Something went wrong. Try again.
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569// SPDX-License-Identifier: GPL-2.0-or-later/* * LSM initialization functions */
#define pr_fmt(fmt) "LSM: " fmt
#include <linux/init.h>#include <linux/lsm_hooks.h>
#include "lsm.h"
/* LSM enabled constants. */static __initdata int lsm_enabled_true = 1;static __initdata int lsm_enabled_false = 0;
/* Pointers to LSM sections defined in include/asm-generic/vmlinux.lds.h */extern struct lsm_info __start_lsm_info[], __end_lsm_info[];extern struct lsm_info __start_early_lsm_info[], __end_early_lsm_info[];
/* Number of "early" LSMs */static __initdata unsigned int lsm_count_early;
/* Build and boot-time LSM ordering. */static __initconst const char *const lsm_order_builtin = CONFIG_LSM;static __initdata const char *lsm_order_cmdline;static __initdata const char *lsm_order_legacy;
/* Ordered list of LSMs to initialize. */static __initdata struct lsm_info *lsm_order[MAX_LSM_COUNT + 1];static __initdata struct lsm_info *lsm_exclusive;
#define lsm_order_for_each(iter) \ for ((iter) = lsm_order; *(iter); (iter)++)#define lsm_for_each_raw(iter) \ for ((iter) = __start_lsm_info; \ (iter) < __end_lsm_info; (iter)++)#define lsm_early_for_each_raw(iter) \ for ((iter) = __start_early_lsm_info; \ (iter) < __end_early_lsm_info; (iter)++)
#define lsm_initcall(level) \ ({ \ int _r, _rc = 0; \ struct lsm_info **_lp, *_l; \ lsm_order_for_each(_lp) { \ _l = *_lp; \ if (!_l->initcall_##level) \ continue; \ lsm_pr_dbg("running %s %s initcall", \ _l->id->name, #level); \ _r = _l->initcall_##level(); \ if (_r) { \ pr_warn("failed LSM %s %s initcall with errno %d\n", \ _l->id->name, #level, _r); \ if (!_rc) \ _rc = _r; \ } \ } \ _rc; \ })
/** * lsm_choose_security - Legacy "major" LSM selection * @str: kernel command line parameter */static int __init lsm_choose_security(char *str){ lsm_order_legacy = str; return 1;}__setup("security=", lsm_choose_security);
/** * lsm_choose_lsm - Modern LSM selection * @str: kernel command line parameter */static int __init lsm_choose_lsm(char *str){ lsm_order_cmdline = str; return 1;}__setup("lsm=", lsm_choose_lsm);
/** * lsm_debug_enable - Enable LSM framework debugging * @str: kernel command line parameter * * Currently we only provide debug info during LSM initialization, but we may * want to expand this in the future. */static int __init lsm_debug_enable(char *str){ lsm_debug = true; return 1;}__setup("lsm.debug", lsm_debug_enable);
/** * lsm_enabled_set - Mark a LSM as enabled * @lsm: LSM definition * @enabled: enabled flag */static void __init lsm_enabled_set(struct lsm_info *lsm, bool enabled){ /* * When an LSM hasn't configured an enable variable, we can use * a hard-coded location for storing the default enabled state. */ if (!lsm->enabled || lsm->enabled == &lsm_enabled_true || lsm->enabled == &lsm_enabled_false) { lsm->enabled = enabled ? &lsm_enabled_true : &lsm_enabled_false; } else { *lsm->enabled = enabled; }}
/** * lsm_is_enabled - Determine if a LSM is enabled * @lsm: LSM definition */static inline bool lsm_is_enabled(struct lsm_info *lsm){ return (lsm->enabled ? *lsm->enabled : false);}
/** * lsm_order_exists - Determine if a LSM exists in the ordered list * @lsm: LSM definition */static bool __init lsm_order_exists(struct lsm_info *lsm){ struct lsm_info **check;
lsm_order_for_each(check) { if (*check == lsm) return true; }
return false;}
/** * lsm_order_append - Append a LSM to the ordered list * @lsm: LSM definition * @src: source of the addition * * Append @lsm to the enabled LSM array after ensuring that it hasn't been * explicitly disabled, is a duplicate entry, or would run afoul of the * LSM_FLAG_EXCLUSIVE logic. */static void __init lsm_order_append(struct lsm_info *lsm, const char *src){ /* Ignore duplicate selections. */ if (lsm_order_exists(lsm)) return;
/* Skip explicitly disabled LSMs. */ if (lsm->enabled && !lsm_is_enabled(lsm)) { lsm_pr_dbg("skip previously disabled LSM %s:%s\n", src, lsm->id->name); return; }
if (lsm_active_cnt == MAX_LSM_COUNT) { pr_warn("exceeded maximum LSM count on %s:%s\n", src, lsm->id->name); lsm_enabled_set(lsm, false); return; }
if (lsm->flags & LSM_FLAG_EXCLUSIVE) { if (lsm_exclusive) { lsm_pr_dbg("skip exclusive LSM conflict %s:%s\n", src, lsm->id->name); lsm_enabled_set(lsm, false); return; } else { lsm_pr_dbg("select exclusive LSM %s:%s\n", src, lsm->id->name); lsm_exclusive = lsm; } }
lsm_enabled_set(lsm, true); lsm_order[lsm_active_cnt] = lsm; lsm_idlist[lsm_active_cnt++] = lsm->id;
lsm_pr_dbg("enabling LSM %s:%s\n", src, lsm->id->name);}
/** * lsm_order_parse - Parse the comma delimited LSM list * @list: LSM list * @src: source of the list */static void __init lsm_order_parse(const char *list, const char *src){ struct lsm_info *lsm; char *sep, *name, *next;
/* Handle any Legacy LSM exclusions if one was specified. */ if (lsm_order_legacy) { /* * To match the original "security=" behavior, this explicitly * does NOT fallback to another Legacy Major if the selected * one was separately disabled: disable all non-matching * Legacy Major LSMs. */ lsm_for_each_raw(lsm) { if ((lsm->flags & LSM_FLAG_LEGACY_MAJOR) && strcmp(lsm->id->name, lsm_order_legacy)) { lsm_enabled_set(lsm, false); lsm_pr_dbg("skip legacy LSM conflict %s:%s\n", src, lsm->id->name); } } }
/* LSM_ORDER_FIRST */ lsm_for_each_raw(lsm) { if (lsm->order == LSM_ORDER_FIRST) lsm_order_append(lsm, "first"); }
/* Normal or "mutable" LSMs */ sep = kstrdup(list, GFP_KERNEL); next = sep; /* Walk the list, looking for matching LSMs. */ while ((name = strsep(&next, ",")) != NULL) { lsm_for_each_raw(lsm) { if (!strcmp(lsm->id->name, name) && lsm->order == LSM_ORDER_MUTABLE) lsm_order_append(lsm, src); } } kfree(sep);
/* Legacy LSM if specified. */ if (lsm_order_legacy) { lsm_for_each_raw(lsm) { if (!strcmp(lsm->id->name, lsm_order_legacy)) lsm_order_append(lsm, src); } }
/* LSM_ORDER_LAST */ lsm_for_each_raw(lsm) { if (lsm->order == LSM_ORDER_LAST) lsm_order_append(lsm, "last"); }
/* Disable all LSMs not previously enabled. */ lsm_for_each_raw(lsm) { if (lsm_order_exists(lsm)) continue; lsm_enabled_set(lsm, false); lsm_pr_dbg("skip disabled LSM %s:%s\n", src, lsm->id->name); }}
/** * lsm_blob_size_update - Update the LSM blob size and offset information * @sz_req: the requested additional blob size * @sz_cur: the existing blob size */static void __init lsm_blob_size_update(unsigned int *sz_req, unsigned int *sz_cur){ unsigned int offset;
if (*sz_req == 0) return;
offset = ALIGN(*sz_cur, sizeof(void *)); *sz_cur = offset + *sz_req; *sz_req = offset;}
/** * lsm_prepare - Prepare the LSM framework for a new LSM * @lsm: LSM definition */static void __init lsm_prepare(struct lsm_info *lsm){ struct lsm_blob_sizes *blobs = lsm->blobs;
if (!blobs) return;
/* Register the LSM blob sizes. */ blobs = lsm->blobs; lsm_blob_size_update(&blobs->lbs_cred, &blob_sizes.lbs_cred); lsm_blob_size_update(&blobs->lbs_file, &blob_sizes.lbs_file); lsm_blob_size_update(&blobs->lbs_backing_file, &blob_sizes.lbs_backing_file); lsm_blob_size_update(&blobs->lbs_ib, &blob_sizes.lbs_ib); /* inode blob gets an rcu_head in addition to LSM blobs. */ if (blobs->lbs_inode && blob_sizes.lbs_inode == 0) blob_sizes.lbs_inode = sizeof(struct rcu_head); lsm_blob_size_update(&blobs->lbs_inode, &blob_sizes.lbs_inode); lsm_blob_size_update(&blobs->lbs_ipc, &blob_sizes.lbs_ipc); lsm_blob_size_update(&blobs->lbs_key, &blob_sizes.lbs_key); lsm_blob_size_update(&blobs->lbs_msg_msg, &blob_sizes.lbs_msg_msg); lsm_blob_size_update(&blobs->lbs_perf_event, &blob_sizes.lbs_perf_event); lsm_blob_size_update(&blobs->lbs_sock, &blob_sizes.lbs_sock); lsm_blob_size_update(&blobs->lbs_superblock, &blob_sizes.lbs_superblock); lsm_blob_size_update(&blobs->lbs_task, &blob_sizes.lbs_task); lsm_blob_size_update(&blobs->lbs_tun_dev, &blob_sizes.lbs_tun_dev); lsm_blob_size_update(&blobs->lbs_xattr_count, &blob_sizes.lbs_xattr_count); lsm_blob_size_update(&blobs->lbs_bdev, &blob_sizes.lbs_bdev); lsm_blob_size_update(&blobs->lbs_bpf_map, &blob_sizes.lbs_bpf_map); lsm_blob_size_update(&blobs->lbs_bpf_prog, &blob_sizes.lbs_bpf_prog); lsm_blob_size_update(&blobs->lbs_bpf_token, &blob_sizes.lbs_bpf_token);}
/** * lsm_init_single - Initialize a given LSM * @lsm: LSM definition */static void __init lsm_init_single(struct lsm_info *lsm){ int ret;
if (!lsm_is_enabled(lsm)) return;
lsm_pr_dbg("initializing %s\n", lsm->id->name); ret = lsm->init(); WARN(ret, "%s failed to initialize: %d\n", lsm->id->name, ret);}
/** * lsm_static_call_init - Initialize a LSM's static calls * @hl: LSM hook list */static int __init lsm_static_call_init(struct security_hook_list *hl){ struct lsm_static_call *scall = hl->scalls; int i;
for (i = 0; i < MAX_LSM_COUNT; i++) { /* Update the first static call that is not used yet */ if (!scall->hl) { __static_call_update(scall->key, scall->trampoline, hl->hook.lsm_func_addr); scall->hl = hl; static_branch_enable(scall->active); return 0; } scall++; }
return -ENOSPC;}
/** * security_add_hooks - Add a LSM's hooks to the LSM framework's hook lists * @hooks: LSM hooks to add * @count: number of hooks to add * @lsmid: identification information for the LSM * * Each LSM has to register its hooks with the LSM framework. */void __init security_add_hooks(struct security_hook_list *hooks, int count, const struct lsm_id *lsmid){ int i;
for (i = 0; i < count; i++) { hooks[i].lsmid = lsmid; if (lsm_static_call_init(&hooks[i])) panic("exhausted LSM callback slots with LSM %s\n", lsmid->name); }}
/** * early_security_init - Initialize the early LSMs */int __init early_security_init(void){ struct lsm_info *lsm;
/* NOTE: lsm_pr_dbg() doesn't work here as lsm_debug is not yet set */
lsm_early_for_each_raw(lsm) { lsm_enabled_set(lsm, true); lsm_order_append(lsm, "early"); lsm_prepare(lsm); lsm_init_single(lsm); lsm_count_early++; }
return 0;}
/** * security_init - Initializes the LSM framework * * This should be called early in the kernel initialization sequence. */int __init security_init(void){ unsigned int cnt; struct lsm_info **lsm;
if (lsm_debug) { struct lsm_info *i;
cnt = 0; lsm_pr("available LSMs: "); lsm_early_for_each_raw(i) lsm_pr_cont("%s%s(E)", (cnt++ ? "," : ""), i->id->name); lsm_for_each_raw(i) lsm_pr_cont("%s%s", (cnt++ ? "," : ""), i->id->name); lsm_pr_cont("\n");
lsm_pr("built-in LSM config: %s\n", lsm_order_builtin);
lsm_pr("legacy LSM parameter: %s\n", lsm_order_legacy); lsm_pr("boot LSM parameter: %s\n", lsm_order_cmdline);
/* see the note about lsm_pr_dbg() in early_security_init() */ lsm_early_for_each_raw(i) lsm_pr("enabled LSM early:%s\n", i->id->name); }
if (lsm_order_cmdline) { if (lsm_order_legacy) lsm_order_legacy = NULL; lsm_order_parse(lsm_order_cmdline, "cmdline"); } else lsm_order_parse(lsm_order_builtin, "builtin");
lsm_order_for_each(lsm) lsm_prepare(*lsm);
if (lsm_debug) { lsm_pr("blob(cred) size %d\n", blob_sizes.lbs_cred); lsm_pr("blob(file) size %d\n", blob_sizes.lbs_file); lsm_pr("blob(backing_file) size %d\n", blob_sizes.lbs_backing_file); lsm_pr("blob(ib) size %d\n", blob_sizes.lbs_ib); lsm_pr("blob(inode) size %d\n", blob_sizes.lbs_inode); lsm_pr("blob(ipc) size %d\n", blob_sizes.lbs_ipc); lsm_pr("blob(key) size %d\n", blob_sizes.lbs_key); lsm_pr("blob(msg_msg)_size %d\n", blob_sizes.lbs_msg_msg); lsm_pr("blob(sock) size %d\n", blob_sizes.lbs_sock); lsm_pr("blob(superblock) size %d\n", blob_sizes.lbs_superblock); lsm_pr("blob(perf_event) size %d\n", blob_sizes.lbs_perf_event); lsm_pr("blob(task) size %d\n", blob_sizes.lbs_task); lsm_pr("blob(tun_dev) size %d\n", blob_sizes.lbs_tun_dev); lsm_pr("blob(xattr) count %d\n", blob_sizes.lbs_xattr_count); lsm_pr("blob(bdev) size %d\n", blob_sizes.lbs_bdev); lsm_pr("blob(bpf_map) size %d\n", blob_sizes.lbs_bpf_map); lsm_pr("blob(bpf_prog) size %d\n", blob_sizes.lbs_bpf_prog); lsm_pr("blob(bpf_token) size %d\n", blob_sizes.lbs_bpf_token); }
if (blob_sizes.lbs_file) lsm_file_cache = kmem_cache_create("lsm_file_cache", blob_sizes.lbs_file, 0, SLAB_PANIC, NULL); if (blob_sizes.lbs_backing_file) lsm_backing_file_cache = kmem_cache_create( "lsm_backing_file_cache", blob_sizes.lbs_backing_file, 0, SLAB_PANIC, NULL); if (blob_sizes.lbs_inode) lsm_inode_cache = kmem_cache_create("lsm_inode_cache", blob_sizes.lbs_inode, 0, SLAB_PANIC, NULL);
if (lsm_cred_alloc((struct cred *)unrcu_pointer(current->cred), GFP_KERNEL)) panic("early LSM cred alloc failed\n"); if (lsm_task_alloc(current)) panic("early LSM task alloc failed\n");
cnt = 0; lsm_order_for_each(lsm) { /* skip the "early" LSMs as they have already been setup */ if (cnt++ < lsm_count_early) continue; lsm_init_single(*lsm); }
return 0;}
/** * security_initcall_pure - Run the LSM pure initcalls */static int __init security_initcall_pure(void){ return lsm_initcall(pure);}pure_initcall(security_initcall_pure);
/** * security_initcall_early - Run the LSM early initcalls */static int __init security_initcall_early(void){ return lsm_initcall(early);}early_initcall(security_initcall_early);
/** * security_initcall_core - Run the LSM core initcalls */static int __init security_initcall_core(void){ int rc_sfs, rc_lsm;
rc_sfs = securityfs_init(); rc_lsm = lsm_initcall(core);
return (rc_sfs ? rc_sfs : rc_lsm);}core_initcall(security_initcall_core);
/** * security_initcall_subsys - Run the LSM subsys initcalls */static int __init security_initcall_subsys(void){ return lsm_initcall(subsys);}subsys_initcall(security_initcall_subsys);
/** * security_initcall_fs - Run the LSM fs initcalls */static int __init security_initcall_fs(void){ return lsm_initcall(fs);}fs_initcall(security_initcall_fs);
/** * security_initcall_device - Run the LSM device initcalls */static int __init security_initcall_device(void){ return lsm_initcall(device);}device_initcall(security_initcall_device);
/** * security_initcall_late - Run the LSM late initcalls */static int __init security_initcall_late(void){ int rc;
rc = lsm_initcall(late); lsm_pr_dbg("all enabled LSMs fully activated\n"); call_blocking_lsm_notifier(LSM_STARTED_ALL, NULL);
return rc;}late_initcall(security_initcall_late);