LSM: Provide init debugging infrastructure

Booting with "lsm.debug" will report future details on how LSM ordering
decisions are being made.

Signed-off-by: Kees Cook <[email protected]>
Reviewed-by: Casey Schaufler <[email protected]>
Reviewed-by: John Johansen <[email protected]>
Reviewed-by: James Morris <[email protected]>
Signed-off-by: James Morris <[email protected]>
This commit is contained in:
Kees Cook 2018-10-10 17:18:25 -07:00 • committed by James Morris
commit 9b8c7c1405
2 changed files with 20 additions and 0 deletions

View file

@ -12,6 +12,8 @@
* (at your option) any later version.
*/
#define pr_fmt(fmt) "LSM: " fmt
#include <linux/bpf.h>
#include <linux/capability.h>
#include <linux/dcache.h>
@ -43,11 +45,19 @@ char *lsm_names;
static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] =
CONFIG_DEFAULT_SECURITY;
static __initdata bool debug;
#define init_debug(...) \
do { \
if (debug) \
pr_info(__VA_ARGS__); \
} while (0)
static void __init major_lsm_init(void)
{
struct lsm_info *lsm;
for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
init_debug("initializing %s\n", lsm->name);
lsm->init();
}
}
@ -91,6 +101,14 @@ static int __init choose_lsm(char *str)
}
__setup("security=", choose_lsm);
/* Enable LSM order debugging. */
static int __init enable_debug(char *str)
{
debug = true;
return 1;
}
__setup("lsm.debug", enable_debug);
static bool match_last_lsm(const char *list, const char *lsm)
{
const char *last;