Commit e6b1db98 authored by Matthew Garrett's avatar Matthew Garrett Committed by James Morris
Browse files

security: Support early LSMs 



The lockdown module is intended to allow for kernels to be locked down
early in boot - sufficiently early that we don't have the ability to
kmalloc() yet. Add support for early initialisation of some LSMs, and
then add them to the list of names when we do full initialisation later.
Early LSMs are initialised in link order and cannot be overridden via
boot parameters, and cannot make use of kmalloc() (since the allocator
isn't initialised yet).

(Fixed by Stephen Rothwell to include a stub to fix builds when
!CONFIG_SECURITY)

Signed-off-by: default avatarMatthew Garrett <mjg59@google.com>
Acked-by: default avatarKees Cook <keescook@chromium.org>
Acked-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 0ecfebd2

include/asm-generic/vmlinux.lds.h

+7 −1
Original line number Diff line number Diff line
@@ -208,8 +208,13 @@ 
			__start_lsm_info = .;				\

			KEEP(*(.lsm_info.init))				\

			__end_lsm_info = .;

#define EARLY_LSM_TABLE()	. = ALIGN(8);				\

			__start_early_lsm_info = .;			\

			KEEP(*(.early_lsm_info.init))			\

			__end_early_lsm_info = .;

#else

#define LSM_TABLE()

#define EARLY_LSM_TABLE()

#endif



#define ___OF_TABLE(cfg, name)	_OF_TABLE_##cfg(name)
@@ -609,7 +614,8 @@ 
	ACPI_PROBE_TABLE(irqchip)					\

	ACPI_PROBE_TABLE(timer)						\

	EARLYCON_TABLE()						\

	LSM_TABLE()

	LSM_TABLE()							\

	EARLY_LSM_TABLE()



#define INIT_TEXT							\

	*(.init.text .init.text.*)					\

include/linux/lsm_hooks.h

+6 −0
Original line number Diff line number Diff line
@@ -2104,12 +2104,18 @@ struct lsm_info { 
};



extern struct lsm_info __start_lsm_info[], __end_lsm_info[];

extern struct lsm_info __start_early_lsm_info[], __end_early_lsm_info[];



#define DEFINE_LSM(lsm)							\

	static struct lsm_info __lsm_##lsm				\

		__used __section(.lsm_info.init)			\

		__aligned(sizeof(unsigned long))



#define DEFINE_EARLY_LSM(lsm)						\

	static struct lsm_info __early_lsm_##lsm			\

		__used __section(.early_lsm_info.init)			\

		__aligned(sizeof(unsigned long))



#ifdef CONFIG_SECURITY_SELINUX_DISABLE

/*

 * Assuring the safety of deleting a security module is up to

include/linux/security.h

+6 −0
Original line number Diff line number Diff line
@@ -195,6 +195,7 @@ int unregister_lsm_notifier(struct notifier_block *nb); 


/* prototypes */

extern int security_init(void);

extern int early_security_init(void);



/* Security operations */

int security_binder_set_context_mgr(struct task_struct *mgr);
@@ -423,6 +424,11 @@ static inline int security_init(void) 
	return 0;

}



static inline int early_security_init(void)

{

	return 0;

}



static inline int security_binder_set_context_mgr(struct task_struct *mgr)

{

	return 0;

init/main.c

+1 −0
Original line number Diff line number Diff line
@@ -569,6 +569,7 @@ asmlinkage __visible void __init start_kernel(void) 
	boot_cpu_init();

	page_address_init();

	pr_notice("%s", linux_banner);

	early_security_init();

	setup_arch(&command_line);

	mm_init_cpumask(&init_mm);

	setup_command_line(command_line);

security/security.c

+42 −8
Original line number Diff line number Diff line
@@ -33,6 +33,7 @@ 


/* How many LSMs were built into the kernel? */

#define LSM_COUNT (__end_lsm_info - __start_lsm_info)

#define EARLY_LSM_COUNT (__end_early_lsm_info - __start_early_lsm_info)



struct security_hook_heads security_hook_heads __lsm_ro_after_init;

static ATOMIC_NOTIFIER_HEAD(lsm_notifier_chain);
@@ -277,6 +278,8 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) 
static void __init lsm_early_cred(struct cred *cred);

static void __init lsm_early_task(struct task_struct *task);



static int lsm_append(const char *new, char **result);



static void __init ordered_lsm_init(void)

{

	struct lsm_info **lsm;
@@ -323,6 +326,26 @@ static void __init ordered_lsm_init(void) 
	kfree(ordered_lsms);

}



int __init early_security_init(void)

{

	int i;

	struct hlist_head *list = (struct hlist_head *) &security_hook_heads;

	struct lsm_info *lsm;



	for (i = 0; i < sizeof(security_hook_heads) / sizeof(struct hlist_head);

	     i++)

		INIT_HLIST_HEAD(&list[i]);



	for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) {

		if (!lsm->enabled)

			lsm->enabled = &lsm_enabled_true;

		prepare_lsm(lsm);

		initialize_lsm(lsm);

	}



	return 0;

}



/**

 * security_init - initializes the security framework

 *
@@ -330,14 +353,18 @@ static void __init ordered_lsm_init(void) 
 */

int __init security_init(void)

{

	int i;

	struct hlist_head *list = (struct hlist_head *) &security_hook_heads;

	struct lsm_info *lsm;



	pr_info("Security Framework initializing\n");



	for (i = 0; i < sizeof(security_hook_heads) / sizeof(struct hlist_head);

	     i++)

		INIT_HLIST_HEAD(&list[i]);

	/*

	 * Append the names of the early LSM modules now that kmalloc() is

	 * available

	 */

	for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) {

		if (lsm->enabled)

			lsm_append(lsm->name, &lsm_names);

	}



	/* Load LSMs in specified order. */

	ordered_lsm_init();
@@ -384,7 +411,7 @@ static bool match_last_lsm(const char *list, const char *lsm) 
	return !strcmp(last, lsm);

}



static int lsm_append(char *new, char **result)

static int lsm_append(const char *new, char **result)

{

	char *cp;
@@ -422,9 +449,16 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count, 
		hooks[i].lsm = lsm;

		hlist_add_tail_rcu(&hooks[i].list, hooks[i].head);

	}



	/*

	 * Don't try to append during early_security_init(), we'll come back

	 * and fix this up afterwards.

	 */

	if (slab_is_available()) {

		if (lsm_append(lsm, &lsm_names) < 0)

			panic("%s - Cannot get early memory.\n", __func__);

	}

}



int call_lsm_notifier(enum lsm_event event, void *data)

{

CRA Git | Maintained and supported by SUSTech CRA and CCSE