lsm: cleanup the debug and console output in lsm_init.c

Move away from an init specific init_debug() macro to a more general lsm_pr()/lsm_pr_cont()/lsm_pr_dbg() set of macros that are available both before and after init. In the process we do a number of minor changes to improve the LSM initialization output and cleanup the code somewhat.

Paul Moore committed 1 year ago

Commit 5137e581 parent 45070533 files · +66 −70Browse files

Showing the changes to security (3 of 3 files). Show all

Unified · Split

3 files

security/lsm.h +11 −0
security/lsm_init.c +53 −70
security/security.c +2 −0

security/lsm.h+11−0

@@ -6,9 +6,20 @@ · 5 unmodified lines
6	6	#ifndef _LSM_H_
7	7	#define _LSM_H_
8	8
	9	+#include <linux/printk.h>
9	10	#include <linux/lsm_hooks.h>
10	11	#include <linux/lsm_count.h>
11	12
	13	+/* LSM debugging */
	14	+extern bool lsm_debug;
	15	+#define lsm_pr(...) pr_info(__VA_ARGS__)
	16	+#define lsm_pr_cont(...) pr_cont(__VA_ARGS__)
	17	+#define lsm_pr_dbg(...) \
	18	+ do { \
	19	+ if (lsm_debug) \
	20	+ pr_info(__VA_ARGS__); \
	21	+ } while (0)
	22	+
12	23	/* List of configured LSMs */
13	24	extern unsigned int lsm_active_cnt;
14	25	extern const struct lsm_id *lsm_idlist[];

security/lsm_init.c+53−70

@@ -30,13 +30,6 @@ static __initdata const char *lsm_order_legacy; · 29 unmodified lines
30	30	static __initdata struct lsm_info *lsm_order[MAX_LSM_COUNT + 1];
31	31	static __initdata struct lsm_info *lsm_exclusive;
32	32
33		−static __initdata bool debug;
34		−#define init_debug(...) \
35		− do { \
36		− if (debug) \
37		− pr_info(__VA_ARGS__); \
38		− } while (0)
39		−
40	33	#define lsm_order_for_each(iter) \
41	34	for ((iter) = lsm_order; *(iter); (iter)++)
42	35	#define lsm_for_each_raw(iter) \
@@ -77,7 +70,7 @@ __setup("lsm=", lsm_choose_lsm); · 34 unmodified lines
77	70	*/
78	71	static int __init lsm_debug_enable(char *str)
79	72	{
80		− debug = true;
	73	+ lsm_debug = true;
81	74	return 1;
82	75	}
83	76	__setup("lsm.debug", lsm_debug_enable);
@@ -143,22 +136,28 @@ static void __init lsm_order_append(struct lsm_info lsm, const char src) · 59 unmodified lines
143	136	return;
144	137
145	138	/* Skip explicitly disabled LSMs. */
146		− if (lsm->enabled && !lsm_is_enabled(lsm))
147		− goto out;
	139	+ if (lsm->enabled && !lsm_is_enabled(lsm)) {
	140	+ lsm_pr_dbg("skip previously disabled LSM %s:%s\n",
	141	+ src, lsm->id->name);
	142	+ return;
	143	+ }
148	144
149		− if (WARN(lsm_active_cnt == MAX_LSM_COUNT,
150		− "%s: out of LSM static calls!?\n", src)) {
	145	+ if (lsm_active_cnt == MAX_LSM_COUNT) {
	146	+ pr_warn("exceeded maximum LSM count on %s:%s\n",
	147	+ src, lsm->id->name);
151	148	lsm_enabled_set(lsm, false);
152		− goto out;
	149	+ return;
153	150	}
154	151
155	152	if (lsm->flags & LSM_FLAG_EXCLUSIVE) {
156	153	if (lsm_exclusive) {
157		− init_debug("exclusive disabled: %s\n", lsm->id->name);
	154	+ lsm_pr_dbg("skip exclusive LSM conflict %s:%s\n",
	155	+ src, lsm->id->name);
158	156	lsm_enabled_set(lsm, false);
159		− goto out;
	157	+ return;
160	158	} else {
161		− init_debug("exclusive chosen: %s\n", lsm->id->name);
	159	+ lsm_pr_dbg("select exclusive LSM %s:%s\n",
	160	+ src, lsm->id->name);
162	161	lsm_exclusive = lsm;
163	162	}
164	163	}
@@ -167,9 +166,7 @@ static void __init lsm_order_append(struct lsm_info lsm, const char src) · 2 unmodified lines
167	166	lsm_order[lsm_active_cnt] = lsm;
168	167	lsm_idlist[lsm_active_cnt++] = lsm->id;
169	168
170		−out:
171		− init_debug("%s ordered: %s (%s)\n", src, lsm->id->name,
172		− lsm_is_enabled(lsm) ? "enabled" : "disabled");
	169	+ lsm_pr_dbg("enabling LSM %s:%s\n", src, lsm->id->name);
173	170	}
174	171
175	172	/**
@@ -239,7 +236,7 @@ static void __init lsm_init_single(struct lsm_info *lsm) · 63 unmodified lines
239	236	if (!lsm_is_enabled(lsm))
240	237	return;
241	238
242		− init_debug("initializing %s\n", lsm->id->name);
	239	+ lsm_pr_dbg("initializing %s\n", lsm->id->name);
243	240	ret = lsm->init();
244	241	WARN(ret, "%s failed to initialize: %d\n", lsm->id->name, ret);
245	242	}
@@ -266,8 +263,8 @@ static void __init lsm_order_parse(const char list, const char src) · 20 unmodified lines
266	263	if ((lsm->flags & LSM_FLAG_LEGACY_MAJOR) &&
267	264	strcmp(lsm->id->name, lsm_order_legacy)) {
268	265	lsm_enabled_set(lsm, false);
269		− init_debug("security=%s disabled: %s (only one legacy major LSM)\n",
270		− lsm_order_legacy, lsm->id->name);
	266	+ lsm_pr_dbg("skip legacy LSM conflict %s:%s\n",
	267	+ src, lsm->id->name);
271	268	}
272	269	}
273	270	}
@@ -310,8 +307,7 @@ static void __init lsm_order_parse(const char list, const char src) · 36 unmodified lines
310	307	if (lsm_order_exists(lsm))
311	308	continue;
312	309	lsm_enabled_set(lsm, false);
313		− init_debug("%s skipped: %s (not in requested order)\n",
314		− src, lsm->id->name);
	310	+ lsm_pr_dbg("skip disabled LSM %s:%s\n", src, lsm->id->name);
315	311	}
316	312	}
317	313
@@ -319,7 +315,7 @@ static void __init lsm_order_parse(const char list, const char src) · 1 unmodified line
319	315	* lsm_static_call_init - Initialize a LSM's static calls
320	316	* @hl: LSM hook list
321	317	*/
322		−static void __init lsm_static_call_init(struct security_hook_list *hl)
	318	+static int __init lsm_static_call_init(struct security_hook_list *hl)
323	319	{
324	320	struct lsm_static_call *scall = hl->scalls;
325	321	int i;
@@ -331,11 +327,12 @@ static void __init lsm_static_call_init(struct security_hook_list *hl) · 5 unmodified lines
331	327	hl->hook.lsm_func_addr);
332	328	scall->hl = hl;
333	329	static_branch_enable(scall->active);
334		− return;
	330	+ return 0;
335	331	}
336	332	scall++;
337	333	}
338		− panic("%s - Ran out of static slots.\n", __func__);
	334	+
	335	+ return -ENOSPC;
339	336	}
340	337
341	338	/**
@@ -353,7 +350,9 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count, · 11 unmodified lines
353	350
354	351	for (i = 0; i < count; i++) {
355	352	hooks[i].lsmid = lsmid;
356		− lsm_static_call_init(&hooks[i]);
	353	+ if (lsm_static_call_init(&hooks[i]))
	354	+ panic("exhausted LSM callback slots with LSM %s\n",
	355	+ lsmid->name);
357	356	}
358	357	}
359	358
@@ -384,19 +383,16 @@ int __init security_init(void) · 24 unmodified lines
384	383	{
385	384	unsigned int cnt;
386	385	struct lsm_info **lsm;
387		− struct lsm_info *early;
388		− unsigned int first = 0;
389	386
390		− init_debug("legacy security=%s\n", lsm_order_legacy ? : " unspecified");
391		− init_debug(" CONFIG_LSM=%s\n", lsm_order_builtin);
392		− init_debug("boot arg lsm=%s\n", lsm_order_cmdline ? : " unspecified");
	387	+ if (lsm_debug) {
	388	+ lsm_pr("built-in LSM list: %s\n", lsm_order_builtin);
	389	+ lsm_pr("legacy LSM parameter: %s\n", lsm_order_legacy);
	390	+ lsm_pr("boot LSM parameter: %s\n", lsm_order_cmdline);
	391	+ }
393	392
394	393	if (lsm_order_cmdline) {
395		− if (lsm_order_legacy) {
396		− pr_warn("security=%s is ignored because it is superseded by lsm=%s\n",
397		− lsm_order_legacy, lsm_order_cmdline);
	394	+ if (lsm_order_legacy)
398	395	lsm_order_legacy = NULL;
399		− }
400	396	lsm_order_parse(lsm_order_cmdline, "cmdline");
401	397	} else
402	398	lsm_order_parse(lsm_order_builtin, "builtin");
@@ -404,38 +400,25 @@ int __init security_init(void) · 1 unmodified line
404	400	lsm_order_for_each(lsm)
405	401	lsm_prepare(*lsm);
406	402
407		− pr_info("initializing lsm=");
408		− lsm_early_for_each_raw(early) {
409		− if (lsm_is_enabled(early))
410		− pr_cont("%s%s",
411		− first++ == 0 ? "" : ",", early->id->name);
412		− }
413		− lsm_order_for_each(lsm) {
414		− if (lsm_is_enabled(*lsm))
415		− pr_cont("%s%s",
416		− first++ == 0 ? "" : ",", (*lsm)->id->name);
	403	+ if (lsm_debug) {
	404	+ lsm_pr("blob(cred) size %d\n", blob_sizes.lbs_cred);
	405	+ lsm_pr("blob(file) size %d\n", blob_sizes.lbs_file);
	406	+ lsm_pr("blob(ib) size %d\n", blob_sizes.lbs_ib);
	407	+ lsm_pr("blob(inode) size %d\n", blob_sizes.lbs_inode);
	408	+ lsm_pr("blob(ipc) size %d\n", blob_sizes.lbs_ipc);
	409	+ lsm_pr("blob(key) size %d\n", blob_sizes.lbs_key);
	410	+ lsm_pr("blob(msg_msg)_size %d\n", blob_sizes.lbs_msg_msg);
	411	+ lsm_pr("blob(sock) size %d\n", blob_sizes.lbs_sock);
	412	+ lsm_pr("blob(superblock) size %d\n", blob_sizes.lbs_superblock);
	413	+ lsm_pr("blob(perf_event) size %d\n", blob_sizes.lbs_perf_event);
	414	+ lsm_pr("blob(task) size %d\n", blob_sizes.lbs_task);
	415	+ lsm_pr("blob(tun_dev) size %d\n", blob_sizes.lbs_tun_dev);
	416	+ lsm_pr("blob(xattr) count %d\n", blob_sizes.lbs_xattr_count);
	417	+ lsm_pr("blob(bdev) size %d\n", blob_sizes.lbs_bdev);
	418	+ lsm_pr("blob(bpf_map) size %d\n", blob_sizes.lbs_bpf_map);
	419	+ lsm_pr("blob(bpf_prog) size %d\n", blob_sizes.lbs_bpf_prog);
	420	+ lsm_pr("blob(bpf_token) size %d\n", blob_sizes.lbs_bpf_token);
417	421	}
418		− pr_cont("\n");
419		−
420		− init_debug("cred blob size = %d\n", blob_sizes.lbs_cred);
421		− init_debug("file blob size = %d\n", blob_sizes.lbs_file);
422		− init_debug("ib blob size = %d\n", blob_sizes.lbs_ib);
423		− init_debug("inode blob size = %d\n", blob_sizes.lbs_inode);
424		− init_debug("ipc blob size = %d\n", blob_sizes.lbs_ipc);
425		−#ifdef CONFIG_KEYS
426		− init_debug("key blob size = %d\n", blob_sizes.lbs_key);
427		−#endif /* CONFIG_KEYS */
428		− init_debug("msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg);
429		− init_debug("sock blob size = %d\n", blob_sizes.lbs_sock);
430		− init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock);
431		− init_debug("perf event blob size = %d\n", blob_sizes.lbs_perf_event);
432		− init_debug("task blob size = %d\n", blob_sizes.lbs_task);
433		− init_debug("tun device blob size = %d\n", blob_sizes.lbs_tun_dev);
434		− init_debug("xattr slots = %d\n", blob_sizes.lbs_xattr_count);
435		− init_debug("bdev blob size = %d\n", blob_sizes.lbs_bdev);
436		− init_debug("bpf map blob size = %d\n", blob_sizes.lbs_bpf_map);
437		− init_debug("bpf prog blob size = %d\n", blob_sizes.lbs_bpf_prog);
438		− init_debug("bpf token blob size = %d\n", blob_sizes.lbs_bpf_token);
439	422
440	423	if (blob_sizes.lbs_file)
441	424	lsm_file_cache = kmem_cache_create("lsm_file_cache",
@@ -447,9 +430,9 @@ int __init security_init(void) · 5 unmodified lines
447	430	SLAB_PANIC, NULL);
448	431
449	432	if (lsm_cred_alloc((struct cred __rcu *)current->cred, GFP_KERNEL))
450		− panic("%s: early cred alloc failed.\n", __func__);
	433	+ panic("early LSM cred alloc failed\n");
451	434	if (lsm_task_alloc(current))
452		− panic("%s: early task alloc failed.\n", __func__);
	435	+ panic("early LSM task alloc failed\n");
453	436
454	437	cnt = 0;
455	438	lsm_order_for_each(lsm) {

security/security.c+2−0

@@ -73,6 +73,8 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX + 1] = { · 72 unmodified lines
73	73	[LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality",
74	74	};
75	75
	76	+bool lsm_debug __ro_after_init;
	77	+
76	78	unsigned int lsm_active_cnt __ro_after_init;
77	79	const struct lsm_id *lsm_idlist[MAX_LSM_COUNT];
78	80