lkml.org 
[lkml]   [2018]   [Dec]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v5 16/38] LoadPin: Initialize as ordered LSM
    Date
    From: Kees Cook <keescook@chromium.org>

    This converts LoadPin from being a direct "minor" LSM into an ordered LSM.

    Signed-off-by: Kees Cook <keescook@chromium.org>
    Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
    ---
    include/linux/lsm_hooks.h | 5 -----
    security/Kconfig | 39 +--------------------------------------
    security/loadpin/loadpin.c | 8 +++++++-
    security/security.c | 1 -
    4 files changed, 8 insertions(+), 45 deletions(-)

    diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
    index 7d04a0c32011..b565c0c10269 100644
    --- a/include/linux/lsm_hooks.h
    +++ b/include/linux/lsm_hooks.h
    @@ -2092,10 +2092,5 @@ extern void __init yama_add_hooks(void);
    #else
    static inline void __init yama_add_hooks(void) { }
    #endif
    -#ifdef CONFIG_SECURITY_LOADPIN
    -void __init loadpin_add_hooks(void);
    -#else
    -static inline void loadpin_add_hooks(void) { };
    -#endif

    #endif /* ! __LINUX_LSM_HOOKS_H */
    diff --git a/security/Kconfig b/security/Kconfig
    index 41aa0be6142f..566d54215cbe 100644
    --- a/security/Kconfig
    +++ b/security/Kconfig
    @@ -239,46 +239,9 @@ source security/yama/Kconfig

    source security/integrity/Kconfig

    -choice
    - prompt "Default security module"
    - default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX
    - default DEFAULT_SECURITY_SMACK if SECURITY_SMACK
    - default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
    - default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
    - default DEFAULT_SECURITY_DAC
    -
    - help
    - Select the security module that will be used by default if the
    - kernel parameter security= is not specified.
    -
    - config DEFAULT_SECURITY_SELINUX
    - bool "SELinux" if SECURITY_SELINUX=y
    -
    - config DEFAULT_SECURITY_SMACK
    - bool "Simplified Mandatory Access Control" if SECURITY_SMACK=y
    -
    - config DEFAULT_SECURITY_TOMOYO
    - bool "TOMOYO" if SECURITY_TOMOYO=y
    -
    - config DEFAULT_SECURITY_APPARMOR
    - bool "AppArmor" if SECURITY_APPARMOR=y
    -
    - config DEFAULT_SECURITY_DAC
    - bool "Unix Discretionary Access Controls"
    -
    -endchoice
    -
    -config DEFAULT_SECURITY
    - string
    - default "selinux" if DEFAULT_SECURITY_SELINUX
    - default "smack" if DEFAULT_SECURITY_SMACK
    - default "tomoyo" if DEFAULT_SECURITY_TOMOYO
    - default "apparmor" if DEFAULT_SECURITY_APPARMOR
    - default "" if DEFAULT_SECURITY_DAC
    -
    config LSM
    string "Ordered list of enabled LSMs"
    - default "integrity"
    + default "loadpin,integrity,selinux,smack,tomoyo,apparmor"
    help
    A comma-separated list of LSMs, in initialization order.
    Any LSMs left off this list will be ignored. This can be
    diff --git a/security/loadpin/loadpin.c b/security/loadpin/loadpin.c
    index 48f39631b370..055fb0a64169 100644
    --- a/security/loadpin/loadpin.c
    +++ b/security/loadpin/loadpin.c
    @@ -187,13 +187,19 @@ static struct security_hook_list loadpin_hooks[] __lsm_ro_after_init = {
    LSM_HOOK_INIT(kernel_load_data, loadpin_load_data),
    };

    -void __init loadpin_add_hooks(void)
    +static int __init loadpin_init(void)
    {
    pr_info("ready to pin (currently %senforcing)\n",
    enforce ? "" : "not ");
    security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks), "loadpin");
    + return 0;
    }

    +DEFINE_LSM(loadpin) = {
    + .name = "loadpin",
    + .init = loadpin_init,
    +};
    +
    /* Should not be mutable after boot, so not listed in sysfs (perm == 0). */
    module_param(enforce, int, 0);
    MODULE_PARM_DESC(enforce, "Enforce module/firmware pinning");
    diff --git a/security/security.c b/security/security.c
    index 3fac0ff39944..0c092d62cc47 100644
    --- a/security/security.c
    +++ b/security/security.c
    @@ -275,7 +275,6 @@ int __init security_init(void)
    */
    capability_add_hooks();
    yama_add_hooks();
    - loadpin_add_hooks();

    /* Load LSMs in specified order. */
    ordered_lsm_init();
    --
    2.14.5
    \
     
     \ /
      Last update: 2018-12-11 23:47    [W:4.446 / U:0.492 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site