Commit 82fe7932 authored by Roberto Sassu's avatar Roberto Sassu Committed by Paul Moore
Browse files

ima,evm: move initcalls to the LSM framework 



This patch converts IMA and EVM to use the LSM frameworks's initcall
mechanism. It moved the integrity_fs_init() call to ima_fs_init() and
evm_init_secfs(), to work around the fact that there is no "integrity" LSM,
and introduced integrity_fs_fini() to remove the integrity directory, if
empty. Both integrity_fs_init() and integrity_fs_fini() support the
scenario of being called by both the IMA and EVM LSMs.

This patch does not touch any of the platform certificate code that
lives under the security/integrity/platform_certs directory as the
IMA/EVM developers would prefer to address that in a future patchset.

Signed-off-by: default avatarRoberto Sassu <roberto.sassu@huawei.com>
Acked-by: default avatarMimi Zohar <zohar@linux.ibm.com>
[PM: adjust description as discussed over email]
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 77ebff06

security/integrity/evm/evm_main.c

+1 −2
Original line number Diff line number Diff line
@@ -1179,6 +1179,5 @@ DEFINE_LSM(evm) = { 
	.init = init_evm_lsm,

	.order = LSM_ORDER_LAST,

	.blobs = &evm_blob_sizes,

	.initcall_late = init_evm,

};
 


late_initcall(init_evm);

security/integrity/evm/evm_secfs.c

+9 −2
Original line number Diff line number Diff line
@@ -302,10 +302,16 @@ int __init evm_init_secfs(void) 
	int error = 0;

	struct dentry *dentry;



	evm_dir = securityfs_create_dir("evm", integrity_dir);

	if (IS_ERR(evm_dir))

	error = integrity_fs_init();

	if (error < 0)

		return -EFAULT;



	evm_dir = securityfs_create_dir("evm", integrity_dir);

	if (IS_ERR(evm_dir)) {

		error = -EFAULT;

		goto out;

	}



	dentry = securityfs_create_file("evm", 0660,

				      evm_dir, NULL, &evm_key_ops);

	if (IS_ERR(dentry)) {
@@ -329,5 +335,6 @@ int __init evm_init_secfs(void) 
out:

	securityfs_remove(evm_symlink);

	securityfs_remove(evm_dir);

	integrity_fs_fini();

	return error;

}

security/integrity/iint.c

+12 −2
Original line number Diff line number Diff line
@@ -42,8 +42,11 @@ void __init integrity_load_keys(void) 
		evm_load_x509();

}



static int __init integrity_fs_init(void)

int __init integrity_fs_init(void)

{

	if (integrity_dir)

		return 0;



	integrity_dir = securityfs_create_dir("integrity", NULL);

	if (IS_ERR(integrity_dir)) {

		int ret = PTR_ERR(integrity_dir);
@@ -58,4 +61,11 @@ static int __init integrity_fs_init(void) 
	return 0;

}



late_initcall(integrity_fs_init)
 
void __init integrity_fs_fini(void)

{

	if (!integrity_dir || !simple_empty(integrity_dir))

		return;



	securityfs_remove(integrity_dir);

	integrity_dir = NULL;

}

security/integrity/ima/ima_fs.c

+9 −2
Original line number Diff line number Diff line
@@ -499,9 +499,15 @@ int __init ima_fs_init(void) 
	struct dentry *dentry;

	int ret;



	ret = integrity_fs_init();

	if (ret < 0)

		return ret;



	ima_dir = securityfs_create_dir("ima", integrity_dir);

	if (IS_ERR(ima_dir))

		return PTR_ERR(ima_dir);

	if (IS_ERR(ima_dir)) {

		ret = PTR_ERR(ima_dir);

		goto out;

	}



	ima_symlink = securityfs_create_symlink("ima", NULL, "integrity/ima",

						NULL);
@@ -555,6 +561,7 @@ int __init ima_fs_init(void) 
out:

	securityfs_remove(ima_symlink);

	securityfs_remove(ima_dir);

	integrity_fs_fini();



	return ret;

}

security/integrity/ima/ima_main.c

+2 −2
Original line number Diff line number Diff line
@@ -1283,6 +1283,6 @@ DEFINE_LSM(ima) = { 
	.init = init_ima_lsm,

	.order = LSM_ORDER_LAST,

	.blobs = &ima_blob_sizes,

	/* Start IMA after the TPM is available */

	.initcall_late = init_ima,

};
 


late_initcall(init_ima);	/* Start IMA after the TPM is available */