Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c5459b82 authored by Kees Cook's avatar Kees Cook
Browse files

LSM: Plumb visibility into optional "enabled" state 



In preparation for lifting the "is this LSM enabled?" logic out of the
individual LSMs, pass in any special enabled state tracking (as needed
for SELinux, AppArmor, and LoadPin). This should be an "int" to include
handling any future cases where "enabled" is exposed via sysctl which
has no "bool" type.

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Reviewed-by: default avatarJohn Johansen <john.johansen@canonical.com>
parent 657d910b

include/linux/lsm_hooks.h

+1 −0
Original line number Diff line number Diff line
@@ -2047,6 +2047,7 @@ extern void security_add_hooks(struct security_hook_list *hooks, int count, 
struct lsm_info {

	const char *name;	/* Required. */

	unsigned long flags;	/* Optional: flags describing LSM */

	int *enabled;		/* Optional: NULL means enabled. */

	int (*init)(void);	/* Required. */

};

security/apparmor/lsm.c

+3 −2
Original line number Diff line number Diff line
@@ -1333,8 +1333,8 @@ bool aa_g_paranoid_load = true; 
module_param_named(paranoid_load, aa_g_paranoid_load, aabool, S_IRUGO);



/* Boot time disable flag */

static bool apparmor_enabled = CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE;

module_param_named(enabled, apparmor_enabled, bool, S_IRUGO);

static int apparmor_enabled = CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE;

module_param_named(enabled, apparmor_enabled, int, 0444);



static int __init apparmor_enabled_setup(char *str)

{
@@ -1730,5 +1730,6 @@ static int __init apparmor_init(void) 
DEFINE_LSM(apparmor) = {

	.name = "apparmor",

	.flags = LSM_FLAG_LEGACY_MAJOR,

	.enabled = &apparmor_enabled,

	.init = apparmor_init,

};

security/selinux/hooks.c

+1 −0
Original line number Diff line number Diff line
@@ -7000,6 +7000,7 @@ void selinux_complete_init(void) 
DEFINE_LSM(selinux) = {

	.name = "selinux",

	.flags = LSM_FLAG_LEGACY_MAJOR,

	.enabled = &selinux_enabled,

	.init = selinux_init,

};