KP Singh, Jiri Olsa,
Emil Tsalapatis, Matt Bobrowski, James Morris, Serge E . Hallyn,
Casey Schaufler, Stephen Smalley, Ondrej Mosnacek, Mimi Zohar,
Roberto Sassu, Dmitry Kasatkin, Eric Snowberg, Alexander Viro,
Christian Brauner, Jan Kara, Shuah Khan, bpf,
linux-security-module, linux-fsdevel, linux-integrity, selinux,
linux-kselftest, linux-kernel
In-Reply-To: <DK3PRLXZFGKN.GES64J05HY6B@gmail.com>
On Mon, Jul 20, 2026 at 5:24 PM Kumar Kartikeya Dwivedi
<memxor@gmail.com> wrote:
> On Mon Jul 20, 2026 at 10:15 PM CEST, Paul Moore wrote:
> > On Mon, Jul 20, 2026 at 2:27 PM Kumar Kartikeya Dwivedi
> > <memxor@gmail.com> wrote:
> >> On Mon Jul 20, 2026 at 8:12 PM CEST, David Windsor wrote:
> >> > On Thu, Jul 16, 2026 at 5:55 PM Paul Moore <paul@paul-moore.com> wrote:
> >> >>
> >> >>
> >> >> I'm sorry David, now that I'm seeing this function again, especially
> >> >> with the LSM specific bits extracted into a LSM function, this absolutely
> >> >> belongs somewhere under security/. It's only callable from within a
> >> >> BPF LSM callback and all it does outside of some BPF pointer boilerplate
> >> >> is call right back into a LSM helper function.
> >> >>
> >> >> If the BPF maintainers aren't willing to accept that, then we will all
> >> >> need to find another way.
> >> >
> >> > Where this code lands doesn't matter to me, so I'll stay out of the
> >> > decision of where it lives.
> >
> > Yes, you're caught up in some territorial wrangling that goes a fair
> > bit beyond what you're looking to accomplish. My apologies for my
> > half of that, it is an unfortunate part of upstream kernel
> > development.
> >
> >> > If this kfunc goes to security/, would we also want to move eg
> >> > bpf_set_dentry_xattr similarly?
> >> >
> >> > I'll roll v6 of this series meanwhile and we'll see what the BPF
> >> > maintainers say.
> >
> > Thanks. Fortunately, it should be easy enough to move the kfunc
> > around, that's likely one of the smaller changes needed in v6.
> >
> >> I don't think there was any preference expressed from the BPF side.
> >
> > Look at the second patch in the v4 patchset, you'll see a preference.
> >
> >> Logically,
> >> one cannot be faulted for adding a kfunc to set the xattr for inode in the same
> >> file where similar kfuncs to set xattr on other FS objects / entities exist.
> >
> > First off, I can't say that the existing BPF kfuncs intended for use
> > within a BPF LSM program are in a good location. Unlike every other
> > LSM which locates its code under security, the BPF LSM devs have
> > chosen to locate their associated code all over the place. Some of
> > that happened before I was responsible for the LSM framework, and some
> > of that which has happened afterwards has likely intentionally avoided
> > traditional LSM review. Unfortunately, this has muddied things with
> > respect to what is possible generally in BPF versus what is possible
> > only when the BPF LSM is enabled; we just recently saw where this was
> > arguably the root cause of an exploitable vulnerability.
> >
> >> The question about bpf_set_dentry_xattr is thus valid.
> >
> > It's a very valid question. It is my opinion that kfuncs which are
> > only intended to be called from within BPF LSMs should be located
> > under security/, just like every other LSM. If there is a kfunc that
> > is generally useful from other contexts, that is a different story,
> > but in the bpf_set_dentry_xattr() case, it is explicitly only useful
> > for setting 'security.bpf.*' xattrs.
>
> I don't think we should do that in v6 though.
Yes, that would be a separate effort and it's one of the reasons I
didn't bring it up in my review comments, I was simply responding to
those who raised it as a question.
--
paul-moore.com
^ permalink raw reply
* Re: [PATCH] apparmor: leverage audit_log_n_untrustedstring() when possible
From: John Johansen @ 2026-07-21 1:41 UTC (permalink / raw)
To: Paul Moore, linux-security-module
In-Reply-To: <20260717215254.383183-2-paul@paul-moore.com>
On 7/17/26 14:52, Paul Moore wrote:
> Make use of the audit_log_n_untrustedstring() function to simplify the
> code in aa_label_xaudit().
>
> Signed-off-by: Paul Moore <paul@paul-moore.com>
Acked-by: John Johansen <john.johansen@canonical.com>
unless you object I will pull this into the apparmor tree
> ---
> security/apparmor/label.c | 5 +----
> 1 file changed, 1 insertion(+), 4 deletions(-)
>
> diff --git a/security/apparmor/label.c b/security/apparmor/label.c
> index 3fd384d8c41a..a165cadf8249 100644
> --- a/security/apparmor/label.c
> +++ b/security/apparmor/label.c
> @@ -1743,10 +1743,7 @@ void aa_label_xaudit(struct audit_buffer *ab, struct aa_ns *ns,
> str = (char *) label->hname;
> len = strlen(str);
> }
> - if (audit_string_contains_control(str, len))
> - audit_log_n_hex(ab, str, len);
> - else
> - audit_log_n_string(ab, str, len);
> + audit_log_n_untrustedstring(ab, str, len);
>
> kfree(name);
> }
^ permalink raw reply
* Re: [PATCH] apparmor: leverage audit_log_n_untrustedstring() when possible
From: Paul Moore @ 2026-07-21 1:53 UTC (permalink / raw)
To: John Johansen, linux-security-module
In-Reply-To: <326a6ffc-8cb1-4842-8bf0-74dd58bfdf08@canonical.com>
On July 20, 2026 9:41:05 PM John Johansen <john.johansen@canonical.com> wrote:
> On 7/17/26 14:52, Paul Moore wrote:
>> Make use of the audit_log_n_untrustedstring() function to simplify the
>> code in aa_label_xaudit().
>>
>> Signed-off-by: Paul Moore <paul@paul-moore.com>
>
> Acked-by: John Johansen <john.johansen@canonical.com>
>
> unless you object I will pull this into the apparmor tree
Please do, that code is up to you and Georgia, not me.
Thanks.
>
>>
--
paul-moore.com
^ permalink raw reply
* [PATCH v2 0/2] Add Apple T2 NHI device links
From: Atharva Tiwari @ 2026-07-21 5:45 UTC (permalink / raw)
Cc: Atharva Tiwari, Bjorn Helgaas, Thomas Gleixner, Ingo Molnar,
Borislav Petkov, Dave Hansen, x86, H. Peter Anvin, Andreas Noever,
Mika Westerberg, Yehezkel Bernat, Hans de Goede,
Ilpo Järvinen, Jarkko Sakkinen, Mimi Zohar, Roberto Sassu,
Dmitry Kasatkin, Eric Snowberg, Paul Moore, James Morris,
Serge E. Hallyn, linux-pci, linux-kernel, linux-usb,
platform-driver-x86, linux-integrity, keyrings,
linux-security-module
This series adds a cached flag to detect Apple T2 systems, then uses it
to create device links for the Thunderbolt NHI.
Changes in v2:
- Used a less generic name for has_t2_chip
- Used DMI instead of PCI for has_apple_t2_chip to avoid PCI problems
- Initialized ret in tb_apple_add_links
Link to v1:
https://lore.kernel.org/all/20260719180308.1398-1-atharvatiwarilinuxdev@gmail.com/
Atharva Tiwari (2):
treewide: Add a flag to detect the Apple T2 chip
thunderbolt: Add device links for Apple T2 NHI
arch/x86/kernel/quirks.c | 105 ++++++++++++++++++
drivers/thunderbolt/tb.c | 51 ++++++++-
include/linux/platform_data/x86/apple.h | 5 +
security/integrity/platform_certs/load_uefi.c | 38 ++-----
4 files changed, 168 insertions(+), 31 deletions(-)
--
2.43.0
^ permalink raw reply
* [PATCH v2 1/2] treewide: Add a flag to detect the Apple T2 chip
From: Atharva Tiwari @ 2026-07-21 5:45 UTC (permalink / raw)
Cc: Atharva Tiwari, Bjorn Helgaas, Thomas Gleixner, Ingo Molnar,
Borislav Petkov, Dave Hansen, x86, H. Peter Anvin, Andreas Noever,
Mika Westerberg, Yehezkel Bernat, Hans de Goede,
Ilpo Järvinen, Jarkko Sakkinen, Mimi Zohar, Roberto Sassu,
Dmitry Kasatkin, Eric Snowberg, Paul Moore, James Morris,
Serge E. Hallyn, linux-pci, linux-kernel, linux-usb,
platform-driver-x86, linux-integrity, keyrings,
linux-security-module
In-Reply-To: <20260721054506.11871-1-atharvatiwarilinuxdev@gmail.com>
Add a flag to detect Apple T2 chips on Intel Macs.
Cache the result to avoid repeated checks. That will
be used in upcoming patches.
Signed-off-by: Atharva Tiwari <atharvatiwarilinuxdev@gmail.com>
---
arch/x86/kernel/quirks.c | 105 ++++++++++++++++++
include/linux/platform_data/x86/apple.h | 5 +
security/integrity/platform_certs/load_uefi.c | 38 ++-----
3 files changed, 118 insertions(+), 30 deletions(-)
diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c
index a92f18db9610..74b29738d404 100644
--- a/arch/x86/kernel/quirks.c
+++ b/arch/x86/kernel/quirks.c
@@ -664,8 +664,113 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2083, quirk_intel_purley_xeon_ras
bool x86_apple_machine;
EXPORT_SYMBOL(x86_apple_machine);
+bool has_apple_t2_chip;
+EXPORT_SYMBOL(has_apple_t2_chip);
+
+static const struct dmi_system_id apple_t2_devices[] = {
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,2"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,3"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,4"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,2"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,3"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,4"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,2"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir9,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Macmini8,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacPro7,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "iMac20,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "iMac20,2"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "iMacPro1,1"),
+ },
+ },
+ { }
+};
+
void __init early_platform_quirks(void)
{
x86_apple_machine = dmi_match(DMI_SYS_VENDOR, "Apple Inc.") ||
dmi_match(DMI_SYS_VENDOR, "Apple Computer, Inc.");
+
+ has_apple_t2_chip = dmi_check_system(apple_t2_devices);
}
diff --git a/include/linux/platform_data/x86/apple.h b/include/linux/platform_data/x86/apple.h
index 079e816c3c21..50bbcc5134fc 100644
--- a/include/linux/platform_data/x86/apple.h
+++ b/include/linux/platform_data/x86/apple.h
@@ -6,8 +6,13 @@
* x86_apple_machine - whether the machine is an x86 Apple Macintosh
*/
extern bool x86_apple_machine;
+/**
+ * has_apple_t2_chip - whether the machine has the Apple T2 chip
+ */
+extern bool has_apple_t2_chip;
#else
#define x86_apple_machine false
+#define has_t2_chip false
#endif
#endif
diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
index c0d6948446c3..b4096d4c828d 100644
--- a/security/integrity/platform_certs/load_uefi.c
+++ b/security/integrity/platform_certs/load_uefi.c
@@ -3,42 +3,16 @@
#include <linux/kernel.h>
#include <linux/sched.h>
#include <linux/cred.h>
-#include <linux/dmi.h>
#include <linux/err.h>
#include <linux/efi.h>
#include <linux/slab.h>
#include <linux/ima.h>
+#include <linux/platform_data/x86/apple.h>
#include <keys/asymmetric-type.h>
#include <keys/system_keyring.h>
#include "../integrity.h"
#include "keyring_handler.h"
-/*
- * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot
- * certificates causes occurrence of a page fault in Apple's firmware and
- * a crash disabling EFI runtime services. The following quirk skips reading
- * these variables.
- */
-static const struct dmi_system_id uefi_skip_cert[] = {
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,1") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,2") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,3") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,4") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,1") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,2") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,3") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,4") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,1") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,2") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir9,1") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "Macmini8,1") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacPro7,1") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,1") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,2") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMacPro1,1") },
- { }
-};
-
/*
* Look to see if a UEFI variable called MokIgnoreDB exists and return true if
* it does.
@@ -165,10 +139,14 @@ static int __init load_uefi_certs(void)
unsigned long dbsize = 0, dbxsize = 0, mokxsize = 0;
efi_status_t status;
int rc = 0;
- const struct dmi_system_id *dmi_id;
- dmi_id = dmi_first_match(uefi_skip_cert);
- if (dmi_id) {
+ /*
+ * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot
+ * certificates causes occurrence of a page fault in Apple's firmware and
+ * a crash disabling EFI runtime services. The following quirk skips reading
+ * these variables.
+ */
+ if (has_apple_t2_chip) {
pr_err("Reading UEFI Secure Boot Certs is not supported on T2 Macs.\n");
return false;
}
--
2.43.0
^ permalink raw reply related
* [PATCH v2 2/2] thunderbolt: Add device links for Apple T2 NHI
From: Atharva Tiwari @ 2026-07-21 5:45 UTC (permalink / raw)
Cc: Atharva Tiwari, Andre Eikmeyer, Bjorn Helgaas, Thomas Gleixner,
Ingo Molnar, Borislav Petkov, Dave Hansen, x86, H. Peter Anvin,
Andreas Noever, Mika Westerberg, Yehezkel Bernat, Hans de Goede,
Ilpo Järvinen, Jarkko Sakkinen, Mimi Zohar, Roberto Sassu,
Dmitry Kasatkin, Eric Snowberg, Paul Moore, James Morris,
Serge E. Hallyn, linux-pci, linux-kernel, linux-usb,
platform-driver-x86, linux-integrity, keyrings,
linux-security-module
In-Reply-To: <20260721054506.11871-1-atharvatiwarilinuxdev@gmail.com>
From: Andre Eikmeyer <andre@negmaster.com>
Thunderbolt NHI on T2 Macs (2018-2020). The NHI and its
associated PCIe root ports all sit directly on the root complex
with no upstream port. Apple's ACPI tables name Thunderbolt root
ports as TRP0, TRP1, etc. Find them and create device links back
to the NHI so that PCIe tunnels can be re-established after sleep.
Co-developed-by: Atharva Tiwari <atharvatiwarilinuxdev@gmail.com>
Signed-off-by: Atharva Tiwari <atharvatiwarilinuxdev@gmail.com>
Signed-off-by: Andre Eikmeyer <andre@negmaster.com>
---
drivers/thunderbolt/tb.c | 51 +++++++++++++++++++++++++++++++++++++++-
1 file changed, 50 insertions(+), 1 deletion(-)
diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
index c69c323e6952..ca47bfbcefdf 100644
--- a/drivers/thunderbolt/tb.c
+++ b/drivers/thunderbolt/tb.c
@@ -6,6 +6,7 @@
* Copyright (C) 2019, Intel Corporation
*/
+#include <linux/acpi.h>
#include <linux/slab.h>
#include <linux/errno.h>
#include <linux/delay.h>
@@ -3305,11 +3306,59 @@ static const struct tb_cm_ops tb_cm_ops = {
static bool tb_apple_add_links(struct tb_nhi *nhi)
{
struct pci_dev *upstream, *pdev;
- bool ret;
+ bool ret = false;
if (!x86_apple_machine)
return false;
+ /* On T2 Macs. the root ports are stored in ACPI as TRP0,
+ * TRP1, etc. Find them and create device links
+ * so that PCIe tunnels can be re-established after
+ * sleep.
+ */
+ if (has_apple_t2_chip) {
+ struct acpi_device *adev;
+ unsigned int slot, func;
+ const struct device_link *link;
+ const char *bid;
+
+ for (slot = 0; slot < 32; slot++) {
+ for (func = 0; func < 8; func++) {
+ pdev = pci_get_slot(nhi->pdev->bus, PCI_DEVFN(slot, func));
+ if (!pdev)
+ continue;
+
+ if (!pci_is_pcie(pdev) || pci_pcie_type(pdev) !=
+ PCI_EXP_TYPE_ROOT_PORT)
+ goto put_pdev;
+
+ adev = ACPI_COMPANION(&pdev->dev);
+ if (!adev)
+ goto put_pdev;
+
+ bid = acpi_device_bid(adev);
+ if (!bid || strncmp(bid, "TRP", 3) != 0)
+ goto put_pdev;
+
+ link = device_link_add(&pdev->dev, &nhi->pdev->dev,
+ DL_FLAG_AUTOREMOVE_SUPPLIER |
+ DL_FLAG_PM_RUNTIME);
+ if (link) {
+ dev_dbg(&nhi->pdev->dev, "created link from %s\n",
+ dev_name(&pdev->dev));
+ ret = true;
+ } else
+ dev_warn(&nhi->pdev->dev,
+ "device link creation from %s failed\n",
+ dev_name(&pdev->dev));
+
+put_pdev:
+ pci_dev_put(pdev);
+ }
+ }
+ return ret;
+ }
+
switch (nhi->pdev->device) {
case PCI_DEVICE_ID_INTEL_LIGHT_RIDGE:
case PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C:
--
2.43.0
^ permalink raw reply related
* [PATCH v3 0/2] Add Apple T2 NHI device links
From: Atharva Tiwari @ 2026-07-21 6:34 UTC (permalink / raw)
Cc: Atharva Tiwari, Bjorn Helgaas, Thomas Gleixner, Ingo Molnar,
Borislav Petkov, Dave Hansen, x86, H. Peter Anvin, Andreas Noever,
Mika Westerberg, Yehezkel Bernat, Hans de Goede,
Ilpo Järvinen, Jarkko Sakkinen, Mimi Zohar, Roberto Sassu,
Dmitry Kasatkin, Eric Snowberg, Paul Moore, James Morris,
Serge E. Hallyn, linux-pci, linux-kernel, linux-usb,
platform-driver-x86, linux-integrity, keyrings,
linux-security-module
This series adds a cached flag to detect Apple T2 systems, then uses it
to create device links for the Thunderbolt NHI.
Changes in v3:
- Fix build errors with non-x86 machines
- Used __initconst for apple_t2_devices
- Removed UEFI_QUIRK_SKIP_CERT as its unused now
- Used IS_ENABLED(CONFIG_ACPI) in tb_apple_add_links for the T2 part
- Removed !bid check to remove warning with -Waddress
Changes in v2:
- Used a less generic name for has_t2_chip
- Used DMI instead of PCI for has_apple_t2_chip to avoid PCI problems
- Initialized ret in tb_apple_add_links
Link to v2:
https://lore.kernel.org/all/20260721054506.11871-1-atharvatiwarilinuxdev@gmail.com/
Link to v1:
https://lore.kernel.org/all/20260719180308.1398-1-atharvatiwarilinuxdev@gmail.com/
Atharva Tiwari (2):
treewide: Add a flag to detect the Apple T2 chip
thunderbolt: Add device links for Apple T2 NHI
arch/x86/kernel/quirks.c | 105 ++++++++++++++++++
drivers/thunderbolt/tb.c | 51 ++++++++-
include/linux/platform_data/x86/apple.h | 5 +
.../platform_certs/keyring_handler.h | 8 --
security/integrity/platform_certs/load_uefi.c | 38 ++-----
5 files changed, 168 insertions(+), 39 deletions(-)
--
2.43.0
^ permalink raw reply
* [PATCH v3 1/2] treewide: Add a flag to detect the Apple T2 chip
From: Atharva Tiwari @ 2026-07-21 6:34 UTC (permalink / raw)
Cc: Atharva Tiwari, Bjorn Helgaas, Thomas Gleixner, Ingo Molnar,
Borislav Petkov, Dave Hansen, x86, H. Peter Anvin, Andreas Noever,
Mika Westerberg, Yehezkel Bernat, Hans de Goede,
Ilpo Järvinen, Jarkko Sakkinen, Mimi Zohar, Roberto Sassu,
Dmitry Kasatkin, Eric Snowberg, Paul Moore, James Morris,
Serge E. Hallyn, linux-pci, linux-kernel, linux-usb,
platform-driver-x86, linux-integrity, keyrings,
linux-security-module
In-Reply-To: <20260721063412.11588-1-atharvatiwarilinuxdev@gmail.com>
Add a flag to detect Apple T2 chips on Intel Macs.
Cache the result to avoid repeated checks. That will
be used in upcoming patches.
Signed-off-by: Atharva Tiwari <atharvatiwarilinuxdev@gmail.com>
---
arch/x86/kernel/quirks.c | 105 ++++++++++++++++++
include/linux/platform_data/x86/apple.h | 5 +
.../platform_certs/keyring_handler.h | 8 --
security/integrity/platform_certs/load_uefi.c | 38 ++-----
4 files changed, 118 insertions(+), 38 deletions(-)
diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c
index a92f18db9610..300d6436060d 100644
--- a/arch/x86/kernel/quirks.c
+++ b/arch/x86/kernel/quirks.c
@@ -664,8 +664,113 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2083, quirk_intel_purley_xeon_ras
bool x86_apple_machine;
EXPORT_SYMBOL(x86_apple_machine);
+bool has_apple_t2_chip;
+EXPORT_SYMBOL(has_apple_t2_chip);
+
+static const struct dmi_system_id apple_t2_devices[] __initconst = {
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,2"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,3"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,4"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,2"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,3"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,4"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,2"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir9,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Macmini8,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "MacPro7,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "iMac20,1"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "iMac20,2"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "iMacPro1,1"),
+ },
+ },
+ { }
+};
+
void __init early_platform_quirks(void)
{
x86_apple_machine = dmi_match(DMI_SYS_VENDOR, "Apple Inc.") ||
dmi_match(DMI_SYS_VENDOR, "Apple Computer, Inc.");
+
+ has_apple_t2_chip = dmi_check_system(apple_t2_devices);
}
diff --git a/include/linux/platform_data/x86/apple.h b/include/linux/platform_data/x86/apple.h
index 079e816c3c21..47b27dceab18 100644
--- a/include/linux/platform_data/x86/apple.h
+++ b/include/linux/platform_data/x86/apple.h
@@ -6,8 +6,13 @@
* x86_apple_machine - whether the machine is an x86 Apple Macintosh
*/
extern bool x86_apple_machine;
+/**
+ * has_apple_t2_chip - whether the machine has the Apple T2 chip
+ */
+extern bool has_apple_t2_chip;
#else
#define x86_apple_machine false
+#define has_apple_t2_chip false
#endif
#endif
diff --git a/security/integrity/platform_certs/keyring_handler.h b/security/integrity/platform_certs/keyring_handler.h
index f92895cc50f6..a355f4400179 100644
--- a/security/integrity/platform_certs/keyring_handler.h
+++ b/security/integrity/platform_certs/keyring_handler.h
@@ -45,11 +45,3 @@ efi_element_handler_t get_handler_for_code_signing_keys(const efi_guid_t *sig_ty
efi_element_handler_t get_handler_for_dbx(const efi_guid_t *sig_type);
#endif
-
-#ifndef UEFI_QUIRK_SKIP_CERT
-#define UEFI_QUIRK_SKIP_CERT(vendor, product) \
- .matches = { \
- DMI_MATCH(DMI_BOARD_VENDOR, vendor), \
- DMI_MATCH(DMI_PRODUCT_NAME, product), \
- },
-#endif
diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
index c0d6948446c3..b4096d4c828d 100644
--- a/security/integrity/platform_certs/load_uefi.c
+++ b/security/integrity/platform_certs/load_uefi.c
@@ -3,42 +3,16 @@
#include <linux/kernel.h>
#include <linux/sched.h>
#include <linux/cred.h>
-#include <linux/dmi.h>
#include <linux/err.h>
#include <linux/efi.h>
#include <linux/slab.h>
#include <linux/ima.h>
+#include <linux/platform_data/x86/apple.h>
#include <keys/asymmetric-type.h>
#include <keys/system_keyring.h>
#include "../integrity.h"
#include "keyring_handler.h"
-/*
- * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot
- * certificates causes occurrence of a page fault in Apple's firmware and
- * a crash disabling EFI runtime services. The following quirk skips reading
- * these variables.
- */
-static const struct dmi_system_id uefi_skip_cert[] = {
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,1") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,2") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,3") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,4") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,1") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,2") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,3") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,4") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,1") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,2") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir9,1") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "Macmini8,1") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacPro7,1") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,1") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,2") },
- { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMacPro1,1") },
- { }
-};
-
/*
* Look to see if a UEFI variable called MokIgnoreDB exists and return true if
* it does.
@@ -165,10 +139,14 @@ static int __init load_uefi_certs(void)
unsigned long dbsize = 0, dbxsize = 0, mokxsize = 0;
efi_status_t status;
int rc = 0;
- const struct dmi_system_id *dmi_id;
- dmi_id = dmi_first_match(uefi_skip_cert);
- if (dmi_id) {
+ /*
+ * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot
+ * certificates causes occurrence of a page fault in Apple's firmware and
+ * a crash disabling EFI runtime services. The following quirk skips reading
+ * these variables.
+ */
+ if (has_apple_t2_chip) {
pr_err("Reading UEFI Secure Boot Certs is not supported on T2 Macs.\n");
return false;
}
--
2.43.0
^ permalink raw reply related
* [PATCH v3 2/2] thunderbolt: Add device links for Apple T2 NHI
From: Atharva Tiwari @ 2026-07-21 6:34 UTC (permalink / raw)
Cc: Atharva Tiwari, Andre Eikmeyer, Bjorn Helgaas, Thomas Gleixner,
Ingo Molnar, Borislav Petkov, Dave Hansen, x86, H. Peter Anvin,
Andreas Noever, Mika Westerberg, Yehezkel Bernat, Hans de Goede,
Ilpo Järvinen, Jarkko Sakkinen, Mimi Zohar, Roberto Sassu,
Dmitry Kasatkin, Eric Snowberg, Paul Moore, James Morris,
Serge E. Hallyn, linux-pci, linux-kernel, linux-usb,
platform-driver-x86, linux-integrity, keyrings,
linux-security-module
In-Reply-To: <20260721063412.11588-1-atharvatiwarilinuxdev@gmail.com>
From: Andre Eikmeyer <andre@negmaster.com>
Thunderbolt NHI on T2 Macs (2018-2020). The NHI and its
associated PCIe root ports all sit directly on the root complex
with no upstream port. Apple's ACPI tables name Thunderbolt root
ports as TRP0, TRP1, etc. Find them and create device links back
to the NHI so that PCIe tunnels can be re-established after sleep.
Co-developed-by: Atharva Tiwari <atharvatiwarilinuxdev@gmail.com>
Signed-off-by: Atharva Tiwari <atharvatiwarilinuxdev@gmail.com>
Signed-off-by: Andre Eikmeyer <andre@negmaster.com>
---
drivers/thunderbolt/tb.c | 51 +++++++++++++++++++++++++++++++++++++++-
1 file changed, 50 insertions(+), 1 deletion(-)
diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
index c69c323e6952..0cdffcf577cd 100644
--- a/drivers/thunderbolt/tb.c
+++ b/drivers/thunderbolt/tb.c
@@ -6,6 +6,7 @@
* Copyright (C) 2019, Intel Corporation
*/
+#include <linux/acpi.h>
#include <linux/slab.h>
#include <linux/errno.h>
#include <linux/delay.h>
@@ -3305,11 +3306,59 @@ static const struct tb_cm_ops tb_cm_ops = {
static bool tb_apple_add_links(struct tb_nhi *nhi)
{
struct pci_dev *upstream, *pdev;
- bool ret;
+ bool ret = false;
if (!x86_apple_machine)
return false;
+ /* On T2 Macs. the root ports are stored in ACPI as TRP0,
+ * TRP1, etc. Find them and create device links
+ * so that PCIe tunnels can be re-established after
+ * sleep.
+ */
+ if (has_apple_t2_chip && IS_ENABLED(CONFIG_ACPI)) {
+ struct acpi_device *adev;
+ unsigned int slot, func;
+ const struct device_link *link;
+ const char *bid;
+
+ for (slot = 0; slot < 32; slot++) {
+ for (func = 0; func < 8; func++) {
+ pdev = pci_get_slot(nhi->pdev->bus, PCI_DEVFN(slot, func));
+ if (!pdev)
+ continue;
+
+ if (!pci_is_pcie(pdev) || pci_pcie_type(pdev) !=
+ PCI_EXP_TYPE_ROOT_PORT)
+ goto put_pdev;
+
+ adev = ACPI_COMPANION(&pdev->dev);
+ if (!adev)
+ goto put_pdev;
+
+ bid = acpi_device_bid(adev);
+ if (strncmp(bid, "TRP", 3) != 0)
+ goto put_pdev;
+
+ link = device_link_add(&pdev->dev, &nhi->pdev->dev,
+ DL_FLAG_AUTOREMOVE_SUPPLIER |
+ DL_FLAG_PM_RUNTIME);
+ if (link) {
+ dev_dbg(&nhi->pdev->dev, "created link from %s\n",
+ dev_name(&pdev->dev));
+ ret = true;
+ } else
+ dev_warn(&nhi->pdev->dev,
+ "device link creation from %s failed\n",
+ dev_name(&pdev->dev));
+
+put_pdev:
+ pci_dev_put(pdev);
+ }
+ }
+ return ret;
+ }
+
switch (nhi->pdev->device) {
case PCI_DEVICE_ID_INTEL_LIGHT_RIDGE:
case PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C:
--
2.43.0
^ permalink raw reply related
* Re: [PATCH v3 2/2] thunderbolt: Add device links for Apple T2 NHI
From: Ilpo Järvinen @ 2026-07-21 9:03 UTC (permalink / raw)
To: Atharva Tiwari
Cc: Andre Eikmeyer, Bjorn Helgaas, Thomas Gleixner, Ingo Molnar,
Borislav Petkov, Dave Hansen, x86, H. Peter Anvin, Andreas Noever,
Mika Westerberg, Yehezkel Bernat, Hans de Goede, Jarkko Sakkinen,
Mimi Zohar, Roberto Sassu, Dmitry Kasatkin, Eric Snowberg,
Paul Moore, James Morris, Serge E. Hallyn, linux-pci, LKML,
linux-usb, platform-driver-x86, linux-integrity, keyrings,
linux-security-module
In-Reply-To: <20260721063412.11588-3-atharvatiwarilinuxdev@gmail.com>
On Tue, 21 Jul 2026, Atharva Tiwari wrote:
> From: Andre Eikmeyer <andre@negmaster.com>
>
> Thunderbolt NHI on T2 Macs (2018-2020). The NHI and its
> associated PCIe root ports all sit directly on the root complex
> with no upstream port. Apple's ACPI tables name Thunderbolt root
> ports as TRP0, TRP1, etc. Find them and create device links back
> to the NHI so that PCIe tunnels can be re-established after sleep.
>
> Co-developed-by: Atharva Tiwari <atharvatiwarilinuxdev@gmail.com>
> Signed-off-by: Atharva Tiwari <atharvatiwarilinuxdev@gmail.com>
>
> Signed-off-by: Andre Eikmeyer <andre@negmaster.com>
> ---
> drivers/thunderbolt/tb.c | 51 +++++++++++++++++++++++++++++++++++++++-
> 1 file changed, 50 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
> index c69c323e6952..0cdffcf577cd 100644
> --- a/drivers/thunderbolt/tb.c
> +++ b/drivers/thunderbolt/tb.c
> @@ -6,6 +6,7 @@
> * Copyright (C) 2019, Intel Corporation
> */
>
> +#include <linux/acpi.h>
> #include <linux/slab.h>
> #include <linux/errno.h>
> #include <linux/delay.h>
> @@ -3305,11 +3306,59 @@ static const struct tb_cm_ops tb_cm_ops = {
> static bool tb_apple_add_links(struct tb_nhi *nhi)
> {
> struct pci_dev *upstream, *pdev;
This file seems to have a pre-existing lack of pci.h include, please add
it now when doing pci related code.
> - bool ret;
> + bool ret = false;
>
> if (!x86_apple_machine)
> return false;
>
> + /* On T2 Macs. the root ports are stored in ACPI as TRP0,
> + * TRP1, etc. Find them and create device links
> + * so that PCIe tunnels can be re-established after
> + * sleep.
> + */
> + if (has_apple_t2_chip && IS_ENABLED(CONFIG_ACPI)) {
> + struct acpi_device *adev;
> + unsigned int slot, func;
> + const struct device_link *link;
> + const char *bid;
> +
> + for (slot = 0; slot < 32; slot++) {
> + for (func = 0; func < 8; func++) {
> + pdev = pci_get_slot(nhi->pdev->bus, PCI_DEVFN(slot, func));
> + if (!pdev)
> + continue;
> +
> + if (!pci_is_pcie(pdev) || pci_pcie_type(pdev) !=
> + PCI_EXP_TYPE_ROOT_PORT)
> + goto put_pdev;
> +
> + adev = ACPI_COMPANION(&pdev->dev);
> + if (!adev)
> + goto put_pdev;
> +
> + bid = acpi_device_bid(adev);
> + if (strncmp(bid, "TRP", 3) != 0)
> + goto put_pdev;
> +
> + link = device_link_add(&pdev->dev, &nhi->pdev->dev,
> + DL_FLAG_AUTOREMOVE_SUPPLIER |
> + DL_FLAG_PM_RUNTIME);
> + if (link) {
> + dev_dbg(&nhi->pdev->dev, "created link from %s\n",
> + dev_name(&pdev->dev));
> + ret = true;
> + } else
> + dev_warn(&nhi->pdev->dev,
> + "device link creation from %s failed\n",
> + dev_name(&pdev->dev));
Please only use balanced braces.
> +
> +put_pdev:
> + pci_dev_put(pdev);
I think you can use __free() with it and avoid the label. You cannot then
reuse the existing pdev variable for it but declare it in this block while
you assign to it.
This line would be misaligned anyway but better get rid of goto logic
anyway.
> + }
> + }
> + return ret;
> + }
> +
> switch (nhi->pdev->device) {
> case PCI_DEVICE_ID_INTEL_LIGHT_RIDGE:
> case PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C:
>
--
i.
^ permalink raw reply
* Re: [PATCH v2 1/2] treewide: Add a flag to detect the Apple T2 chip
From: Jarkko Sakkinen @ 2026-07-21 10:56 UTC (permalink / raw)
To: Atharva Tiwari
Cc: Bjorn Helgaas, Thomas Gleixner, Ingo Molnar, Borislav Petkov,
Dave Hansen, x86, H. Peter Anvin, Andreas Noever, Mika Westerberg,
Yehezkel Bernat, Hans de Goede, Ilpo Järvinen, Mimi Zohar,
Roberto Sassu, Dmitry Kasatkin, Eric Snowberg, Paul Moore,
James Morris, Serge E. Hallyn, linux-pci, linux-kernel, linux-usb,
platform-driver-x86, linux-integrity, keyrings,
linux-security-module
In-Reply-To: <20260721054506.11871-2-atharvatiwarilinuxdev@gmail.com>
On Tue, Jul 21, 2026 at 01:45:01AM -0400, Atharva Tiwari wrote:
> Add a flag to detect Apple T2 chips on Intel Macs.
> Cache the result to avoid repeated checks. That will
> be used in upcoming patches.
>
> Signed-off-by: Atharva Tiwari <atharvatiwarilinuxdev@gmail.com>
> ---
> arch/x86/kernel/quirks.c | 105 ++++++++++++++++++
> include/linux/platform_data/x86/apple.h | 5 +
> security/integrity/platform_certs/load_uefi.c | 38 ++-----
> 3 files changed, 118 insertions(+), 30 deletions(-)
>
> diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c
> index a92f18db9610..74b29738d404 100644
> --- a/arch/x86/kernel/quirks.c
> +++ b/arch/x86/kernel/quirks.c
> @@ -664,8 +664,113 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2083, quirk_intel_purley_xeon_ras
> bool x86_apple_machine;
> EXPORT_SYMBOL(x86_apple_machine);
>
> +bool has_apple_t2_chip;
> +EXPORT_SYMBOL(has_apple_t2_chip);
> +
> +static const struct dmi_system_id apple_t2_devices[] = {
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,2"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,3"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,4"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,2"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,3"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,4"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,2"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir9,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "Macmini8,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacPro7,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "iMac20,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "iMac20,2"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "iMacPro1,1"),
> + },
> + },
> + { }
> +};
> +
> void __init early_platform_quirks(void)
> {
> x86_apple_machine = dmi_match(DMI_SYS_VENDOR, "Apple Inc.") ||
> dmi_match(DMI_SYS_VENDOR, "Apple Computer, Inc.");
> +
> + has_apple_t2_chip = dmi_check_system(apple_t2_devices);
> }
> diff --git a/include/linux/platform_data/x86/apple.h b/include/linux/platform_data/x86/apple.h
> index 079e816c3c21..50bbcc5134fc 100644
> --- a/include/linux/platform_data/x86/apple.h
> +++ b/include/linux/platform_data/x86/apple.h
> @@ -6,8 +6,13 @@
> * x86_apple_machine - whether the machine is an x86 Apple Macintosh
> */
> extern bool x86_apple_machine;
> +/**
> + * has_apple_t2_chip - whether the machine has the Apple T2 chip
> + */
> +extern bool has_apple_t2_chip;
> #else
> #define x86_apple_machine false
> +#define has_t2_chip false
> #endif
>
> #endif
> diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
> index c0d6948446c3..b4096d4c828d 100644
> --- a/security/integrity/platform_certs/load_uefi.c
> +++ b/security/integrity/platform_certs/load_uefi.c
> @@ -3,42 +3,16 @@
> #include <linux/kernel.h>
> #include <linux/sched.h>
> #include <linux/cred.h>
> -#include <linux/dmi.h>
> #include <linux/err.h>
> #include <linux/efi.h>
> #include <linux/slab.h>
> #include <linux/ima.h>
> +#include <linux/platform_data/x86/apple.h>
> #include <keys/asymmetric-type.h>
> #include <keys/system_keyring.h>
> #include "../integrity.h"
> #include "keyring_handler.h"
>
> -/*
> - * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot
> - * certificates causes occurrence of a page fault in Apple's firmware and
> - * a crash disabling EFI runtime services. The following quirk skips reading
> - * these variables.
> - */
> -static const struct dmi_system_id uefi_skip_cert[] = {
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,2") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,3") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,4") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,2") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,3") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,4") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,2") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir9,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "Macmini8,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacPro7,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,2") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMacPro1,1") },
> - { }
> -};
> -
> /*
> * Look to see if a UEFI variable called MokIgnoreDB exists and return true if
> * it does.
> @@ -165,10 +139,14 @@ static int __init load_uefi_certs(void)
> unsigned long dbsize = 0, dbxsize = 0, mokxsize = 0;
> efi_status_t status;
> int rc = 0;
> - const struct dmi_system_id *dmi_id;
>
> - dmi_id = dmi_first_match(uefi_skip_cert);
> - if (dmi_id) {
> + /*
> + * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot
> + * certificates causes occurrence of a page fault in Apple's firmware and
> + * a crash disabling EFI runtime services. The following quirk skips reading
> + * these variables.
> + */
> + if (has_apple_t2_chip) {
> pr_err("Reading UEFI Secure Boot Certs is not supported on T2 Macs.\n");
> return false;
> }
> --
> 2.43.0
>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
BR, Jarkko
^ permalink raw reply
* Re: [PATCH v3 1/2] treewide: Add a flag to detect the Apple T2 chip
From: Jarkko Sakkinen @ 2026-07-21 10:57 UTC (permalink / raw)
To: Atharva Tiwari
Cc: Bjorn Helgaas, Thomas Gleixner, Ingo Molnar, Borislav Petkov,
Dave Hansen, x86, H. Peter Anvin, Andreas Noever, Mika Westerberg,
Yehezkel Bernat, Hans de Goede, Ilpo Järvinen, Mimi Zohar,
Roberto Sassu, Dmitry Kasatkin, Eric Snowberg, Paul Moore,
James Morris, Serge E. Hallyn, linux-pci, linux-kernel, linux-usb,
platform-driver-x86, linux-integrity, keyrings,
linux-security-module
In-Reply-To: <20260721063412.11588-2-atharvatiwarilinuxdev@gmail.com>
On Tue, Jul 21, 2026 at 02:34:06AM -0400, Atharva Tiwari wrote:
> Add a flag to detect Apple T2 chips on Intel Macs.
> Cache the result to avoid repeated checks. That will
> be used in upcoming patches.
>
> Signed-off-by: Atharva Tiwari <atharvatiwarilinuxdev@gmail.com>
> ---
> arch/x86/kernel/quirks.c | 105 ++++++++++++++++++
> include/linux/platform_data/x86/apple.h | 5 +
> .../platform_certs/keyring_handler.h | 8 --
> security/integrity/platform_certs/load_uefi.c | 38 ++-----
> 4 files changed, 118 insertions(+), 38 deletions(-)
>
> diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c
> index a92f18db9610..300d6436060d 100644
> --- a/arch/x86/kernel/quirks.c
> +++ b/arch/x86/kernel/quirks.c
> @@ -664,8 +664,113 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2083, quirk_intel_purley_xeon_ras
> bool x86_apple_machine;
> EXPORT_SYMBOL(x86_apple_machine);
>
> +bool has_apple_t2_chip;
> +EXPORT_SYMBOL(has_apple_t2_chip);
> +
> +static const struct dmi_system_id apple_t2_devices[] __initconst = {
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,2"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,3"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,4"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,2"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,3"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,4"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,2"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir9,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "Macmini8,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacPro7,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "iMac20,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "iMac20,2"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "iMacPro1,1"),
> + },
> + },
> + { }
> +};
> +
> void __init early_platform_quirks(void)
> {
> x86_apple_machine = dmi_match(DMI_SYS_VENDOR, "Apple Inc.") ||
> dmi_match(DMI_SYS_VENDOR, "Apple Computer, Inc.");
> +
> + has_apple_t2_chip = dmi_check_system(apple_t2_devices);
> }
> diff --git a/include/linux/platform_data/x86/apple.h b/include/linux/platform_data/x86/apple.h
> index 079e816c3c21..47b27dceab18 100644
> --- a/include/linux/platform_data/x86/apple.h
> +++ b/include/linux/platform_data/x86/apple.h
> @@ -6,8 +6,13 @@
> * x86_apple_machine - whether the machine is an x86 Apple Macintosh
> */
> extern bool x86_apple_machine;
> +/**
> + * has_apple_t2_chip - whether the machine has the Apple T2 chip
> + */
> +extern bool has_apple_t2_chip;
> #else
> #define x86_apple_machine false
> +#define has_apple_t2_chip false
> #endif
>
> #endif
> diff --git a/security/integrity/platform_certs/keyring_handler.h b/security/integrity/platform_certs/keyring_handler.h
> index f92895cc50f6..a355f4400179 100644
> --- a/security/integrity/platform_certs/keyring_handler.h
> +++ b/security/integrity/platform_certs/keyring_handler.h
> @@ -45,11 +45,3 @@ efi_element_handler_t get_handler_for_code_signing_keys(const efi_guid_t *sig_ty
> efi_element_handler_t get_handler_for_dbx(const efi_guid_t *sig_type);
>
> #endif
> -
> -#ifndef UEFI_QUIRK_SKIP_CERT
> -#define UEFI_QUIRK_SKIP_CERT(vendor, product) \
> - .matches = { \
> - DMI_MATCH(DMI_BOARD_VENDOR, vendor), \
> - DMI_MATCH(DMI_PRODUCT_NAME, product), \
> - },
> -#endif
> diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
> index c0d6948446c3..b4096d4c828d 100644
> --- a/security/integrity/platform_certs/load_uefi.c
> +++ b/security/integrity/platform_certs/load_uefi.c
> @@ -3,42 +3,16 @@
> #include <linux/kernel.h>
> #include <linux/sched.h>
> #include <linux/cred.h>
> -#include <linux/dmi.h>
> #include <linux/err.h>
> #include <linux/efi.h>
> #include <linux/slab.h>
> #include <linux/ima.h>
> +#include <linux/platform_data/x86/apple.h>
> #include <keys/asymmetric-type.h>
> #include <keys/system_keyring.h>
> #include "../integrity.h"
> #include "keyring_handler.h"
>
> -/*
> - * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot
> - * certificates causes occurrence of a page fault in Apple's firmware and
> - * a crash disabling EFI runtime services. The following quirk skips reading
> - * these variables.
> - */
> -static const struct dmi_system_id uefi_skip_cert[] = {
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,2") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,3") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,4") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,2") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,3") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,4") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,2") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir9,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "Macmini8,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacPro7,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,2") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMacPro1,1") },
> - { }
> -};
> -
> /*
> * Look to see if a UEFI variable called MokIgnoreDB exists and return true if
> * it does.
> @@ -165,10 +139,14 @@ static int __init load_uefi_certs(void)
> unsigned long dbsize = 0, dbxsize = 0, mokxsize = 0;
> efi_status_t status;
> int rc = 0;
> - const struct dmi_system_id *dmi_id;
>
> - dmi_id = dmi_first_match(uefi_skip_cert);
> - if (dmi_id) {
> + /*
> + * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot
> + * certificates causes occurrence of a page fault in Apple's firmware and
> + * a crash disabling EFI runtime services. The following quirk skips reading
> + * these variables.
> + */
> + if (has_apple_t2_chip) {
> pr_err("Reading UEFI Secure Boot Certs is not supported on T2 Macs.\n");
> return false;
> }
> --
> 2.43.0
>
Acked-by: Jarkko Sakkinen <jarkko@kernel.org>
BR, Jarkko
^ permalink raw reply
* [PATCH] apparmor: update website link
From: Baruch Siach @ 2026-07-21 11:19 UTC (permalink / raw)
To: John Johansen, John Johansen, Georgia Garcia
Cc: apparmor, linux-security-module, Baruch Siach
apparmor.wiki.kernel.org redirects to the current website.
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
---
security/apparmor/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/apparmor/Kconfig b/security/apparmor/Kconfig
index 1e3bd44643da..472aa38254be 100644
--- a/security/apparmor/Kconfig
+++ b/security/apparmor/Kconfig
@@ -11,7 +11,7 @@ config SECURITY_APPARMOR
This enables the AppArmor security module.
Required userspace tools (if they are not included in your
distribution) and further information may be found at
- http://apparmor.wiki.kernel.org
+ https://wiki.apparmor.net
If you are unsure how to answer this question, answer N.
--
2.53.0
^ permalink raw reply related
* [PATCH v2 0/3] Bring includes in linux/kmod.h up to date
From: Petr Pavlu @ 2026-07-21 13:11 UTC (permalink / raw)
To: Tony Luck, Borislav Petkov, Thomas Gleixner, Ingo Molnar,
Dave Hansen, x86, H. Peter Anvin, Philipp Reisner, Lars Ellenberg,
Christoph Böhmwalder, Jens Axboe, Johan Hovold, Alex Elder,
Greg Kroah-Hartman, Rafael J. Wysocki, Michal Januszewski,
Helge Deller, Alexander Viro, Christian Brauner, Jan Kara,
Trond Myklebust, Anna Schumaker, Chuck Lever, Jeff Layton,
NeilBrown, Olga Kornievskaia, Dai Ngo, Tom Talpey, Mark Fasheh,
Joel Becker, Joseph Qi, Tejun Heo, Johannes Weiner,
Michal Koutný, Luis Chamberlain, Petr Pavlu, Daniel Gomez,
Sami Tolvanen, Aaron Tomlin, Pavel Machek, Len Brown,
Andrew Morton, Danilo Krummrich, Nikolay Aleksandrov,
Ido Schimmel, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, David Howells, Jarkko Sakkinen,
Paul Moore, James Morris, Serge E. Hallyn, Kentaro Takeda,
Tetsuo Handa
Cc: linux-edac, linux-kernel, drbd-dev, linux-block, greybus-dev,
linuxppc-dev, linux-acpi, linux-fbdev, dri-devel, linux-fsdevel,
linux-nfs, ocfs2-devel, cgroups, linux-modules, linux-pm,
driver-core, bridge, netdev, keyrings, linux-security-module
The usermode helper declarations were previously provided by linux/kmod.h
but commit c1f3fa2a4fde ("kmod: split off umh headers into its own file")
moved them to linux/umh.h in 2017. Add explicit includes of linux/umh.h to
files that use usermode helpers and remove linux/kmod.h where it is no
longer needed.
Also add a missing include of linux/sysctl.h to kernel/time/jiffies.c.
Finally, clean up linux/kmod.h so that it includes only the headers that it
actually requires, importantly removing the compat linux/umh.h include.
This cleanup is motivated by trying to reduce the preprocessed size of
linux/module.h, which includes linux/kmod.h. The linux/module.h header is
included by every *.mod.c file to provide `struct module` and other related
definitions, so it should avoid pulling in unnecessary dependencies. Note
that this series doesn't immediately improve the situation, since most of
the files included by linux/kmod.h are, for now, also included by
linux/module.h through other paths.
Apologies for the wide distribution. Acked-bys are appreciated.
Changes in v2:
- Remove the linux/kmod.h include from kernel/cgroup/cgroup-v1.c.
- Add a missing include of linux/sysctl.h to kernel/time/jiffies.c.
- Link to v1: https://lore.kernel.org/linux-modules/20260708154510.6794-1-petr.pavlu@suse.com/
Petr Pavlu (3):
umh, treewide: Explicitly include linux/umh.h where needed
time/jiffies: Include linux/sysctl.h for proc_int_u2k_conv_uop(), ...
module: Bring includes in linux/kmod.h up to date
arch/x86/kernel/cpu/mce/dev-mcelog.c | 2 +-
drivers/block/drbd/drbd_nl.c | 1 +
drivers/greybus/svc_watchdog.c | 1 +
drivers/macintosh/windfarm_core.c | 1 +
drivers/pnp/pnpbios/core.c | 2 +-
drivers/video/fbdev/uvesafb.c | 1 +
fs/coredump.c | 2 +-
fs/nfs/cache_lib.c | 2 +-
fs/nfsd/nfs4layouts.c | 2 +-
fs/nfsd/nfs4recover.c | 1 +
fs/ocfs2/stackglue.c | 1 +
include/linux/kmod.h | 12 ++----------
kernel/cgroup/cgroup-v1.c | 2 +-
kernel/module/kmod.c | 1 +
kernel/power/process.c | 2 +-
kernel/reboot.c | 2 +-
kernel/time/jiffies.c | 1 +
kernel/umh.c | 2 +-
lib/kobject_uevent.c | 2 +-
net/bridge/br_stp_if.c | 2 +-
security/keys/request_key.c | 2 +-
security/tomoyo/common.h | 2 +-
22 files changed, 23 insertions(+), 23 deletions(-)
--
2.54.0
^ permalink raw reply
* [PATCH v2 1/3] umh, treewide: Explicitly include linux/umh.h where needed
From: Petr Pavlu @ 2026-07-21 13:11 UTC (permalink / raw)
To: Tony Luck, Borislav Petkov, Thomas Gleixner, Ingo Molnar,
Dave Hansen, x86, H. Peter Anvin, Philipp Reisner, Lars Ellenberg,
Christoph Böhmwalder, Jens Axboe, Johan Hovold, Alex Elder,
Greg Kroah-Hartman, Rafael J. Wysocki, Michal Januszewski,
Helge Deller, Alexander Viro, Christian Brauner, Jan Kara,
Trond Myklebust, Anna Schumaker, Chuck Lever, Jeff Layton,
NeilBrown, Olga Kornievskaia, Dai Ngo, Tom Talpey, Mark Fasheh,
Joel Becker, Joseph Qi, Tejun Heo, Johannes Weiner,
Michal Koutný, Luis Chamberlain, Petr Pavlu, Daniel Gomez,
Sami Tolvanen, Aaron Tomlin, Pavel Machek, Len Brown,
Andrew Morton, Danilo Krummrich, Nikolay Aleksandrov,
Ido Schimmel, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, David Howells, Jarkko Sakkinen,
Paul Moore, James Morris, Serge E. Hallyn, Kentaro Takeda,
Tetsuo Handa
Cc: linux-edac, linux-kernel, drbd-dev, linux-block, greybus-dev,
linuxppc-dev, linux-acpi, linux-fbdev, dri-devel, linux-fsdevel,
linux-nfs, ocfs2-devel, cgroups, linux-modules, linux-pm,
driver-core, bridge, netdev, keyrings, linux-security-module
In-Reply-To: <20260721131207.803760-1-petr.pavlu@suse.com>
The usermode helper declarations were previously provided by linux/kmod.h
but commit c1f3fa2a4fde ("kmod: split off umh headers into its own file")
moved them to linux/umh.h in 2017. Add explicit includes of linux/umh.h to
files that use usermode helpers and remove linux/kmod.h where it is no
longer needed.
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
---
arch/x86/kernel/cpu/mce/dev-mcelog.c | 2 +-
drivers/block/drbd/drbd_nl.c | 1 +
drivers/greybus/svc_watchdog.c | 1 +
drivers/macintosh/windfarm_core.c | 1 +
drivers/pnp/pnpbios/core.c | 2 +-
drivers/video/fbdev/uvesafb.c | 1 +
fs/coredump.c | 2 +-
fs/nfs/cache_lib.c | 2 +-
fs/nfsd/nfs4layouts.c | 2 +-
fs/nfsd/nfs4recover.c | 1 +
fs/ocfs2/stackglue.c | 1 +
kernel/cgroup/cgroup-v1.c | 2 +-
kernel/module/kmod.c | 1 +
kernel/power/process.c | 2 +-
kernel/reboot.c | 2 +-
kernel/umh.c | 2 +-
lib/kobject_uevent.c | 2 +-
net/bridge/br_stp_if.c | 2 +-
security/keys/request_key.c | 2 +-
security/tomoyo/common.h | 2 +-
20 files changed, 20 insertions(+), 13 deletions(-)
diff --git a/arch/x86/kernel/cpu/mce/dev-mcelog.c b/arch/x86/kernel/cpu/mce/dev-mcelog.c
index 053555206d81..af4e76babe7a 100644
--- a/arch/x86/kernel/cpu/mce/dev-mcelog.c
+++ b/arch/x86/kernel/cpu/mce/dev-mcelog.c
@@ -11,7 +11,7 @@
#include <linux/miscdevice.h>
#include <linux/slab.h>
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <linux/poll.h>
#include "internal.h"
diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
index f9ffcd67607b..de90cf4a0789 100644
--- a/drivers/block/drbd/drbd_nl.c
+++ b/drivers/block/drbd/drbd_nl.c
@@ -14,6 +14,7 @@
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/module.h>
+#include <linux/umh.h>
#include <linux/drbd.h>
#include <linux/in.h>
#include <linux/fs.h>
diff --git a/drivers/greybus/svc_watchdog.c b/drivers/greybus/svc_watchdog.c
index 16e6de5e9eff..b318eb34bcca 100644
--- a/drivers/greybus/svc_watchdog.c
+++ b/drivers/greybus/svc_watchdog.c
@@ -7,6 +7,7 @@
#include <linux/delay.h>
#include <linux/suspend.h>
+#include <linux/umh.h>
#include <linux/workqueue.h>
#include <linux/greybus.h>
diff --git a/drivers/macintosh/windfarm_core.c b/drivers/macintosh/windfarm_core.c
index 5307b1e34261..e66de11c69a3 100644
--- a/drivers/macintosh/windfarm_core.c
+++ b/drivers/macintosh/windfarm_core.c
@@ -34,6 +34,7 @@
#include <linux/platform_device.h>
#include <linux/mutex.h>
#include <linux/freezer.h>
+#include <linux/umh.h>
#include "windfarm.h"
diff --git a/drivers/pnp/pnpbios/core.c b/drivers/pnp/pnpbios/core.c
index f7e86ae9f72f..46af1f549337 100644
--- a/drivers/pnp/pnpbios/core.c
+++ b/drivers/pnp/pnpbios/core.c
@@ -47,7 +47,7 @@
#include <linux/delay.h>
#include <linux/acpi.h>
#include <linux/freezer.h>
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <linux/kthread.h>
#include <asm/page.h>
diff --git a/drivers/video/fbdev/uvesafb.c b/drivers/video/fbdev/uvesafb.c
index 9d82326c744f..6c503e6914d6 100644
--- a/drivers/video/fbdev/uvesafb.c
+++ b/drivers/video/fbdev/uvesafb.c
@@ -23,6 +23,7 @@
#include <linux/io.h>
#include <linux/mutex.h>
#include <linux/slab.h>
+#include <linux/umh.h>
#include <video/edid.h>
#include <video/uvesafb.h>
#ifdef CONFIG_X86
diff --git a/fs/coredump.c b/fs/coredump.c
index e68a76ff92a3..4908b44f6fdc 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -32,7 +32,7 @@
#include <linux/tsacct_kern.h>
#include <linux/cn_proc.h>
#include <linux/audit.h>
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <linux/fsnotify.h>
#include <linux/fs_struct.h>
#include <linux/pipe_fs_i.h>
diff --git a/fs/nfs/cache_lib.c b/fs/nfs/cache_lib.c
index 9738a1ae92ca..ca4e81d4e315 100644
--- a/fs/nfs/cache_lib.c
+++ b/fs/nfs/cache_lib.c
@@ -6,7 +6,7 @@
*
* Copyright (c) 2009 Trond Myklebust <Trond.Myklebust@netapp.com>
*/
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/mount.h>
diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
index f34320e4c2f4..008f0f088c3a 100644
--- a/fs/nfsd/nfs4layouts.c
+++ b/fs/nfsd/nfs4layouts.c
@@ -3,7 +3,7 @@
* Copyright (c) 2014 Christoph Hellwig.
*/
#include <linux/exportfs_block.h>
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <linux/file.h>
#include <linux/jhash.h>
#include <linux/sched.h>
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 6ea25a52d2f4..20b98e43f668 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -41,6 +41,7 @@
#include <linux/fs.h>
#include <linux/hex.h>
#include <linux/module.h>
+#include <linux/umh.h>
#include <net/net_namespace.h>
#include <linux/sunrpc/rpc_pipe_fs.h>
#include <linux/sunrpc/clnt.h>
diff --git a/fs/ocfs2/stackglue.c b/fs/ocfs2/stackglue.c
index 741d6191d871..0ccaab29426d 100644
--- a/fs/ocfs2/stackglue.c
+++ b/fs/ocfs2/stackglue.c
@@ -18,6 +18,7 @@
#include <linux/kobject.h>
#include <linux/sysfs.h>
#include <linux/sysctl.h>
+#include <linux/umh.h>
#include "ocfs2_fs.h"
diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
index a4337c9b5287..cbcde5c28b18 100644
--- a/kernel/cgroup/cgroup-v1.c
+++ b/kernel/cgroup/cgroup-v1.c
@@ -2,7 +2,7 @@
#include "cgroup-internal.h"
#include <linux/ctype.h>
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <linux/sort.h>
#include <linux/delay.h>
#include <linux/mm.h>
diff --git a/kernel/module/kmod.c b/kernel/module/kmod.c
index a25dccdf7aa7..dcaad5d65275 100644
--- a/kernel/module/kmod.c
+++ b/kernel/module/kmod.c
@@ -28,6 +28,7 @@
#include <linux/ptrace.h>
#include <linux/async.h>
#include <linux/uaccess.h>
+#include <linux/umh.h>
#include <trace/events/module.h>
#include "internal.h"
diff --git a/kernel/power/process.c b/kernel/power/process.c
index dc0dfc349f22..295904ec9a82 100644
--- a/kernel/power/process.c
+++ b/kernel/power/process.c
@@ -16,7 +16,7 @@
#include <linux/freezer.h>
#include <linux/delay.h>
#include <linux/workqueue.h>
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <trace/events/power.h>
#include <linux/cpuset.h>
diff --git a/kernel/reboot.c b/kernel/reboot.c
index 695c33e75efd..3d4a262973e7 100644
--- a/kernel/reboot.c
+++ b/kernel/reboot.c
@@ -11,13 +11,13 @@
#include <linux/ctype.h>
#include <linux/export.h>
#include <linux/kexec.h>
-#include <linux/kmod.h>
#include <linux/kmsg_dump.h>
#include <linux/reboot.h>
#include <linux/suspend.h>
#include <linux/syscalls.h>
#include <linux/syscore_ops.h>
#include <linux/uaccess.h>
+#include <linux/umh.h>
/*
* this indicates whether you can reboot with ctrl-alt-del: the default is yes
diff --git a/kernel/umh.c b/kernel/umh.c
index 48117c569e1a..72b2d9a878aa 100644
--- a/kernel/umh.c
+++ b/kernel/umh.c
@@ -8,7 +8,7 @@
#include <linux/binfmts.h>
#include <linux/syscalls.h>
#include <linux/unistd.h>
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <linux/slab.h>
#include <linux/completion.h>
#include <linux/cred.h>
diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index ddbc4d7482d2..a67129e452a3 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -17,7 +17,7 @@
#include <linux/string.h>
#include <linux/kobject.h>
#include <linux/export.h>
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <linux/slab.h>
#include <linux/socket.h>
#include <linux/skbuff.h>
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index a7e5422eb5d1..89bc161a4b47 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -8,7 +8,7 @@
*/
#include <linux/kernel.h>
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <linux/etherdevice.h>
#include <linux/rtnetlink.h>
#include <net/switchdev.h>
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index fa2bb9f2f538..e6ba2d054399 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -9,7 +9,7 @@
#include <linux/export.h>
#include <linux/sched.h>
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <linux/err.h>
#include <linux/keyctl.h>
#include <linux/slab.h>
diff --git a/security/tomoyo/common.h b/security/tomoyo/common.h
index d098cf8aae61..d26034000913 100644
--- a/security/tomoyo/common.h
+++ b/security/tomoyo/common.h
@@ -16,7 +16,7 @@
#include <linux/string.h>
#include <linux/mm.h>
#include <linux/file.h>
-#include <linux/kmod.h>
+#include <linux/umh.h>
#include <linux/fs.h>
#include <linux/sched.h>
#include <linux/namei.h>
--
2.54.0
^ permalink raw reply related
* [PATCH v2 2/3] time/jiffies: Include linux/sysctl.h for proc_int_u2k_conv_uop(), ...
From: Petr Pavlu @ 2026-07-21 13:11 UTC (permalink / raw)
To: Tony Luck, Borislav Petkov, Thomas Gleixner, Ingo Molnar,
Dave Hansen, x86, H. Peter Anvin, Philipp Reisner, Lars Ellenberg,
Christoph Böhmwalder, Jens Axboe, Johan Hovold, Alex Elder,
Greg Kroah-Hartman, Rafael J. Wysocki, Michal Januszewski,
Helge Deller, Alexander Viro, Christian Brauner, Jan Kara,
Trond Myklebust, Anna Schumaker, Chuck Lever, Jeff Layton,
NeilBrown, Olga Kornievskaia, Dai Ngo, Tom Talpey, Mark Fasheh,
Joel Becker, Joseph Qi, Tejun Heo, Johannes Weiner,
Michal Koutný, Luis Chamberlain, Petr Pavlu, Daniel Gomez,
Sami Tolvanen, Aaron Tomlin, Pavel Machek, Len Brown,
Andrew Morton, Danilo Krummrich, Nikolay Aleksandrov,
Ido Schimmel, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, David Howells, Jarkko Sakkinen,
Paul Moore, James Morris, Serge E. Hallyn, Kentaro Takeda,
Tetsuo Handa
Cc: linux-edac, linux-kernel, drbd-dev, linux-block, greybus-dev,
linuxppc-dev, linux-acpi, linux-fbdev, dri-devel, linux-fsdevel,
linux-nfs, ocfs2-devel, cgroups, linux-modules, linux-pm,
driver-core, bridge, netdev, keyrings, linux-security-module
In-Reply-To: <20260721131207.803760-1-petr.pavlu@suse.com>
The kernel/time/jiffies.c file uses proc_int_u2k_conv_uop(),
proc_int_k2u_conv_kop(), proc_int_conv(), proc_dointvec_conv() and
proc_doulongvec_minmax_conv(), which are declared in linux/sysctl.h. It
currently relies on this header being included indirectly through
linux/module.h -> linux/kmod.h. Add the missing include in preparation for
removing the linux/sysctl.h include from linux/kmod.h.
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
---
kernel/time/jiffies.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/time/jiffies.c b/kernel/time/jiffies.c
index d51428867a33..17cdb5ef8893 100644
--- a/kernel/time/jiffies.c
+++ b/kernel/time/jiffies.c
@@ -8,6 +8,7 @@
#include <linux/jiffies.h>
#include <linux/module.h>
#include <linux/init.h>
+#include <linux/sysctl.h>
#include "timekeeping.h"
#include "tick-internal.h"
--
2.54.0
^ permalink raw reply related
* [PATCH v2 3/3] module: Bring includes in linux/kmod.h up to date
From: Petr Pavlu @ 2026-07-21 13:11 UTC (permalink / raw)
To: Tony Luck, Borislav Petkov, Thomas Gleixner, Ingo Molnar,
Dave Hansen, x86, H. Peter Anvin, Philipp Reisner, Lars Ellenberg,
Christoph Böhmwalder, Jens Axboe, Johan Hovold, Alex Elder,
Greg Kroah-Hartman, Rafael J. Wysocki, Michal Januszewski,
Helge Deller, Alexander Viro, Christian Brauner, Jan Kara,
Trond Myklebust, Anna Schumaker, Chuck Lever, Jeff Layton,
NeilBrown, Olga Kornievskaia, Dai Ngo, Tom Talpey, Mark Fasheh,
Joel Becker, Joseph Qi, Tejun Heo, Johannes Weiner,
Michal Koutný, Luis Chamberlain, Petr Pavlu, Daniel Gomez,
Sami Tolvanen, Aaron Tomlin, Pavel Machek, Len Brown,
Andrew Morton, Danilo Krummrich, Nikolay Aleksandrov,
Ido Schimmel, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, David Howells, Jarkko Sakkinen,
Paul Moore, James Morris, Serge E. Hallyn, Kentaro Takeda,
Tetsuo Handa
Cc: linux-edac, linux-kernel, drbd-dev, linux-block, greybus-dev,
linuxppc-dev, linux-acpi, linux-fbdev, dri-devel, linux-fsdevel,
linux-nfs, ocfs2-devel, cgroups, linux-modules, linux-pm,
driver-core, bridge, netdev, keyrings, linux-security-module
In-Reply-To: <20260721131207.803760-1-petr.pavlu@suse.com>
Including linux/kmod.h alone results in 1.5 MB of preprocessed output, even
though it provides only a few functions and macros.
The header currently depends on:
* __printf() -> linux/compiler_attributes.h,
* ENOSYS -> linux/errno.h,
* bool -> linux/types.h.
Include only these files, reducing the preprocessed output to 10 kB.
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
Reviewed-by: Aaron Tomlin <atomlin@atomlin.com>
---
include/linux/kmod.h | 12 ++----------
1 file changed, 2 insertions(+), 10 deletions(-)
diff --git a/include/linux/kmod.h b/include/linux/kmod.h
index 9a07c3215389..b9474a62a568 100644
--- a/include/linux/kmod.h
+++ b/include/linux/kmod.h
@@ -2,17 +2,9 @@
#ifndef __LINUX_KMOD_H__
#define __LINUX_KMOD_H__
-/*
- * include/linux/kmod.h
- */
-
-#include <linux/umh.h>
-#include <linux/gfp.h>
-#include <linux/stddef.h>
+#include <linux/compiler_attributes.h>
#include <linux/errno.h>
-#include <linux/compiler.h>
-#include <linux/workqueue.h>
-#include <linux/sysctl.h>
+#include <linux/types.h>
#ifdef CONFIG_MODULES
/* modprobe exit status on success, -ve on error. Return value
--
2.54.0
^ permalink raw reply related
* Re: [PATCH v4] security: Expand task_setscheduler LSM hook
From: Casey Schaufler @ 2026-07-21 14:45 UTC (permalink / raw)
To: Aaron Tomlin, tsbogend, paul, jmorris, serge, mingo, peterz,
juri.lelli, vincent.guittot, stephen.smalley.work, longman, tj,
hannes, mkoutny
Cc: chenridong, dietmar.eggemann, rostedt, bsegall, mgorman, vschneid,
kprateek.nayak, omosnace, kees, neelx, sean, chjohnst, steve,
mproche, nick.lange, cgroups, linux-mips, linux-fsdevel,
linux-security-module, selinux, linux-kernel, Casey Schaufler
In-Reply-To: <20260720014156.459386-1-atomlin@atomlin.com>
On 7/19/2026 6:41 PM, Aaron Tomlin wrote:
> At present, the task_setscheduler LSM hook provides security modules
> with the opportunity to mediate changes to a task's scheduling policy by
> inspecting the requested sched_attr. However, when invoked via
> sched_setaffinity(), the hook lacks visibility into the actual CPU
> affinity mask being requested. Consequently, security modules are
> entirely blind to the target CPUs and cannot make granular access
> control decisions based on spatial isolation.
>
> In modern multi-tenant and real-time environments, CPU isolation is a
> critical boundary. The inability to audit or restrict specific CPU
> pinning requests limits the effectiveness of security policies,
> particularly when attempting to shield isolated or cryptographic cores
> from unprivileged or compromised tasks.
>
> This patch expands the security_task_setscheduler() hook signature to
> include a pointer to the requested cpumask alongside the existing
> sched_attr. Because this is a shared hook used for multiple scheduling
> attribute changes, call sites that do not modify CPU affinity are
> updated to safely pass NULL for the mask. To protect against unverified
> dereferences, the parameter is annotated with __nullable in the LSM hook
> definition, ensuring the BPF verifier mandates explicit NULL checks for
> attached eBPF programs.
>
> Historically, SELinux has governed all scheduling alterations under a
> single, monolithic PROCESS__SETSCHED access vector. However, by
> inspecting fields such as attr->sched_policy or attr->sched_priority, a
> security module can introduce granular access controls. For instance,
> differentiating between standard time-sharing policies and
> latency-sensitive real-time policies.
>
> This change updates all in-tree security modules (SELinux and Smack) to
> accommodate the new parameter mechanically, while providing LSMs with
> the necessary context to enforce strict affinity policies.
>
> Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
> ---
> Changes since v3:
>
> - Expanded the task_setscheduler LSM hook to accept the 'sched_attr'
> payload, enabling BPF and other LSMs to inspect scheduling attributes
> (Peter Zijlstra)
>
> - Updated all call sites for security_task_setscheduler() to correctly
> pass the attr structure when available, or NULL otherwise
> (Peter Zijlstra)
>
> - Added the necessary forward declaration for struct sched_attr to
> include/linux/security.h
>
> - Linked to v3: https://lore.kernel.org/lkml/20260526142838.774711-1-atomlin@atomlin.com/
>
> Changes since v2:
>
> - Dropped patch 1. This is to be addressed by the cgroup cpuset
> maintainer (Waiman Long)
>
> - Dropped patch 3. Will be submitted as a separate patch (Paul Moore)
>
> - Linked to v2: https://lore.kernel.org/lkml/20260509213803.968464-1-atomlin@atomlin.com/
>
> Changes since v1:
>
> - Reordered the allocation and user-copy of new_mask in the MIPS
> architecture's mipsmt_sys_sched_setaffinity() to occur before the
> LSM hook is invoked. This ensures the security modules evaluate a fully
> populated mask rather than uninitialised memory, while cleanly handling
> error unwinding
>
> - Updated cpuset_can_fork() to pass the destination cpuset's effective CPU
> mask instead of NULL
>
> - Linked to v1: https://lore.kernel.org/lkml/20260509164847.939294-1-atomlin@atomlin.com/
>
> Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
For the (trivial) Smack changes:
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
> ---
> arch/mips/kernel/mips-mt-fpaff.c | 2 +-
> fs/proc/base.c | 2 +-
> include/linux/lsm_hook_defs.h | 4 +++-
> include/linux/security.h | 15 +++++++++++----
> kernel/cgroup/cpuset.c | 4 ++--
> kernel/sched/syscalls.c | 4 ++--
> security/commoncap.c | 9 +++++++--
> security/security.c | 14 +++++++++-----
> security/selinux/hooks.c | 4 +++-
> security/smack/smack_lsm.c | 13 +++++++++++--
> 10 files changed, 50 insertions(+), 21 deletions(-)
>
> diff --git a/arch/mips/kernel/mips-mt-fpaff.c b/arch/mips/kernel/mips-mt-fpaff.c
> index 4fead87d2f43..c7a5d55cf7ca 100644
> --- a/arch/mips/kernel/mips-mt-fpaff.c
> +++ b/arch/mips/kernel/mips-mt-fpaff.c
> @@ -110,7 +110,7 @@ asmlinkage long mipsmt_sys_sched_setaffinity(pid_t pid, unsigned int len,
> goto out_unlock;
> }
>
> - retval = security_task_setscheduler(p);
> + retval = security_task_setscheduler(p, NULL, new_mask);
> if (retval)
> goto out_unlock;
>
> diff --git a/fs/proc/base.c b/fs/proc/base.c
> index 780f81259052..b14401030e5c 100644
> --- a/fs/proc/base.c
> +++ b/fs/proc/base.c
> @@ -2589,7 +2589,7 @@ static ssize_t timerslack_ns_write(struct file *file, const char __user *buf,
> }
> rcu_read_unlock();
>
> - err = security_task_setscheduler(p);
> + err = security_task_setscheduler(p, NULL, NULL);
> if (err) {
> count = err;
> goto out;
> diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
> index 65c9609ec207..80ca02879620 100644
> --- a/include/linux/lsm_hook_defs.h
> +++ b/include/linux/lsm_hook_defs.h
> @@ -255,7 +255,9 @@ LSM_HOOK(int, 0, task_prlimit, const struct cred *cred,
> const struct cred *tcred, unsigned int flags)
> LSM_HOOK(int, 0, task_setrlimit, struct task_struct *p, unsigned int resource,
> struct rlimit *new_rlim)
> -LSM_HOOK(int, 0, task_setscheduler, struct task_struct *p)
> +LSM_HOOK(int, 0, task_setscheduler, struct task_struct *p,
> + const struct sched_attr *attr__nullable,
> + const struct cpumask *in_mask__nullable)
> LSM_HOOK(int, 0, task_getscheduler, struct task_struct *p)
> LSM_HOOK(int, 0, task_movememory, struct task_struct *p)
> LSM_HOOK(int, 0, task_kill, struct task_struct *p, struct kernel_siginfo *info,
> diff --git a/include/linux/security.h b/include/linux/security.h
> index 153e9043058f..82dfe4e3f8d1 100644
> --- a/include/linux/security.h
> +++ b/include/linux/security.h
> @@ -82,6 +82,7 @@ struct ctl_table;
> struct audit_krule;
> struct user_namespace;
> struct timezone;
> +struct sched_attr;
>
> enum lsm_event {
> LSM_POLICY_CHANGE,
> @@ -196,7 +197,9 @@ extern int cap_mmap_addr(unsigned long addr);
> extern int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags);
> extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
> unsigned long arg4, unsigned long arg5);
> -extern int cap_task_setscheduler(struct task_struct *p);
> +extern int cap_task_setscheduler(struct task_struct *p,
> + const struct sched_attr *attr,
> + const struct cpumask *in_mask);
> extern int cap_task_setioprio(struct task_struct *p, int ioprio);
> extern int cap_task_setnice(struct task_struct *p, int nice);
> extern int cap_vm_enough_memory(struct mm_struct *mm, long pages);
> @@ -531,7 +534,9 @@ int security_task_prlimit(const struct cred *cred, const struct cred *tcred,
> unsigned int flags);
> int security_task_setrlimit(struct task_struct *p, unsigned int resource,
> struct rlimit *new_rlim);
> -int security_task_setscheduler(struct task_struct *p);
> +int security_task_setscheduler(struct task_struct *p,
> + const struct sched_attr *attr,
> + const struct cpumask *in_mask);
> int security_task_getscheduler(struct task_struct *p);
> int security_task_movememory(struct task_struct *p);
> int security_task_kill(struct task_struct *p, struct kernel_siginfo *info,
> @@ -1393,9 +1398,11 @@ static inline int security_task_setrlimit(struct task_struct *p,
> return 0;
> }
>
> -static inline int security_task_setscheduler(struct task_struct *p)
> +static inline int security_task_setscheduler(struct task_struct *p,
> + const struct sched_attr *attr,
> + const struct cpumask *in_mask)
> {
> - return cap_task_setscheduler(p);
> + return cap_task_setscheduler(p, attr, in_mask);
> }
>
> static inline int security_task_getscheduler(struct task_struct *p)
> diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
> index 45944b3e31ca..6ab47cf5582b 100644
> --- a/kernel/cgroup/cpuset.c
> +++ b/kernel/cgroup/cpuset.c
> @@ -3042,7 +3042,7 @@ static int cpuset_can_attach(struct cgroup_taskset *tset)
> goto out_unlock;
>
> if (setsched_check) {
> - ret = security_task_setscheduler(task);
> + ret = security_task_setscheduler(task, NULL, cs->effective_cpus);
> if (ret)
> goto out_unlock;
> }
> @@ -3600,7 +3600,7 @@ static int cpuset_can_fork(struct task_struct *task, struct css_set *cset)
> if (ret)
> goto out_unlock;
>
> - ret = security_task_setscheduler(task);
> + ret = security_task_setscheduler(task, NULL, cs->effective_cpus);
> if (ret)
> goto out_unlock;
>
> diff --git a/kernel/sched/syscalls.c b/kernel/sched/syscalls.c
> index b215b0ead9a6..86490035e815 100644
> --- a/kernel/sched/syscalls.c
> +++ b/kernel/sched/syscalls.c
> @@ -540,7 +540,7 @@ int __sched_setscheduler(struct task_struct *p,
> if (attr->sched_flags & SCHED_FLAG_SUGOV)
> return -EINVAL;
>
> - retval = security_task_setscheduler(p);
> + retval = security_task_setscheduler(p, attr, NULL);
> if (retval)
> return retval;
> }
> @@ -1213,7 +1213,7 @@ long sched_setaffinity(pid_t pid, const struct cpumask *in_mask)
> return -EPERM;
> }
>
> - retval = security_task_setscheduler(p);
> + retval = security_task_setscheduler(p, NULL, in_mask);
> if (retval)
> return retval;
>
> diff --git a/security/commoncap.c b/security/commoncap.c
> index 3399535808fe..d83eee0459fe 100644
> --- a/security/commoncap.c
> +++ b/security/commoncap.c
> @@ -1222,13 +1222,18 @@ static int cap_safe_nice(struct task_struct *p)
> /**
> * cap_task_setscheduler - Determine if scheduler policy change is permitted
> * @p: The task to affect
> + * @attr: Requested scheduling attributes (ignored)
> + * @in_mask: Requested CPU affinity mask (ignored)
> *
> * Determine if the requested scheduler policy change is permitted for the
> - * specified task.
> + * specified task. The capabilities security module does not evaluate the
> + * @attr or @in_mask parameters, relying solely on cap_safe_nice().
> *
> * Return: 0 if permission is granted, -ve if denied.
> */
> -int cap_task_setscheduler(struct task_struct *p)
> +int cap_task_setscheduler(struct task_struct *p,
> + const struct sched_attr *attr __always_unused,
> + const struct cpumask *in_mask __always_unused)
> {
> return cap_safe_nice(p);
> }
> diff --git a/security/security.c b/security/security.c
> index 71aea8fdf014..a6725dddc34f 100644
> --- a/security/security.c
> +++ b/security/security.c
> @@ -3240,17 +3240,21 @@ int security_task_setrlimit(struct task_struct *p, unsigned int resource,
> }
>
> /**
> - * security_task_setscheduler() - Check if setting sched policy/param is allowed
> + * security_task_setscheduler() - Check if setting sched policy/param/affinity is allowed
> * @p: target task
> + * @attr: requested scheduling attributes, or NULL if not changing parameters
> + * @in_mask: requested CPU affinity mask, or NULL if not changing affinity
> *
> - * Check permission before setting scheduling policy and/or parameters of
> - * process @p.
> + * Check permission before setting the scheduling policy, parameters, and/or
> + * CPU affinity of process @p.
> *
> * Return: Returns 0 if permission is granted.
> */
> -int security_task_setscheduler(struct task_struct *p)
> +int security_task_setscheduler(struct task_struct *p,
> + const struct sched_attr *attr,
> + const struct cpumask *in_mask)
> {
> - return call_int_hook(task_setscheduler, p);
> + return call_int_hook(task_setscheduler, p, attr, in_mask);
> }
>
> /**
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 8d6945edae7a..d77a8d5c364c 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -4559,7 +4559,9 @@ static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
> return 0;
> }
>
> -static int selinux_task_setscheduler(struct task_struct *p)
> +static int selinux_task_setscheduler(struct task_struct *p,
> + const struct sched_attr *attr __always_unused,
> + const struct cpumask *in_mask __always_unused)
> {
> return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
> PROCESS__SETSCHED, NULL);
> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
> index ff115068c5c0..cf28ccc28b80 100644
> --- a/security/smack/smack_lsm.c
> +++ b/security/smack/smack_lsm.c
> @@ -2338,10 +2338,19 @@ static int smack_task_getioprio(struct task_struct *p)
> /**
> * smack_task_setscheduler - Smack check on setting scheduler
> * @p: the task object
> + * @attr: Requested scheduling attributes (ignored)
> + * @in_mask: Requested CPU affinity mask (ignored)
> *
> - * Return 0 if read access is permitted
> + * Evaluate whether the current task has write access to the target task @p
> + * to change its scheduling policy. The Smack security module relies
> + * strictly on label-based access control and does not evaluate CPU
> + * affinity masks or scheduling attributes.
> + *
> + * Return: 0 if write access is permitted
> */
> -static int smack_task_setscheduler(struct task_struct *p)
> +static int smack_task_setscheduler(struct task_struct *p,
> + const struct sched_attr *attr __always_unused,
> + const struct cpumask *in_mask __always_unused)
> {
> return smk_curacc_on_task(p, MAY_WRITE, __func__);
> }
^ permalink raw reply
* Re: [PATCH v3 1/2] treewide: Add a flag to detect the Apple T2 chip
From: Hans de Goede @ 2026-07-21 15:29 UTC (permalink / raw)
To: Atharva Tiwari
Cc: Bjorn Helgaas, Thomas Gleixner, Ingo Molnar, Borislav Petkov,
Dave Hansen, x86, H. Peter Anvin, Andreas Noever, Mika Westerberg,
Yehezkel Bernat, Ilpo Järvinen, Jarkko Sakkinen, Mimi Zohar,
Roberto Sassu, Dmitry Kasatkin, Eric Snowberg, Paul Moore,
James Morris, Serge E. Hallyn, linux-pci, linux-kernel, linux-usb,
platform-driver-x86, linux-integrity, keyrings,
linux-security-module
In-Reply-To: <20260721063412.11588-2-atharvatiwarilinuxdev@gmail.com>
Hi,
On 21-Jul-26 08:34, Atharva Tiwari wrote:
> Add a flag to detect Apple T2 chips on Intel Macs.
> Cache the result to avoid repeated checks. That will
> be used in upcoming patches.
>
> Signed-off-by: Atharva Tiwari <atharvatiwarilinuxdev@gmail.com>
> ---
> arch/x86/kernel/quirks.c | 105 ++++++++++++++++++
> include/linux/platform_data/x86/apple.h | 5 +
> .../platform_certs/keyring_handler.h | 8 --
> security/integrity/platform_certs/load_uefi.c | 38 ++-----
> 4 files changed, 118 insertions(+), 38 deletions(-)
>
> diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c
> index a92f18db9610..300d6436060d 100644
> --- a/arch/x86/kernel/quirks.c
> +++ b/arch/x86/kernel/quirks.c
> @@ -664,8 +664,113 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2083, quirk_intel_purley_xeon_ras
> bool x86_apple_machine;
> EXPORT_SYMBOL(x86_apple_machine);
>
> +bool has_apple_t2_chip;
> +EXPORT_SYMBOL(has_apple_t2_chip);
> +
> +static const struct dmi_system_id apple_t2_devices[] __initconst = {
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,2"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,3"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,4"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,2"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,3"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,4"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,2"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir9,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "Macmini8,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "MacPro7,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "iMac20,1"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "iMac20,2"),
> + },
> + },
> + {
> + .matches = {
> + DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
> + DMI_MATCH(DMI_PRODUCT_NAME, "iMacPro1,1"),
> + },
> + },
> + { }
> +};
> +
This takes quite a bit of storage, struct dmi_system_id is not
very efficient.
How about making this a NULL terminated array of strings:
const char *apple_t2_devices[] __initconst = {
"MacBookPro15,1",
...
"iMacPro1,1",
NULL
};
> void __init early_platform_quirks(void)
> {
> x86_apple_machine = dmi_match(DMI_SYS_VENDOR, "Apple Inc.") ||
> dmi_match(DMI_SYS_VENDOR, "Apple Computer, Inc.");
> +
> + has_apple_t2_chip = dmi_check_system(apple_t2_devices);
and then here:
for (int i = 0; x86_apple_machine && apple_t2_devices[i]; i++)
if (dmi_match(DMI_PRODUCT_NAME, apple_t2_devices[i])) {
has_apple_t2_chip = true;
break;
}
This should save some space and IMHO just having a compact list of
product-names is more readable too.
Regards,
Hans
> }
> diff --git a/include/linux/platform_data/x86/apple.h b/include/linux/platform_data/x86/apple.h
> index 079e816c3c21..47b27dceab18 100644
> --- a/include/linux/platform_data/x86/apple.h
> +++ b/include/linux/platform_data/x86/apple.h
> @@ -6,8 +6,13 @@
> * x86_apple_machine - whether the machine is an x86 Apple Macintosh
> */
> extern bool x86_apple_machine;
> +/**
> + * has_apple_t2_chip - whether the machine has the Apple T2 chip
> + */
> +extern bool has_apple_t2_chip;
> #else
> #define x86_apple_machine false
> +#define has_apple_t2_chip false
> #endif
>
> #endif
> diff --git a/security/integrity/platform_certs/keyring_handler.h b/security/integrity/platform_certs/keyring_handler.h
> index f92895cc50f6..a355f4400179 100644
> --- a/security/integrity/platform_certs/keyring_handler.h
> +++ b/security/integrity/platform_certs/keyring_handler.h
> @@ -45,11 +45,3 @@ efi_element_handler_t get_handler_for_code_signing_keys(const efi_guid_t *sig_ty
> efi_element_handler_t get_handler_for_dbx(const efi_guid_t *sig_type);
>
> #endif
> -
> -#ifndef UEFI_QUIRK_SKIP_CERT
> -#define UEFI_QUIRK_SKIP_CERT(vendor, product) \
> - .matches = { \
> - DMI_MATCH(DMI_BOARD_VENDOR, vendor), \
> - DMI_MATCH(DMI_PRODUCT_NAME, product), \
> - },
> -#endif
> diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c
> index c0d6948446c3..b4096d4c828d 100644
> --- a/security/integrity/platform_certs/load_uefi.c
> +++ b/security/integrity/platform_certs/load_uefi.c
> @@ -3,42 +3,16 @@
> #include <linux/kernel.h>
> #include <linux/sched.h>
> #include <linux/cred.h>
> -#include <linux/dmi.h>
> #include <linux/err.h>
> #include <linux/efi.h>
> #include <linux/slab.h>
> #include <linux/ima.h>
> +#include <linux/platform_data/x86/apple.h>
> #include <keys/asymmetric-type.h>
> #include <keys/system_keyring.h>
> #include "../integrity.h"
> #include "keyring_handler.h"
>
> -/*
> - * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot
> - * certificates causes occurrence of a page fault in Apple's firmware and
> - * a crash disabling EFI runtime services. The following quirk skips reading
> - * these variables.
> - */
> -static const struct dmi_system_id uefi_skip_cert[] = {
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,2") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,3") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro15,4") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,2") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,3") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookPro16,4") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir8,2") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacBookAir9,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "Macmini8,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "MacPro7,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,1") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMac20,2") },
> - { UEFI_QUIRK_SKIP_CERT("Apple Inc.", "iMacPro1,1") },
> - { }
> -};
> -
> /*
> * Look to see if a UEFI variable called MokIgnoreDB exists and return true if
> * it does.
> @@ -165,10 +139,14 @@ static int __init load_uefi_certs(void)
> unsigned long dbsize = 0, dbxsize = 0, mokxsize = 0;
> efi_status_t status;
> int rc = 0;
> - const struct dmi_system_id *dmi_id;
>
> - dmi_id = dmi_first_match(uefi_skip_cert);
> - if (dmi_id) {
> + /*
> + * On T2 Macs reading the db and dbx efi variables to load UEFI Secure Boot
> + * certificates causes occurrence of a page fault in Apple's firmware and
> + * a crash disabling EFI runtime services. The following quirk skips reading
> + * these variables.
> + */
> + if (has_apple_t2_chip) {
> pr_err("Reading UEFI Secure Boot Certs is not supported on T2 Macs.\n");
> return false;
> }
^ permalink raw reply
* Re: unix_stream_connect and socket address resolution
From: John Ericson @ 2026-07-21 20:37 UTC (permalink / raw)
To: David Laight
Cc: Kuniyuki Iwashima, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Cong Wang, Simon Horman, Christian Brauner,
David Rheinsberg, Andy Lutomirski, Sergei Zimmerman, network dev,
Mickaël Salaün, Günther Noack, Paul Moore,
linux-security-module, LKML
In-Reply-To: <85991dc3-6fa5-4466-a0cb-b407291cdb44@app.fastmail.com>
In case this is useful or interesting to anyone, I deep a some history
spelunking, and the restart logic in question seems to date back to
Import 2.2.4pre6:
https://github.com/tbodt/linux-history/commit/7d4fc34b9bbc0a14d3e5f6b2f978373422e1ca8a#diff-0553d076c243e06ae312480cb8cb52f1cebe1d80fc099d3842593e12c9e0d4f3
---
@@ -673,9 +703,25 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
we will have to recheck all again in any case.
*/
+restart:
/* Find listening sock */
other=unix_find_other(sunaddr, addr_len, sk->type, hash, &err);
+ if (!other)
+ return -ECONNREFUSED;
+
+ while (other->ack_backlog >= other->max_ack_backlog) {
+ unix_unlock(other);
+ if (other->dead || other->state != TCP_LISTEN)
+ return -ECONNREFUSED;
+ if (flags & O_NONBLOCK)
+ return -EAGAIN;
+ interruptible_sleep_on(&unix_ack_wqueue);
+ if (signal_pending(current))
+ return -ERESTARTSYS;
+ goto restart;
+ }
+
/* create new sock for complete connection */
newsk = unix_create1(NULL, 1);
@@ -704,7 +750,7 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
/* Check that listener is in valid state. */
err = -ECONNREFUSED;
- if (other == NULL || other->dead || other->state != TCP_LISTEN)
+ if (other->dead || other->state != TCP_LISTEN)
goto out;
err = -ENOMEM;
---
My question can be basically restated: why should the `restart` label
not go *after* the `unix_find_other` call?
Cheers,
John
^ permalink raw reply
* Re: [RFC PATCH 06/20] bpf: lsm: Add Landlock kfuncs
From: Justin Suess @ 2026-07-21 21:55 UTC (permalink / raw)
To: Paul Moore
Cc: Mickaël Salaün, ast, daniel, andrii, kpsingh, viro,
brauner, kees, gnoack, jack, jmorris, serge, song, yonghong.song,
martin.lau, m, eddyz87, john.fastabend, sdf, skhan, bpf,
linux-security-module, linux-kernel, linux-fsdevel,
Frederick Lawler
In-Reply-To: <CAHC9VhRp6pvQXskNU0FXBkDw=MAF8Ht1Mk7BbUeU8JnEkSk52g@mail.gmail.com>
On Wed, Jul 01, 2026 at 02:33:26PM -0400, Paul Moore wrote:
> On Wed, Jul 1, 2026 at 2:29 PM Justin Suess <utilityemal77@gmail.com> wrote:
> > On Wed, Jul 01, 2026 at 09:28:22AM -0400, Paul Moore wrote:
> > > On Wed, Jul 1, 2026 at 8:52 AM Justin Suess <utilityemal77@gmail.com> wrote:
> > > > On Wed, Jul 01, 2026 at 08:12:34AM -0400, Paul Moore wrote:
> > > > > On Wed, Jul 1, 2026 at 6:59 AM Mickaël Salaün <mic@digikod.net> wrote:
> > > > > > On Tue, Apr 07, 2026 at 04:01:28PM -0400, Justin Suess wrote:
> [..]
>
> Please keep in mind that the LSM framework API needs to be reasonably
> generic. We've got some general guidance on adding new LSM hooks at
> the link below:
>
> https://github.com/LinuxSecurityModule/kernel/blob/main/README.md#new-lsm-hooks
>
Howdy,
I'd like to reopen this conversation with a fresh proposal.
Apologies it's been a while.. hope this isn't too long.
I've re-read the LSM design documents linked above, plus some of the
older discussions where similar things were proposed, and this is a
redesign I'd like feedback on before wasting time prototyping.
Background
==========
Refresher (since it's been a minute):
The original RFC exposed kfuncs (non-ABI functions callable
from sleepable BPF LSM programs) straight out of security/landlock, to
apply a userspace-created Landlock ruleset to a binprm during exec.
That skipped the LSM framework entirely and was basically a direct
line into one LSM.
Paul and Casey, as I understand it your objection breaks down into
two parts:
1. LSM configuration/policy interfaces shouldn't exist outside the
LSM framework. If every LSM grows its own kernel-internal API
surface it gets messy and hard to refactor.
2. Anything at the framework level has to be reasonably generic. From
the design docs:
"Hooks should be designed to be LSM agnostic. While it is possible
that only one LSM might implement the hook at the time of
submission, the hook's behavior should be generic enough that
other LSMs could provide a meaningful implementation."
The proposal here should meet this better.
Proposal
========
Broadly, I am seeking to propose an LSM framework API for kfuncs.
This would be ALL through the existing LSM hook interface.
Instead of individual LSMs exporting kfuncs, the LSM framework exports
all LSM kfuncs and dispatches them to LSMs through generic LSM hooks.
Here's an ASCII diagram (hopefully it doesn't get mangled)
of the framework:
bpf_landlock_restrict_binprm(bprm, ruleset, flags)
|
| strongly BTF-typed
| (struct bpf_landlock_ruleset *)
v
+-------------------------------------------------------------+
| LSM framework |
| |
| security/lsm_kfuncs.c (owns all kfuncs) |
| - kfunc filter: prog type / sleepable / LSM enabled? |
| - type erasure: ruleset -> void *policy |
| | |
| v |
| security_kfunc_enforce_bprm_policy(LSM_ID_LANDLOCK, |
| bprm, policy, flags) |
| | |
| lsm_for_each_hook: | dispatch by lsm_id |
| +---------------+---------------+ |
| | | | |
+--------|---------------|---------------|--------------------+
v v v
id != lsm_id id != lsm_id id == LSM_ID_LANDLOCK
(skipped) (skipped) |
v
+-------------------------------------------------------------+
| security/landlock |
| |
| LSM_HOOK_INIT(kfunc_enforce_bprm_policy, |
| hook_enforce_bprm_policy) |
| - applies ruleset, staged to bprm_committing_creds |
+-------------------------------------------------------------+
no LSM matches / hook not implemented -> -EOPNOTSUPP
1. The LSM framework owns the kfuncs.
Individual LSMs never register or export a kfunc. All kfuncs live
under security/ (say security/lsm_kfuncs.c) and go through the LSM
tree. LSMs only ever implement ordinary LSM hooks, via
LSM_HOOK_INIT() like anything else. No LSM touches BPF.
The kfuncs break down into two categories:
a. kfuncs that talk to the LSM framework itself and no specific
LSM. There's already userspace precedent for this category in
the LSM syscalls (lsm_list_modules() etc). To be honest
category (a) may not need any kfuncs at all to start with; I'm
including it for completeness of the model :)
b. kfuncs that carry a policy operation to one specific LSM.
Applying a Landlock ruleset to a binprm (this series), or
hypothetically loading an AppArmor profile. The kfunc from
this series is one of these:
bpf_landlock_restrict_binprm(struct linux_binprm *bprm,
const struct bpf_landlock_ruleset *ruleset,
u32 flags);
2. Either way, every kfunc call passes through a generic LSM hook. No
kfunc calls directly into an individual LSM. The shim in
security/security.c (or other lsm framework owned file) is the
only caller of the hook.
3. Category (a) kfuncs map 1:1 onto an LSM hook. The framework
dispatches to every LSM implementing the hook and returns the
collective verdict, same as any hook today.
4. Category (b) kfuncs follow the existing
security_getprocattr()/security_setprocattr() precedent: a generic
hook dispatched by LSM id. For the Landlock case the shim would
look something like:
int security_kfunc_enforce_bprm_policy(int lsm_id,
struct linux_binprm *bprm,
void *policy,
u32 flags);
dispatched by lsm_id:
lsm_for_each_hook(scall, kfunc_enforce_bprm_policy) {
if (scall->hl->lsmid->id != lsm_id)
continue;
return scall->hl->hook.kfunc_enforce_bprm_policy(bprm,
policy, flags);
}
return -EOPNOTSUPP;
The hook is generic in that any LSM with a notion of a per-task or
per-exec policy object can implement it. Landlock implements it
like any other hook:
LSM_HOOK_INIT(kfunc_enforce_bprm_policy,
hook_enforce_bprm_policy),
Critically, Landlock only receives hook calls with a matching
LSM_ID, so another LSM implementing the same hook never sees calls
meant for a different kfunc.
5. Type safety at the kfunc boundary is preserved.
Note the asymmetry between the kfunc signature and the hook
signature above: the kfunc the BPF verifier sees stays strongly
BTF-typed (struct bpf_landlock_ruleset *), so BPF programs get
full verifier type checking and can't pass an arbitrary pointer.
This also avoids a user facing multiplexer.
The erasure to void * happens inside the shim, after the verifier
has already guaranteed the pointer's type, and the receiving LSM
(picked by lsm_id) is the only LSM that will ever see it. Think
the relationship setprocattr has with its string payloads, just
with stronger (BPF verifier-enforced) typing on the kfunc side.
6. The shim checks that the target LSM is actually enabled at
runtime, and that the calling context is OK (i.e. implementing a
kfunc filter). This is centralized to make it easier for review
from both LSM and BPF subsystems.
BPF Side
=========
Alexei / Song / Kumar / BPF maintainers,
Even if this proposal doesn't touch kernel/bpf/, I still would
need to hear your feedback / review on this every bit as much
as I need to hear the LSM side.
I think the kfunc / kptr model with strong typing fits this well.
We can have reference counted and strongly typed policy objects
for the LSMs, and kfuncs give more flexibility for API deprecation
as they are not considered to be ABI like helpers...
Obviously any new kfunc / kptr would need to be reviewed by BPF tree
especially with regards to kptr lifetimes and the calling context.
But hopefully this centralizes the interface that would otherwise be an
ad-hoc mess of individual LSMs trying to define kfuncs willy-nilly and
causing regressions.
One particular point that I would need to know is what should happen if
an LSM is not loaded / compiled in, but the kfunc is called. Is a
verifier rejection acceptible? Or is a runtime error more appropriate
for this?
Thanks,
Justin
^ permalink raw reply
* Re: unix_stream_connect and socket address resolution
From: Günther Noack @ 2026-07-22 7:25 UTC (permalink / raw)
To: John Ericson
Cc: David Laight, Kuniyuki Iwashima, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Cong Wang, Simon Horman,
Christian Brauner, David Rheinsberg, Andy Lutomirski,
Sergei Zimmerman, network dev, Mickaël Salaün,
Günther Noack, Paul Moore, linux-security-module, LKML
In-Reply-To: <9c437c7c-7919-41e2-9161-fc94803a9b34@app.fastmail.com>
Hello John!
On Tue, Jul 21, 2026 at 04:37:07PM -0400, John Ericson wrote:
> In case this is useful or interesting to anyone, I deep a some history
> spelunking, and the restart logic in question seems to date back to
> Import 2.2.4pre6:
>
> https://github.com/tbodt/linux-history/commit/7d4fc34b9bbc0a14d3e5f6b2f978373422e1ca8a#diff-0553d076c243e06ae312480cb8cb52f1cebe1d80fc099d3842593e12c9e0d4f3
>
> ---
> @@ -673,9 +703,25 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
> we will have to recheck all again in any case.
> */
>
> +restart:
> /* Find listening sock */
> other=unix_find_other(sunaddr, addr_len, sk->type, hash, &err);
>
> + if (!other)
> + return -ECONNREFUSED;
> +
> + while (other->ack_backlog >= other->max_ack_backlog) {
> + unix_unlock(other);
> + if (other->dead || other->state != TCP_LISTEN)
> + return -ECONNREFUSED;
> + if (flags & O_NONBLOCK)
> + return -EAGAIN;
> + interruptible_sleep_on(&unix_ack_wqueue);
> + if (signal_pending(current))
> + return -ERESTARTSYS;
> + goto restart;
> + }
> +
> /* create new sock for complete connection */
> newsk = unix_create1(NULL, 1);
>
> @@ -704,7 +750,7 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
>
> /* Check that listener is in valid state. */
> err = -ECONNREFUSED;
> - if (other == NULL || other->dead || other->state != TCP_LISTEN)
> + if (other->dead || other->state != TCP_LISTEN)
> goto out;
>
> err = -ENOMEM;
> ---
>
> My question can be basically restated: why should the `restart` label
> not go *after* the `unix_find_other` call?
To elaborate on David Laights answer -- the classic way of restarting
a Unix Domain socket server is that the server unlink(2)s the socket
file and then bind(2)s the address again. In other words, when the
server restarts, the new instance offers the service on a socket file
with the same name but it's technically a *fresh* socket file. So a
"normal" server restart is not technically that different to the
example you gave in your earlier mail (the "File system version").
Another variant of this is one where the server uses rename(2) to
switch out the socket file atomically during restart.
I was not around when that af_unix code was written, and cannot
guarantee that by interpretation is correct, but in the hope that
someone will point it out if it's totally bogus: My interpretation is
that the "goto restart" loop in af_unix.c is designed to smoothen the
server restart cases in a way so that the client doesn't have to deal
with manual system call restarts. That loop needs to include the
repeated vfs lookup so that it actually gets the socket that belongs
to the fresh socket file. (Otherwise it would just observe the same
SOCK_DEAD socket from the old server process again. - The new server
serves from a new struct socket.)
Example Scenario, where a client connect(2) races with the shutdown of
an old server during an "atomic" (rename(2)) server restart:
* Old server process serves on /foo/bar.sock
* New server process starts up
* New server process binds (and creates) /foo/bar.sock.tmp
* Client runs connect(2) to /foo/bar.sock,
does the unix_find_other lookup, getting the old server's socket
* New server process renames /foo/bar.sock.tmp to /foo/bar.sock
* Old server process shuts down, socket transitions to SOCK_DEAD
through unix_release() -> unix_release_sock() -> sock_orphan()
* Client connect(2) syscall checks the socket and discovers the
SOCK_DEAD state, because it still holds a pointer to the old server
socket.
To recover from this, connect(2) does the VFS lookup again, because
the already looked up dead socket isn't coming back. The connect(2)
function pretends that it ran a tiny bit later and only observed the
new socket.
In this scenario, the userspace server is already going to great
lengths to make the switch atomic - it would be surprising IMHO if the
connect(2) operation could still return errors to userspace due to
race conditions in that case.
Again, this is just my own interpretation. I also did not find any
better documentation on this. If I am wrong, I am more than happy to
be corrected. :)
–Günther
^ permalink raw reply
* Re: unix_stream_connect and socket address resolution
From: David Laight @ 2026-07-22 10:05 UTC (permalink / raw)
To: John Ericson
Cc: Kuniyuki Iwashima, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Cong Wang, Simon Horman, Christian Brauner,
David Rheinsberg, Andy Lutomirski, Sergei Zimmerman, network dev,
Mickaël Salaün, Günther Noack, Paul Moore,
linux-security-module, LKML
In-Reply-To: <9c437c7c-7919-41e2-9161-fc94803a9b34@app.fastmail.com>
On Tue, 21 Jul 2026 16:37:07 -0400
"John Ericson" <mail@johnericson.me> wrote:
> In case this is useful or interesting to anyone, I deep a some history
> spelunking, and the restart logic in question seems to date back to
> Import 2.2.4pre6:
>
> https://github.com/tbodt/linux-history/commit/7d4fc34b9bbc0a14d3e5f6b2f978373422e1ca8a#diff-0553d076c243e06ae312480cb8cb52f1cebe1d80fc099d3842593e12c9e0d4f3
>
> ---
> @@ -673,9 +703,25 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
> we will have to recheck all again in any case.
> */
>
> +restart:
> /* Find listening sock */
> other=unix_find_other(sunaddr, addr_len, sk->type, hash, &err);
>
> + if (!other)
> + return -ECONNREFUSED;
> +
> + while (other->ack_backlog >= other->max_ack_backlog) {
> + unix_unlock(other);
This unlocks the socket - I doubt it makes sense to sleep with it locked.
> + if (other->dead || other->state != TCP_LISTEN)
> + return -ECONNREFUSED;
Those look like potential UAF.
Hopefully changed in the current code!
> + if (flags & O_NONBLOCK)
> + return -EAGAIN;
> + interruptible_sleep_on(&unix_ack_wqueue);
> + if (signal_pending(current))
> + return -ERESTARTSYS;
> + goto restart;
Since 'other' was unlocked the search must be repated.
David
> + }
> +
> /* create new sock for complete connection */
> newsk = unix_create1(NULL, 1);
>
> @@ -704,7 +750,7 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
>
> /* Check that listener is in valid state. */
> err = -ECONNREFUSED;
> - if (other == NULL || other->dead || other->state != TCP_LISTEN)
> + if (other->dead || other->state != TCP_LISTEN)
> goto out;
>
> err = -ENOMEM;
> ---
>
> My question can be basically restated: why should the `restart` label
> not go *after* the `unix_find_other` call?
>
> Cheers,
>
> John
>
^ permalink raw reply
* [PATCH 0/6] landlock: Add POSIX message queue scoping
From: Oxana Kharitonova @ 2026-07-22 12:29 UTC (permalink / raw)
To: mic, gnoack
Cc: paul, jmorris, serge, wangyan01, linux-security-module,
linux-kernel, landlock, oxana, webprosto
Hi,
This series adds landlock support for scoping POSIX message queuesi [1].
Landlock already supports scoped IPC restrictions for signals and abstract
UNIX sockets. These restrictions make it possible to prevent a sandboxed
task from interacting with IPC objects outside of its Landlock domain,
while still allowing communication within the same domain or with nested
domains.
This series extends the same model to POSIX message queues with a new
LANDLOCK_SCOPE_POSIX_MSG_QUEUE scope. When this scope is enforced, a task
can only open POSIX message queues that were created by a task in the same
landlock domain or in a nested domain.
The implementation tags mqueuefs inodes at creation time with the creator's
landlock domain. This domain is kept alive for the lifetime of the inode
and is checked when the queue is opened.
The series also exposes the mqueuefs magic number through the shared UAPI
magic header, bumps the Landlock ABI, updates documentation, adds sandboxer
support, and adds selftests.
The new behavior is:
- a task restricted with LANDLOCK_SCOPE_POSIX_MSG_QUEUE cannot open a queue
created outside of its Landlock scope;
- a task can still open a queue created within its own Landlock domain;
- queues created outside of any Landlock domain are treated as outside the
scope for a scoped opener.
[1] https://man7.org/linux/man-pages/man7/mq_overview.7.html
Oxana Kharitonova (6):
ipc: Move mqueue fs magic to uapi magic header
landlock: Scope POSIX message queue opens
landlock: Bump ABI for LANDLOCK_SCOPE_POSIX_MSG_QUEUE
selftests/landlock: Test POSIX message queue scoping
samples/landlock: Support POSIX message queue scoping
landlock: Document POSIX message queue scoping
Documentation/admin-guide/LSM/landlock.rst | 6 +-
Documentation/userspace-api/landlock.rst | 11 +-
include/uapi/linux/landlock.h | 7 +-
include/uapi/linux/magic.h | 2 +
ipc/mqueue.c | 2 +-
samples/landlock/sandboxer.c | 16 +-
security/landlock/audit.c | 9 +
security/landlock/audit.h | 1 +
security/landlock/fs.c | 35 +++
security/landlock/fs.h | 15 ++
security/landlock/limits.h | 2 +-
security/landlock/ruleset.c | 1 -
security/landlock/syscalls.c | 2 +-
security/landlock/task.c | 43 ++++
security/landlock/task.h | 4 +
tools/testing/selftests/landlock/base_test.c | 2 +-
.../landlock/scoped_posix_msg_queue_test.c | 223 ++++++++++++++++++
.../testing/selftests/landlock/scoped_test.c | 2 +-
18 files changed, 371 insertions(+), 12 deletions(-)
create mode 100644 tools/testing/selftests/landlock/scoped_posix_msg_queue_test.c
--
2.50.1 (Apple Git-155)
^ permalink raw reply
* [PATCH 1/6] ipc: Move mqueue fs magic to uapi magic header
From: Oxana Kharitonova @ 2026-07-22 12:29 UTC (permalink / raw)
To: mic, gnoack
Cc: paul, jmorris, serge, wangyan01, linux-security-module,
linux-kernel, landlock, oxana, webprosto
In-Reply-To: <20260722122952.42149-1-oxana@cloudflare.com>
Move MQUEUE_MAGIC from ipc/mqueue.c to include/uapi/linux/magic.h so
it can be shared by code outside of ipc/mqueue.c without duplicating
the constant.
Signed-off-by: Oxana Kharitonova <oxana@cloudflare.com>
---
include/uapi/linux/magic.h | 2 ++
ipc/mqueue.c | 2 +-
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/include/uapi/linux/magic.h b/include/uapi/linux/magic.h
index 4f2da935a76c..8e5d33bb1453 100644
--- a/include/uapi/linux/magic.h
+++ b/include/uapi/linux/magic.h
@@ -78,6 +78,8 @@
#define V9FS_MAGIC 0x01021997
+#define MQUEUE_MAGIC 0x19800202
+
#define BDEVFS_MAGIC 0x62646576
#define DAXFS_MAGIC 0x64646178
#define BINFMTFS_MAGIC 0x42494e4d
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 4798b375972b..9515597d45ce 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -22,6 +22,7 @@
#include <linux/sysctl.h>
#include <linux/poll.h>
#include <linux/mqueue.h>
+#include <linux/magic.h>
#include <linux/msg.h>
#include <linux/skbuff.h>
#include <linux/vmalloc.h>
@@ -47,7 +48,6 @@ struct mqueue_fs_context {
bool newns; /* Set if newly created ipc namespace */
};
-#define MQUEUE_MAGIC 0x19800202
#define DIRENT_SIZE 20
#define FILENT_SIZE 80
--
2.50.1 (Apple Git-155)
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox