Commit 79f7865d authored by Kees Cook's avatar Kees Cook

LSM: Introduce "lsm=" for boottime LSM selection

Provide a way to explicitly choose LSM initialization order via the new
"lsm=" comma-separated list of LSMs.
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
parent 13e735c0
...@@ -2319,6 +2319,10 @@ ...@@ -2319,6 +2319,10 @@
lsm.debug [SECURITY] Enable LSM initialization debugging output. lsm.debug [SECURITY] Enable LSM initialization debugging output.
lsm=lsm1,...,lsmN
[SECURITY] Choose order of LSM initialization. This
overrides CONFIG_LSM.
machvec= [IA-64] Force the use of a particular machine-vector machvec= [IA-64] Force the use of a particular machine-vector
(machvec) in a generic kernel. (machvec) in a generic kernel.
Example: machvec=hpzx1_swiotlb Example: machvec=hpzx1_swiotlb
......
...@@ -281,7 +281,8 @@ config LSM ...@@ -281,7 +281,8 @@ config LSM
default "integrity" default "integrity"
help help
A comma-separated list of LSMs, in initialization order. A comma-separated list of LSMs, in initialization order.
Any LSMs left off this list will be ignored. Any LSMs left off this list will be ignored. This can be
controlled at boot with the "lsm=" parameter.
If unsure, leave this as the default. If unsure, leave this as the default.
......
...@@ -47,6 +47,7 @@ char *lsm_names; ...@@ -47,6 +47,7 @@ char *lsm_names;
/* Boot-time LSM user choice */ /* Boot-time LSM user choice */
static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] = static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] =
CONFIG_DEFAULT_SECURITY; CONFIG_DEFAULT_SECURITY;
static __initdata const char *chosen_lsm_order;
static __initconst const char * const builtin_lsm_order = CONFIG_LSM; static __initconst const char * const builtin_lsm_order = CONFIG_LSM;
...@@ -190,6 +191,9 @@ static void __init ordered_lsm_init(void) ...@@ -190,6 +191,9 @@ static void __init ordered_lsm_init(void)
ordered_lsms = kcalloc(LSM_COUNT + 1, sizeof(*ordered_lsms), ordered_lsms = kcalloc(LSM_COUNT + 1, sizeof(*ordered_lsms),
GFP_KERNEL); GFP_KERNEL);
if (chosen_lsm_order)
ordered_lsm_parse(chosen_lsm_order, "cmdline");
else
ordered_lsm_parse(builtin_lsm_order, "builtin"); ordered_lsm_parse(builtin_lsm_order, "builtin");
for (lsm = ordered_lsms; *lsm; lsm++) for (lsm = ordered_lsms; *lsm; lsm++)
...@@ -252,6 +256,14 @@ static int __init choose_lsm(char *str) ...@@ -252,6 +256,14 @@ static int __init choose_lsm(char *str)
} }
__setup("security=", choose_lsm); __setup("security=", choose_lsm);
/* Explicitly choose LSM initialization order. */
static int __init choose_lsm_order(char *str)
{
chosen_lsm_order = str;
return 1;
}
__setup("lsm=", choose_lsm_order);
/* Enable LSM order debugging. */ /* Enable LSM order debugging. */
static int __init enable_debug(char *str) static int __init enable_debug(char *str)
{ {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment