lkml.org 
[lkml]   [2018]   [Nov]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Subject[PATCH v5 07/38] LSM: Introduce "lsm=" for boottime LSM selection
    From
    Date
    Provide a way to explicitly choose LSM initialization order via the new
    "lsm=" comma-separated list of LSMs.

    Signed-off-by: Kees Cook <keescook@chromium.org>
    ---
    Documentation/admin-guide/kernel-parameters.txt | 4 ++++
    security/Kconfig | 3 ++-
    security/security.c | 14 +++++++++++++-
    3 files changed, 19 insertions(+), 2 deletions(-)

    diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
    index 81d1d5a74728..ea33bcbaecb2 100644
    --- a/Documentation/admin-guide/kernel-parameters.txt
    +++ b/Documentation/admin-guide/kernel-parameters.txt
    @@ -2302,6 +2302,10 @@

    lsm.debug [SECURITY] Enable LSM initialization debugging output.

    + lsm=lsm1,...,lsmN
    + [SECURITY] Choose order of LSM initialization. This
    + overrides CONFIG_LSM.
    +
    machvec= [IA-64] Force the use of a particular machine-vector
    (machvec) in a generic kernel.
    Example: machvec=hpzx1_swiotlb
    diff --git a/security/Kconfig b/security/Kconfig
    index 7de42bbacc28..41aa0be6142f 100644
    --- a/security/Kconfig
    +++ b/security/Kconfig
    @@ -281,7 +281,8 @@ config LSM
    default "integrity"
    help
    A comma-separated list of LSMs, in initialization order.
    - Any LSMs left off this list will be ignored.
    + Any LSMs left off this list will be ignored. This can be
    + controlled at boot with the "lsm=" parameter.

    If unsure, leave this as the default.

    diff --git a/security/security.c b/security/security.c
    index 96e0b7d057b0..38fc436e8b4b 100644
    --- a/security/security.c
    +++ b/security/security.c
    @@ -47,6 +47,7 @@ char *lsm_names;
    /* Boot-time LSM user choice */
    static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] =
    CONFIG_DEFAULT_SECURITY;
    +static __initdata const char *chosen_lsm_order;

    static __initconst const char * const builtin_lsm_order = CONFIG_LSM;

    @@ -190,7 +191,10 @@ static void __init ordered_lsm_init(void)
    ordered_lsms = kcalloc(LSM_COUNT + 1, sizeof(*ordered_lsms),
    GFP_KERNEL);

    - ordered_lsm_parse(builtin_lsm_order, "builtin");
    + if (chosen_lsm_order)
    + ordered_lsm_parse(chosen_lsm_order, "cmdline");
    + else
    + ordered_lsm_parse(builtin_lsm_order, "builtin");

    for (lsm = ordered_lsms; *lsm; lsm++)
    maybe_initialize_lsm(*lsm);
    @@ -252,6 +256,14 @@ static int __init choose_lsm(char *str)
    }
    __setup("security=", choose_lsm);

    +/* Explicitly choose LSM initialization order. */
    +static int __init choose_lsm_order(char *str)
    +{
    + chosen_lsm_order = str;
    + return 1;
    +}
    +__setup("lsm=", choose_lsm_order);
    +
    /* Enable LSM order debugging. */
    static int __init enable_debug(char *str)
    {
    --
    2.14.5

    \
     
     \ /
      Last update: 2018-11-27 00:36    [W:4.080 / U:0.144 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site