Skip to content

Commit d69dece

Browse files
cschauflerJames Morris
cschaufler
authored and
James Morris
committed
LSM: Add /sys/kernel/security/lsm
I am still tired of having to find indirect ways to determine what security modules are active on a system. I have added /sys/kernel/security/lsm, which contains a comma separated list of the active security modules. No more groping around in /proc/filesystems or other clever hacks. Unchanged from previous versions except for being updated to the latest security next branch. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Acked-by: John Johansen <john.johansen@canonical.com> Acked-by: Paul Moore <paul@paul-moore.com> Acked-by: Kees Cook <keescook@chromium.org> Signed-off-by: James Morris <james.l.morris@oracle.com>
1 parent 3ccb76c commit d69dece

File tree

11 files changed

+82
-17
lines changed

11 files changed

+82
-17
lines changed

‎Documentation/security/LSM.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,13 @@ system, building their checks on top of the defined capability hooks.
2222
For more details on capabilities, see capabilities(7) in the Linux
2323
man-pages project.
2424

25+
A list of the active security modules can be found by reading
26+
/sys/kernel/security/lsm. This is a comma separated list, and
27+
will always include the capability module. The list reflects the
28+
order in which checks are made. The capability module will always
29+
be first, followed by any "minor" modules (e.g. Yama) and then
30+
the one "major" module (e.g. SELinux) if there is one configured.
31+
2532
Based on https://lkml.org/lkml/2007/10/26/215,
2633
a new LSM is accepted into the kernel when its intent (a description of
2734
what it tries to protect against and in what cases one would expect to

‎include/linux/lsm_hooks.h

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1875,6 +1875,7 @@ struct security_hook_list {
18751875
struct list_head list;
18761876
struct list_head *head;
18771877
union security_list_options hook;
1878+
char *lsm;
18781879
};
18791880

18801881
/*
@@ -1887,15 +1888,10 @@ struct security_hook_list {
18871888
{ .head = &security_hook_heads.HEAD, .hook = { .HEAD = HOOK } }
18881889

18891890
extern struct security_hook_heads security_hook_heads;
1891+
extern char *lsm_names;
18901892

1891-
static inline void security_add_hooks(struct security_hook_list *hooks,
1892-
int count)
1893-
{
1894-
int i;
1895-
1896-
for (i = 0; i < count; i++)
1897-
list_add_tail_rcu(&hooks[i].list, hooks[i].head);
1898-
}
1893+
extern void security_add_hooks(struct security_hook_list *hooks, int count,
1894+
char *lsm);
18991895

19001896
#ifdef CONFIG_SECURITY_SELINUX_DISABLE
19011897
/*

‎security/apparmor/lsm.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -999,7 +999,8 @@ static int __init apparmor_init(void)
999999
aa_free_root_ns();
10001000
goto buffers_out;
10011001
}
1002-
security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks));
1002+
security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks),
1003+
"apparmor");
10031004

10041005
/* Report that AppArmor successfully initialized */
10051006
apparmor_initialized = 1;

‎security/commoncap.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1093,7 +1093,8 @@ struct security_hook_list capability_hooks[] = {
10931093

10941094
void __init capability_add_hooks(void)
10951095
{
1096-
security_add_hooks(capability_hooks, ARRAY_SIZE(capability_hooks));
1096+
security_add_hooks(capability_hooks, ARRAY_SIZE(capability_hooks),
1097+
"capability");
10971098
}
10981099

10991100
#endif /* CONFIG_SECURITY */

‎security/inode.c

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
#include <linux/init.h>
2121
#include <linux/namei.h>
2222
#include <linux/security.h>
23+
#include <linux/lsm_hooks.h>
2324
#include <linux/magic.h>
2425

2526
static struct vfsmount *mount;
@@ -204,6 +205,21 @@ void securityfs_remove(struct dentry *dentry)
204205
}
205206
EXPORT_SYMBOL_GPL(securityfs_remove);
206207

208+
#ifdef CONFIG_SECURITY
209+
static struct dentry *lsm_dentry;
210+
static ssize_t lsm_read(struct file *filp, char __user *buf, size_t count,
211+
loff_t *ppos)
212+
{
213+
return simple_read_from_buffer(buf, count, ppos, lsm_names,
214+
strlen(lsm_names));
215+
}
216+
217+
static const struct file_operations lsm_ops = {
218+
.read = lsm_read,
219+
.llseek = generic_file_llseek,
220+
};
221+
#endif
222+
207223
static int __init securityfs_init(void)
208224
{
209225
int retval;
@@ -213,9 +229,15 @@ static int __init securityfs_init(void)
213229
return retval;
214230

215231
retval = register_filesystem(&fs_type);
216-
if (retval)
232+
if (retval) {
217233
sysfs_remove_mount_point(kernel_kobj, "security");
218-
return retval;
234+
return retval;
235+
}
236+
#ifdef CONFIG_SECURITY
237+
lsm_dentry = securityfs_create_file("lsm", 0444, NULL, NULL,
238+
&lsm_ops);
239+
#endif
240+
return 0;
219241
}
220242

221243
core_initcall(securityfs_init);

‎security/loadpin/loadpin.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -182,7 +182,7 @@ static struct security_hook_list loadpin_hooks[] = {
182182
void __init loadpin_add_hooks(void)
183183
{
184184
pr_info("ready to pin (currently %sabled)", enabled ? "en" : "dis");
185-
security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks));
185+
security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks), "loadpin");
186186
}
187187

188188
/* Should not be mutable after boot, so not listed in sysfs (perm == 0). */

‎security/security.c

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
/* Maximum number of letters for an LSM name string */
3333
#define SECURITY_NAME_MAX 10
3434

35+
char *lsm_names;
3536
/* Boot-time LSM user choice */
3637
static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] =
3738
CONFIG_DEFAULT_SECURITY;
@@ -78,6 +79,22 @@ static int __init choose_lsm(char *str)
7879
}
7980
__setup("security=", choose_lsm);
8081

82+
static int lsm_append(char *new, char **result)
83+
{
84+
char *cp;
85+
86+
if (*result == NULL) {
87+
*result = kstrdup(new, GFP_KERNEL);
88+
} else {
89+
cp = kasprintf(GFP_KERNEL, "%s,%s", *result, new);
90+
if (cp == NULL)
91+
return -ENOMEM;
92+
kfree(*result);
93+
*result = cp;
94+
}
95+
return 0;
96+
}
97+
8198
/**
8299
* security_module_enable - Load given security module on boot ?
83100
* @module: the name of the module
@@ -97,6 +114,27 @@ int __init security_module_enable(const char *module)
97114
return !strcmp(module, chosen_lsm);
98115
}
99116

117+
/**
118+
* security_add_hooks - Add a modules hooks to the hook lists.
119+
* @hooks: the hooks to add
120+
* @count: the number of hooks to add
121+
* @lsm: the name of the security module
122+
*
123+
* Each LSM has to register its hooks with the infrastructure.
124+
*/
125+
void __init security_add_hooks(struct security_hook_list *hooks, int count,
126+
char *lsm)
127+
{
128+
int i;
129+
130+
for (i = 0; i < count; i++) {
131+
hooks[i].lsm = lsm;
132+
list_add_tail_rcu(&hooks[i].list, hooks[i].head);
133+
}
134+
if (lsm_append(lsm, &lsm_names) < 0)
135+
panic("%s - Cannot get early memory.\n", __func__);
136+
}
137+
100138
/*
101139
* Hook list operation macros.
102140
*

‎security/selinux/hooks.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6349,7 +6349,7 @@ static __init int selinux_init(void)
63496349
0, SLAB_PANIC, NULL);
63506350
avc_init();
63516351

6352-
security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6352+
security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
63536353

63546354
if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
63556355
panic("SELinux: Unable to register AVC netcache callback\n");

‎security/smack/smack_lsm.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4819,7 +4819,7 @@ static __init int smack_init(void)
48194819
/*
48204820
* Register with LSM
48214821
*/
4822-
security_add_hooks(smack_hooks, ARRAY_SIZE(smack_hooks));
4822+
security_add_hooks(smack_hooks, ARRAY_SIZE(smack_hooks), "smack");
48234823

48244824
return 0;
48254825
}

‎security/tomoyo/tomoyo.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -542,7 +542,7 @@ static int __init tomoyo_init(void)
542542
if (!security_module_enable("tomoyo"))
543543
return 0;
544544
/* register ourselves with the security framework */
545-
security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks));
545+
security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks), "tomoyo");
546546
printk(KERN_INFO "TOMOYO Linux initialized\n");
547547
cred->security = &tomoyo_kernel_domain;
548548
tomoyo_mm_init();

‎security/yama/yama_lsm.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -485,6 +485,6 @@ static inline void yama_init_sysctl(void) { }
485485
void __init yama_add_hooks(void)
486486
{
487487
pr_info("Yama: becoming mindful.\n");
488-
security_add_hooks(yama_hooks, ARRAY_SIZE(yama_hooks));
488+
security_add_hooks(yama_hooks, ARRAY_SIZE(yama_hooks), "yama");
489489
yama_init_sysctl();
490490
}

0 commit comments

Comments
 (0)