[go: up one dir, main page]
1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * LSM initialization functions
4 */
5
6#define pr_fmt(fmt) "LSM: " fmt
7
8#include <linux/init.h>
9#include <linux/lsm_hooks.h>
10
11#include "lsm.h"
12
13/* LSM enabled constants. */
14static __initdata int lsm_enabled_true = 1;
15static __initdata int lsm_enabled_false = 0;
16
17/* Pointers to LSM sections defined in include/asm-generic/vmlinux.lds.h */
18extern struct lsm_info __start_lsm_info[], __end_lsm_info[];
19extern struct lsm_info __start_early_lsm_info[], __end_early_lsm_info[];
20
21/* Number of "early" LSMs */
22static __initdata unsigned int lsm_count_early;
23
24/* Build and boot-time LSM ordering. */
25static __initconst const char *const lsm_order_builtin = CONFIG_LSM;
26static __initdata const char *lsm_order_cmdline;
27static __initdata const char *lsm_order_legacy;
28
29/* Ordered list of LSMs to initialize. */
30static __initdata struct lsm_info *lsm_order[MAX_LSM_COUNT + 1];
31static __initdata struct lsm_info *lsm_exclusive;
32
33#define lsm_order_for_each(iter) \
34 for ((iter) = lsm_order; *(iter); (iter)++)
35#define lsm_for_each_raw(iter) \
36 for ((iter) = __start_lsm_info; \
37 (iter) < __end_lsm_info; (iter)++)
38#define lsm_early_for_each_raw(iter) \
39 for ((iter) = __start_early_lsm_info; \
40 (iter) < __end_early_lsm_info; (iter)++)
41
42#define lsm_initcall(level) \
43 ({ \
44 int _r, _rc = 0; \
45 struct lsm_info **_lp, *_l; \
46 lsm_order_for_each(_lp) { \
47 _l = *_lp; \
48 if (!_l->initcall_##level) \
49 continue; \
50 lsm_pr_dbg("running %s %s initcall", \
51 _l->id->name, #level); \
52 _r = _l->initcall_##level(); \
53 if (_r) { \
54 pr_warn("failed LSM %s %s initcall with errno %d\n", \
55 _l->id->name, #level, _r); \
56 if (!_rc) \
57 _rc = _r; \
58 } \
59 } \
60 _rc; \
61 })
62
63/**
64 * lsm_choose_security - Legacy "major" LSM selection
65 * @str: kernel command line parameter
66 */
67static int __init lsm_choose_security(char *str)
68{
69 lsm_order_legacy = str;
70 return 1;
71}
72__setup("security=", lsm_choose_security);
73
74/**
75 * lsm_choose_lsm - Modern LSM selection
76 * @str: kernel command line parameter
77 */
78static int __init lsm_choose_lsm(char *str)
79{
80 lsm_order_cmdline = str;
81 return 1;
82}
83__setup("lsm=", lsm_choose_lsm);
84
85/**
86 * lsm_debug_enable - Enable LSM framework debugging
87 * @str: kernel command line parameter
88 *
89 * Currently we only provide debug info during LSM initialization, but we may
90 * want to expand this in the future.
91 */
92static int __init lsm_debug_enable(char *str)
93{
94 lsm_debug = true;
95 return 1;
96}
97__setup("lsm.debug", lsm_debug_enable);
98
99/**
100 * lsm_enabled_set - Mark a LSM as enabled
101 * @lsm: LSM definition
102 * @enabled: enabled flag
103 */
104static void __init lsm_enabled_set(struct lsm_info *lsm, bool enabled)
105{
106 /*
107 * When an LSM hasn't configured an enable variable, we can use
108 * a hard-coded location for storing the default enabled state.
109 */
110 if (!lsm->enabled ||
111 lsm->enabled == &lsm_enabled_true ||
112 lsm->enabled == &lsm_enabled_false) {
113 lsm->enabled = enabled ? &lsm_enabled_true : &lsm_enabled_false;
114 } else {
115 *lsm->enabled = enabled;
116 }
117}
118
119/**
120 * lsm_is_enabled - Determine if a LSM is enabled
121 * @lsm: LSM definition
122 */
123static inline bool lsm_is_enabled(struct lsm_info *lsm)
124{
125 return (lsm->enabled ? *lsm->enabled : false);
126}
127
128/**
129 * lsm_order_exists - Determine if a LSM exists in the ordered list
130 * @lsm: LSM definition
131 */
132static bool __init lsm_order_exists(struct lsm_info *lsm)
133{
134 struct lsm_info **check;
135
136 lsm_order_for_each(check) {
137 if (*check == lsm)
138 return true;
139 }
140
141 return false;
142}
143
144/**
145 * lsm_order_append - Append a LSM to the ordered list
146 * @lsm: LSM definition
147 * @src: source of the addition
148 *
149 * Append @lsm to the enabled LSM array after ensuring that it hasn't been
150 * explicitly disabled, is a duplicate entry, or would run afoul of the
151 * LSM_FLAG_EXCLUSIVE logic.
152 */
153static void __init lsm_order_append(struct lsm_info *lsm, const char *src)
154{
155 /* Ignore duplicate selections. */
156 if (lsm_order_exists(lsm))
157 return;
158
159 /* Skip explicitly disabled LSMs. */
160 if (lsm->enabled && !lsm_is_enabled(lsm)) {
161 lsm_pr_dbg("skip previously disabled LSM %s:%s\n",
162 src, lsm->id->name);
163 return;
164 }
165
166 if (lsm_active_cnt == MAX_LSM_COUNT) {
167 pr_warn("exceeded maximum LSM count on %s:%s\n",
168 src, lsm->id->name);
169 lsm_enabled_set(lsm, enabled: false);
170 return;
171 }
172
173 if (lsm->flags & LSM_FLAG_EXCLUSIVE) {
174 if (lsm_exclusive) {
175 lsm_pr_dbg("skip exclusive LSM conflict %s:%s\n",
176 src, lsm->id->name);
177 lsm_enabled_set(lsm, enabled: false);
178 return;
179 } else {
180 lsm_pr_dbg("select exclusive LSM %s:%s\n",
181 src, lsm->id->name);
182 lsm_exclusive = lsm;
183 }
184 }
185
186 lsm_enabled_set(lsm, enabled: true);
187 lsm_order[lsm_active_cnt] = lsm;
188 lsm_idlist[lsm_active_cnt++] = lsm->id;
189
190 lsm_pr_dbg("enabling LSM %s:%s\n", src, lsm->id->name);
191}
192
193/**
194 * lsm_order_parse - Parse the comma delimited LSM list
195 * @list: LSM list
196 * @src: source of the list
197 */
198static void __init lsm_order_parse(const char *list, const char *src)
199{
200 struct lsm_info *lsm;
201 char *sep, *name, *next;
202
203 /* Handle any Legacy LSM exclusions if one was specified. */
204 if (lsm_order_legacy) {
205 /*
206 * To match the original "security=" behavior, this explicitly
207 * does NOT fallback to another Legacy Major if the selected
208 * one was separately disabled: disable all non-matching
209 * Legacy Major LSMs.
210 */
211 lsm_for_each_raw(lsm) {
212 if ((lsm->flags & LSM_FLAG_LEGACY_MAJOR) &&
213 strcmp(lsm->id->name, lsm_order_legacy)) {
214 lsm_enabled_set(lsm, enabled: false);
215 lsm_pr_dbg("skip legacy LSM conflict %s:%s\n",
216 src, lsm->id->name);
217 }
218 }
219 }
220
221 /* LSM_ORDER_FIRST */
222 lsm_for_each_raw(lsm) {
223 if (lsm->order == LSM_ORDER_FIRST)
224 lsm_order_append(lsm, src: "first");
225 }
226
227 /* Normal or "mutable" LSMs */
228 sep = kstrdup(s: list, GFP_KERNEL);
229 next = sep;
230 /* Walk the list, looking for matching LSMs. */
231 while ((name = strsep(&next, ",")) != NULL) {
232 lsm_for_each_raw(lsm) {
233 if (!strcmp(lsm->id->name, name) &&
234 lsm->order == LSM_ORDER_MUTABLE)
235 lsm_order_append(lsm, src);
236 }
237 }
238 kfree(objp: sep);
239
240 /* Legacy LSM if specified. */
241 if (lsm_order_legacy) {
242 lsm_for_each_raw(lsm) {
243 if (!strcmp(lsm->id->name, lsm_order_legacy))
244 lsm_order_append(lsm, src);
245 }
246 }
247
248 /* LSM_ORDER_LAST */
249 lsm_for_each_raw(lsm) {
250 if (lsm->order == LSM_ORDER_LAST)
251 lsm_order_append(lsm, src: "last");
252 }
253
254 /* Disable all LSMs not previously enabled. */
255 lsm_for_each_raw(lsm) {
256 if (lsm_order_exists(lsm))
257 continue;
258 lsm_enabled_set(lsm, enabled: false);
259 lsm_pr_dbg("skip disabled LSM %s:%s\n", src, lsm->id->name);
260 }
261}
262
263/**
264 * lsm_blob_size_update - Update the LSM blob size and offset information
265 * @sz_req: the requested additional blob size
266 * @sz_cur: the existing blob size
267 */
268static void __init lsm_blob_size_update(unsigned int *sz_req,
269 unsigned int *sz_cur)
270{
271 unsigned int offset;
272
273 if (*sz_req == 0)
274 return;
275
276 offset = ALIGN(*sz_cur, sizeof(void *));
277 *sz_cur = offset + *sz_req;
278 *sz_req = offset;
279}
280
281/**
282 * lsm_prepare - Prepare the LSM framework for a new LSM
283 * @lsm: LSM definition
284 */
285static void __init lsm_prepare(struct lsm_info *lsm)
286{
287 struct lsm_blob_sizes *blobs = lsm->blobs;
288
289 if (!blobs)
290 return;
291
292 /* Register the LSM blob sizes. */
293 blobs = lsm->blobs;
294 lsm_blob_size_update(sz_req: &blobs->lbs_cred, sz_cur: &blob_sizes.lbs_cred);
295 lsm_blob_size_update(sz_req: &blobs->lbs_file, sz_cur: &blob_sizes.lbs_file);
296 lsm_blob_size_update(sz_req: &blobs->lbs_ib, sz_cur: &blob_sizes.lbs_ib);
297 /* inode blob gets an rcu_head in addition to LSM blobs. */
298 if (blobs->lbs_inode && blob_sizes.lbs_inode == 0)
299 blob_sizes.lbs_inode = sizeof(struct rcu_head);
300 lsm_blob_size_update(sz_req: &blobs->lbs_inode, sz_cur: &blob_sizes.lbs_inode);
301 lsm_blob_size_update(sz_req: &blobs->lbs_ipc, sz_cur: &blob_sizes.lbs_ipc);
302 lsm_blob_size_update(sz_req: &blobs->lbs_key, sz_cur: &blob_sizes.lbs_key);
303 lsm_blob_size_update(sz_req: &blobs->lbs_msg_msg, sz_cur: &blob_sizes.lbs_msg_msg);
304 lsm_blob_size_update(sz_req: &blobs->lbs_perf_event,
305 sz_cur: &blob_sizes.lbs_perf_event);
306 lsm_blob_size_update(sz_req: &blobs->lbs_sock, sz_cur: &blob_sizes.lbs_sock);
307 lsm_blob_size_update(sz_req: &blobs->lbs_superblock,
308 sz_cur: &blob_sizes.lbs_superblock);
309 lsm_blob_size_update(sz_req: &blobs->lbs_task, sz_cur: &blob_sizes.lbs_task);
310 lsm_blob_size_update(sz_req: &blobs->lbs_tun_dev, sz_cur: &blob_sizes.lbs_tun_dev);
311 lsm_blob_size_update(sz_req: &blobs->lbs_xattr_count,
312 sz_cur: &blob_sizes.lbs_xattr_count);
313 lsm_blob_size_update(sz_req: &blobs->lbs_bdev, sz_cur: &blob_sizes.lbs_bdev);
314 lsm_blob_size_update(sz_req: &blobs->lbs_bpf_map, sz_cur: &blob_sizes.lbs_bpf_map);
315 lsm_blob_size_update(sz_req: &blobs->lbs_bpf_prog, sz_cur: &blob_sizes.lbs_bpf_prog);
316 lsm_blob_size_update(sz_req: &blobs->lbs_bpf_token, sz_cur: &blob_sizes.lbs_bpf_token);
317}
318
319/**
320 * lsm_init_single - Initialize a given LSM
321 * @lsm: LSM definition
322 */
323static void __init lsm_init_single(struct lsm_info *lsm)
324{
325 int ret;
326
327 if (!lsm_is_enabled(lsm))
328 return;
329
330 lsm_pr_dbg("initializing %s\n", lsm->id->name);
331 ret = lsm->init();
332 WARN(ret, "%s failed to initialize: %d\n", lsm->id->name, ret);
333}
334
335/**
336 * lsm_static_call_init - Initialize a LSM's static calls
337 * @hl: LSM hook list
338 */
339static int __init lsm_static_call_init(struct security_hook_list *hl)
340{
341 struct lsm_static_call *scall = hl->scalls;
342 int i;
343
344 for (i = 0; i < MAX_LSM_COUNT; i++) {
345 /* Update the first static call that is not used yet */
346 if (!scall->hl) {
347 __static_call_update(key: scall->key, tramp: scall->trampoline,
348 func: hl->hook.lsm_func_addr);
349 scall->hl = hl;
350 static_branch_enable(scall->active);
351 return 0;
352 }
353 scall++;
354 }
355
356 return -ENOSPC;
357}
358
359/**
360 * security_add_hooks - Add a LSM's hooks to the LSM framework's hook lists
361 * @hooks: LSM hooks to add
362 * @count: number of hooks to add
363 * @lsmid: identification information for the LSM
364 *
365 * Each LSM has to register its hooks with the LSM framework.
366 */
367void __init security_add_hooks(struct security_hook_list *hooks, int count,
368 const struct lsm_id *lsmid)
369{
370 int i;
371
372 for (i = 0; i < count; i++) {
373 hooks[i].lsmid = lsmid;
374 if (lsm_static_call_init(hl: &hooks[i]))
375 panic(fmt: "exhausted LSM callback slots with LSM %s\n",
376 lsmid->name);
377 }
378}
379
380/**
381 * early_security_init - Initialize the early LSMs
382 */
383int __init early_security_init(void)
384{
385 struct lsm_info *lsm;
386
387 /* NOTE: lsm_pr_dbg() doesn't work here as lsm_debug is not yet set */
388
389 lsm_early_for_each_raw(lsm) {
390 lsm_enabled_set(lsm, enabled: true);
391 lsm_order_append(lsm, src: "early");
392 lsm_prepare(lsm);
393 lsm_init_single(lsm);
394 lsm_count_early++;
395 }
396
397 return 0;
398}
399
400/**
401 * security_init - Initializes the LSM framework
402 *
403 * This should be called early in the kernel initialization sequence.
404 */
405int __init security_init(void)
406{
407 unsigned int cnt;
408 struct lsm_info **lsm;
409
410 if (lsm_debug) {
411 struct lsm_info *i;
412
413 cnt = 0;
414 lsm_pr("available LSMs: ");
415 lsm_early_for_each_raw(i)
416 lsm_pr_cont("%s%s(E)", (cnt++ ? "," : ""), i->id->name);
417 lsm_for_each_raw(i)
418 lsm_pr_cont("%s%s", (cnt++ ? "," : ""), i->id->name);
419 lsm_pr_cont("\n");
420
421 lsm_pr("built-in LSM config: %s\n", lsm_order_builtin);
422
423 lsm_pr("legacy LSM parameter: %s\n", lsm_order_legacy);
424 lsm_pr("boot LSM parameter: %s\n", lsm_order_cmdline);
425
426 /* see the note about lsm_pr_dbg() in early_security_init() */
427 lsm_early_for_each_raw(i)
428 lsm_pr("enabled LSM early:%s\n", i->id->name);
429 }
430
431 if (lsm_order_cmdline) {
432 if (lsm_order_legacy)
433 lsm_order_legacy = NULL;
434 lsm_order_parse(list: lsm_order_cmdline, src: "cmdline");
435 } else
436 lsm_order_parse(list: lsm_order_builtin, src: "builtin");
437
438 lsm_order_for_each(lsm)
439 lsm_prepare(lsm: *lsm);
440
441 if (lsm_debug) {
442 lsm_pr("blob(cred) size %d\n", blob_sizes.lbs_cred);
443 lsm_pr("blob(file) size %d\n", blob_sizes.lbs_file);
444 lsm_pr("blob(ib) size %d\n", blob_sizes.lbs_ib);
445 lsm_pr("blob(inode) size %d\n", blob_sizes.lbs_inode);
446 lsm_pr("blob(ipc) size %d\n", blob_sizes.lbs_ipc);
447 lsm_pr("blob(key) size %d\n", blob_sizes.lbs_key);
448 lsm_pr("blob(msg_msg)_size %d\n", blob_sizes.lbs_msg_msg);
449 lsm_pr("blob(sock) size %d\n", blob_sizes.lbs_sock);
450 lsm_pr("blob(superblock) size %d\n", blob_sizes.lbs_superblock);
451 lsm_pr("blob(perf_event) size %d\n", blob_sizes.lbs_perf_event);
452 lsm_pr("blob(task) size %d\n", blob_sizes.lbs_task);
453 lsm_pr("blob(tun_dev) size %d\n", blob_sizes.lbs_tun_dev);
454 lsm_pr("blob(xattr) count %d\n", blob_sizes.lbs_xattr_count);
455 lsm_pr("blob(bdev) size %d\n", blob_sizes.lbs_bdev);
456 lsm_pr("blob(bpf_map) size %d\n", blob_sizes.lbs_bpf_map);
457 lsm_pr("blob(bpf_prog) size %d\n", blob_sizes.lbs_bpf_prog);
458 lsm_pr("blob(bpf_token) size %d\n", blob_sizes.lbs_bpf_token);
459 }
460
461 if (blob_sizes.lbs_file)
462 lsm_file_cache = kmem_cache_create("lsm_file_cache",
463 blob_sizes.lbs_file, 0,
464 SLAB_PANIC, NULL);
465 if (blob_sizes.lbs_inode)
466 lsm_inode_cache = kmem_cache_create("lsm_inode_cache",
467 blob_sizes.lbs_inode, 0,
468 SLAB_PANIC, NULL);
469
470 if (lsm_cred_alloc(cred: (struct cred *)unrcu_pointer(current->cred),
471 GFP_KERNEL))
472 panic(fmt: "early LSM cred alloc failed\n");
473 if (lsm_task_alloc(current))
474 panic(fmt: "early LSM task alloc failed\n");
475
476 cnt = 0;
477 lsm_order_for_each(lsm) {
478 /* skip the "early" LSMs as they have already been setup */
479 if (cnt++ < lsm_count_early)
480 continue;
481 lsm_init_single(lsm: *lsm);
482 }
483
484 return 0;
485}
486
487/**
488 * security_initcall_pure - Run the LSM pure initcalls
489 */
490static int __init security_initcall_pure(void)
491{
492 return lsm_initcall(pure);
493}
494pure_initcall(security_initcall_pure);
495
496/**
497 * security_initcall_early - Run the LSM early initcalls
498 */
499static int __init security_initcall_early(void)
500{
501 return lsm_initcall(early);
502}
503early_initcall(security_initcall_early);
504
505/**
506 * security_initcall_core - Run the LSM core initcalls
507 */
508static int __init security_initcall_core(void)
509{
510 int rc_sfs, rc_lsm;
511
512 rc_sfs = securityfs_init();
513 rc_lsm = lsm_initcall(core);
514
515 return (rc_sfs ? rc_sfs : rc_lsm);
516}
517core_initcall(security_initcall_core);
518
519/**
520 * security_initcall_subsys - Run the LSM subsys initcalls
521 */
522static int __init security_initcall_subsys(void)
523{
524 return lsm_initcall(subsys);
525}
526subsys_initcall(security_initcall_subsys);
527
528/**
529 * security_initcall_fs - Run the LSM fs initcalls
530 */
531static int __init security_initcall_fs(void)
532{
533 return lsm_initcall(fs);
534}
535fs_initcall(security_initcall_fs);
536
537/**
538 * security_initcall_device - Run the LSM device initcalls
539 */
540static int __init security_initcall_device(void)
541{
542 return lsm_initcall(device);
543}
544device_initcall(security_initcall_device);
545
546/**
547 * security_initcall_late - Run the LSM late initcalls
548 */
549static int __init security_initcall_late(void)
550{
551 int rc;
552
553 rc = lsm_initcall(late);
554 lsm_pr_dbg("all enabled LSMs fully activated\n");
555 call_blocking_lsm_notifier(event: LSM_STARTED_ALL, NULL);
556
557 return rc;
558}
559late_initcall(security_initcall_late);
560

source code of linux/security/lsm_init.c