[PATCH v5 07/38] LSM: Introduce "lsm=" for boottime LSM selection

[Casey Schaufler]

Provide a way to explicitly choose LSM initialization order via the new
"lsm=" comma-separated list of LSMs.

Signed-off-by: Kees Cook <keesc...@chromium.org>
---
 Documentation/admin-guide/kernel-parameters.txt |  4 ++++
 security/Kconfig                                |  3 ++-
 security/security.c                             | 14 +++++++++++++-
 3 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/Documentation/admin-guide/kernel-parameters.txt 
b/Documentation/admin-guide/kernel-parameters.txt
index 81d1d5a74728..ea33bcbaecb2 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -2302,6 +2302,10 @@
 
        lsm.debug       [SECURITY] Enable LSM initialization debugging output.
 
+       lsm=lsm1,...,lsmN
+                       [SECURITY] Choose order of LSM initialization. This
+                       overrides CONFIG_LSM.
+
        machvec=        [IA-64] Force the use of a particular machine-vector
                        (machvec) in a generic kernel.
                        Example: machvec=hpzx1_swiotlb
diff --git a/security/Kconfig b/security/Kconfig
index 7de42bbacc28..41aa0be6142f 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -281,7 +281,8 @@ config LSM
        default "integrity"
        help
          A comma-separated list of LSMs, in initialization order.
-         Any LSMs left off this list will be ignored.
+         Any LSMs left off this list will be ignored. This can be
+         controlled at boot with the "lsm=" parameter.
 
          If unsure, leave this as the default.
 
diff --git a/security/security.c b/security/security.c
index 96e0b7d057b0..38fc436e8b4b 100644
--- a/security/security.c
+++ b/security/security.c
@@ -47,6 +47,7 @@ char *lsm_names;
 /* Boot-time LSM user choice */
 static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] =
        CONFIG_DEFAULT_SECURITY;
+static __initdata const char *chosen_lsm_order;
 
 static __initconst const char * const builtin_lsm_order = CONFIG_LSM;
 
@@ -190,7 +191,10 @@ static void __init ordered_lsm_init(void)
        ordered_lsms = kcalloc(LSM_COUNT + 1, sizeof(*ordered_lsms),
                                GFP_KERNEL);
 
-       ordered_lsm_parse(builtin_lsm_order, "builtin");
+       if (chosen_lsm_order)
+               ordered_lsm_parse(chosen_lsm_order, "cmdline");
+       else
+               ordered_lsm_parse(builtin_lsm_order, "builtin");
 
        for (lsm = ordered_lsms; *lsm; lsm++)
                maybe_initialize_lsm(*lsm);
@@ -252,6 +256,14 @@ static int __init choose_lsm(char *str)
 }
 __setup("security=", choose_lsm);
 
+/* Explicitly choose LSM initialization order. */
+static int __init choose_lsm_order(char *str)
+{
+       chosen_lsm_order = str;
+       return 1;
+}
+__setup("lsm=", choose_lsm_order);
+
 /* Enable LSM order debugging. */
 static int __init enable_debug(char *str)
 {
-- 
2.14.5


_______________________________________________
Selinux mailing list
Selinux@tycho.nsa.gov
To unsubscribe, send email to selinux-le...@tycho.nsa.gov.
To get help, send an email containing "help" to selinux-requ...@tycho.nsa.gov.