Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e2bc445b authored by Kees Cook's avatar Kees Cook
Browse files

LSM: Introduce enum lsm_order 



In preparation for distinguishing the "capability" LSM from other LSMs, it
must be ordered first. This introduces LSM_ORDER_MUTABLE for the general
LSMs and LSM_ORDER_FIRST for capability. In the future LSM_ORDER_LAST
for could be added for anything that must run last (e.g. Landlock may
use this).

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
parent d6aed64b

include/linux/lsm_hooks.h

+6 −0
Original line number Diff line number Diff line
@@ -2045,8 +2045,14 @@ extern void security_add_hooks(struct security_hook_list *hooks, int count, 
#define LSM_FLAG_LEGACY_MAJOR	BIT(0)

#define LSM_FLAG_EXCLUSIVE	BIT(1)



enum lsm_order {

	LSM_ORDER_FIRST = -1,	/* This is only for capabilities. */

	LSM_ORDER_MUTABLE = 0,

};



struct lsm_info {

	const char *name;	/* Required. */

	enum lsm_order order;	/* Optional: default is LSM_ORDER_MUTABLE */

	unsigned long flags;	/* Optional: flags describing LSM */

	int *enabled;		/* Optional: controlled by CONFIG_LSM */

	int (*init)(void);	/* Required. */

security/security.c

+8 −1
Original line number Diff line number Diff line
@@ -174,6 +174,12 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) 
	struct lsm_info *lsm;

	char *sep, *name, *next;



	/* LSM_ORDER_FIRST is always first. */

	for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {

		if (lsm->order == LSM_ORDER_FIRST)

			append_ordered_lsm(lsm, "first");

	}



	/* Process "security=", if given. */

	if (chosen_major_lsm) {

		struct lsm_info *major;
@@ -202,7 +208,8 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) 
		bool found = false;



		for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {

			if (strcmp(lsm->name, name) == 0) {

			if (lsm->order == LSM_ORDER_MUTABLE &&

			    strcmp(lsm->name, name) == 0) {

				append_ordered_lsm(lsm, origin);

				found = true;

			}