Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

lsm: rename the lsm order variables for consistency 

Rename the builtin_lsm_order variable to lsm_order_builtin,
chosen_lsm_order to lsm_order_cmdline, chosen_major_lsm to
lsm_order_legacy, ordered_lsms[] to lsm_order[], and exclusive
to lsm_exclusive.

This patch also renames the associated kernel command line parsing
functions and adds some basic function comment blocks.  The parsing
function choose_major_lsm() was renamed to lsm_choose_security(),
choose_lsm_order() to lsm_choose_lsm(), and enable_debug() to
lsm_debug_enable().

Reviewed-by: Kees Cook <kees@kernel.org>
Reviewed-by: John Johansen <john.johansen@canonical.com>
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Paul Moore 2025-02-11 17:13:26 -05:00
parent 9f9dc69e06
commit 592b104f9b
1 changed files with 48 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

86
security/lsm_init.c
View File

@ -16,14 +16,14 @@ char *lsm_names;
extern struct lsm_info __start_lsm_info[], __end_lsm_info[];
extern struct lsm_info __start_early_lsm_info[], __end_early_lsm_info[];
/* Boot-time LSM user choice */
static __initconst const char *const builtin_lsm_order = CONFIG_LSM;
static __initdata const char *chosen_lsm_order;
static __initdata const char *chosen_major_lsm;
/* Build and boot-time LSM ordering. */
static __initconst const char *const lsm_order_builtin = CONFIG_LSM;
static __initdata const char *lsm_order_cmdline;
static __initdata const char *lsm_order_legacy;
/* Ordered list of LSMs to initialize. */
static __initdata struct lsm_info *ordered_lsms[MAX_LSM_COUNT + 1];
static __initdata struct lsm_info *exclusive;
static __initdata struct lsm_info *lsm_order[MAX_LSM_COUNT + 1];
static __initdata struct lsm_info *lsm_exclusive;
static __initdata bool debug;
#define init_debug(...) \
@ -33,7 +33,7 @@ static __initdata bool debug;
} while (0)
#define lsm_order_for_each(iter) \
for ((iter) = ordered_lsms; *(iter); (iter)++)
for ((iter) = lsm_order; *(iter); (iter)++)
#define lsm_for_each_raw(iter) \
for ((iter) = __start_lsm_info; \
(iter) < __end_lsm_info; (iter)++)
@ -41,31 +41,41 @@ static __initdata bool debug;
for ((iter) = __start_early_lsm_info; \
(iter) < __end_early_lsm_info; (iter)++)
static int lsm_append(const char *new, char **result);
/* Save user chosen LSM */
static int __init choose_major_lsm(char *str)
/**
* lsm_choose_security - Legacy "major" LSM selection
* @str: kernel command line parameter
*/
static int __init lsm_choose_security(char *str)
{
chosen_major_lsm = str;
lsm_order_legacy = str;
return 1;
}
__setup("security=", choose_major_lsm);
__setup("security=", lsm_choose_security);
/* Explicitly choose LSM initialization order. */
static int __init choose_lsm_order(char *str)
/**
* lsm_choose_lsm - Modern LSM selection
* @str: kernel command line parameter
*/
static int __init lsm_choose_lsm(char *str)
{
chosen_lsm_order = str;
lsm_order_cmdline = str;
return 1;
}
__setup("lsm=", choose_lsm_order);
__setup("lsm=", lsm_choose_lsm);
/* Enable LSM order debugging. */
static int __init enable_debug(char *str)
/**
* lsm_debug_enable - Enable LSM framework debugging
* @str: kernel command line parameter
*
* Currently we only provide debug info during LSM initialization, but we may
* want to expand this in the future.
*/
static int __init lsm_debug_enable(char *str)
{
debug = true;
return 1;
}
__setup("lsm.debug", enable_debug);
__setup("lsm.debug", lsm_debug_enable);
/* Mark an LSM's enabled flag. */
static int lsm_enabled_true __initdata = 1;
@ -127,7 +137,7 @@ static void __init append_ordered_lsm(struct lsm_info *lsm, const char *from)
/* Enable this LSM, if it is not already set. */
if (!lsm->enabled)
lsm->enabled = &lsm_enabled_true;
ordered_lsms[last_lsm] = lsm;
lsm_order[last_lsm] = lsm;
lsm_idlist[last_lsm++] = lsm->id;
init_debug("%s ordered: %s (%s)\n", from, lsm->id->name,
@ -157,7 +167,7 @@ static void __init lsm_prepare(struct lsm_info *lsm)
if (!is_enabled(lsm)) {
set_enabled(lsm, false);
return;
} else if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && exclusive) {
} else if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && lsm_exclusive) {
init_debug("exclusive disabled: %s\n", lsm->id->name);
set_enabled(lsm, false);
return;
@ -165,9 +175,9 @@ static void __init lsm_prepare(struct lsm_info *lsm)
/* Mark the LSM as enabled. */
set_enabled(lsm, true);
if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && !exclusive) {
if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && !lsm_exclusive) {
init_debug("exclusive chosen: %s\n", lsm->id->name);
exclusive = lsm;
lsm_exclusive = lsm;
}
/* Register the LSM blob sizes. */
@ -226,7 +236,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
}
/* Process "security=", if given. */
if (chosen_major_lsm) {
if (lsm_order_legacy) {
struct lsm_info *major;
/*
@ -237,10 +247,10 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
*/
lsm_for_each_raw(major) {
if ((major->flags & LSM_FLAG_LEGACY_MAJOR) &&
strcmp(major->id->name, chosen_major_lsm) != 0) {
strcmp(major->id->name, lsm_order_legacy) != 0) {
set_enabled(major, false);
init_debug("security=%s disabled: %s (only one legacy major LSM)\n",
chosen_major_lsm, major->id->name);
lsm_order_legacy, major->id->name);
}
}
}
@ -265,11 +275,11 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
}
/* Process "security=", if given. */
if (chosen_major_lsm) {
if (lsm_order_legacy) {
lsm_for_each_raw(lsm) {
if (exists_ordered_lsm(lsm))
continue;
if (strcmp(lsm->id->name, chosen_major_lsm) == 0)
if (strcmp(lsm->id->name, lsm_order_legacy) == 0)
append_ordered_lsm(lsm, "security=");
}
}
@ -301,15 +311,15 @@ static void __init lsm_init_ordered(void)
struct lsm_info **lsm;
struct lsm_info *early;
if (chosen_lsm_order) {
if (chosen_major_lsm) {
if (lsm_order_cmdline) {
if (lsm_order_legacy) {
pr_warn("security=%s is ignored because it is superseded by lsm=%s\n",
chosen_major_lsm, chosen_lsm_order);
chosen_major_lsm = NULL;
lsm_order_legacy, lsm_order_cmdline);
lsm_order_legacy = NULL;
}
ordered_lsm_parse(chosen_lsm_order, "cmdline");
ordered_lsm_parse(lsm_order_cmdline, "cmdline");
} else
ordered_lsm_parse(builtin_lsm_order, "builtin");
ordered_lsm_parse(lsm_order_builtin, "builtin");
lsm_order_for_each(lsm) {
lsm_prepare(*lsm);
@ -473,9 +483,9 @@ int __init security_init(void)
{
struct lsm_info *lsm;
init_debug("legacy security=%s\n", chosen_major_lsm ? : " *unspecified*");
init_debug(" CONFIG_LSM=%s\n", builtin_lsm_order);
init_debug("boot arg lsm=%s\n", chosen_lsm_order ? : " *unspecified*");
init_debug("legacy security=%s\n", lsm_order_legacy ? : " *unspecified*");
init_debug(" CONFIG_LSM=%s\n", lsm_order_builtin);
init_debug("boot arg lsm=%s\n", lsm_order_cmdline ? : " *unspecified*");
/*
* Append the names of the early LSM modules now that kmalloc() is