lkml.org 
[lkml]   [2022]   [Nov]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v2] LSM: Better reporting of actual LSMs at boot
    Date
    Enhance the details reported by "lsm.debug" in several ways:

    - report contents of "security="
    - report contents of "CONFIG_LSM"
    - report contents of "lsm="
    - report any early LSM details
    - whitespace-align the output of similar phases for easier visual parsing
    - change "disabled" to more accurate "skipped"
    - explain what "skipped" and "ignored" mean in a parenthetical

    Upgrade the "security= is ignored" warning from pr_info to pr_warn,
    and include full arguments list to make the cause even more clear.

    Replace static "Security Framework initializing" pr_info with specific
    list of the resulting order of enabled LSMs.

    For example, if the kernel is built with:

    CONFIG_SECURITY_SELINUX=y
    CONFIG_SECURITY_APPARMOR=y
    CONFIG_SECURITY_LOADPIN=y
    CONFIG_SECURITY_YAMA=y
    CONFIG_SECURITY_SAFESETID=y
    CONFIG_SECURITY_LOCKDOWN_LSM=y
    CONFIG_SECURITY_LANDLOCK=y
    CONFIG_INTEGRITY=y
    CONFIG_BPF_LSM=y
    CONFIG_DEFAULT_SECURITY_APPARMOR=y
    CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"

    Booting without options will show:

    LSM: initializing lsm=lockdown,capability,landlock,yama,loadpin,safesetid,integrity,selinux,bpf
    landlock: Up and running.
    Yama: becoming mindful.
    LoadPin: ready to pin (currently not enforcing)
    SELinux: Initializing.
    LSM support for eBPF active

    Boot with "lsm.debug" will show:

    LSM: legacy security= *unspecified*
    LSM: CONFIG_LSM=landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf
    LSM: boot arg lsm= *unspecified*
    LSM: early started: lockdown (enabled)
    LSM: first ordered: capability (enabled)
    LSM: builtin ordered: landlock (enabled)
    LSM: builtin ignored: lockdown (not built into kernel)
    LSM: builtin ordered: yama (enabled)
    LSM: builtin ordered: loadpin (enabled)
    LSM: builtin ordered: safesetid (enabled)
    LSM: builtin ordered: integrity (enabled)
    LSM: builtin ordered: selinux (enabled)
    LSM: builtin ignored: smack (not built into kernel)
    LSM: builtin ignored: tomoyo (not built into kernel)
    LSM: builtin ordered: apparmor (enabled)
    LSM: builtin ordered: bpf (enabled)
    LSM: exclusive chosen: selinux
    LSM: exclusive disabled: apparmor
    LSM: initializing lsm=lockdown,capability,landlock,yama,loadpin,safesetid,integrity,selinux,bpf
    LSM: cred blob size = 32
    LSM: file blob size = 16
    LSM: inode blob size = 72
    LSM: ipc blob size = 8
    LSM: msg_msg blob size = 4
    LSM: superblock blob size = 80
    LSM: task blob size = 8
    LSM: initializing capability
    LSM: initializing landlock
    landlock: Up and running.
    LSM: initializing yama
    Yama: becoming mindful.
    LSM: initializing loadpin
    LoadPin: ready to pin (currently not enforcing)
    LSM: initializing safesetid
    LSM: initializing integrity
    LSM: initializing selinux
    SELinux: Initializing.
    LSM: initializing bpf
    LSM support for eBPF active

    And some examples of how the lsm.debug ordering report changes...

    With "lsm.debug security=selinux":

    LSM: legacy security=selinux
    LSM: CONFIG_LSM=landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf
    LSM: boot arg lsm= *unspecified*
    LSM: early started: lockdown (enabled)
    LSM: first ordered: capability (enabled)
    LSM: security=selinux disabled: apparmor (only one legacy major LSM)
    LSM: builtin ordered: landlock (enabled)
    LSM: builtin ignored: lockdown (not built into kernel)
    LSM: builtin ordered: yama (enabled)
    LSM: builtin ordered: loadpin (enabled)
    LSM: builtin ordered: safesetid (enabled)
    LSM: builtin ordered: integrity (enabled)
    LSM: builtin ordered: selinux (enabled)
    LSM: builtin ignored: smack (not built into kernel)
    LSM: builtin ignored: tomoyo (not built into kernel)
    LSM: builtin ordered: apparmor (disabled)
    LSM: builtin ordered: bpf (enabled)
    LSM: exclusive chosen: selinux
    LSM: initializing lsm=lockdown,capability,landlock,yama,loadpin,safesetid,integrity,selinux,bpf

    With "lsm.debug lsm=integrity,selinux,loadpin,crabability,bpf,loadpin,loadpin":

    LSM: legacy security= *unspecified*
    LSM: CONFIG_LSM=landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf
    LSM: boot arg lsm=integrity,selinux,loadpin,capability,bpf,loadpin,loadpin
    LSM: early started: lockdown (enabled)
    LSM: first ordered: capability (enabled)
    LSM: cmdline ordered: integrity (enabled)
    LSM: cmdline ordered: selinux (enabled)
    LSM: cmdline ordered: loadpin (enabled)
    LSM: cmdline ignored: crabability (not built into kernel)
    LSM: cmdline ordered: bpf (enabled)
    LSM: cmdline skipped: apparmor (not in requested order)
    LSM: cmdline skipped: yama (not in requested order)
    LSM: cmdline skipped: safesetid (not in requested order)
    LSM: cmdline skipped: landlock (not in requested order)
    LSM: exclusive chosen: selinux
    LSM: initializing lsm=lockdown,capability,integrity,selinux,loadpin,bpf

    Cc: Paul Moore <paul@paul-moore.com>
    Cc: James Morris <jmorris@namei.org>
    Cc: "Serge E. Hallyn" <serge@hallyn.com>
    Cc: linux-security-module@vger.kernel.org
    Signed-off-by: Kees Cook <keescook@chromium.org>
    ---
    v2: en/dis-enabled expanded, example output in commit log, use pr_cont.
    v1: https://lore.kernel.org/lkml/20221018064825.never.323-kees@kernel.org/
    ---
    security/security.c | 45 ++++++++++++++++++++++++++++++++++++---------
    1 file changed, 36 insertions(+), 9 deletions(-)

    diff --git a/security/security.c b/security/security.c
    index 79d82cb6e469..abceabda103d 100644
    --- a/security/security.c
    +++ b/security/security.c
    @@ -161,8 +161,8 @@ static void __init append_ordered_lsm(struct lsm_info *lsm, const char *from)
    lsm->enabled = &lsm_enabled_true;
    ordered_lsms[last_lsm++] = lsm;

    - init_debug("%s ordering: %s (%sabled)\n", from, lsm->name,
    - is_enabled(lsm) ? "en" : "dis");
    + init_debug("%s ordered: %s (%s)\n", from, lsm->name,
    + is_enabled(lsm) ? "enabled" : "disabled");
    }

    /* Is an LSM allowed to be initialized? */
    @@ -224,7 +224,7 @@ static void __init prepare_lsm(struct lsm_info *lsm)
    if (enabled) {
    if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && !exclusive) {
    exclusive = lsm;
    - init_debug("exclusive chosen: %s\n", lsm->name);
    + init_debug("exclusive chosen: %s\n", lsm->name);
    }

    lsm_set_blob_sizes(lsm->blobs);
    @@ -252,7 +252,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
    /* LSM_ORDER_FIRST is always first. */
    for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
    if (lsm->order == LSM_ORDER_FIRST)
    - append_ordered_lsm(lsm, "first");
    + append_ordered_lsm(lsm, " first");
    }

    /* Process "security=", if given. */
    @@ -270,7 +270,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
    if ((major->flags & LSM_FLAG_LEGACY_MAJOR) &&
    strcmp(major->name, chosen_major_lsm) != 0) {
    set_enabled(major, false);
    - init_debug("security=%s disabled: %s\n",
    + init_debug("security=%s disabled: %s (only one legacy major LSM)\n",
    chosen_major_lsm, major->name);
    }
    }
    @@ -291,7 +291,8 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
    }

    if (!found)
    - init_debug("%s ignored: %s\n", origin, name);
    + init_debug("%s ignored: %s (not built into kernel)\n",
    + origin, name);
    }

    /* Process "security=", if given. */
    @@ -309,7 +310,8 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
    if (exists_ordered_lsm(lsm))
    continue;
    set_enabled(lsm, false);
    - init_debug("%s disabled: %s\n", origin, lsm->name);
    + init_debug("%s skipped: %s (not in requested order)\n",
    + origin, lsm->name);
    }

    kfree(sep);
    @@ -320,6 +322,24 @@ static void __init lsm_early_task(struct task_struct *task);

    static int lsm_append(const char *new, char **result);

    +static void __init report_lsm_order(void)
    +{
    + struct lsm_info **lsm, *early;
    + int first = 0;
    +
    + pr_info("initializing lsm=");
    +
    + /* Report each enabled LSM name, comma separated. */
    + for (early = __start_early_lsm_info; early < __end_early_lsm_info; early++)
    + if (is_enabled(early))
    + pr_cont("%s%s", first++ == 0 ? "" : ",", early->name);
    + for (lsm = ordered_lsms; *lsm; lsm++)
    + if (is_enabled(*lsm))
    + pr_cont("%s%s", first++ == 0 ? "" : ",", (*lsm)->name);
    +
    + pr_cont("\n");
    +}
    +
    static void __init ordered_lsm_init(void)
    {
    struct lsm_info **lsm;
    @@ -329,7 +349,8 @@ static void __init ordered_lsm_init(void)

    if (chosen_lsm_order) {
    if (chosen_major_lsm) {
    - pr_info("security= is ignored because it is superseded by lsm=\n");
    + pr_warn("security=%s is ignored because it is superseded by lsm=%s\n",
    + chosen_major_lsm, chosen_lsm_order);
    chosen_major_lsm = NULL;
    }
    ordered_lsm_parse(chosen_lsm_order, "cmdline");
    @@ -339,6 +360,8 @@ static void __init ordered_lsm_init(void)
    for (lsm = ordered_lsms; *lsm; lsm++)
    prepare_lsm(*lsm);

    + report_lsm_order();
    +
    init_debug("cred blob size = %d\n", blob_sizes.lbs_cred);
    init_debug("file blob size = %d\n", blob_sizes.lbs_file);
    init_debug("inode blob size = %d\n", blob_sizes.lbs_inode);
    @@ -395,13 +418,17 @@ int __init security_init(void)
    {
    struct lsm_info *lsm;

    - pr_info("Security Framework initializing\n");
    + init_debug("legacy security=%s\n", chosen_major_lsm ?: " *unspecified*");
    + init_debug(" CONFIG_LSM=%s\n", builtin_lsm_order);
    + init_debug("boot arg lsm=%s\n", chosen_lsm_order ?: " *unspecified*");

    /*
    * Append the names of the early LSM modules now that kmalloc() is
    * available
    */
    for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) {
    + init_debug(" early started: %s (%s)\n", lsm->name,
    + is_enabled(lsm) ? "enabled" : "disabled");
    if (lsm->enabled)
    lsm_append(lsm->name, &lsm_names);
    }
    --
    2.34.1
    \
     
     \ /
      Last update: 2022-11-02 01:06    [W:3.494 / U:1.256 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site