Commit 553bd5a2 authored by Chris Wright's avatar Chris Wright Committed by Linus Torvalds

[PATCH] lsm: Early init for security modules (1/4)

As discussed before, this allows for early initialization of security
modules when compiled statically into the kernel.  The standard
do_initcalls is too late for complete coverage of all filesystems and
threads, for example.
parent 47382294
...@@ -74,6 +74,9 @@ SECTIONS ...@@ -74,6 +74,9 @@ SECTIONS
__con_initcall_end = .; __con_initcall_end = .;
} }
. = ALIGN(8);
SECURITY_INIT
. = ALIGN(64); . = ALIGN(64);
__per_cpu_start = .; __per_cpu_start = .;
.data.percpu : { *(.data.percpu) } .data.percpu : { *(.data.percpu) }
......
...@@ -43,6 +43,7 @@ SECTIONS ...@@ -43,6 +43,7 @@ SECTIONS
__con_initcall_start = .; __con_initcall_start = .;
*(.con_initcall.init) *(.con_initcall.init)
__con_initcall_end = .; __con_initcall_end = .;
SECURITY_INIT
. = ALIGN(32768); . = ALIGN(32768);
__init_end = .; __init_end = .;
} }
......
...@@ -53,6 +53,7 @@ SECTIONS ...@@ -53,6 +53,7 @@ SECTIONS
__con_initcall_start = .; __con_initcall_start = .;
*(.con_initcall.init) *(.con_initcall.init)
__con_initcall_end = .; __con_initcall_end = .;
SECURITY_INIT
. = ALIGN(32); . = ALIGN(32);
__initramfs_start = .; __initramfs_start = .;
usr/built-in.o(.init.ramfs) usr/built-in.o(.init.ramfs)
......
...@@ -74,6 +74,11 @@ SECTIONS ...@@ -74,6 +74,11 @@ SECTIONS
__con_initcall_start = .; __con_initcall_start = .;
*(.con_initcall.init) *(.con_initcall.init)
__con_initcall_end = .; __con_initcall_end = .;
}
.security_initcall.init : {
__security_initcall_start = .;
*(.security_initcall.init)
__security_initcall_end = .;
/* We fill to the next page, so we can discard all init /* We fill to the next page, so we can discard all init
pages without needing to consider what payload might be pages without needing to consider what payload might be
......
...@@ -83,6 +83,7 @@ SECTIONS ...@@ -83,6 +83,7 @@ SECTIONS
___con_initcall_start = .; ___con_initcall_start = .;
*(.con_initcall.init) *(.con_initcall.init)
___con_initcall_end = .; ___con_initcall_end = .;
SECURITY_INIT
. = ALIGN(4); . = ALIGN(4);
___initramfs_start = .; ___initramfs_start = .;
*(.init.ramfs) *(.init.ramfs)
......
...@@ -81,6 +81,7 @@ SECTIONS ...@@ -81,6 +81,7 @@ SECTIONS
__con_initcall_start = .; __con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) } .con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .; __con_initcall_end = .;
SECURITY_INIT
. = ALIGN(4); . = ALIGN(4);
__alt_instructions = .; __alt_instructions = .;
.altinstructions : { *(.altinstructions) } .altinstructions : { *(.altinstructions) }
......
...@@ -141,6 +141,10 @@ SECTIONS ...@@ -141,6 +141,10 @@ SECTIONS
.con_initcall.init : AT(ADDR(.con_initcall.init) - PAGE_OFFSET) .con_initcall.init : AT(ADDR(.con_initcall.init) - PAGE_OFFSET)
{ *(.con_initcall.init) } { *(.con_initcall.init) }
__con_initcall_end = .; __con_initcall_end = .;
__security_initcall_start = .;
.security_initcall.init : AT(ADDR(.security_initcall.init) - PAGE_OFFSET)
{ *(.security_initcall.init) }
__security_initcall_end = .;
. = ALIGN(PAGE_SIZE); . = ALIGN(PAGE_SIZE);
__init_end = .; __init_end = .;
......
...@@ -67,6 +67,7 @@ SECTIONS ...@@ -67,6 +67,7 @@ SECTIONS
__con_initcall_start = .; __con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) } .con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .; __con_initcall_end = .;
SECURITY_INIT
. = ALIGN(8192); . = ALIGN(8192);
__initramfs_start = .; __initramfs_start = .;
.init.ramfs : { *(.init.ramfs) } .init.ramfs : { *(.init.ramfs) }
......
...@@ -61,6 +61,7 @@ __init_begin = .; ...@@ -61,6 +61,7 @@ __init_begin = .;
__con_initcall_start = .; __con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) } .con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .; __con_initcall_end = .;
SECURITY_INIT
. = ALIGN(8192); . = ALIGN(8192);
__initramfs_start = .; __initramfs_start = .;
.init.ramfs : { *(.init.ramfs) } .init.ramfs : { *(.init.ramfs) }
......
...@@ -277,9 +277,7 @@ SECTIONS { ...@@ -277,9 +277,7 @@ SECTIONS {
__con_initcall_start = .; __con_initcall_start = .;
*(.con_initcall.init) *(.con_initcall.init)
__con_initcall_end = .; __con_initcall_end = .;
__security_initcall_start = .; SECURITY_INIT
*(.security_initcall.init)
__security_initcall_end = .;
. = ALIGN(4); . = ALIGN(4);
__initramfs_start = .; __initramfs_start = .;
*(.init.ramfs) *(.init.ramfs)
......
...@@ -54,6 +54,7 @@ SECTIONS ...@@ -54,6 +54,7 @@ SECTIONS
__con_initcall_start = .; __con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) } .con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .; __con_initcall_end = .;
SECURITY_INIT
. = ALIGN(4096); /* Align double page for init_task_union */ . = ALIGN(4096); /* Align double page for init_task_union */
__init_end = .; __init_end = .;
......
...@@ -53,6 +53,7 @@ SECTIONS ...@@ -53,6 +53,7 @@ SECTIONS
__con_initcall_start = .; __con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) } .con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .; __con_initcall_end = .;
SECURITY_INIT
. = ALIGN(4096); /* Align double page for init_task_union */ . = ALIGN(4096); /* Align double page for init_task_union */
__init_end = .; __init_end = .;
......
...@@ -80,6 +80,7 @@ SECTIONS ...@@ -80,6 +80,7 @@ SECTIONS
__con_initcall_start = .; __con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) } .con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .; __con_initcall_end = .;
SECURITY_INIT
. = ALIGN(4096); . = ALIGN(4096);
__initramfs_start = .; __initramfs_start = .;
.init.ramfs : { *(.init.ramfs) } .init.ramfs : { *(.init.ramfs) }
......
...@@ -119,6 +119,8 @@ SECTIONS ...@@ -119,6 +119,8 @@ SECTIONS
.con_initcall.init : { *(.con_initcall.init) } .con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .; __con_initcall_end = .;
SECURITY_INIT
__start___ftr_fixup = .; __start___ftr_fixup = .;
__ftr_fixup : { *(__ftr_fixup) } __ftr_fixup : { *(__ftr_fixup) }
__stop___ftr_fixup = .; __stop___ftr_fixup = .;
......
...@@ -104,6 +104,7 @@ SECTIONS ...@@ -104,6 +104,7 @@ SECTIONS
__con_initcall_start = .; __con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) } .con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .; __con_initcall_end = .;
SECURITY_INIT
. = ALIGN(4096); . = ALIGN(4096);
__initramfs_start = .; __initramfs_start = .;
.init.ramfs : { *(.init.ramfs) } .init.ramfs : { *(.init.ramfs) }
......
...@@ -94,6 +94,7 @@ SECTIONS ...@@ -94,6 +94,7 @@ SECTIONS
__con_initcall_start = .; __con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) } .con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .; __con_initcall_end = .;
SECURITY_INIT
. = ALIGN(256); . = ALIGN(256);
__initramfs_start = .; __initramfs_start = .;
.init.ramfs : { *(.init.initramfs) } .init.ramfs : { *(.init.initramfs) }
......
...@@ -71,6 +71,7 @@ SECTIONS ...@@ -71,6 +71,7 @@ SECTIONS
__con_initcall_start = .; __con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) } .con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .; __con_initcall_end = .;
SECURITY_INIT
__machvec_start = .; __machvec_start = .;
.machvec.init : { *(.machvec.init) } .machvec.init : { *(.machvec.init) }
__machvec_end = .; __machvec_end = .;
......
...@@ -62,6 +62,7 @@ SECTIONS ...@@ -62,6 +62,7 @@ SECTIONS
__con_initcall_start = .; __con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) } .con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .; __con_initcall_end = .;
SECURITY_INIT
. = ALIGN(4096); . = ALIGN(4096);
__initramfs_start = .; __initramfs_start = .;
.init.ramfs : { *(.init.ramfs) } .init.ramfs : { *(.init.ramfs) }
......
...@@ -68,6 +68,7 @@ SECTIONS ...@@ -68,6 +68,7 @@ SECTIONS
__con_initcall_start = .; __con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) } .con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .; __con_initcall_end = .;
SECURITY_INIT
. = ALIGN(8192); . = ALIGN(8192);
__initramfs_start = .; __initramfs_start = .;
.init.ramfs : { *(.init.ramfs) } .init.ramfs : { *(.init.ramfs) }
......
...@@ -105,6 +105,7 @@ SECTIONS ...@@ -105,6 +105,7 @@ SECTIONS
__con_initcall_start = .; __con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) } .con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .; __con_initcall_end = .;
SECURITY_INIT
. = ALIGN(4096); . = ALIGN(4096);
__initramfs_start = .; __initramfs_start = .;
.init.ramfs : { *(.init.ramfs) } .init.ramfs : { *(.init.ramfs) }
......
...@@ -45,3 +45,9 @@ ...@@ -45,3 +45,9 @@
*(__ksymtab_strings) \ *(__ksymtab_strings) \
} }
#define SECURITY_INIT \
.security_initcall.init : { \
__security_initcall_start = .; \
*(.security_initcall.init) \
__security_initcall_end = .; \
}
...@@ -64,6 +64,7 @@ typedef int (*initcall_t)(void); ...@@ -64,6 +64,7 @@ typedef int (*initcall_t)(void);
typedef void (*exitcall_t)(void); typedef void (*exitcall_t)(void);
extern initcall_t __con_initcall_start, __con_initcall_end; extern initcall_t __con_initcall_start, __con_initcall_end;
extern initcall_t __security_initcall_start, __security_initcall_end;
#endif #endif
#ifndef MODULE #ifndef MODULE
...@@ -96,6 +97,9 @@ extern initcall_t __con_initcall_start, __con_initcall_end; ...@@ -96,6 +97,9 @@ extern initcall_t __con_initcall_start, __con_initcall_end;
#define console_initcall(fn) \ #define console_initcall(fn) \
static initcall_t __initcall_##fn __attribute__ ((unused,__section__ (".con_initcall.init")))=fn static initcall_t __initcall_##fn __attribute__ ((unused,__section__ (".con_initcall.init")))=fn
#define security_initcall(fn) \
static initcall_t __initcall_##fn __attribute__ ((unused,__section__ (".security_initcall.init"))) = fn
struct obs_kernel_param { struct obs_kernel_param {
const char *str; const char *str;
int (*setup_func)(char *); int (*setup_func)(char *);
...@@ -143,6 +147,8 @@ struct obs_kernel_param { ...@@ -143,6 +147,8 @@ struct obs_kernel_param {
#define device_initcall(fn) module_init(fn) #define device_initcall(fn) module_init(fn)
#define late_initcall(fn) module_init(fn) #define late_initcall(fn) module_init(fn)
#define security_initcall(fn) module_init(fn)
/* These macros create a dummy inline: gcc 2.9x does not count alias /* These macros create a dummy inline: gcc 2.9x does not count alias
as usage, hence the `unused function' warning when __init functions as usage, hence the `unused function' warning when __init functions
are declared static. We use the dummy __*_module_inline functions are declared static. We use the dummy __*_module_inline functions
......
...@@ -439,8 +439,8 @@ asmlinkage void __init start_kernel(void) ...@@ -439,8 +439,8 @@ asmlinkage void __init start_kernel(void)
pte_chain_init(); pte_chain_init();
fork_init(num_physpages); fork_init(num_physpages);
proc_caches_init(); proc_caches_init();
security_scaffolding_startup();
buffer_init(); buffer_init();
security_scaffolding_startup();
vfs_caches_init(num_physpages); vfs_caches_init(num_physpages);
radix_tree_init(); radix_tree_init();
signals_init(); signals_init();
......
...@@ -348,7 +348,7 @@ static void __exit capability_exit (void) ...@@ -348,7 +348,7 @@ static void __exit capability_exit (void)
} }
} }
module_init (capability_init); security_initcall (capability_init);
module_exit (capability_exit); module_exit (capability_exit);
MODULE_DESCRIPTION("Standard Linux Capabilities Security Module"); MODULE_DESCRIPTION("Standard Linux Capabilities Security Module");
......
...@@ -135,7 +135,7 @@ static void __exit rootplug_exit (void) ...@@ -135,7 +135,7 @@ static void __exit rootplug_exit (void)
printk (KERN_INFO "Root Plug module removed\n"); printk (KERN_INFO "Root Plug module removed\n");
} }
module_init (rootplug_init); security_initcall (rootplug_init);
module_exit (rootplug_exit); module_exit (rootplug_exit);
MODULE_DESCRIPTION("Root Plug sample LSM module, written for Linux Journal article"); MODULE_DESCRIPTION("Root Plug sample LSM module, written for Linux Journal article");
......
...@@ -38,12 +38,22 @@ static inline int verify (struct security_operations *ops) ...@@ -38,12 +38,22 @@ static inline int verify (struct security_operations *ops)
return 0; return 0;
} }
static void __init do_security_initcalls(void)
{
initcall_t *call;
call = &__security_initcall_start;
while (call < &__security_initcall_end) {
(*call)();
call++;
}
}
/** /**
* security_scaffolding_startup - initialzes the security scaffolding framework * security_scaffolding_startup - initialzes the security scaffolding framework
* *
* This should be called early in the kernel initialization sequence. * This should be called early in the kernel initialization sequence.
*/ */
int security_scaffolding_startup (void) int __init security_scaffolding_startup (void)
{ {
printk (KERN_INFO "Security Scaffold v" SECURITY_SCAFFOLD_VERSION printk (KERN_INFO "Security Scaffold v" SECURITY_SCAFFOLD_VERSION
" initialized\n"); " initialized\n");
...@@ -55,6 +65,7 @@ int security_scaffolding_startup (void) ...@@ -55,6 +65,7 @@ int security_scaffolding_startup (void)
} }
security_ops = &dummy_security_ops; security_ops = &dummy_security_ops;
do_security_initcalls();
return 0; return 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment