nagai/kernel
3
0
Fork 0
forked from mirrors/linux
Code Pull requests Activity

LSM: Introduce "lsm=" for boottime LSM selection

Browse source 
Provide a way to explicitly choose LSM initialization order via the new
"lsm=" comma-separated list of LSMs.

Signed-off-by: Kees Cook <keescook@chromium.org>
This commit is contained in:
Kees Cook 2018-09-19 17:30:09 -07:00
parent 13e735c0e9
commit 79f7865d84
3 changed files with 19 additions and 2 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

4
Documentation/admin-guide/kernel-parameters.txt
View file

@ -2319,6 +2319,10 @@
lsm.debug [SECURITY] Enable LSM initialization debugging output. lsm.debug [SECURITY] Enable LSM initialization debugging output.
lsm=lsm1,...,lsmN
[SECURITY] Choose order of LSM initialization. This
overrides CONFIG_LSM.
machvec= [IA-64] Force the use of a particular machine-vector machvec= [IA-64] Force the use of a particular machine-vector
(machvec) in a generic kernel. (machvec) in a generic kernel.
Example: machvec=hpzx1_swiotlb Example: machvec=hpzx1_swiotlb

3
security/Kconfig
View file

@ -281,7 +281,8 @@ config LSM
default "integrity" default "integrity"
help help
A comma-separated list of LSMs, in initialization order. A comma-separated list of LSMs, in initialization order.
Any LSMs left off this list will be ignored. Any LSMs left off this list will be ignored. This can be
controlled at boot with the "lsm=" parameter.
If unsure, leave this as the default. If unsure, leave this as the default.

12
security/security.c
View file

@ -47,6 +47,7 @@ char *lsm_names;
/* Boot-time LSM user choice */ /* Boot-time LSM user choice */
static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] = static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] =
CONFIG_DEFAULT_SECURITY; CONFIG_DEFAULT_SECURITY;
static __initdata const char *chosen_lsm_order;
static __initconst const char * const builtin_lsm_order = CONFIG_LSM; static __initconst const char * const builtin_lsm_order = CONFIG_LSM;
@ -190,6 +191,9 @@ static void __init ordered_lsm_init(void)
ordered_lsms = kcalloc(LSM_COUNT + 1, sizeof(*ordered_lsms), ordered_lsms = kcalloc(LSM_COUNT + 1, sizeof(*ordered_lsms),
GFP_KERNEL); GFP_KERNEL);
if (chosen_lsm_order)
ordered_lsm_parse(chosen_lsm_order, "cmdline");
else
ordered_lsm_parse(builtin_lsm_order, "builtin"); ordered_lsm_parse(builtin_lsm_order, "builtin");
for (lsm = ordered_lsms; *lsm; lsm++) for (lsm = ordered_lsms; *lsm; lsm++)
@ -252,6 +256,14 @@ static int __init choose_lsm(char *str)
} }
__setup("security=", choose_lsm); __setup("security=", choose_lsm);
/* Explicitly choose LSM initialization order. */
static int __init choose_lsm_order(char *str)
{
chosen_lsm_order = str;
return 1;
}
__setup("lsm=", choose_lsm_order);
/* Enable LSM order debugging. */ /* Enable LSM order debugging. */
static int __init enable_debug(char *str) static int __init enable_debug(char *str)
{ {