On Wed, Dec 11, 2019 at 3:08 PM Ondrej Mosnacek <omosnace@xxxxxxxxxx> wrote:
> Instead of deleting the hooks from each list one-by-one (which creates
> some bad race conditions), allow an LSM to provide a reference to its
> "enabled" variable and check this variable before calling the hook.
>
> As a nice side effect, this allows marking the hooks (and other stuff)
> __ro_after_init unconditionally. Since SECURITY_WRITABLE_HOOKS no longer
> makes sense, remove it and instead use SECURITY_SELINUX_DISABLE directly
> for turning on the runtime disable functionality, to emphasize that this
> is only used by SELinux and is meant to be removed in the future.
>
> Fixes: b1d9e6b0646d ("LSM: Switch to lists of hooks")
> Signed-off-by: Ondrej Mosnacek <omosnace@xxxxxxxxxx>
> ---
>
> This is an alternative to [1]. It turned out to be less simple than I
> had hoped, but OTOH the hook arrays can now be unconditionally made
> __ro_after_init so may be still worth it.
>
> Compile- and boot- tested with SECURITY_SELINUX_DISABLE set to =y and
> =n; SELinux enabled. Changes to other LSMs only compile-tested (but
> those are trivial).
>
> [1] https://lore.kernel.org/selinux/20191209075756.123157-1-omosnace@xxxxxxxxxx/T/
>
> include/linux/lsm_hooks.h | 46 +++++++++----------------------
> security/Kconfig | 5 ----
> security/apparmor/lsm.c | 14 ++++++----
> security/commoncap.c | 11 +++++---
> security/loadpin/loadpin.c | 10 +++++--
> security/lockdown/lockdown.c | 11 +++++---
> security/safesetid/lsm.c | 9 +++++--
> security/security.c | 52 +++++++++++++++++++++---------------
> security/selinux/Kconfig | 5 ++--
> security/selinux/hooks.c | 28 ++++++++++++++-----
> security/smack/smack_lsm.c | 11 +++++---
> security/tomoyo/tomoyo.c | 13 ++++++---
> security/yama/yama_lsm.c | 10 +++++--
> 13 files changed, 133 insertions(+), 92 deletions(-)
>
> diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
> index 20d8cf194fb7..91b77ebcb822 100644
> --- a/include/linux/lsm_hooks.h
> +++ b/include/linux/lsm_hooks.h
> @@ -27,7 +27,6 @@
>
> #include <linux/security.h>
> #include <linux/init.h>
> -#include <linux/rculist.h>
I missed that there is still a hlist_add_tail_rcu() call left, so I'll
have to add this back in the next revision in case of positive
feedback for this patch.
--
Ondrej Mosnacek <omosnace at redhat dot com>
Software Engineer, Security Technologies
Red Hat, Inc.
