Skip to content

Commit

Permalink
LSM: Initialize security_hook_heads upon registration.
Browse files Browse the repository at this point in the history 
"struct security_hook_heads" is an array of "struct list_head"
where elements can be initialized just before registration.

There is no need to waste 350+ lines for initialization. Let's
initialize "struct security_hook_heads" just before registration.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: John Johansen <john.johansen@canonical.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Casey Schaufler <casey@schaufler-ca.com>
Cc: James Morris <james.l.morris@oracle.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
  • Loading branch information
Tetsuo Handa authored and James Morris committed Mar 24, 2017
1 parent ca97d93 commit 3dfc9b0
Showing 1 changed file with 7 additions and 354 deletions.
361 changes: 7 additions & 354 deletions security/security.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@
/* Maximum number of letters for an LSM name string */
#define SECURITY_NAME_MAX 10

struct security_hook_heads security_hook_heads __lsm_ro_after_init;
char *lsm_names;
/* Boot-time LSM user choice */
static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] =
Expand All @@ -54,6 +55,12 @@ static void __init do_security_initcalls(void)
*/
int __init security_init(void)
{
int i;
struct list_head *list = (struct list_head *) &security_hook_heads;

for (i = 0; i < sizeof(security_hook_heads) / sizeof(struct list_head);
i++)
INIT_LIST_HEAD(&list[i]);
pr_info("Security Framework initialized\n");

/*
Expand Down Expand Up @@ -1627,357 +1634,3 @@ int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule,
actx);
}
#endif /* CONFIG_AUDIT */

struct security_hook_heads security_hook_heads __lsm_ro_after_init = {
.binder_set_context_mgr =
LIST_HEAD_INIT(security_hook_heads.binder_set_context_mgr),
.binder_transaction =
LIST_HEAD_INIT(security_hook_heads.binder_transaction),
.binder_transfer_binder =
LIST_HEAD_INIT(security_hook_heads.binder_transfer_binder),
.binder_transfer_file =
LIST_HEAD_INIT(security_hook_heads.binder_transfer_file),

.ptrace_access_check =
LIST_HEAD_INIT(security_hook_heads.ptrace_access_check),
.ptrace_traceme =
LIST_HEAD_INIT(security_hook_heads.ptrace_traceme),
.capget = LIST_HEAD_INIT(security_hook_heads.capget),
.capset = LIST_HEAD_INIT(security_hook_heads.capset),
.capable = LIST_HEAD_INIT(security_hook_heads.capable),
.quotactl = LIST_HEAD_INIT(security_hook_heads.quotactl),
.quota_on = LIST_HEAD_INIT(security_hook_heads.quota_on),
.syslog = LIST_HEAD_INIT(security_hook_heads.syslog),
.settime = LIST_HEAD_INIT(security_hook_heads.settime),
.vm_enough_memory =
LIST_HEAD_INIT(security_hook_heads.vm_enough_memory),
.bprm_set_creds =
LIST_HEAD_INIT(security_hook_heads.bprm_set_creds),
.bprm_check_security =
LIST_HEAD_INIT(security_hook_heads.bprm_check_security),
.bprm_secureexec =
LIST_HEAD_INIT(security_hook_heads.bprm_secureexec),
.bprm_committing_creds =
LIST_HEAD_INIT(security_hook_heads.bprm_committing_creds),
.bprm_committed_creds =
LIST_HEAD_INIT(security_hook_heads.bprm_committed_creds),
.sb_alloc_security =
LIST_HEAD_INIT(security_hook_heads.sb_alloc_security),
.sb_free_security =
LIST_HEAD_INIT(security_hook_heads.sb_free_security),
.sb_copy_data = LIST_HEAD_INIT(security_hook_heads.sb_copy_data),
.sb_remount = LIST_HEAD_INIT(security_hook_heads.sb_remount),
.sb_kern_mount =
LIST_HEAD_INIT(security_hook_heads.sb_kern_mount),
.sb_show_options =
LIST_HEAD_INIT(security_hook_heads.sb_show_options),
.sb_statfs = LIST_HEAD_INIT(security_hook_heads.sb_statfs),
.sb_mount = LIST_HEAD_INIT(security_hook_heads.sb_mount),
.sb_umount = LIST_HEAD_INIT(security_hook_heads.sb_umount),
.sb_pivotroot = LIST_HEAD_INIT(security_hook_heads.sb_pivotroot),
.sb_set_mnt_opts =
LIST_HEAD_INIT(security_hook_heads.sb_set_mnt_opts),
.sb_clone_mnt_opts =
LIST_HEAD_INIT(security_hook_heads.sb_clone_mnt_opts),
.sb_parse_opts_str =
LIST_HEAD_INIT(security_hook_heads.sb_parse_opts_str),
.dentry_init_security =
LIST_HEAD_INIT(security_hook_heads.dentry_init_security),
.dentry_create_files_as =
LIST_HEAD_INIT(security_hook_heads.dentry_create_files_as),
#ifdef CONFIG_SECURITY_PATH
.path_unlink = LIST_HEAD_INIT(security_hook_heads.path_unlink),
.path_mkdir = LIST_HEAD_INIT(security_hook_heads.path_mkdir),
.path_rmdir = LIST_HEAD_INIT(security_hook_heads.path_rmdir),
.path_mknod = LIST_HEAD_INIT(security_hook_heads.path_mknod),
.path_truncate =
LIST_HEAD_INIT(security_hook_heads.path_truncate),
.path_symlink = LIST_HEAD_INIT(security_hook_heads.path_symlink),
.path_link = LIST_HEAD_INIT(security_hook_heads.path_link),
.path_rename = LIST_HEAD_INIT(security_hook_heads.path_rename),
.path_chmod = LIST_HEAD_INIT(security_hook_heads.path_chmod),
.path_chown = LIST_HEAD_INIT(security_hook_heads.path_chown),
.path_chroot = LIST_HEAD_INIT(security_hook_heads.path_chroot),
#endif
.inode_alloc_security =
LIST_HEAD_INIT(security_hook_heads.inode_alloc_security),
.inode_free_security =
LIST_HEAD_INIT(security_hook_heads.inode_free_security),
.inode_init_security =
LIST_HEAD_INIT(security_hook_heads.inode_init_security),
.inode_create = LIST_HEAD_INIT(security_hook_heads.inode_create),
.inode_link = LIST_HEAD_INIT(security_hook_heads.inode_link),
.inode_unlink = LIST_HEAD_INIT(security_hook_heads.inode_unlink),
.inode_symlink =
LIST_HEAD_INIT(security_hook_heads.inode_symlink),
.inode_mkdir = LIST_HEAD_INIT(security_hook_heads.inode_mkdir),
.inode_rmdir = LIST_HEAD_INIT(security_hook_heads.inode_rmdir),
.inode_mknod = LIST_HEAD_INIT(security_hook_heads.inode_mknod),
.inode_rename = LIST_HEAD_INIT(security_hook_heads.inode_rename),
.inode_readlink =
LIST_HEAD_INIT(security_hook_heads.inode_readlink),
.inode_follow_link =
LIST_HEAD_INIT(security_hook_heads.inode_follow_link),
.inode_permission =
LIST_HEAD_INIT(security_hook_heads.inode_permission),
.inode_setattr =
LIST_HEAD_INIT(security_hook_heads.inode_setattr),
.inode_getattr =
LIST_HEAD_INIT(security_hook_heads.inode_getattr),
.inode_setxattr =
LIST_HEAD_INIT(security_hook_heads.inode_setxattr),
.inode_post_setxattr =
LIST_HEAD_INIT(security_hook_heads.inode_post_setxattr),
.inode_getxattr =
LIST_HEAD_INIT(security_hook_heads.inode_getxattr),
.inode_listxattr =
LIST_HEAD_INIT(security_hook_heads.inode_listxattr),
.inode_removexattr =
LIST_HEAD_INIT(security_hook_heads.inode_removexattr),
.inode_need_killpriv =
LIST_HEAD_INIT(security_hook_heads.inode_need_killpriv),
.inode_killpriv =
LIST_HEAD_INIT(security_hook_heads.inode_killpriv),
.inode_getsecurity =
LIST_HEAD_INIT(security_hook_heads.inode_getsecurity),
.inode_setsecurity =
LIST_HEAD_INIT(security_hook_heads.inode_setsecurity),
.inode_listsecurity =
LIST_HEAD_INIT(security_hook_heads.inode_listsecurity),
.inode_getsecid =
LIST_HEAD_INIT(security_hook_heads.inode_getsecid),
.inode_copy_up =
LIST_HEAD_INIT(security_hook_heads.inode_copy_up),
.inode_copy_up_xattr =
LIST_HEAD_INIT(security_hook_heads.inode_copy_up_xattr),
.file_permission =
LIST_HEAD_INIT(security_hook_heads.file_permission),
.file_alloc_security =
LIST_HEAD_INIT(security_hook_heads.file_alloc_security),
.file_free_security =
LIST_HEAD_INIT(security_hook_heads.file_free_security),
.file_ioctl = LIST_HEAD_INIT(security_hook_heads.file_ioctl),
.mmap_addr = LIST_HEAD_INIT(security_hook_heads.mmap_addr),
.mmap_file = LIST_HEAD_INIT(security_hook_heads.mmap_file),
.file_mprotect =
LIST_HEAD_INIT(security_hook_heads.file_mprotect),
.file_lock = LIST_HEAD_INIT(security_hook_heads.file_lock),
.file_fcntl = LIST_HEAD_INIT(security_hook_heads.file_fcntl),
.file_set_fowner =
LIST_HEAD_INIT(security_hook_heads.file_set_fowner),
.file_send_sigiotask =
LIST_HEAD_INIT(security_hook_heads.file_send_sigiotask),
.file_receive = LIST_HEAD_INIT(security_hook_heads.file_receive),
.file_open = LIST_HEAD_INIT(security_hook_heads.file_open),
.task_create = LIST_HEAD_INIT(security_hook_heads.task_create),
.task_free = LIST_HEAD_INIT(security_hook_heads.task_free),
.cred_alloc_blank =
LIST_HEAD_INIT(security_hook_heads.cred_alloc_blank),
.cred_free = LIST_HEAD_INIT(security_hook_heads.cred_free),
.cred_prepare = LIST_HEAD_INIT(security_hook_heads.cred_prepare),
.cred_transfer =
LIST_HEAD_INIT(security_hook_heads.cred_transfer),
.kernel_act_as =
LIST_HEAD_INIT(security_hook_heads.kernel_act_as),
.kernel_create_files_as =
LIST_HEAD_INIT(security_hook_heads.kernel_create_files_as),
.kernel_module_request =
LIST_HEAD_INIT(security_hook_heads.kernel_module_request),
.kernel_read_file =
LIST_HEAD_INIT(security_hook_heads.kernel_read_file),
.kernel_post_read_file =
LIST_HEAD_INIT(security_hook_heads.kernel_post_read_file),
.task_fix_setuid =
LIST_HEAD_INIT(security_hook_heads.task_fix_setuid),
.task_setpgid = LIST_HEAD_INIT(security_hook_heads.task_setpgid),
.task_getpgid = LIST_HEAD_INIT(security_hook_heads.task_getpgid),
.task_getsid = LIST_HEAD_INIT(security_hook_heads.task_getsid),
.task_getsecid =
LIST_HEAD_INIT(security_hook_heads.task_getsecid),
.task_setnice = LIST_HEAD_INIT(security_hook_heads.task_setnice),
.task_setioprio =
LIST_HEAD_INIT(security_hook_heads.task_setioprio),
.task_getioprio =
LIST_HEAD_INIT(security_hook_heads.task_getioprio),
.task_prlimit =
LIST_HEAD_INIT(security_hook_heads.task_prlimit),
.task_setrlimit =
LIST_HEAD_INIT(security_hook_heads.task_setrlimit),
.task_setscheduler =
LIST_HEAD_INIT(security_hook_heads.task_setscheduler),
.task_getscheduler =
LIST_HEAD_INIT(security_hook_heads.task_getscheduler),
.task_movememory =
LIST_HEAD_INIT(security_hook_heads.task_movememory),
.task_kill = LIST_HEAD_INIT(security_hook_heads.task_kill),
.task_prctl = LIST_HEAD_INIT(security_hook_heads.task_prctl),
.task_to_inode =
LIST_HEAD_INIT(security_hook_heads.task_to_inode),
.ipc_permission =
LIST_HEAD_INIT(security_hook_heads.ipc_permission),
.ipc_getsecid = LIST_HEAD_INIT(security_hook_heads.ipc_getsecid),
.msg_msg_alloc_security =
LIST_HEAD_INIT(security_hook_heads.msg_msg_alloc_security),
.msg_msg_free_security =
LIST_HEAD_INIT(security_hook_heads.msg_msg_free_security),
.msg_queue_alloc_security =
LIST_HEAD_INIT(security_hook_heads.msg_queue_alloc_security),
.msg_queue_free_security =
LIST_HEAD_INIT(security_hook_heads.msg_queue_free_security),
.msg_queue_associate =
LIST_HEAD_INIT(security_hook_heads.msg_queue_associate),
.msg_queue_msgctl =
LIST_HEAD_INIT(security_hook_heads.msg_queue_msgctl),
.msg_queue_msgsnd =
LIST_HEAD_INIT(security_hook_heads.msg_queue_msgsnd),
.msg_queue_msgrcv =
LIST_HEAD_INIT(security_hook_heads.msg_queue_msgrcv),
.shm_alloc_security =
LIST_HEAD_INIT(security_hook_heads.shm_alloc_security),
.shm_free_security =
LIST_HEAD_INIT(security_hook_heads.shm_free_security),
.shm_associate =
LIST_HEAD_INIT(security_hook_heads.shm_associate),
.shm_shmctl = LIST_HEAD_INIT(security_hook_heads.shm_shmctl),
.shm_shmat = LIST_HEAD_INIT(security_hook_heads.shm_shmat),
.sem_alloc_security =
LIST_HEAD_INIT(security_hook_heads.sem_alloc_security),
.sem_free_security =
LIST_HEAD_INIT(security_hook_heads.sem_free_security),
.sem_associate =
LIST_HEAD_INIT(security_hook_heads.sem_associate),
.sem_semctl = LIST_HEAD_INIT(security_hook_heads.sem_semctl),
.sem_semop = LIST_HEAD_INIT(security_hook_heads.sem_semop),
.netlink_send = LIST_HEAD_INIT(security_hook_heads.netlink_send),
.d_instantiate =
LIST_HEAD_INIT(security_hook_heads.d_instantiate),
.getprocattr = LIST_HEAD_INIT(security_hook_heads.getprocattr),
.setprocattr = LIST_HEAD_INIT(security_hook_heads.setprocattr),
.ismaclabel = LIST_HEAD_INIT(security_hook_heads.ismaclabel),
.secid_to_secctx =
LIST_HEAD_INIT(security_hook_heads.secid_to_secctx),
.secctx_to_secid =
LIST_HEAD_INIT(security_hook_heads.secctx_to_secid),
.release_secctx =
LIST_HEAD_INIT(security_hook_heads.release_secctx),
.inode_invalidate_secctx =
LIST_HEAD_INIT(security_hook_heads.inode_invalidate_secctx),
.inode_notifysecctx =
LIST_HEAD_INIT(security_hook_heads.inode_notifysecctx),
.inode_setsecctx =
LIST_HEAD_INIT(security_hook_heads.inode_setsecctx),
.inode_getsecctx =
LIST_HEAD_INIT(security_hook_heads.inode_getsecctx),
#ifdef CONFIG_SECURITY_NETWORK
.unix_stream_connect =
LIST_HEAD_INIT(security_hook_heads.unix_stream_connect),
.unix_may_send =
LIST_HEAD_INIT(security_hook_heads.unix_may_send),
.socket_create =
LIST_HEAD_INIT(security_hook_heads.socket_create),
.socket_post_create =
LIST_HEAD_INIT(security_hook_heads.socket_post_create),
.socket_bind = LIST_HEAD_INIT(security_hook_heads.socket_bind),
.socket_connect =
LIST_HEAD_INIT(security_hook_heads.socket_connect),
.socket_listen =
LIST_HEAD_INIT(security_hook_heads.socket_listen),
.socket_accept =
LIST_HEAD_INIT(security_hook_heads.socket_accept),
.socket_sendmsg =
LIST_HEAD_INIT(security_hook_heads.socket_sendmsg),
.socket_recvmsg =
LIST_HEAD_INIT(security_hook_heads.socket_recvmsg),
.socket_getsockname =
LIST_HEAD_INIT(security_hook_heads.socket_getsockname),
.socket_getpeername =
LIST_HEAD_INIT(security_hook_heads.socket_getpeername),
.socket_getsockopt =
LIST_HEAD_INIT(security_hook_heads.socket_getsockopt),
.socket_setsockopt =
LIST_HEAD_INIT(security_hook_heads.socket_setsockopt),
.socket_shutdown =
LIST_HEAD_INIT(security_hook_heads.socket_shutdown),
.socket_sock_rcv_skb =
LIST_HEAD_INIT(security_hook_heads.socket_sock_rcv_skb),
.socket_getpeersec_stream =
LIST_HEAD_INIT(security_hook_heads.socket_getpeersec_stream),
.socket_getpeersec_dgram =
LIST_HEAD_INIT(security_hook_heads.socket_getpeersec_dgram),
.sk_alloc_security =
LIST_HEAD_INIT(security_hook_heads.sk_alloc_security),
.sk_free_security =
LIST_HEAD_INIT(security_hook_heads.sk_free_security),
.sk_clone_security =
LIST_HEAD_INIT(security_hook_heads.sk_clone_security),
.sk_getsecid = LIST_HEAD_INIT(security_hook_heads.sk_getsecid),
.sock_graft = LIST_HEAD_INIT(security_hook_heads.sock_graft),
.inet_conn_request =
LIST_HEAD_INIT(security_hook_heads.inet_conn_request),
.inet_csk_clone =
LIST_HEAD_INIT(security_hook_heads.inet_csk_clone),
.inet_conn_established =
LIST_HEAD_INIT(security_hook_heads.inet_conn_established),
.secmark_relabel_packet =
LIST_HEAD_INIT(security_hook_heads.secmark_relabel_packet),
.secmark_refcount_inc =
LIST_HEAD_INIT(security_hook_heads.secmark_refcount_inc),
.secmark_refcount_dec =
LIST_HEAD_INIT(security_hook_heads.secmark_refcount_dec),
.req_classify_flow =
LIST_HEAD_INIT(security_hook_heads.req_classify_flow),
.tun_dev_alloc_security =
LIST_HEAD_INIT(security_hook_heads.tun_dev_alloc_security),
.tun_dev_free_security =
LIST_HEAD_INIT(security_hook_heads.tun_dev_free_security),
.tun_dev_create =
LIST_HEAD_INIT(security_hook_heads.tun_dev_create),
.tun_dev_attach_queue =
LIST_HEAD_INIT(security_hook_heads.tun_dev_attach_queue),
.tun_dev_attach =
LIST_HEAD_INIT(security_hook_heads.tun_dev_attach),
.tun_dev_open = LIST_HEAD_INIT(security_hook_heads.tun_dev_open),
#endif /* CONFIG_SECURITY_NETWORK */
#ifdef CONFIG_SECURITY_NETWORK_XFRM
.xfrm_policy_alloc_security =
LIST_HEAD_INIT(security_hook_heads.xfrm_policy_alloc_security),
.xfrm_policy_clone_security =
LIST_HEAD_INIT(security_hook_heads.xfrm_policy_clone_security),
.xfrm_policy_free_security =
LIST_HEAD_INIT(security_hook_heads.xfrm_policy_free_security),
.xfrm_policy_delete_security =
LIST_HEAD_INIT(security_hook_heads.xfrm_policy_delete_security),
.xfrm_state_alloc =
LIST_HEAD_INIT(security_hook_heads.xfrm_state_alloc),
.xfrm_state_alloc_acquire =
LIST_HEAD_INIT(security_hook_heads.xfrm_state_alloc_acquire),
.xfrm_state_free_security =
LIST_HEAD_INIT(security_hook_heads.xfrm_state_free_security),
.xfrm_state_delete_security =
LIST_HEAD_INIT(security_hook_heads.xfrm_state_delete_security),
.xfrm_policy_lookup =
LIST_HEAD_INIT(security_hook_heads.xfrm_policy_lookup),
.xfrm_state_pol_flow_match =
LIST_HEAD_INIT(security_hook_heads.xfrm_state_pol_flow_match),
.xfrm_decode_session =
LIST_HEAD_INIT(security_hook_heads.xfrm_decode_session),
#endif /* CONFIG_SECURITY_NETWORK_XFRM */
#ifdef CONFIG_KEYS
.key_alloc = LIST_HEAD_INIT(security_hook_heads.key_alloc),
.key_free = LIST_HEAD_INIT(security_hook_heads.key_free),
.key_permission =
LIST_HEAD_INIT(security_hook_heads.key_permission),
.key_getsecurity =
LIST_HEAD_INIT(security_hook_heads.key_getsecurity),
#endif /* CONFIG_KEYS */
#ifdef CONFIG_AUDIT
.audit_rule_init =
LIST_HEAD_INIT(security_hook_heads.audit_rule_init),
.audit_rule_known =
LIST_HEAD_INIT(security_hook_heads.audit_rule_known),
.audit_rule_match =
LIST_HEAD_INIT(security_hook_heads.audit_rule_match),
.audit_rule_free =
LIST_HEAD_INIT(security_hook_heads.audit_rule_free),
#endif /* CONFIG_AUDIT */
};

0 comments on commit 3dfc9b0

Please sign in to comment.