This provides a way to declare LSM initialization order via Kconfig.
Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
Reviewed-by: Casey Schaufler <casey@xxxxxxxxxxxxxxxx>
---
security/Kconfig | 16 ++++++++++++++++
security/security.c | 40 +++++++++++++++++++++++++++++++++++++---
2 files changed, 53 insertions(+), 3 deletions(-)
diff --git a/security/Kconfig b/security/Kconfig
index 1e57619fd561..c68520d97fd7 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -286,5 +286,21 @@ config LSM_ENABLE
changed with the "lsm.enable=" and "lsm.disable=" boot
parameters.
+ Note that any enabled exclusive LSM modules will be initialized
+ based on LSM ordering, automatically disabling any following
+ exclusive LSMs. See CONFIG_LSM_ORDER for more details on
+ changing LSM initialization order.
+
+config LSM_ORDER
+ string "Default initialization order of builtin LSMs"
+ default "integrity"
+ help
+ A comma-separated list of LSMs, in initialization order.
+ Any LSMs left off this list will be link-order initialized
+ after any listed LSMs. Any LSMs listed here but not built in
+ the kernel will be ignored.
+
+ If unsure, leave this as the default.
+
endmenu
diff --git a/security/security.c b/security/security.c
index 8706b42b4d44..0510bb8e0af0 100644
--- a/security/security.c
+++ b/security/security.c
@@ -47,6 +47,7 @@ static __initdata const char *chosen_lsm_disable;
static __initdata const char *chosen_major_lsm;
static __initconst const char * const builtin_lsm_enable = CONFIG_LSM_ENABLE;
+static __initconst const char * const builtin_lsm_order = CONFIG_LSM_ORDER;
/* Ordered list of LSMs to initialize. */
static __initdata struct lsm_info **ordered_lsms;
@@ -122,14 +123,47 @@ static void __init append_ordered_lsm(struct lsm_info *lsm, const char *from)
is_enabled(lsm) ? "en" : "dis");
}
-/* Populate ordered LSMs list from hard-coded list of LSMs. */
+/* Populate ordered LSMs list from given string. */
+static void __init parse_lsm_order(const char *order, const char *origin)
+{
+ struct lsm_info *lsm;
+ char *sep, *name, *next;
+
+ if (!order)
+ return;
+
+ sep = kstrdup(order, GFP_KERNEL);
+ next = sep;
+ /* Walk the list, looking for matching LSMs. */
+ while ((name = strsep(&next, ",")) != NULL) {
+ bool found = false;
+
+ for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
+ if ((lsm->flags & LSM_FLAG_LEGACY_MAJOR) == 0 &&
+ strcmp(lsm->name, name) == 0) {
+ append_ordered_lsm(lsm, origin);
+ found = true;
+ }
+ }
+
+ if (!found)
+ init_debug("%s ignored: %s\n", origin, name);
+ }
+ kfree(sep);
+}
+
+/* Populate ordered LSMs list from builtin list of LSMs. */
static void __init prepare_lsm_order(void)
{
struct lsm_info *lsm;
+ /* Parse order from builtin list. */
+ parse_lsm_order(builtin_lsm_order, "builtin");
+
+ /* Add any missing LSMs, in link order. */
for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
- if (strcmp(lsm->name, "integrity") == 0)
- append_ordered_lsm(lsm, "builtin");
+ if ((lsm->flags & LSM_FLAG_LEGACY_MAJOR) == 0)
+ append_ordered_lsm(lsm, "link-time");
}
}
--
2.17.1
