iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

LSM: Introduce "lsm=" for boottime LSM selection

Browse Source 
Provide a way to explicitly choose LSM initialization order via the new
"lsm=" comma-separated list of LSMs.

Signed-off-by: Kees Cook <keescook@chromium.org>
This commit is contained in:
Kees Cook 2018-09-19 17:30:09 -07:00
parent 13e735c0e9
commit 79f7865d84
3 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Documentation/admin-guide/kernel-parameters.txt
View File

@ -2319,6 +2319,10 @@
lsm.debug [SECURITY] Enable LSM initialization debugging output.
lsm=lsm1,...,lsmN
[SECURITY] Choose order of LSM initialization. This
overrides CONFIG_LSM.
machvec= [IA-64] Force the use of a particular machine-vector
(machvec) in a generic kernel.
Example: machvec=hpzx1_swiotlb

3
security/Kconfig
View File

@ -281,7 +281,8 @@ config LSM
default "integrity"
help
A comma-separated list of LSMs, in initialization order.
Any LSMs left off this list will be ignored.
Any LSMs left off this list will be ignored. This can be
controlled at boot with the "lsm=" parameter.
If unsure, leave this as the default.

14
security/security.c
View File

@ -47,6 +47,7 @@ char *lsm_names;
/* Boot-time LSM user choice */
static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] =
CONFIG_DEFAULT_SECURITY;
static __initdata const char *chosen_lsm_order;
static __initconst const char * const builtin_lsm_order = CONFIG_LSM;
@ -190,7 +191,10 @@ static void __init ordered_lsm_init(void)
ordered_lsms = kcalloc(LSM_COUNT + 1, sizeof(*ordered_lsms),
GFP_KERNEL);
ordered_lsm_parse(builtin_lsm_order, "builtin");
if (chosen_lsm_order)
ordered_lsm_parse(chosen_lsm_order, "cmdline");
else
ordered_lsm_parse(builtin_lsm_order, "builtin");
for (lsm = ordered_lsms; *lsm; lsm++)
maybe_initialize_lsm(*lsm);
@ -252,6 +256,14 @@ static int __init choose_lsm(char *str)
}
__setup("security=", choose_lsm);
/* Explicitly choose LSM initialization order. */
static int __init choose_lsm_order(char *str)
{
chosen_lsm_order = str;
return 1;
}
__setup("lsm=", choose_lsm_order);
/* Enable LSM order debugging. */
static int __init enable_debug(char *str)
{