diff options
| author | Paul Moore <paul@paul-moore.com> | 2025-03-19 23:38:20 +0300 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2025-10-23 02:24:23 +0300 |
| commit | ac3c47cece27014e34d2ec561d72c0a7c7de50a9 (patch) | |
| tree | a208bb19d26a13d12ac0a43da544b60a38e20324 /security/lsm_init.c | |
| parent | 5137e583ba2635b82667dc63cb35305750420411 (diff) | |
| download | linux-ac3c47cece27014e34d2ec561d72c0a7c7de50a9.tar.xz | |
lsm: output available LSMs when debugging
This will display all of the LSMs built into the kernel, regardless
of if they are enabled or not.
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: John Johansen <john.johhansen@canonical.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security/lsm_init.c')
| -rw-r--r-- | security/lsm_init.c | 19 |
1 files changed, 18 insertions, 1 deletions
diff --git a/security/lsm_init.c b/security/lsm_init.c index cd1779e03497..cfcf3bf7127f 100644 --- a/security/lsm_init.c +++ b/security/lsm_init.c @@ -363,6 +363,8 @@ int __init early_security_init(void) { struct lsm_info *lsm; + /* NOTE: lsm_pr_dbg() doesn't work here as lsm_debug is not yet set */ + lsm_early_for_each_raw(lsm) { lsm_enabled_set(lsm, true); lsm_order_append(lsm, "early"); @@ -385,9 +387,24 @@ int __init security_init(void) struct lsm_info **lsm; if (lsm_debug) { - lsm_pr("built-in LSM list: %s\n", lsm_order_builtin); + struct lsm_info *i; + + cnt = 0; + lsm_pr("available LSMs: "); + lsm_early_for_each_raw(i) + lsm_pr_cont("%s%s(E)", (cnt++ ? "," : ""), i->id->name); + lsm_for_each_raw(i) + lsm_pr_cont("%s%s", (cnt++ ? "," : ""), i->id->name); + lsm_pr_cont("\n"); + + lsm_pr("built-in LSM config: %s\n", lsm_order_builtin); + lsm_pr("legacy LSM parameter: %s\n", lsm_order_legacy); lsm_pr("boot LSM parameter: %s\n", lsm_order_cmdline); + + /* see the note about lsm_pr_dbg() in early_security_init() */ + lsm_early_for_each_raw(i) + lsm_pr("enabled LSM early:%s\n", i->id->name); } if (lsm_order_cmdline) { |