kernel/linux.git/security/lsm_init.c, branch v6.19.11

lsm: preserve /proc/sys/vm/mmap_min_addr when !CONFIG_SECURITY

2026-01-29T18:56:53+00:00

While reworking the LSM initialization code the /proc/sys/vm/mmap_min_addr handler was inadvertently caught up in the change and the procfs entry wasn't setup when CONFIG_SECURITY was not selected at kernel build time. This patch restores the previous behavior and ensures that the procfs entry is setup regardless of the CONFIG_SECURITY state. Future work will improve upon this, likely by moving the procfs handler into the mm subsystem, but this patch should resolve the immediate regression. Fixes: 4ab5efcc2829 ("lsm: consolidate all of the LSM framework initcalls") Reported-by: Lorenzo Stoakes Reviewed-by: Lorenzo Stoakes Tested-by: Lorenzo Stoakes Reviewed-by: Kees Cook Signed-off-by: Paul Moore

lsm: use unrcu_pointer() for current->cred in security_init()

2025-11-19T15:32:06+00:00

We need to directly allocate the cred's LSM state for the initial task when we initialize the LSM framework. Unfortunately, this results in a RCU related type mismatch, use the unrcu_pointer() macro to handle this a bit more elegantly. The explicit type casting still remains as we need to work around the constification of current->cred in this particular case. Reviewed-by: Xiu Jianfeng Signed-off-by: Paul Moore

lsm: add a LSM_STARTED_ALL notification event

2025-10-22T23:24:29+00:00

Add a new LSM notifier event, LSM_STARTED_ALL, which is fired once at boot when all of the LSMs have been started. Reviewed-by: Kees Cook Reviewed-by: Casey Schaufler Reviewed-by: John Johansen Signed-off-by: Paul Moore

lsm: consolidate all of the LSM framework initcalls

2025-10-22T23:24:28+00:00

The LSM framework itself registers a small number of initcalls, this patch converts these initcalls into the new initcall mechanism. Reviewed-by: Casey Schaufler Reviewed-by: John Johansen Signed-off-by: Paul Moore

lsm: introduce an initcall mechanism into the LSM framework

2025-10-22T23:24:24+00:00

Currently the individual LSMs register their own initcalls, and while this should be harmless, it can be wasteful in the case where a LSM is disabled at boot as the initcall will still be executed. This patch introduces support for managing the initcalls in the LSM framework, and future patches will convert the existing LSMs over to this new mechanism. Only initcall types which are used by the current in-tree LSMs are supported, additional initcall types can easily be added in the future if needed. Reviewed-by: Kees Cook Reviewed-by: Casey Schaufler Reviewed-by: John Johansen Reviewed-by: Mimi Zohar Signed-off-by: Paul Moore

lsm: group lsm_order_parse() with the other lsm_order_*() functions

2025-10-22T23:24:24+00:00

Move the lsm_order_parse() function near the other lsm_order_*() functions to improve readability. No code changes. Reviewed-by: Casey Schaufler Reviewed-by: John Johansen Reviewed-by: Mimi Zohar Signed-off-by: Paul Moore

lsm: output available LSMs when debugging

2025-10-22T23:24:23+00:00

This will display all of the LSMs built into the kernel, regardless of if they are enabled or not. Reviewed-by: Casey Schaufler Reviewed-by: John Johansen Reviewed-by: Mimi Zohar Signed-off-by: Paul Moore

lsm: cleanup the debug and console output in lsm_init.c

2025-10-22T23:24:23+00:00

Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat. Reviewed-by: Casey Schaufler Reviewed-by: John Johansen Signed-off-by: Paul Moore

lsm: add/tweak function header comment blocks in lsm_init.c

2025-10-22T23:24:23+00:00

Add function header comments for lsm_static_call_init() and early_security_init(), tweak the existing comment block for security_add_hooks(). Reviewed-by: Casey Schaufler Reviewed-by: John Johansen Signed-off-by: Paul Moore

lsm: fold lsm_init_ordered() into security_init()

2025-10-22T23:24:22+00:00

With only security_init() calling lsm_init_ordered, it makes little sense to keep lsm_init_ordered() as a standalone function. Fold lsm_init_ordered() into security_init(). Reviewed-by: Casey Schaufler Reviewed-by: John Johansen Signed-off-by: Paul Moore