• Matthew Garrett's avatar
    security: Support early LSMs · e6b1db98
    Matthew Garrett authored
    The lockdown module is intended to allow for kernels to be locked down
    early in boot - sufficiently early that we don't have the ability to
    kmalloc() yet. Add support for early initialisation of some LSMs, and
    then add them to the list of names when we do full initialisation later.
    Early LSMs are initialised in link order and cannot be overridden via
    boot parameters, and cannot make use of kmalloc() (since the allocator
    isn't initialised yet).
    
    (Fixed by Stephen Rothwell to include a stub to fix builds when
    !CONFIG_SECURITY)
    Signed-off-by: default avatarMatthew Garrett <mjg59@google.com>
    Acked-by: default avatarKees Cook <keescook@chromium.org>
    Acked-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
    Cc: Stephen Rothwell <sfr@canb.auug.org.au>
    Signed-off-by: default avatarJames Morris <jmorris@namei.org>
    e6b1db98
security.c 58.7 KB