admin/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2025-12-07 20:06:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

ima,evm: move initcalls to the LSM framework

Browse Source 
This patch converts IMA and EVM to use the LSM frameworks's initcall
mechanism. It moved the integrity_fs_init() call to ima_fs_init() and
evm_init_secfs(), to work around the fact that there is no "integrity" LSM,
and introduced integrity_fs_fini() to remove the integrity directory, if
empty. Both integrity_fs_init() and integrity_fs_fini() support the
scenario of being called by both the IMA and EVM LSMs.

This patch does not touch any of the platform certificate code that
lives under the security/integrity/platform_certs directory as the
IMA/EVM developers would prefer to address that in a future patchset.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Acked-by: Mimi Zohar <zohar@linux.ibm.com>
[PM: adjust description as discussed over email]
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Roberto Sassu
2025-09-02 14:54:57 +02:00
committed by Paul Moore
parent 77ebff0607
commit 82fe7932e8
6 changed files with 35 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
security/integrity/evm/evm_main.c
View File

@@ -1179,6 +1179,5 @@ DEFINE_LSM(evm) = {
.init = init_evm_lsm,
.order = LSM_ORDER_LAST,
.blobs = &evm_blob_sizes,
.initcall_late = init_evm,
};
late_initcall(init_evm);

11
security/integrity/evm/evm_secfs.c
View File

@@ -302,10 +302,16 @@ int __init evm_init_secfs(void)
int error = 0;
struct dentry *dentry;
evm_dir = securityfs_create_dir("evm", integrity_dir);
if (IS_ERR(evm_dir))
error = integrity_fs_init();
if (error < 0)
return -EFAULT;
evm_dir = securityfs_create_dir("evm", integrity_dir);
if (IS_ERR(evm_dir)) {
error = -EFAULT;
goto out;
}
dentry = securityfs_create_file("evm", 0660,
evm_dir, NULL, &evm_key_ops);
if (IS_ERR(dentry)) {
@@ -329,5 +335,6 @@ int __init evm_init_secfs(void)
out:
securityfs_remove(evm_symlink);
securityfs_remove(evm_dir);
integrity_fs_fini();
return error;
}

14
security/integrity/iint.c
View File

@@ -42,8 +42,11 @@ void __init integrity_load_keys(void)
evm_load_x509();
}
static int __init integrity_fs_init(void)
int __init integrity_fs_init(void)
{
if (integrity_dir)
return 0;
integrity_dir = securityfs_create_dir("integrity", NULL);
if (IS_ERR(integrity_dir)) {
int ret = PTR_ERR(integrity_dir);
@@ -58,4 +61,11 @@ static int __init integrity_fs_init(void)
return 0;
}
late_initcall(integrity_fs_init)
void __init integrity_fs_fini(void)
{
if (!integrity_dir || !simple_empty(integrity_dir))
return;
securityfs_remove(integrity_dir);
integrity_dir = NULL;
}

11
security/integrity/ima/ima_fs.c
View File

@@ -499,9 +499,15 @@ int __init ima_fs_init(void)
struct dentry *dentry;
int ret;
ret = integrity_fs_init();
if (ret < 0)
return ret;
ima_dir = securityfs_create_dir("ima", integrity_dir);
if (IS_ERR(ima_dir))
return PTR_ERR(ima_dir);
if (IS_ERR(ima_dir)) {
ret = PTR_ERR(ima_dir);
goto out;
}
ima_symlink = securityfs_create_symlink("ima", NULL, "integrity/ima",
NULL);
@@ -555,6 +561,7 @@ int __init ima_fs_init(void)
out:
securityfs_remove(ima_symlink);
securityfs_remove(ima_dir);
integrity_fs_fini();
return ret;
}

4
security/integrity/ima/ima_main.c
View File

@@ -1283,6 +1283,6 @@ DEFINE_LSM(ima) = {
.init = init_ima_lsm,
.order = LSM_ORDER_LAST,
.blobs = &ima_blob_sizes,
/* Start IMA after the TPM is available */
.initcall_late = init_ima,
};
late_initcall(init_ima); /* Start IMA after the TPM is available */

2
security/integrity/integrity.h
View File

@@ -114,6 +114,8 @@ struct ima_file_id {
int integrity_kernel_read(struct file *file, loff_t offset,
void *addr, unsigned long count);
int __init integrity_fs_init(void);
void __init integrity_fs_fini(void);
#define INTEGRITY_KEYRING_EVM 0
#define INTEGRITY_KEYRING_IMA 1