On 6/15/2023 5:04 PM, KP Singh wrote: > These macros are a clever trick to determine a count of the number of > LSMs that are enabled in the config to ascertain the maximum number of > static calls that need to be configured per LSM hook. > > Without this one would need to generate static calls for (number of > possible LSMs * number of LSM hooks) which ends up being quite wasteful > especially when some LSMs are not compiled into the kernel. > > Suggested-by: Kui-Feng Lee <sinquersw@xxxxxxxxx> > Signed-off-by: KP Singh <kpsingh@xxxxxxxxxx> > --- > include/linux/lsm_count.h | 131 ++++++++++++++++++++++++++++++++++++++ > 1 file changed, 131 insertions(+) > create mode 100644 include/linux/lsm_count.h > > diff --git a/include/linux/lsm_count.h b/include/linux/lsm_count.h > new file mode 100644 > index 000000000000..818f62ffa723 > --- /dev/null > +++ b/include/linux/lsm_count.h > @@ -0,0 +1,131 @@ > +/* SPDX-License-Identifier: GPL-2.0 */ > + > +/* > + * Copyright (C) 2023 Google LLC. > + */ > + > +#ifndef __LINUX_LSM_COUNT_H > +#define __LINUX_LSM_COUNT_H > + > +#include <linux/kconfig.h> > + > +/* > + * Macros to count the number of LSMs enabled in the kernel at compile time. > + */ > + > +#define __LSM_COUNT_15(x, y...) 15 > +#define __LSM_COUNT_14(x, y...) 14 > +#define __LSM_COUNT_13(x, y...) 13 > +#define __LSM_COUNT_12(x, y...) 12 > +#define __LSM_COUNT_11(x, y...) 11 > +#define __LSM_COUNT_10(x, y...) 10 > +#define __LSM_COUNT_9(x, y...) 9 > +#define __LSM_COUNT_8(x, y...) 8 > +#define __LSM_COUNT_7(x, y...) 7 > +#define __LSM_COUNT_6(x, y...) 6 > +#define __LSM_COUNT_5(x, y...) 5 > +#define __LSM_COUNT_4(x, y...) 4 > +#define __LSM_COUNT_3(x, y...) 3 > +#define __LSM_COUNT_2(x, y...) 2 > +#define __LSM_COUNT_1(x, y...) 1 > +#define __LSM_COUNT_0(x, y...) 0 > + > +#define __LSM_COUNT1_15(x, y...) __LSM_COUNT ## x ## _15(y) > +#define __LSM_COUNT1_14(x, y...) __LSM_COUNT ## x ## _14(y) > +#define __LSM_COUNT1_13(x, y...) __LSM_COUNT ## x ## _13(y) > +#define __LSM_COUNT1_12(x, y...) __LSM_COUNT ## x ## _12(y) > +#define __LSM_COUNT1_10(x, y...) __LSM_COUNT ## x ## _11(y) > +#define __LSM_COUNT1_9(x, y...) __LSM_COUNT ## x ## _10(y) > +#define __LSM_COUNT1_8(x, y...) __LSM_COUNT ## x ## _9(y) > +#define __LSM_COUNT1_7(x, y...) __LSM_COUNT ## x ## _8(y) > +#define __LSM_COUNT1_6(x, y...) __LSM_COUNT ## x ## _7(y) > +#define __LSM_COUNT1_5(x, y...) __LSM_COUNT ## x ## _6(y) > +#define __LSM_COUNT1_4(x, y...) __LSM_COUNT ## x ## _5(y) > +#define __LSM_COUNT1_3(x, y...) __LSM_COUNT ## x ## _4(y) > +#define __LSM_COUNT1_2(x, y...) __LSM_COUNT ## x ## _3(y) > +#define __LSM_COUNT1_1(x, y...) __LSM_COUNT ## x ## _2(y) > +#define __LSM_COUNT1_0(x, y...) __LSM_COUNT ## x ## _1(y) > +#define __LSM_COUNT(x, y...) __LSM_COUNT ## x ## _0(y) > + > +#define __LSM_COUNT_EXPAND(x...) __LSM_COUNT(x) > + > +#if IS_ENABLED(CONFIG_SECURITY) > +#define CAPABILITIES_ENABLED 1, > +#else > +#define CAPABILITIES_ENABLED > +#endif > + > +#if IS_ENABLED(CONFIG_SECURITY_SELINUX) > +#define SELINUX_ENABLED 1, > +#else > +#define SELINUX_ENABLED > +#endif > + > +#if IS_ENABLED(CONFIG_SECURITY_SMACK) > +#define SMACK_ENABLED 1, > +#else > +#define SMACK_ENABLED > +#endif > + > +#if IS_ENABLED(CONFIG_SECURITY_APPARMOR) > +#define APPARMOR_ENABLED 1, > +#else > +#define APPARMOR_ENABLED > +#endif > + > +#if IS_ENABLED(CONFIG_SECURITY_TOMOYO) > +#define TOMOYO_ENABLED 1, > +#else > +#define TOMOYO_ENABLED > +#endif > + > +#if IS_ENABLED(CONFIG_SECURITY_YAMA) > +#define YAMA_ENABLED 1, > +#else > +#define YAMA_ENABLED > +#endif > + > +#if IS_ENABLED(CONFIG_SECURITY_LOADPIN) > +#define LOADPIN_ENABLED 1, > +#else > +#define LOADPIN_ENABLED > +#endif > + > +#if IS_ENABLED(CONFIG_SECURITY_LOCKDOWN_LSM) > +#define LOCKDOWN_ENABLED 1, > +#else > +#define LOCKDOWN_ENABLED > +#endif > + > +#if IS_ENABLED(CONFIG_BPF_LSM) > +#define BPF_LSM_ENABLED 1, > +#else > +#define BPF_LSM_ENABLED > +#endif > + > +#if IS_ENABLED(CONFIG_BPF_LSM) > +#define BPF_LSM_ENABLED 1, > +#else > +#define BPF_LSM_ENABLED > +#endif > + > +#if IS_ENABLED(CONFIG_SECURITY_LANDLOCK) > +#define LANDLOCK_ENABLED 1, > +#else > +#define LANDLOCK_ENABLED > +#endif > + > +#define MAX_LSM_COUNT \ > + __LSM_COUNT_EXPAND( \ > + CAPABILITIES_ENABLED \ > + SELINUX_ENABLED \ > + SMACK_ENABLED \ > + APPARMOR_ENABLED \ > + TOMOYO_ENABLED \ > + YAMA_ENABLED \ > + LOADPIN_ENABLED \ > + LOCKDOWN_ENABLED \ > + BPF_LSM_ENABLED \ > + LANDLOCK_ENABLED) > + Wouldn't the following be simpler? It's from my LSM syscall patchset. It certainly takes up fewer lines and would be easier to maintain than the set of macros you've proposed. +#define LSM_COUNT ( \ + (IS_ENABLED(CONFIG_SECURITY) ? 1 : 0) + \ + (IS_ENABLED(CONFIG_SECURITY_SELINUX) ? 1 : 0) + \ + (IS_ENABLED(CONFIG_SECURITY_SMACK) ? 1 : 0) + \ + (IS_ENABLED(CONFIG_SECURITY_TOMOYO) ? 1 : 0) + \ + (IS_ENABLED(CONFIG_IMA) ? 1 : 0) + \ + (IS_ENABLED(CONFIG_SECURITY_APPARMOR) ? 1 : 0) + \ + (IS_ENABLED(CONFIG_SECURITY_YAMA) ? 1 : 0) + \ + (IS_ENABLED(CONFIG_SECURITY_LOADPIN) ? 1 : 0) + \ + (IS_ENABLED(CONFIG_SECURITY_SAFESETID) ? 1 : 0) + \ + (IS_ENABLED(CONFIG_SECURITY_LOCKDOWN_LSM) ? 1 : 0) + \ + (IS_ENABLED(CONFIG_BPF_LSM) ? 1 : 0) + \ + (IS_ENABLED(CONFIG_SECURITY_LANDLOCK) ? 1 : 0)) > +#endif /* __LINUX_LSM_COUNT_H */
