kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-13 07:31:07 +00:00
Code Issues Releases Packages Activity
linux/security/lsm_init.c

559 lines
14 KiB
Raw Normal View History

lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: rework the LSM enable/disable setter/getter functions In addition to style changes, rename set_enabled() to lsm_enabled_set() and is_enabled() to lsm_is_enabled() to better fit within the LSM initialization code. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-04-10 22:04:26 -04:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: fold lsm_init_ordered() into security_init() With only security_init() calling lsm_init_ordered, it makes little sense to keep lsm_init_ordered() as a standalone function. Fold lsm_init_ordered() into security_init(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:10:37 -05:00
lsm: rename the lsm order variables for consistency Rename the builtin_lsm_order variable to lsm_order_builtin, chosen_lsm_order to lsm_order_cmdline, chosen_major_lsm to lsm_order_legacy, ordered_lsms[] to lsm_order[], and exclusive to lsm_exclusive. This patch also renames the associated kernel command line parsing functions and adds some basic function comment blocks. The parsing function choose_major_lsm() was renamed to lsm_choose_security(), choose_lsm_order() to lsm_choose_lsm(), and enable_debug() to lsm_debug_enable(). Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 17:13:26 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: rename the lsm order variables for consistency Rename the builtin_lsm_order variable to lsm_order_builtin, chosen_lsm_order to lsm_order_cmdline, chosen_major_lsm to lsm_order_legacy, ordered_lsms[] to lsm_order[], and exclusive to lsm_exclusive. This patch also renames the associated kernel command line parsing functions and adds some basic function comment blocks. The parsing function choose_major_lsm() was renamed to lsm_choose_security(), choose_lsm_order() to lsm_choose_lsm(), and enable_debug() to lsm_debug_enable(). Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 17:13:26 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: introduce looping macros for the initialization code There are three common for loop patterns in the LSM initialization code to loop through the ordered LSM list and the registered "early" LSMs. This patch implements these loop patterns as macros to help simplify the code and reduce the chance for errors. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-04-09 17:59:42 -04:00
lsm: rename the lsm order variables for consistency Rename the builtin_lsm_order variable to lsm_order_builtin, chosen_lsm_order to lsm_order_cmdline, chosen_major_lsm to lsm_order_legacy, ordered_lsms[] to lsm_order[], and exclusive to lsm_exclusive. This patch also renames the associated kernel command line parsing functions and adds some basic function comment blocks. The parsing function choose_major_lsm() was renamed to lsm_choose_security(), choose_lsm_order() to lsm_choose_lsm(), and enable_debug() to lsm_debug_enable(). Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 17:13:26 -05:00
lsm: introduce looping macros for the initialization code There are three common for loop patterns in the LSM initialization code to loop through the ordered LSM list and the registered "early" LSMs. This patch implements these loop patterns as macros to help simplify the code and reduce the chance for errors. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-04-09 17:59:42 -04:00
lsm: introduce an initcall mechanism into the LSM framework Currently the individual LSMs register their own initcalls, and while this should be harmless, it can be wasteful in the case where a LSM is disabled at boot as the initcall will still be executed. This patch introduces support for managing the initcalls in the LSM framework, and future patches will convert the existing LSMs over to this new mechanism. Only initcall types which are used by the current in-tree LSMs are supported, additional initcall types can easily be added in the future if needed. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 12:18:35 -05:00
lsm: rename the lsm order variables for consistency Rename the builtin_lsm_order variable to lsm_order_builtin, chosen_lsm_order to lsm_order_cmdline, chosen_major_lsm to lsm_order_legacy, ordered_lsms[] to lsm_order[], and exclusive to lsm_exclusive. This patch also renames the associated kernel command line parsing functions and adds some basic function comment blocks. The parsing function choose_major_lsm() was renamed to lsm_choose_security(), choose_lsm_order() to lsm_choose_lsm(), and enable_debug() to lsm_debug_enable(). Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 17:13:26 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: rename the lsm order variables for consistency Rename the builtin_lsm_order variable to lsm_order_builtin, chosen_lsm_order to lsm_order_cmdline, chosen_major_lsm to lsm_order_legacy, ordered_lsms[] to lsm_order[], and exclusive to lsm_exclusive. This patch also renames the associated kernel command line parsing functions and adds some basic function comment blocks. The parsing function choose_major_lsm() was renamed to lsm_choose_security(), choose_lsm_order() to lsm_choose_lsm(), and enable_debug() to lsm_debug_enable(). Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 17:13:26 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: rename the lsm order variables for consistency Rename the builtin_lsm_order variable to lsm_order_builtin, chosen_lsm_order to lsm_order_cmdline, chosen_major_lsm to lsm_order_legacy, ordered_lsms[] to lsm_order[], and exclusive to lsm_exclusive. This patch also renames the associated kernel command line parsing functions and adds some basic function comment blocks. The parsing function choose_major_lsm() was renamed to lsm_choose_security(), choose_lsm_order() to lsm_choose_lsm(), and enable_debug() to lsm_debug_enable(). Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 17:13:26 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: rename the lsm order variables for consistency Rename the builtin_lsm_order variable to lsm_order_builtin, chosen_lsm_order to lsm_order_cmdline, chosen_major_lsm to lsm_order_legacy, ordered_lsms[] to lsm_order[], and exclusive to lsm_exclusive. This patch also renames the associated kernel command line parsing functions and adds some basic function comment blocks. The parsing function choose_major_lsm() was renamed to lsm_choose_security(), choose_lsm_order() to lsm_choose_lsm(), and enable_debug() to lsm_debug_enable(). Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 17:13:26 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: rename the lsm order variables for consistency Rename the builtin_lsm_order variable to lsm_order_builtin, chosen_lsm_order to lsm_order_cmdline, chosen_major_lsm to lsm_order_legacy, ordered_lsms[] to lsm_order[], and exclusive to lsm_exclusive. This patch also renames the associated kernel command line parsing functions and adds some basic function comment blocks. The parsing function choose_major_lsm() was renamed to lsm_choose_security(), choose_lsm_order() to lsm_choose_lsm(), and enable_debug() to lsm_debug_enable(). Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 17:13:26 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: rename the lsm order variables for consistency Rename the builtin_lsm_order variable to lsm_order_builtin, chosen_lsm_order to lsm_order_cmdline, chosen_major_lsm to lsm_order_legacy, ordered_lsms[] to lsm_order[], and exclusive to lsm_exclusive. This patch also renames the associated kernel command line parsing functions and adds some basic function comment blocks. The parsing function choose_major_lsm() was renamed to lsm_choose_security(), choose_lsm_order() to lsm_choose_lsm(), and enable_debug() to lsm_debug_enable(). Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 17:13:26 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: rename the lsm order variables for consistency Rename the builtin_lsm_order variable to lsm_order_builtin, chosen_lsm_order to lsm_order_cmdline, chosen_major_lsm to lsm_order_legacy, ordered_lsms[] to lsm_order[], and exclusive to lsm_exclusive. This patch also renames the associated kernel command line parsing functions and adds some basic function comment blocks. The parsing function choose_major_lsm() was renamed to lsm_choose_security(), choose_lsm_order() to lsm_choose_lsm(), and enable_debug() to lsm_debug_enable(). Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 17:13:26 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: cleanup the debug and console output in lsm_init.c Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:20:01 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: rename the lsm order variables for consistency Rename the builtin_lsm_order variable to lsm_order_builtin, chosen_lsm_order to lsm_order_cmdline, chosen_major_lsm to lsm_order_legacy, ordered_lsms[] to lsm_order[], and exclusive to lsm_exclusive. This patch also renames the associated kernel command line parsing functions and adds some basic function comment blocks. The parsing function choose_major_lsm() was renamed to lsm_choose_security(), choose_lsm_order() to lsm_choose_lsm(), and enable_debug() to lsm_debug_enable(). Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 17:13:26 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: rework the LSM enable/disable setter/getter functions In addition to style changes, rename set_enabled() to lsm_enabled_set() and is_enabled() to lsm_is_enabled() to better fit within the LSM initialization code. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-04-10 22:04:26 -04:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: rework the LSM enable/disable setter/getter functions In addition to style changes, rename set_enabled() to lsm_enabled_set() and is_enabled() to lsm_is_enabled() to better fit within the LSM initialization code. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-04-10 22:04:26 -04:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: rework the LSM enable/disable setter/getter functions In addition to style changes, rename set_enabled() to lsm_enabled_set() and is_enabled() to lsm_is_enabled() to better fit within the LSM initialization code. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-04-10 22:04:26 -04:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: rework the LSM enable/disable setter/getter functions In addition to style changes, rename set_enabled() to lsm_enabled_set() and is_enabled() to lsm_is_enabled() to better fit within the LSM initialization code. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-04-10 22:04:26 -04:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: rename exists_ordered_lsm() to lsm_order_exists() Also add a header comment block to the function. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-07-13 17:37:56 -04:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: introduce looping macros for the initialization code There are three common for loop patterns in the LSM initialization code to loop through the ordered LSM list and the registered "early" LSMs. This patch implements these loop patterns as macros to help simplify the code and reduce the chance for errors. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-04-09 17:59:42 -04:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: introduce looping macros for the initialization code There are three common for loop patterns in the LSM initialization code to loop through the ordered LSM list and the registered "early" LSMs. This patch implements these loop patterns as macros to help simplify the code and reduce the chance for errors. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-04-09 17:59:42 -04:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: rename/rework append_ordered_lsm() into lsm_order_append() Rename append_ordered_lsm() to lsm_order_append() to better match convention and do some rework. The rework includes moving the LSM_FLAG_EXCLUSIVE logic from lsm_prepare() to lsm_order_append() in order to consolidate the individual LSM append/activation code, and adding logic to skip appending explicitly disabled LSMs to the active LSM list. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-07-16 15:04:10 -04:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: rename exists_ordered_lsm() to lsm_order_exists() Also add a header comment block to the function. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-07-13 17:37:56 -04:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: rename/rework append_ordered_lsm() into lsm_order_append() Rename append_ordered_lsm() to lsm_order_append() to better match convention and do some rework. The rework includes moving the LSM_FLAG_EXCLUSIVE logic from lsm_prepare() to lsm_order_append() in order to consolidate the individual LSM append/activation code, and adding logic to skip appending explicitly disabled LSMs to the active LSM list. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-07-16 15:04:10 -04:00
lsm: cleanup the debug and console output in lsm_init.c Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:20:01 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: cleanup the debug and console output in lsm_init.c Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:20:01 -05:00
lsm: rename/rework append_ordered_lsm() into lsm_order_append() Rename append_ordered_lsm() to lsm_order_append() to better match convention and do some rework. The rework includes moving the LSM_FLAG_EXCLUSIVE logic from lsm_prepare() to lsm_order_append() in order to consolidate the individual LSM append/activation code, and adding logic to skip appending explicitly disabled LSMs to the active LSM list. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-07-16 15:04:10 -04:00
lsm: cleanup the debug and console output in lsm_init.c Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:20:01 -05:00
lsm: rename/rework append_ordered_lsm() into lsm_order_append() Rename append_ordered_lsm() to lsm_order_append() to better match convention and do some rework. The rework includes moving the LSM_FLAG_EXCLUSIVE logic from lsm_prepare() to lsm_order_append() in order to consolidate the individual LSM append/activation code, and adding logic to skip appending explicitly disabled LSMs to the active LSM list. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-07-16 15:04:10 -04:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: rename/rework append_ordered_lsm() into lsm_order_append() Rename append_ordered_lsm() to lsm_order_append() to better match convention and do some rework. The rework includes moving the LSM_FLAG_EXCLUSIVE logic from lsm_prepare() to lsm_order_append() in order to consolidate the individual LSM append/activation code, and adding logic to skip appending explicitly disabled LSMs to the active LSM list. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-07-16 15:04:10 -04:00
lsm: cleanup the debug and console output in lsm_init.c Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:20:01 -05:00
lsm: rename/rework append_ordered_lsm() into lsm_order_append() Rename append_ordered_lsm() to lsm_order_append() to better match convention and do some rework. The rework includes moving the LSM_FLAG_EXCLUSIVE logic from lsm_prepare() to lsm_order_append() in order to consolidate the individual LSM append/activation code, and adding logic to skip appending explicitly disabled LSMs to the active LSM list. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-07-16 15:04:10 -04:00
lsm: cleanup the debug and console output in lsm_init.c Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:20:01 -05:00
lsm: rename/rework append_ordered_lsm() into lsm_order_append() Rename append_ordered_lsm() to lsm_order_append() to better match convention and do some rework. The rework includes moving the LSM_FLAG_EXCLUSIVE logic from lsm_prepare() to lsm_order_append() in order to consolidate the individual LSM append/activation code, and adding logic to skip appending explicitly disabled LSMs to the active LSM list. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-07-16 15:04:10 -04:00
lsm: cleanup the debug and console output in lsm_init.c Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:20:01 -05:00
lsm: rename/rework append_ordered_lsm() into lsm_order_append() Rename append_ordered_lsm() to lsm_order_append() to better match convention and do some rework. The rework includes moving the LSM_FLAG_EXCLUSIVE logic from lsm_prepare() to lsm_order_append() in order to consolidate the individual LSM append/activation code, and adding logic to skip appending explicitly disabled LSMs to the active LSM list. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-07-16 15:04:10 -04:00
lsm: cleanup the debug and console output in lsm_init.c Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:20:01 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: group lsm_order_parse() with the other lsm_order_*() functions Move the lsm_order_parse() function near the other lsm_order_*() functions to improve readability. No code changes. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-07-21 16:36:03 -04:00
lsm: cleanup the LSM blob size code Convert the lsm_blob_size fields to unsigned integers as there is no current need for them to be negative, change "lsm_set_blob_size()" to "lsm_blob_size_update()" to better reflect reality, and perform some other minor cleanups to the associated code. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 17:49:11 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: cleanup the LSM blob size code Convert the lsm_blob_size fields to unsigned integers as there is no current need for them to be negative, change "lsm_set_blob_size()" to "lsm_blob_size_update()" to better reflect reality, and perform some other minor cleanups to the associated code. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 17:49:11 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: cleanup the LSM blob size code Convert the lsm_blob_size fields to unsigned integers as there is no current need for them to be negative, change "lsm_set_blob_size()" to "lsm_blob_size_update()" to better reflect reality, and perform some other minor cleanups to the associated code. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 17:49:11 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: cleanup the LSM blob size code Convert the lsm_blob_size fields to unsigned integers as there is no current need for them to be negative, change "lsm_set_blob_size()" to "lsm_blob_size_update()" to better reflect reality, and perform some other minor cleanups to the associated code. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 17:49:11 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() Simplify and consolidate the lsm_allowed() and prepare_lsm() functions into a new function, lsm_prepare(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 12:19:47 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: rename/rework append_ordered_lsm() into lsm_order_append() Rename append_ordered_lsm() to lsm_order_append() to better match convention and do some rework. The rework includes moving the LSM_FLAG_EXCLUSIVE logic from lsm_prepare() to lsm_order_append() in order to consolidate the individual LSM append/activation code, and adding logic to skip appending explicitly disabled LSMs to the active LSM list. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-07-16 15:04:10 -04:00
lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() Simplify and consolidate the lsm_allowed() and prepare_lsm() functions into a new function, lsm_prepare(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 12:19:47 -05:00
lsm: rename/rework append_ordered_lsm() into lsm_order_append() Rename append_ordered_lsm() to lsm_order_append() to better match convention and do some rework. The rework includes moving the LSM_FLAG_EXCLUSIVE logic from lsm_prepare() to lsm_order_append() in order to consolidate the individual LSM append/activation code, and adding logic to skip appending explicitly disabled LSMs to the active LSM list. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-07-16 15:04:10 -04:00
lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() Simplify and consolidate the lsm_allowed() and prepare_lsm() functions into a new function, lsm_prepare(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 12:19:47 -05:00
lsm: cleanup the LSM blob size code Convert the lsm_blob_size fields to unsigned integers as there is no current need for them to be negative, change "lsm_set_blob_size()" to "lsm_blob_size_update()" to better reflect reality, and perform some other minor cleanups to the associated code. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 17:49:11 -05:00
lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() Simplify and consolidate the lsm_allowed() and prepare_lsm() functions into a new function, lsm_prepare(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 12:19:47 -05:00
lsm: cleanup the LSM blob size code Convert the lsm_blob_size fields to unsigned integers as there is no current need for them to be negative, change "lsm_set_blob_size()" to "lsm_blob_size_update()" to better reflect reality, and perform some other minor cleanups to the associated code. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 17:49:11 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: cleanup initialize_lsm() and rename to lsm_init_single() Rename initialize_lsm() to be more consistent with the rest of the LSM initialization changes and rework the function itself to better fit with the "exit on fail" coding pattern. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 18:24:04 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: cleanup initialize_lsm() and rename to lsm_init_single() Rename initialize_lsm() to be more consistent with the rest of the LSM initialization changes and rework the function itself to better fit with the "exit on fail" coding pattern. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 18:24:04 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: cleanup initialize_lsm() and rename to lsm_init_single() Rename initialize_lsm() to be more consistent with the rest of the LSM initialization changes and rework the function itself to better fit with the "exit on fail" coding pattern. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 18:24:04 -05:00
lsm: cleanup the debug and console output in lsm_init.c Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:20:01 -05:00
lsm: cleanup initialize_lsm() and rename to lsm_init_single() Rename initialize_lsm() to be more consistent with the rest of the LSM initialization changes and rework the function itself to better fit with the "exit on fail" coding pattern. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 18:24:04 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: add/tweak function header comment blocks in lsm_init.c Add function header comments for lsm_static_call_init() and early_security_init(), tweak the existing comment block for security_add_hooks(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:17:03 -05:00
lsm: cleanup the debug and console output in lsm_init.c Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:20:01 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: fold lsm_init_ordered() into security_init() With only security_init() calling lsm_init_ordered, it makes little sense to keep lsm_init_ordered() as a standalone function. Fold lsm_init_ordered() into security_init(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:10:37 -05:00
lsm: cleanup the debug and console output in lsm_init.c Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:20:01 -05:00
lsm: fold lsm_init_ordered() into security_init() With only security_init() calling lsm_init_ordered, it makes little sense to keep lsm_init_ordered() as a standalone function. Fold lsm_init_ordered() into security_init(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:10:37 -05:00
lsm: cleanup the debug and console output in lsm_init.c Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:20:01 -05:00
lsm: fold lsm_init_ordered() into security_init() With only security_init() calling lsm_init_ordered, it makes little sense to keep lsm_init_ordered() as a standalone function. Fold lsm_init_ordered() into security_init(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:10:37 -05:00
lsm: add/tweak function header comment blocks in lsm_init.c Add function header comments for lsm_static_call_init() and early_security_init(), tweak the existing comment block for security_add_hooks(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:17:03 -05:00
lsm: fold lsm_init_ordered() into security_init() With only security_init() calling lsm_init_ordered, it makes little sense to keep lsm_init_ordered() as a standalone function. Fold lsm_init_ordered() into security_init(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:10:37 -05:00
lsm: add/tweak function header comment blocks in lsm_init.c Add function header comments for lsm_static_call_init() and early_security_init(), tweak the existing comment block for security_add_hooks(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:17:03 -05:00
lsm: fold lsm_init_ordered() into security_init() With only security_init() calling lsm_init_ordered, it makes little sense to keep lsm_init_ordered() as a standalone function. Fold lsm_init_ordered() into security_init(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:10:37 -05:00
lsm: cleanup the debug and console output in lsm_init.c Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:20:01 -05:00
lsm: fold lsm_init_ordered() into security_init() With only security_init() calling lsm_init_ordered, it makes little sense to keep lsm_init_ordered() as a standalone function. Fold lsm_init_ordered() into security_init(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:10:37 -05:00
lsm: add/tweak function header comment blocks in lsm_init.c Add function header comments for lsm_static_call_init() and early_security_init(), tweak the existing comment block for security_add_hooks(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:17:03 -05:00
lsm: fold lsm_init_ordered() into security_init() With only security_init() calling lsm_init_ordered, it makes little sense to keep lsm_init_ordered() as a standalone function. Fold lsm_init_ordered() into security_init(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:10:37 -05:00
lsm: output available LSMs when debugging This will display all of the LSMs built into the kernel, regardless of if they are enabled or not. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-03-19 16:38:20 -04:00
lsm: fold lsm_init_ordered() into security_init() With only security_init() calling lsm_init_ordered, it makes little sense to keep lsm_init_ordered() as a standalone function. Fold lsm_init_ordered() into security_init(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:10:37 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: fold lsm_init_ordered() into security_init() With only security_init() calling lsm_init_ordered, it makes little sense to keep lsm_init_ordered() as a standalone function. Fold lsm_init_ordered() into security_init(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:10:37 -05:00
lsm: cleanup the debug and console output in lsm_init.c Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:20:01 -05:00
lsm: output available LSMs when debugging This will display all of the LSMs built into the kernel, regardless of if they are enabled or not. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-03-19 16:38:20 -04:00
lsm: cleanup the debug and console output in lsm_init.c Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:20:01 -05:00
lsm: output available LSMs when debugging This will display all of the LSMs built into the kernel, regardless of if they are enabled or not. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-03-19 16:38:20 -04:00
lsm: cleanup the debug and console output in lsm_init.c Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:20:01 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: rename the lsm order variables for consistency Rename the builtin_lsm_order variable to lsm_order_builtin, chosen_lsm_order to lsm_order_cmdline, chosen_major_lsm to lsm_order_legacy, ordered_lsms[] to lsm_order[], and exclusive to lsm_exclusive. This patch also renames the associated kernel command line parsing functions and adds some basic function comment blocks. The parsing function choose_major_lsm() was renamed to lsm_choose_security(), choose_lsm_order() to lsm_choose_lsm(), and enable_debug() to lsm_debug_enable(). Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 17:13:26 -05:00
lsm: cleanup the debug and console output in lsm_init.c Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:20:01 -05:00
lsm: rename the lsm order variables for consistency Rename the builtin_lsm_order variable to lsm_order_builtin, chosen_lsm_order to lsm_order_cmdline, chosen_major_lsm to lsm_order_legacy, ordered_lsms[] to lsm_order[], and exclusive to lsm_exclusive. This patch also renames the associated kernel command line parsing functions and adds some basic function comment blocks. The parsing function choose_major_lsm() was renamed to lsm_choose_security(), choose_lsm_order() to lsm_choose_lsm(), and enable_debug() to lsm_debug_enable(). Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 17:13:26 -05:00
lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() Rename ordered_lsm_parse() to lsm_order_parse() for the sake of consistency with the other LSM initialization routines, and also do some minor rework of the function. Aside from some minor style decisions, the majority of the rework involved shuffling the order of the LSM_FLAG_LEGACY and LSM_ORDER_FIRST code so that the LSM_FLAG_LEGACY checks are handled first; it is important to note that this doesn't affect the order in which the LSMs are registered. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-07-13 17:51:12 -04:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() Rename ordered_lsm_parse() to lsm_order_parse() for the sake of consistency with the other LSM initialization routines, and also do some minor rework of the function. Aside from some minor style decisions, the majority of the rework involved shuffling the order of the LSM_FLAG_LEGACY and LSM_ORDER_FIRST code so that the LSM_FLAG_LEGACY checks are handled first; it is important to note that this doesn't affect the order in which the LSMs are registered. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-07-13 17:51:12 -04:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: fold lsm_init_ordered() into security_init() With only security_init() calling lsm_init_ordered, it makes little sense to keep lsm_init_ordered() as a standalone function. Fold lsm_init_ordered() into security_init(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:10:37 -05:00
lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() Simplify and consolidate the lsm_allowed() and prepare_lsm() functions into a new function, lsm_prepare(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 12:19:47 -05:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: cleanup the debug and console output in lsm_init.c Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:20:01 -05:00
lsm: integrate report_lsm_order() code into caller With only one caller of report_lsm_order(), insert the function's code directly into the caller and ger rid of report_lsm_order(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-07-12 16:10:15 -04:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: use unrcu_pointer() for current->cred in security_init() We need to directly allocate the cred's LSM state for the initial task when we initialize the LSM framework. Unfortunately, this results in a RCU related type mismatch, use the unrcu_pointer() macro to handle this a bit more elegantly. The explicit type casting still remains as we need to work around the constification of current->cred in this particular case. Reviewed-by: Xiu Jianfeng <xiujianfeng@huawei.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-11-18 19:18:10 -05:00
lsm: cleanup the debug and console output in lsm_init.c Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:20:01 -05:00
lsm: integrate lsm_early_cred() and lsm_early_task() into caller With only one caller of lsm_early_cred() and lsm_early_task(), insert the functions' code directly into the caller and ger rid of the two functions. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-07-12 16:27:39 -04:00
lsm: cleanup the debug and console output in lsm_init.c Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:20:01 -05:00
lsm: integrate lsm_early_cred() and lsm_early_task() into caller With only one caller of lsm_early_cred() and lsm_early_task(), insert the functions' code directly into the caller and ger rid of the two functions. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-07-12 16:27:39 -04:00
lsm: fold lsm_init_ordered() into security_init() With only security_init() calling lsm_init_ordered, it makes little sense to keep lsm_init_ordered() as a standalone function. Fold lsm_init_ordered() into security_init(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:10:37 -05:00
lsm: introduce looping macros for the initialization code There are three common for loop patterns in the LSM initialization code to loop through the ordered LSM list and the registered "early" LSMs. This patch implements these loop patterns as macros to help simplify the code and reduce the chance for errors. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-04-09 17:59:42 -04:00
lsm: fold lsm_init_ordered() into security_init() With only security_init() calling lsm_init_ordered, it makes little sense to keep lsm_init_ordered() as a standalone function. Fold lsm_init_ordered() into security_init(). Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-12 18:10:37 -05:00
lsm: cleanup initialize_lsm() and rename to lsm_init_single() Rename initialize_lsm() to be more consistent with the rest of the LSM initialization changes and rework the function itself to better fit with the "exit on fail" coding pattern. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 18:24:04 -05:00
lsm: introduce looping macros for the initialization code There are three common for loop patterns in the LSM initialization code to loop through the ordered LSM list and the registered "early" LSMs. This patch implements these loop patterns as macros to help simplify the code and reduce the chance for errors. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-04-09 17:59:42 -04:00
lsm: split the init code out into lsm_init.c Continue to pull code out of security/security.c to help improve readability by pulling all of the LSM framework initialization code out into a new file. No code changes. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-06 16:44:10 -05:00
lsm: introduce an initcall mechanism into the LSM framework Currently the individual LSMs register their own initcalls, and while this should be harmless, it can be wasteful in the case where a LSM is disabled at boot as the initcall will still be executed. This patch introduces support for managing the initcalls in the LSM framework, and future patches will convert the existing LSMs over to this new mechanism. Only initcall types which are used by the current in-tree LSMs are supported, additional initcall types can easily be added in the future if needed. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 12:18:35 -05:00
lsm: preserve /proc/sys/vm/mmap_min_addr when !CONFIG_SECURITY While reworking the LSM initialization code the /proc/sys/vm/mmap_min_addr handler was inadvertently caught up in the change and the procfs entry wasn't setup when CONFIG_SECURITY was not selected at kernel build time. This patch restores the previous behavior and ensures that the procfs entry is setup regardless of the CONFIG_SECURITY state. Future work will improve upon this, likely by moving the procfs handler into the mm subsystem, but this patch should resolve the immediate regression. Fixes: 4ab5efcc2829 ("lsm: consolidate all of the LSM framework initcalls") Reported-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com> Tested-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com> Reviewed-by: Kees Cook <kees@kernel.org> Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-01-29 13:31:56 -05:00
lsm: introduce an initcall mechanism into the LSM framework Currently the individual LSMs register their own initcalls, and while this should be harmless, it can be wasteful in the case where a LSM is disabled at boot as the initcall will still be executed. This patch introduces support for managing the initcalls in the LSM framework, and future patches will convert the existing LSMs over to this new mechanism. Only initcall types which are used by the current in-tree LSMs are supported, additional initcall types can easily be added in the future if needed. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 12:18:35 -05:00
lsm: consolidate all of the LSM framework initcalls The LSM framework itself registers a small number of initcalls, this patch converts these initcalls into the new initcall mechanism. Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-18 17:25:20 -05:00
lsm: introduce an initcall mechanism into the LSM framework Currently the individual LSMs register their own initcalls, and while this should be harmless, it can be wasteful in the case where a LSM is disabled at boot as the initcall will still be executed. This patch introduces support for managing the initcalls in the LSM framework, and future patches will convert the existing LSMs over to this new mechanism. Only initcall types which are used by the current in-tree LSMs are supported, additional initcall types can easily be added in the future if needed. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 12:18:35 -05:00
lsm: add a LSM_STARTED_ALL notification event Add a new LSM notifier event, LSM_STARTED_ALL, which is fired once at boot when all of the LSMs have been started. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-21 11:53:29 -05:00
lsm: introduce an initcall mechanism into the LSM framework Currently the individual LSMs register their own initcalls, and while this should be harmless, it can be wasteful in the case where a LSM is disabled at boot as the initcall will still be executed. This patch introduces support for managing the initcalls in the LSM framework, and future patches will convert the existing LSMs over to this new mechanism. Only initcall types which are used by the current in-tree LSMs are supported, additional initcall types can easily be added in the future if needed. Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johhansen@canonical.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2025-02-11 12:18:35 -05:00