Commit 86ef3c73 authored Nov 01, 2022 by Kees Cook Committed by Paul Moore Nov 16, 2022

LSM: Better reporting of actual LSMs at boot



Enhance the details reported by "lsm.debug" in several ways:

- report contents of "security="
- report contents of "CONFIG_LSM"
- report contents of "lsm="
- report any early LSM details
- whitespace-align the output of similar phases for easier visual parsing
- change "disabled" to more accurate "skipped"
- explain what "skipped" and "ignored" mean in a parenthetical

Upgrade the "security= is ignored" warning from pr_info to pr_warn,
and include full arguments list to make the cause even more clear.

Replace static "Security Framework initializing" pr_info with specific
list of the resulting order of enabled LSMs.

For example, if the kernel is built with:

CONFIG_SECURITY_SELINUX=y
CONFIG_SECURITY_APPARMOR=y
CONFIG_SECURITY_LOADPIN=y
CONFIG_SECURITY_YAMA=y
CONFIG_SECURITY_SAFESETID=y
CONFIG_SECURITY_LOCKDOWN_LSM=y
CONFIG_SECURITY_LANDLOCK=y
CONFIG_INTEGRITY=y
CONFIG_BPF_LSM=y
CONFIG_DEFAULT_SECURITY_APPARMOR=y
CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,
            smack,tomoyo,apparmor,bpf"

Booting without options will show:

LSM: initializing lsm=lockdown,capability,landlock,yama,loadpin,
     safesetid,integrity,selinux,bpf
landlock: Up and running.
Yama: becoming mindful.
LoadPin: ready to pin (currently not enforcing)
SELinux:  Initializing.
LSM support for eBPF active

Boot with "lsm.debug" will show:

LSM: legacy security= *unspecified*
LSM: CONFIG_LSM=landlock,lockdown,yama,loadpin,safesetid,integrity,
                selinux,smack,tomoyo,apparmor,bpf
LSM: boot arg lsm= *unspecified*
LSM:   early started: lockdown (enabled)
LSM:   first ordered: capability (enabled)
LSM: builtin ordered: landlock (enabled)
LSM: builtin ignored: lockdown (not built into kernel)
LSM: builtin ordered: yama (enabled)
LSM: builtin ordered: loadpin (enabled)
LSM: builtin ordered: safesetid (enabled)
LSM: builtin ordered: integrity (enabled)
LSM: builtin ordered: selinux (enabled)
LSM: builtin ignored: smack (not built into kernel)
LSM: builtin ignored: tomoyo (not built into kernel)
LSM: builtin ordered: apparmor (enabled)
LSM: builtin ordered: bpf (enabled)
LSM: exclusive chosen:   selinux
LSM: exclusive disabled: apparmor
LSM: initializing lsm=lockdown,capability,landlock,yama,loadpin,
                      safesetid,integrity,selinux,bpf
LSM: cred blob size       = 32
LSM: file blob size       = 16
LSM: inode blob size      = 72
LSM: ipc blob size        = 8
LSM: msg_msg blob size    = 4
LSM: superblock blob size = 80
LSM: task blob size       = 8
LSM: initializing capability
LSM: initializing landlock
landlock: Up and running.
LSM: initializing yama
Yama: becoming mindful.
LSM: initializing loadpin
LoadPin: ready to pin (currently not enforcing)
LSM: initializing safesetid
LSM: initializing integrity
LSM: initializing selinux
SELinux:  Initializing.
LSM: initializing bpf
LSM support for eBPF active

And some examples of how the lsm.debug ordering report changes...

With "lsm.debug security=selinux":

LSM: legacy security=selinux
LSM: CONFIG_LSM=landlock,lockdown,yama,loadpin,safesetid,integrity,
                selinux,smack,tomoyo,apparmor,bpf
LSM: boot arg lsm= *unspecified*
LSM:   early started: lockdown (enabled)
LSM:   first ordered: capability (enabled)
LSM: security=selinux disabled: apparmor (only one legacy major LSM)
LSM: builtin ordered: landlock (enabled)
LSM: builtin ignored: lockdown (not built into kernel)
LSM: builtin ordered: yama (enabled)
LSM: builtin ordered: loadpin (enabled)
LSM: builtin ordered: safesetid (enabled)
LSM: builtin ordered: integrity (enabled)
LSM: builtin ordered: selinux (enabled)
LSM: builtin ignored: smack (not built into kernel)
LSM: builtin ignored: tomoyo (not built into kernel)
LSM: builtin ordered: apparmor (disabled)
LSM: builtin ordered: bpf (enabled)
LSM: exclusive chosen:   selinux
LSM: initializing lsm=lockdown,capability,landlock,yama,loadpin,
		      safesetid,integrity,selinux,bpf

With "lsm.debug lsm=integrity,selinux,loadpin,crabability,bpf,
                    loadpin,loadpin":

LSM: legacy security= *unspecified*
LSM: CONFIG_LSM=landlock,lockdown,yama,loadpin,safesetid,integrity,
                selinux,smack,tomoyo,apparmor,bpf
LSM: boot arg lsm=integrity,selinux,loadpin,capability,bpf,loadpin,
		  loadpin
LSM:   early started: lockdown (enabled)
LSM:   first ordered: capability (enabled)
LSM: cmdline ordered: integrity (enabled)
LSM: cmdline ordered: selinux (enabled)
LSM: cmdline ordered: loadpin (enabled)
LSM: cmdline ignored: crabability (not built into kernel)
LSM: cmdline ordered: bpf (enabled)
LSM: cmdline skipped: apparmor (not in requested order)
LSM: cmdline skipped: yama (not in requested order)
LSM: cmdline skipped: safesetid (not in requested order)
LSM: cmdline skipped: landlock (not in requested order)
LSM: exclusive chosen:   selinux
LSM: initializing lsm=lockdown,capability,integrity,selinux,loadpin,bpf

Cc: Paul Moore <paul@paul-moore.com>
Cc: James Morris <jmorris@namei.org>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Cc: linux-security-module@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Acked-by: Mickaël Salaün <mic@digikod.net>
[PM: line wrapped commit description]
Signed-off-by: Paul Moore <paul@paul-moore.com>

parent b10b9c34

security/security.c

+36 −9

Original line number	Diff line number	Diff line
		@@ -161,8 +161,8 @@ static void __init append_ordered_lsm(struct lsm_info lsm, const char from)
		lsm->enabled = &lsm_enabled_true;
		ordered_lsms[last_lsm++] = lsm;

		init_debug("%s ordering: %s (%sabled)\n", from, lsm->name,
		is_enabled(lsm) ? "en" : "dis");
		init_debug("%s ordered: %s (%s)\n", from, lsm->name,
		is_enabled(lsm) ? "enabled" : "disabled");
		}

		/* Is an LSM allowed to be initialized? */
		@@ -270,7 +270,7 @@ static void __init ordered_lsm_parse(const char order, const char origin)
		if ((major->flags & LSM_FLAG_LEGACY_MAJOR) &&
		strcmp(major->name, chosen_major_lsm) != 0) {
		set_enabled(major, false);
		init_debug("security=%s disabled: %s\n",
		init_debug("security=%s disabled: %s (only one legacy major LSM)\n",
		chosen_major_lsm, major->name);
		}
		}
		@@ -291,7 +291,8 @@ static void __init ordered_lsm_parse(const char order, const char origin)
		}

		if (!found)
		init_debug("%s ignored: %s\n", origin, name);
		init_debug("%s ignored: %s (not built into kernel)\n",
		origin, name);
		}

		/* Process "security=", if given. */
		@@ -309,7 +310,8 @@ static void __init ordered_lsm_parse(const char order, const char origin)
		if (exists_ordered_lsm(lsm))
		continue;
		set_enabled(lsm, false);
		init_debug("%s disabled: %s\n", origin, lsm->name);
		init_debug("%s skipped: %s (not in requested order)\n",
		origin, lsm->name);
		}

		kfree(sep);
		@@ -320,6 +322,24 @@ static void __init lsm_early_task(struct task_struct *task);

		static int lsm_append(const char new, char *result);

		static void __init report_lsm_order(void)
		{
		struct lsm_info *lsm, early;
		int first = 0;

		pr_info("initializing lsm=");

		/* Report each enabled LSM name, comma separated. */
		for (early = __start_early_lsm_info; early < __end_early_lsm_info; early++)
		if (is_enabled(early))
		pr_cont("%s%s", first++ == 0 ? "" : ",", early->name);
		for (lsm = ordered_lsms; *lsm; lsm++)
		if (is_enabled(*lsm))
		pr_cont("%s%s", first++ == 0 ? "" : ",", (*lsm)->name);

		pr_cont("\n");
		}

		static void __init ordered_lsm_init(void)
		{
		struct lsm_info **lsm;
		@@ -329,7 +349,8 @@ static void __init ordered_lsm_init(void)

		if (chosen_lsm_order) {
		if (chosen_major_lsm) {
		pr_info("security= is ignored because it is superseded by lsm=\n");
		pr_warn("security=%s is ignored because it is superseded by lsm=%s\n",
		chosen_major_lsm, chosen_lsm_order);
		chosen_major_lsm = NULL;
		}
		ordered_lsm_parse(chosen_lsm_order, "cmdline");
		@@ -339,6 +360,8 @@ static void __init ordered_lsm_init(void)
		for (lsm = ordered_lsms; *lsm; lsm++)
		prepare_lsm(*lsm);

		report_lsm_order();

		init_debug("cred blob size = %d\n", blob_sizes.lbs_cred);
		init_debug("file blob size = %d\n", blob_sizes.lbs_file);
		init_debug("inode blob size = %d\n", blob_sizes.lbs_inode);
		@@ -395,13 +418,17 @@ int __init security_init(void)
		{
		struct lsm_info *lsm;

		pr_info("Security Framework initializing\n");
		init_debug("legacy security=%s\n", chosen_major_lsm ?: " unspecified");
		init_debug(" CONFIG_LSM=%s\n", builtin_lsm_order);
		init_debug("boot arg lsm=%s\n", chosen_lsm_order ?: " unspecified");

		/*
		* Append the names of the early LSM modules now that kmalloc() is
		* available
		*/
		for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) {
		init_debug(" early started: %s (%s)\n", lsm->name,
		is_enabled(lsm) ? "enabled" : "disabled");
		if (lsm->enabled)
		lsm_append(lsm->name, &lsm_names);
		}