summaryrefslogtreecommitdiff
path: root/security
diff options
context:
space:
mode:
authorCasey Schaufler <casey@schaufler-ca.com>2018-11-20 05:04:32 +0300
committerKees Cook <keescook@chromium.org>2019-01-09 00:18:43 +0300
commitc91d8106b370593b4d3dcc0b06282bf39478ae13 (patch)
treeab45414d24e44e6aefcb909ecdc50b37d2effec6 /security
parentbe6ec88f41ba94746f830ba38cc4d08dd5ddbb08 (diff)
downloadlinux-c91d8106b370593b4d3dcc0b06282bf39478ae13.tar.xz
LSM: Add all exclusive LSMs to ordered initialization
This removes CONFIG_DEFAULT_SECURITY in favor of the explicit ordering offered by CONFIG_LSM and adds all the exclusive LSMs to the ordered LSM initialization. The old meaning of CONFIG_DEFAULT_SECURITY is now captured by which exclusive LSM is listed first in the LSM order. All LSMs not added to the ordered list are explicitly disabled. Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Diffstat (limited to 'security')
-rw-r--r--security/security.c45
1 files changed, 20 insertions, 25 deletions
diff --git a/security/security.c b/security/security.c
index a8dd7defe30a..2d08a5357bf4 100644
--- a/security/security.c
+++ b/security/security.c
@@ -169,8 +169,6 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
char *sep, *name, *next;
/* Process "security=", if given. */
- if (!chosen_major_lsm)
- chosen_major_lsm = CONFIG_DEFAULT_SECURITY;
if (chosen_major_lsm) {
struct lsm_info *major;
@@ -198,8 +196,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
bool found = false;
for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
- if ((lsm->flags & LSM_FLAG_LEGACY_MAJOR) == 0 &&
- strcmp(lsm->name, name) == 0) {
+ if (strcmp(lsm->name, name) == 0) {
append_ordered_lsm(lsm, origin);
found = true;
}
@@ -208,6 +205,25 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
if (!found)
init_debug("%s ignored: %s\n", origin, name);
}
+
+ /* Process "security=", if given. */
+ if (chosen_major_lsm) {
+ for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
+ if (exists_ordered_lsm(lsm))
+ continue;
+ if (strcmp(lsm->name, chosen_major_lsm) == 0)
+ append_ordered_lsm(lsm, "security=");
+ }
+ }
+
+ /* Disable all LSMs not in the ordered list. */
+ for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
+ if (exists_ordered_lsm(lsm))
+ continue;
+ set_enabled(lsm, false);
+ init_debug("%s disabled: %s\n", origin, lsm->name);
+ }
+
kfree(sep);
}
@@ -229,22 +245,6 @@ static void __init ordered_lsm_init(void)
kfree(ordered_lsms);
}
-static void __init major_lsm_init(void)
-{
- struct lsm_info *lsm;
-
- for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
- if ((lsm->flags & LSM_FLAG_LEGACY_MAJOR) == 0)
- continue;
-
- /* Enable this LSM, if it is not already set. */
- if (!lsm->enabled)
- lsm->enabled = &lsm_enabled_true;
-
- maybe_initialize_lsm(lsm);
- }
-}
-
/**
* security_init - initializes the security framework
*
@@ -271,11 +271,6 @@ int __init security_init(void)
/* Load LSMs in specified order. */
ordered_lsm_init();
- /*
- * Load all the remaining security modules.
- */
- major_lsm_init();
-
return 0;
}