Commit 3d6e5f6d authored by Kees Cook's avatar Kees Cook Committed by James Morris
Browse files

LSM: Convert security_initcall() into DEFINE_LSM() 



Instead of using argument-based initializers, switch to defining the
contents of struct lsm_info on a per-LSM basis. This also drops
the final use of the now inaccurate "initcall" naming.

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Reviewed-by: default avatarJames Morris <james.morris@microsoft.com>
Signed-off-by: default avatarJames Morris <james.morris@microsoft.com>
parent 3ac946d1

include/linux/lsm_hooks.h

+2 −3
Original line number Diff line number Diff line
@@ -2045,11 +2045,10 @@ struct lsm_info { 


extern struct lsm_info __start_lsm_info[], __end_lsm_info[];



#define security_initcall(lsm)						\

#define DEFINE_LSM(lsm)							\

	static struct lsm_info __lsm_##lsm				\

		__used __section(.lsm_info.init)			\

		__aligned(sizeof(unsigned long))			\

		= { .init = lsm, }

		__aligned(sizeof(unsigned long))



#ifdef CONFIG_SECURITY_SELINUX_DISABLE

/*

security/apparmor/lsm.c

+3 −1
Original line number Diff line number Diff line
@@ -1606,4 +1606,6 @@ alloc_out: 
	return error;

}



security_initcall(apparmor_init);
 
DEFINE_LSM(apparmor) = {

	.init = apparmor_init,

};

security/integrity/iint.c

+3 −1
Original line number Diff line number Diff line
@@ -175,7 +175,9 @@ static int __init integrity_iintcache_init(void) 
			      0, SLAB_PANIC, init_once);

	return 0;

}

security_initcall(integrity_iintcache_init);

DEFINE_LSM(integrity) = {

	.init = integrity_iintcache_init,

};





/*

security/selinux/hooks.c

+3 −1
Original line number Diff line number Diff line
@@ -7202,7 +7202,9 @@ void selinux_complete_init(void) 


/* SELinux requires early initialization in order to label

   all processes and objects when they are created. */

security_initcall(selinux_init);

DEFINE_LSM(selinux) = {

	.init = selinux_init,

};



#if defined(CONFIG_NETFILTER)

security/smack/smack_lsm.c

+3 −1
Original line number Diff line number Diff line
@@ -4882,4 +4882,6 @@ static __init int smack_init(void) 
 * Smack requires early initialization in order to label

 * all processes and objects when they are created.

 */

security_initcall(smack_init);
 
DEFINE_LSM(smack) = {

	.init = smack_init,

};

CRA Git | Maintained and supported by SUSTech CRA and CCSE