Commit 553bd5a2 authored by Chris Wright's avatar Chris Wright Committed by Linus Torvalds

[PATCH] lsm: Early init for security modules (1/4)

As discussed before, this allows for early initialization of security
modules when compiled statically into the kernel.  The standard
do_initcalls is too late for complete coverage of all filesystems and
threads, for example.
parent 47382294
......@@ -74,6 +74,9 @@ SECTIONS
__con_initcall_end = .;
}
. = ALIGN(8);
SECURITY_INIT
. = ALIGN(64);
__per_cpu_start = .;
.data.percpu : { *(.data.percpu) }
......
......@@ -43,6 +43,7 @@ SECTIONS
__con_initcall_start = .;
*(.con_initcall.init)
__con_initcall_end = .;
SECURITY_INIT
. = ALIGN(32768);
__init_end = .;
}
......
......@@ -53,6 +53,7 @@ SECTIONS
__con_initcall_start = .;
*(.con_initcall.init)
__con_initcall_end = .;
SECURITY_INIT
. = ALIGN(32);
__initramfs_start = .;
usr/built-in.o(.init.ramfs)
......
......@@ -74,6 +74,11 @@ SECTIONS
__con_initcall_start = .;
*(.con_initcall.init)
__con_initcall_end = .;
}
.security_initcall.init : {
__security_initcall_start = .;
*(.security_initcall.init)
__security_initcall_end = .;
/* We fill to the next page, so we can discard all init
pages without needing to consider what payload might be
......
......@@ -83,6 +83,7 @@ SECTIONS
___con_initcall_start = .;
*(.con_initcall.init)
___con_initcall_end = .;
SECURITY_INIT
. = ALIGN(4);
___initramfs_start = .;
*(.init.ramfs)
......
......@@ -81,6 +81,7 @@ SECTIONS
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
SECURITY_INIT
. = ALIGN(4);
__alt_instructions = .;
.altinstructions : { *(.altinstructions) }
......
......@@ -141,6 +141,10 @@ SECTIONS
.con_initcall.init : AT(ADDR(.con_initcall.init) - PAGE_OFFSET)
{ *(.con_initcall.init) }
__con_initcall_end = .;
__security_initcall_start = .;
.security_initcall.init : AT(ADDR(.security_initcall.init) - PAGE_OFFSET)
{ *(.security_initcall.init) }
__security_initcall_end = .;
. = ALIGN(PAGE_SIZE);
__init_end = .;
......
......@@ -67,6 +67,7 @@ SECTIONS
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
SECURITY_INIT
. = ALIGN(8192);
__initramfs_start = .;
.init.ramfs : { *(.init.ramfs) }
......
......@@ -61,6 +61,7 @@ __init_begin = .;
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
SECURITY_INIT
. = ALIGN(8192);
__initramfs_start = .;
.init.ramfs : { *(.init.ramfs) }
......
......@@ -277,9 +277,7 @@ SECTIONS {
__con_initcall_start = .;
*(.con_initcall.init)
__con_initcall_end = .;
__security_initcall_start = .;
*(.security_initcall.init)
__security_initcall_end = .;
SECURITY_INIT
. = ALIGN(4);
__initramfs_start = .;
*(.init.ramfs)
......
......@@ -54,6 +54,7 @@ SECTIONS
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
SECURITY_INIT
. = ALIGN(4096); /* Align double page for init_task_union */
__init_end = .;
......
......@@ -53,6 +53,7 @@ SECTIONS
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
SECURITY_INIT
. = ALIGN(4096); /* Align double page for init_task_union */
__init_end = .;
......
......@@ -80,6 +80,7 @@ SECTIONS
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
SECURITY_INIT
. = ALIGN(4096);
__initramfs_start = .;
.init.ramfs : { *(.init.ramfs) }
......
......@@ -119,6 +119,8 @@ SECTIONS
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
SECURITY_INIT
__start___ftr_fixup = .;
__ftr_fixup : { *(__ftr_fixup) }
__stop___ftr_fixup = .;
......
......@@ -104,6 +104,7 @@ SECTIONS
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
SECURITY_INIT
. = ALIGN(4096);
__initramfs_start = .;
.init.ramfs : { *(.init.ramfs) }
......
......@@ -94,6 +94,7 @@ SECTIONS
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
SECURITY_INIT
. = ALIGN(256);
__initramfs_start = .;
.init.ramfs : { *(.init.initramfs) }
......
......@@ -71,6 +71,7 @@ SECTIONS
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
SECURITY_INIT
__machvec_start = .;
.machvec.init : { *(.machvec.init) }
__machvec_end = .;
......
......@@ -62,6 +62,7 @@ SECTIONS
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
SECURITY_INIT
. = ALIGN(4096);
__initramfs_start = .;
.init.ramfs : { *(.init.ramfs) }
......
......@@ -68,6 +68,7 @@ SECTIONS
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
SECURITY_INIT
. = ALIGN(8192);
__initramfs_start = .;
.init.ramfs : { *(.init.ramfs) }
......
......@@ -105,6 +105,7 @@ SECTIONS
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
SECURITY_INIT
. = ALIGN(4096);
__initramfs_start = .;
.init.ramfs : { *(.init.ramfs) }
......
......@@ -45,3 +45,9 @@
*(__ksymtab_strings) \
}
#define SECURITY_INIT \
.security_initcall.init : { \
__security_initcall_start = .; \
*(.security_initcall.init) \
__security_initcall_end = .; \
}
......@@ -64,6 +64,7 @@ typedef int (*initcall_t)(void);
typedef void (*exitcall_t)(void);
extern initcall_t __con_initcall_start, __con_initcall_end;
extern initcall_t __security_initcall_start, __security_initcall_end;
#endif
#ifndef MODULE
......@@ -96,6 +97,9 @@ extern initcall_t __con_initcall_start, __con_initcall_end;
#define console_initcall(fn) \
static initcall_t __initcall_##fn __attribute__ ((unused,__section__ (".con_initcall.init")))=fn
#define security_initcall(fn) \
static initcall_t __initcall_##fn __attribute__ ((unused,__section__ (".security_initcall.init"))) = fn
struct obs_kernel_param {
const char *str;
int (*setup_func)(char *);
......@@ -143,6 +147,8 @@ struct obs_kernel_param {
#define device_initcall(fn) module_init(fn)
#define late_initcall(fn) module_init(fn)
#define security_initcall(fn) module_init(fn)
/* These macros create a dummy inline: gcc 2.9x does not count alias
as usage, hence the `unused function' warning when __init functions
are declared static. We use the dummy __*_module_inline functions
......
......@@ -439,8 +439,8 @@ asmlinkage void __init start_kernel(void)
pte_chain_init();
fork_init(num_physpages);
proc_caches_init();
security_scaffolding_startup();
buffer_init();
security_scaffolding_startup();
vfs_caches_init(num_physpages);
radix_tree_init();
signals_init();
......
......@@ -348,7 +348,7 @@ static void __exit capability_exit (void)
}
}
module_init (capability_init);
security_initcall (capability_init);
module_exit (capability_exit);
MODULE_DESCRIPTION("Standard Linux Capabilities Security Module");
......
......@@ -135,7 +135,7 @@ static void __exit rootplug_exit (void)
printk (KERN_INFO "Root Plug module removed\n");
}
module_init (rootplug_init);
security_initcall (rootplug_init);
module_exit (rootplug_exit);
MODULE_DESCRIPTION("Root Plug sample LSM module, written for Linux Journal article");
......
......@@ -38,12 +38,22 @@ static inline int verify (struct security_operations *ops)
return 0;
}
static void __init do_security_initcalls(void)
{
initcall_t *call;
call = &__security_initcall_start;
while (call < &__security_initcall_end) {
(*call)();
call++;
}
}
/**
* security_scaffolding_startup - initialzes the security scaffolding framework
*
* This should be called early in the kernel initialization sequence.
*/
int security_scaffolding_startup (void)
int __init security_scaffolding_startup (void)
{
printk (KERN_INFO "Security Scaffold v" SECURITY_SCAFFOLD_VERSION
" initialized\n");
......@@ -55,6 +65,7 @@ int security_scaffolding_startup (void)
}
security_ops = &dummy_security_ops;
do_security_initcalls();
return 0;
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment