Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat.
Showing the changes to security (3 of 3 files). Show all
Unified · Split
| @@ -6,9 +6,20 @@ · 5 unmodified lines | |||
| 6 | #ifndef _LSM_H_ | 6 | #ifndef _LSM_H_ |
| 7 | #define _LSM_H_ | 7 | #define _LSM_H_ |
| 8 | 8 | ||
| 9 | #include <linux/printk.h> | ||
| 9 | #include <linux/lsm_hooks.h> | 10 | #include <linux/lsm_hooks.h> |
| 10 | #include <linux/lsm_count.h> | 11 | #include <linux/lsm_count.h> |
| 11 | 12 | ||
| 13 | /* LSM debugging */ | ||
| 14 | extern bool lsm_debug; | ||
| 15 | #define lsm_pr(...) pr_info(__VA_ARGS__) | ||
| 16 | #define lsm_pr_cont(...) pr_cont(__VA_ARGS__) | ||
| 17 | #define lsm_pr_dbg(...) \ | ||
| 18 | do { \ | ||
| 19 | if (lsm_debug) \ | ||
| 20 | pr_info(__VA_ARGS__); \ | ||
| 21 | } while (0) | ||
| 22 | |||
| 12 | /* List of configured LSMs */ | 23 | /* List of configured LSMs */ |
| 13 | extern unsigned int lsm_active_cnt; | 24 | extern unsigned int lsm_active_cnt; |
| 14 | extern const struct lsm_id *lsm_idlist[]; | 25 | extern const struct lsm_id *lsm_idlist[]; |
| @@ -30,13 +30,6 @@ static __initdata const char *lsm_order_legacy; · 29 unmodified lines | |||
| 30 | static __initdata struct lsm_info *lsm_order[MAX_LSM_COUNT + 1]; | 30 | static __initdata struct lsm_info *lsm_order[MAX_LSM_COUNT + 1]; |
| 31 | static __initdata struct lsm_info *lsm_exclusive; | 31 | static __initdata struct lsm_info *lsm_exclusive; |
| 32 | 32 | ||
| 33 | static __initdata bool debug; | ||
| 34 | #define init_debug(...) \ | ||
| 35 | do { \ | ||
| 36 | if (debug) \ | ||
| 37 | pr_info(__VA_ARGS__); \ | ||
| 38 | } while (0) | ||
| 39 | |||
| 40 | #define lsm_order_for_each(iter) \ | 33 | #define lsm_order_for_each(iter) \ |
| 41 | for ((iter) = lsm_order; *(iter); (iter)++) | 34 | for ((iter) = lsm_order; *(iter); (iter)++) |
| 42 | #define lsm_for_each_raw(iter) \ | 35 | #define lsm_for_each_raw(iter) \ |
| @@ -77,7 +70,7 @@ __setup("lsm=", lsm_choose_lsm); · 34 unmodified lines | |||
| 77 | */ | 70 | */ |
| 78 | static int __init lsm_debug_enable(char *str) | 71 | static int __init lsm_debug_enable(char *str) |
| 79 | { | 72 | { |
| 80 | debug = true; | 73 | lsm_debug = true; |
| 81 | return 1; | 74 | return 1; |
| 82 | } | 75 | } |
| 83 | __setup("lsm.debug", lsm_debug_enable); | 76 | __setup("lsm.debug", lsm_debug_enable); |
| @@ -143,22 +136,28 @@ static void __init lsm_order_append(struct lsm_info *lsm, const char *src) · 59 unmodified lines | |||
| 143 | return; | 136 | return; |
| 144 | 137 | ||
| 145 | /* Skip explicitly disabled LSMs. */ | 138 | /* Skip explicitly disabled LSMs. */ |
| 146 | if (lsm->enabled && !lsm_is_enabled(lsm)) | 139 | if (lsm->enabled && !lsm_is_enabled(lsm)) { |
| 147 | goto out; | 140 | lsm_pr_dbg("skip previously disabled LSM %s:%s\n", |
| 141 | src, lsm->id->name); | ||
| 142 | return; | ||
| 143 | } | ||
| 148 | 144 | ||
| 149 | if (WARN(lsm_active_cnt == MAX_LSM_COUNT, | 145 | if (lsm_active_cnt == MAX_LSM_COUNT) { |
| 150 | "%s: out of LSM static calls!?\n", src)) { | 146 | pr_warn("exceeded maximum LSM count on %s:%s\n", |
| 147 | src, lsm->id->name); | ||
| 151 | lsm_enabled_set(lsm, false); | 148 | lsm_enabled_set(lsm, false); |
| 152 | goto out; | 149 | return; |
| 153 | } | 150 | } |
| 154 | 151 | ||
| 155 | if (lsm->flags & LSM_FLAG_EXCLUSIVE) { | 152 | if (lsm->flags & LSM_FLAG_EXCLUSIVE) { |
| 156 | if (lsm_exclusive) { | 153 | if (lsm_exclusive) { |
| 157 | init_debug("exclusive disabled: %s\n", lsm->id->name); | 154 | lsm_pr_dbg("skip exclusive LSM conflict %s:%s\n", |
| 155 | src, lsm->id->name); | ||
| 158 | lsm_enabled_set(lsm, false); | 156 | lsm_enabled_set(lsm, false); |
| 159 | goto out; | 157 | return; |
| 160 | } else { | 158 | } else { |
| 161 | init_debug("exclusive chosen: %s\n", lsm->id->name); | 159 | lsm_pr_dbg("select exclusive LSM %s:%s\n", |
| 160 | src, lsm->id->name); | ||
| 162 | lsm_exclusive = lsm; | 161 | lsm_exclusive = lsm; |
| 163 | } | 162 | } |
| 164 | } | 163 | } |
| @@ -167,9 +166,7 @@ static void __init lsm_order_append(struct lsm_info *lsm, const char *src) · 2 unmodified lines | |||
| 167 | lsm_order[lsm_active_cnt] = lsm; | 166 | lsm_order[lsm_active_cnt] = lsm; |
| 168 | lsm_idlist[lsm_active_cnt++] = lsm->id; | 167 | lsm_idlist[lsm_active_cnt++] = lsm->id; |
| 169 | 168 | ||
| 170 | out: | 169 | lsm_pr_dbg("enabling LSM %s:%s\n", src, lsm->id->name); |
| 171 | init_debug("%s ordered: %s (%s)\n", src, lsm->id->name, | ||
| 172 | lsm_is_enabled(lsm) ? "enabled" : "disabled"); | ||
| 173 | } | 170 | } |
| 174 | 171 | ||
| 175 | /** | 172 | /** |
| @@ -239,7 +236,7 @@ static void __init lsm_init_single(struct lsm_info *lsm) · 63 unmodified lines | |||
| 239 | if (!lsm_is_enabled(lsm)) | 236 | if (!lsm_is_enabled(lsm)) |
| 240 | return; | 237 | return; |
| 241 | 238 | ||
| 242 | init_debug("initializing %s\n", lsm->id->name); | 239 | lsm_pr_dbg("initializing %s\n", lsm->id->name); |
| 243 | ret = lsm->init(); | 240 | ret = lsm->init(); |
| 244 | WARN(ret, "%s failed to initialize: %d\n", lsm->id->name, ret); | 241 | WARN(ret, "%s failed to initialize: %d\n", lsm->id->name, ret); |
| 245 | } | 242 | } |
| @@ -266,8 +263,8 @@ static void __init lsm_order_parse(const char *list, const char *src) · 20 unmodified lines | |||
| 266 | if ((lsm->flags & LSM_FLAG_LEGACY_MAJOR) && | 263 | if ((lsm->flags & LSM_FLAG_LEGACY_MAJOR) && |
| 267 | strcmp(lsm->id->name, lsm_order_legacy)) { | 264 | strcmp(lsm->id->name, lsm_order_legacy)) { |
| 268 | lsm_enabled_set(lsm, false); | 265 | lsm_enabled_set(lsm, false); |
| 269 | init_debug("security=%s disabled: %s (only one legacy major LSM)\n", | 266 | lsm_pr_dbg("skip legacy LSM conflict %s:%s\n", |
| 270 | lsm_order_legacy, lsm->id->name); | 267 | src, lsm->id->name); |
| 271 | } | 268 | } |
| 272 | } | 269 | } |
| 273 | } | 270 | } |
| @@ -310,8 +307,7 @@ static void __init lsm_order_parse(const char *list, const char *src) · 36 unmodified lines | |||
| 310 | if (lsm_order_exists(lsm)) | 307 | if (lsm_order_exists(lsm)) |
| 311 | continue; | 308 | continue; |
| 312 | lsm_enabled_set(lsm, false); | 309 | lsm_enabled_set(lsm, false); |
| 313 | init_debug("%s skipped: %s (not in requested order)\n", | 310 | lsm_pr_dbg("skip disabled LSM %s:%s\n", src, lsm->id->name); |
| 314 | src, lsm->id->name); | ||
| 315 | } | 311 | } |
| 316 | } | 312 | } |
| 317 | 313 | ||
| @@ -319,7 +315,7 @@ static void __init lsm_order_parse(const char *list, const char *src) · 1 unmodified line | |||
| 319 | * lsm_static_call_init - Initialize a LSM's static calls | 315 | * lsm_static_call_init - Initialize a LSM's static calls |
| 320 | * @hl: LSM hook list | 316 | * @hl: LSM hook list |
| 321 | */ | 317 | */ |
| 322 | static void __init lsm_static_call_init(struct security_hook_list *hl) | 318 | static int __init lsm_static_call_init(struct security_hook_list *hl) |
| 323 | { | 319 | { |
| 324 | struct lsm_static_call *scall = hl->scalls; | 320 | struct lsm_static_call *scall = hl->scalls; |
| 325 | int i; | 321 | int i; |
| @@ -331,11 +327,12 @@ static void __init lsm_static_call_init(struct security_hook_list *hl) · 5 unmodified lines | |||
| 331 | hl->hook.lsm_func_addr); | 327 | hl->hook.lsm_func_addr); |
| 332 | scall->hl = hl; | 328 | scall->hl = hl; |
| 333 | static_branch_enable(scall->active); | 329 | static_branch_enable(scall->active); |
| 334 | return; | 330 | return 0; |
| 335 | } | 331 | } |
| 336 | scall++; | 332 | scall++; |
| 337 | } | 333 | } |
| 338 | panic("%s - Ran out of static slots.\n", __func__); | 334 | |
| 335 | return -ENOSPC; | ||
| 339 | } | 336 | } |
| 340 | 337 | ||
| 341 | /** | 338 | /** |
| @@ -353,7 +350,9 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count, · 11 unmodified lines | |||
| 353 | 350 | ||
| 354 | for (i = 0; i < count; i++) { | 351 | for (i = 0; i < count; i++) { |
| 355 | hooks[i].lsmid = lsmid; | 352 | hooks[i].lsmid = lsmid; |
| 356 | lsm_static_call_init(&hooks[i]); | 353 | if (lsm_static_call_init(&hooks[i])) |
| 354 | panic("exhausted LSM callback slots with LSM %s\n", | ||
| 355 | lsmid->name); | ||
| 357 | } | 356 | } |
| 358 | } | 357 | } |
| 359 | 358 | ||
| @@ -384,19 +383,16 @@ int __init security_init(void) · 24 unmodified lines | |||
| 384 | { | 383 | { |
| 385 | unsigned int cnt; | 384 | unsigned int cnt; |
| 386 | struct lsm_info **lsm; | 385 | struct lsm_info **lsm; |
| 387 | struct lsm_info *early; | ||
| 388 | unsigned int first = 0; | ||
| 389 | 386 | ||
| 390 | init_debug("legacy security=%s\n", lsm_order_legacy ? : " *unspecified*"); | 387 | if (lsm_debug) { |
| 391 | init_debug(" CONFIG_LSM=%s\n", lsm_order_builtin); | 388 | lsm_pr("built-in LSM list: %s\n", lsm_order_builtin); |
| 392 | init_debug("boot arg lsm=%s\n", lsm_order_cmdline ? : " *unspecified*"); | 389 | lsm_pr("legacy LSM parameter: %s\n", lsm_order_legacy); |
| 390 | lsm_pr("boot LSM parameter: %s\n", lsm_order_cmdline); | ||
| 391 | } | ||
| 393 | 392 | ||
| 394 | if (lsm_order_cmdline) { | 393 | if (lsm_order_cmdline) { |
| 395 | if (lsm_order_legacy) { | 394 | if (lsm_order_legacy) |
| 396 | pr_warn("security=%s is ignored because it is superseded by lsm=%s\n", | ||
| 397 | lsm_order_legacy, lsm_order_cmdline); | ||
| 398 | lsm_order_legacy = NULL; | 395 | lsm_order_legacy = NULL; |
| 399 | } | ||
| 400 | lsm_order_parse(lsm_order_cmdline, "cmdline"); | 396 | lsm_order_parse(lsm_order_cmdline, "cmdline"); |
| 401 | } else | 397 | } else |
| 402 | lsm_order_parse(lsm_order_builtin, "builtin"); | 398 | lsm_order_parse(lsm_order_builtin, "builtin"); |
| @@ -404,38 +400,25 @@ int __init security_init(void) · 1 unmodified line | |||
| 404 | lsm_order_for_each(lsm) | 400 | lsm_order_for_each(lsm) |
| 405 | lsm_prepare(*lsm); | 401 | lsm_prepare(*lsm); |
| 406 | 402 | ||
| 407 | pr_info("initializing lsm="); | 403 | if (lsm_debug) { |
| 408 | lsm_early_for_each_raw(early) { | 404 | lsm_pr("blob(cred) size %d\n", blob_sizes.lbs_cred); |
| 409 | if (lsm_is_enabled(early)) | 405 | lsm_pr("blob(file) size %d\n", blob_sizes.lbs_file); |
| 410 | pr_cont("%s%s", | 406 | lsm_pr("blob(ib) size %d\n", blob_sizes.lbs_ib); |
| 411 | first++ == 0 ? "" : ",", early->id->name); | 407 | lsm_pr("blob(inode) size %d\n", blob_sizes.lbs_inode); |
| 412 | } | 408 | lsm_pr("blob(ipc) size %d\n", blob_sizes.lbs_ipc); |
| 413 | lsm_order_for_each(lsm) { | 409 | lsm_pr("blob(key) size %d\n", blob_sizes.lbs_key); |
| 414 | if (lsm_is_enabled(*lsm)) | 410 | lsm_pr("blob(msg_msg)_size %d\n", blob_sizes.lbs_msg_msg); |
| 415 | pr_cont("%s%s", | 411 | lsm_pr("blob(sock) size %d\n", blob_sizes.lbs_sock); |
| 416 | first++ == 0 ? "" : ",", (*lsm)->id->name); | 412 | lsm_pr("blob(superblock) size %d\n", blob_sizes.lbs_superblock); |
| 413 | lsm_pr("blob(perf_event) size %d\n", blob_sizes.lbs_perf_event); | ||
| 414 | lsm_pr("blob(task) size %d\n", blob_sizes.lbs_task); | ||
| 415 | lsm_pr("blob(tun_dev) size %d\n", blob_sizes.lbs_tun_dev); | ||
| 416 | lsm_pr("blob(xattr) count %d\n", blob_sizes.lbs_xattr_count); | ||
| 417 | lsm_pr("blob(bdev) size %d\n", blob_sizes.lbs_bdev); | ||
| 418 | lsm_pr("blob(bpf_map) size %d\n", blob_sizes.lbs_bpf_map); | ||
| 419 | lsm_pr("blob(bpf_prog) size %d\n", blob_sizes.lbs_bpf_prog); | ||
| 420 | lsm_pr("blob(bpf_token) size %d\n", blob_sizes.lbs_bpf_token); | ||
| 417 | } | 421 | } |
| 418 | pr_cont("\n"); | ||
| 419 | |||
| 420 | init_debug("cred blob size = %d\n", blob_sizes.lbs_cred); | ||
| 421 | init_debug("file blob size = %d\n", blob_sizes.lbs_file); | ||
| 422 | init_debug("ib blob size = %d\n", blob_sizes.lbs_ib); | ||
| 423 | init_debug("inode blob size = %d\n", blob_sizes.lbs_inode); | ||
| 424 | init_debug("ipc blob size = %d\n", blob_sizes.lbs_ipc); | ||
| 425 | #ifdef CONFIG_KEYS | ||
| 426 | init_debug("key blob size = %d\n", blob_sizes.lbs_key); | ||
| 427 | #endif /* CONFIG_KEYS */ | ||
| 428 | init_debug("msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg); | ||
| 429 | init_debug("sock blob size = %d\n", blob_sizes.lbs_sock); | ||
| 430 | init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock); | ||
| 431 | init_debug("perf event blob size = %d\n", blob_sizes.lbs_perf_event); | ||
| 432 | init_debug("task blob size = %d\n", blob_sizes.lbs_task); | ||
| 433 | init_debug("tun device blob size = %d\n", blob_sizes.lbs_tun_dev); | ||
| 434 | init_debug("xattr slots = %d\n", blob_sizes.lbs_xattr_count); | ||
| 435 | init_debug("bdev blob size = %d\n", blob_sizes.lbs_bdev); | ||
| 436 | init_debug("bpf map blob size = %d\n", blob_sizes.lbs_bpf_map); | ||
| 437 | init_debug("bpf prog blob size = %d\n", blob_sizes.lbs_bpf_prog); | ||
| 438 | init_debug("bpf token blob size = %d\n", blob_sizes.lbs_bpf_token); | ||
| 439 | 422 | ||
| 440 | if (blob_sizes.lbs_file) | 423 | if (blob_sizes.lbs_file) |
| 441 | lsm_file_cache = kmem_cache_create("lsm_file_cache", | 424 | lsm_file_cache = kmem_cache_create("lsm_file_cache", |
| @@ -447,9 +430,9 @@ int __init security_init(void) · 5 unmodified lines | |||
| 447 | SLAB_PANIC, NULL); | 430 | SLAB_PANIC, NULL); |
| 448 | 431 | ||
| 449 | if (lsm_cred_alloc((struct cred __rcu *)current->cred, GFP_KERNEL)) | 432 | if (lsm_cred_alloc((struct cred __rcu *)current->cred, GFP_KERNEL)) |
| 450 | panic("%s: early cred alloc failed.\n", __func__); | 433 | panic("early LSM cred alloc failed\n"); |
| 451 | if (lsm_task_alloc(current)) | 434 | if (lsm_task_alloc(current)) |
| 452 | panic("%s: early task alloc failed.\n", __func__); | 435 | panic("early LSM task alloc failed\n"); |
| 453 | 436 | ||
| 454 | cnt = 0; | 437 | cnt = 0; |
| 455 | lsm_order_for_each(lsm) { | 438 | lsm_order_for_each(lsm) { |
| @@ -73,6 +73,8 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX + 1] = { · 72 unmodified lines | |||
| 73 | [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality", | 73 | [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality", |
| 74 | }; | 74 | }; |
| 75 | 75 | ||
| 76 | bool lsm_debug __ro_after_init; | ||
| 77 | |||
| 76 | unsigned int lsm_active_cnt __ro_after_init; | 78 | unsigned int lsm_active_cnt __ro_after_init; |
| 77 | const struct lsm_id *lsm_idlist[MAX_LSM_COUNT]; | 79 | const struct lsm_id *lsm_idlist[MAX_LSM_COUNT]; |
| 78 | 80 | ||