Commit 7ccbe076 authored by Mickaël Salaün's avatar Mickaël Salaün Committed by Paul Moore
Browse files

lsm: Only build lsm_audit.c if CONFIG_SECURITY and CONFIG_AUDIT are set 

When CONFIG_AUDIT is set, its CONFIG_NET dependency is also set, and the
dev_get_by_index and init_net symbols (used by dump_common_audit_data)
are found by the linker.  dump_common_audit_data() should then failed to
build when CONFIG_NET is not set. However, because the compiler is
smart, it knows that audit_log_start() always return NULL when
!CONFIG_AUDIT, and it doesn't build the body of common_lsm_audit().  As
a side effect, dump_common_audit_data() is not built and the linker
doesn't error out because of missing symbols.

Let's only build lsm_audit.o when CONFIG_SECURITY and CONFIG_AUDIT are
both set, which is checked with the new CONFIG_HAS_SECURITY_AUDIT.

ipv4_skb_to_auditdata() and ipv6_skb_to_auditdata() are only used by
Smack if CONFIG_AUDIT is set, so they don't need fake implementations.

Because common_lsm_audit() is used in multiple places without
CONFIG_AUDIT checks, add a fake implementation.

Link: https://lore.kernel.org/r/20241122143353.59367-2-mic@digikod.net


Cc: Casey Schaufler <casey@schaufler-ca.com>
Cc: James Morris <jmorris@namei.org>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Serge E. Hallyn <serge@hallyn.com>
Signed-off-by: default avatarMickaël Salaün <mic@digikod.net>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 7a9b65ab

include/linux/lsm_audit.h

+14 −0
Original line number Diff line number Diff line
@@ -116,14 +116,28 @@ struct common_audit_data { 
#define v4info fam.v4

#define v6info fam.v6



#ifdef CONFIG_AUDIT



int ipv4_skb_to_auditdata(struct sk_buff *skb,

		struct common_audit_data *ad, u8 *proto);



#if IS_ENABLED(CONFIG_IPV6)

int ipv6_skb_to_auditdata(struct sk_buff *skb,

		struct common_audit_data *ad, u8 *proto);

#endif /* IS_ENABLED(CONFIG_IPV6) */



void common_lsm_audit(struct common_audit_data *a,

	void (*pre_audit)(struct audit_buffer *, void *),

	void (*post_audit)(struct audit_buffer *, void *));



#else /* CONFIG_AUDIT */



static inline void common_lsm_audit(struct common_audit_data *a,

	void (*pre_audit)(struct audit_buffer *, void *),

	void (*post_audit)(struct audit_buffer *, void *))

{

}



#endif /* CONFIG_AUDIT */



#endif

security/Kconfig

+5 −0
Original line number Diff line number Diff line
@@ -64,6 +64,11 @@ config SECURITY 


	  If you are unsure how to answer this question, answer N.



config HAS_SECURITY_AUDIT

	def_bool y

	depends on AUDIT

	depends on SECURITY



config SECURITYFS

	bool "Enable the securityfs filesystem"

	help

security/Makefile

+1 −1
Original line number Diff line number Diff line
@@ -15,7 +15,7 @@ obj-$(CONFIG_SECURITY) += security.o 
obj-$(CONFIG_SECURITYFS)		+= inode.o

obj-$(CONFIG_SECURITY_SELINUX)		+= selinux/

obj-$(CONFIG_SECURITY_SMACK)		+= smack/

obj-$(CONFIG_SECURITY)			+= lsm_audit.o

obj-$(CONFIG_HAS_SECURITY_AUDIT)	+= lsm_audit.o

obj-$(CONFIG_SECURITY_TOMOYO)		+= tomoyo/

obj-$(CONFIG_SECURITY_APPARMOR)		+= apparmor/

obj-$(CONFIG_SECURITY_YAMA)		+= yama/