Security: Introduce security= boot parameter

Add the security= boot parameter. This is done to avoid LSM
registration clashes in case of more than one bult-in module.

User can choose a security module to enable at boot. If no
security= boot parameter is specified, only the first LSM
asking for registration will be loaded. An invalid security
module name will be treated as if no module has been chosen.

LSM modules must check now if they are allowed to register
by calling security_module_enable(ops) first. Modify SELinux
and SMACK to do so.

Do not let SMACK register smackfs if it was not chosen on
boot. Smackfs assumes that smack hooks are registered and
the initial task security setup (swapper->security) is done.

Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
Acked-by: James Morris <jmorris@namei.org>

diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 256a2162503c1b91c450c794401c33e0af8ee5c7..4b0f1ae31a4c152f4547050e2b3d8cc6b375bb31 100644 (file)
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -366,6 +366,12 @@ and is between 256 and 4096 characters. It is defined in the file
                        possible to determine what the correct size should be.
                        This option provides an override for these situations.
 
+       security=       [SECURITY] Choose a security module to enable at boot.
+                       If this boot parameter is not specified, only the first
+                       security module asking for security registration will be
+                       loaded. An invalid security module name will be treated
+                       as if no module has been chosen.
+
        capability.disable=
                        [SECURITY] Disable capabilities.  This would normally
                        be used only if an alternative security model is to be

diff --git a/include/linux/security.h b/include/linux/security.h
index 697f228daf1947f7ea4e039118263c5121fff89c..f4116d6ed64b8339cb886e48f994ba7ba29ce219 100644 (file)
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -36,6 +36,9 @@
 
 extern unsigned securebits;
 
+/* Maximum number of letters for an LSM name string */
+#define SECURITY_NAME_MAX      10
+
 struct ctl_table;
 struct audit_krule;
 
@@ -137,6 +140,12 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
 /**
  * struct security_operations - main security structure
  *
+ * Security module identifier.
+ *
+ * @name:
+ *     A string that acts as a unique identifeir for the LSM with max number
+ *     of characters = SECURITY_NAME_MAX.
+ *
  * Security hooks for program execution operations.
  *
  * @bprm_alloc_security:
@@ -1270,6 +1279,8 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  * This is the main security structure.
  */
 struct security_operations {
+       char name[SECURITY_NAME_MAX + 1];
+
        int (*ptrace) (struct task_struct * parent, struct task_struct * child);
        int (*capget) (struct task_struct * target,
                       kernel_cap_t * effective,
@@ -1537,6 +1548,7 @@ struct security_operations {
 
 /* prototypes */
 extern int security_init       (void);
+extern int security_module_enable(struct security_operations *ops);
 extern int register_security   (struct security_operations *ops);
 extern int mod_reg_security    (const char *name, struct security_operations *ops);
 extern struct dentry *securityfs_create_file(const char *name, mode_t mode,

diff --git a/security/dummy.c b/security/dummy.c
index 1ac9f8e66aa2970a6905c582520ac92123dc932b..d797a4196b8939162480a5ad8e6b1f30b36539ed 100644 (file)
--- a/security/dummy.c
+++ b/security/dummy.c
@@ -1017,7 +1017,9 @@ static inline void dummy_audit_rule_free(void *lsmrule)
 
 #endif /* CONFIG_AUDIT */
 
-struct security_operations dummy_security_ops;
+struct security_operations dummy_security_ops = {
+       .name = "dummy",
+};
 
 #define set_to_dummy_if_null(ops, function)                            \
        do {                                                            \

diff --git a/security/security.c b/security/security.c
index 2ef593ec70f3b29832d2fbe26ccaa6f57eb12e56..dd0c6baed494d96969432c9616a81990689ade29 100644 (file)
--- a/security/security.c
+++ b/security/security.c
@@ -17,6 +17,8 @@
 #include <linux/kernel.h>
 #include <linux/security.h>
 
+/* Boot-time LSM user choice */
+static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1];
 
 /* things that live in dummy.c */
 extern struct security_operations dummy_security_ops;
@@ -67,13 +69,47 @@ int __init security_init(void)
        return 0;
 }
 
+/* Save user chosen LSM */
+static int __init choose_lsm(char *str)
+{
+       strncpy(chosen_lsm, str, SECURITY_NAME_MAX);
+       return 1;
+}
+__setup("security=", choose_lsm);
+
+/**
+ * security_module_enable - Load given security module on boot ?
+ * @ops: a pointer to the struct security_operations that is to be checked.
+ *
+ * Each LSM must pass this method before registering its own operations
+ * to avoid security registration races. This method may also be used
+ * to check if your LSM is currently loaded.
+ *
+ * Return true if:
+ *     -The passed LSM is the one chosen by user at boot time,
+ *     -or user didsn't specify a specific LSM and we're the first to ask
+ *      for registeration permissoin,
+ *     -or the passed LSM is currently loaded.
+ * Otherwise, return false.
+ */
+int __init security_module_enable(struct security_operations *ops)
+{
+       if (!*chosen_lsm)
+               strncpy(chosen_lsm, ops->name, SECURITY_NAME_MAX);
+       else if (strncmp(ops->name, chosen_lsm, SECURITY_NAME_MAX))
+               return 0;
+
+       return 1;
+}
+
 /**
  * register_security - registers a security framework with the kernel
  * @ops: a pointer to the struct security_options that is to be registered
  *
  * This function is to allow a security module to register itself with the
  * kernel security subsystem.  Some rudimentary checking is done on the @ops
- * value passed to this function.
+ * value passed to this function. You'll need to check first if your LSM
+ * is allowed to register its @ops by calling security_module_enable(@ops).
  *
  * If there is already a security module registered with the kernel,
  * an error will be returned.  Otherwise 0 is returned on success.

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index a2f7e9cf78c59ec25c4adefeb3d0138266e194aa..f9927f02bc3d07d70c352d3669dababde1fd2536 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -5295,6 +5295,8 @@ static int selinux_key_permission(key_ref_t key_ref,
 #endif
 
 static struct security_operations selinux_ops = {
+       .name =                         "selinux",
+
        .ptrace =                       selinux_ptrace,
        .capget =                       selinux_capget,
        .capset_check =                 selinux_capset_check,
@@ -5492,6 +5494,11 @@ static __init int selinux_init(void)
 {
        struct task_security_struct *tsec;
 
+       if (!security_module_enable(&selinux_ops)) {
+               selinux_enabled = 0;
+               return 0;
+       }
+
        if (!selinux_enabled) {
                printk(KERN_INFO "SELinux:  Disabled at boot.\n");
                return 0;

diff --git a/security/smack/smack.h b/security/smack/smack.h
index 62c1e982849d9b1ab83c38c1bc6bc9df68749e77..4a4477f5afdcd3468074c72ea05aa5697dea4566 100644 (file)
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -15,6 +15,7 @@
 
 #include <linux/capability.h>
 #include <linux/spinlock.h>
+#include <linux/security.h>
 #include <net/netlabel.h>
 
 /*
@@ -187,6 +188,7 @@ extern struct smack_known smack_known_star;
 extern struct smack_known smack_known_unset;
 
 extern struct smk_list_entry *smack_list;
+extern struct security_operations smack_ops;
 
 /*
  * Stricly for CIPSO level manipulation.

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 732ba27923c44f16dd63871416b1fd77ae18d2e4..904bdc01a12be62d27f7aef2df37161f38cfe7ac 100644 (file)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -2424,7 +2424,9 @@ static void smack_release_secctx(char *secdata, u32 seclen)
 {
 }
 
-static struct security_operations smack_ops = {
+struct security_operations smack_ops = {
+       .name =                         "smack",
+
        .ptrace =                       smack_ptrace,
        .capget =                       cap_capget,
        .capset_check =                 cap_capset_check,
@@ -2557,6 +2559,9 @@ static struct security_operations smack_ops = {
  */
 static __init int smack_init(void)
 {
+       if (!security_module_enable(&smack_ops))
+               return 0;
+
        printk(KERN_INFO "Smack:  Initializing.\n");
 
        /*

diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index cfae8afcc262d9fd9e18e3b79f45b5a3f4598bd8..6ba283783b70af178d7c66bca1e44eb632674f2b 100644 (file)
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -965,12 +965,21 @@ static struct vfsmount *smackfs_mount;
  *
  * register the smackfs
  *
- * Returns 0 unless the registration fails.
+ * Do not register smackfs if Smack wasn't enabled
+ * on boot. We can not put this method normally under the
+ * smack_init() code path since the security subsystem get
+ * initialized before the vfs caches.
+ *
+ * Returns true if we were not chosen on boot or if
+ * we were chosen and filesystem registration succeeded.
  */
 static int __init init_smk_fs(void)
 {
        int err;
 
+       if (!security_module_enable(&smack_ops))
+               return 0;
+
        err = register_filesystem(&smk_fs_type);
        if (!err) {
                smackfs_mount = kern_mount(&smk_fs_type);