leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

LSM: Ignore "security=" when "lsm=" is specified

Browse Source 
To avoid potential confusion, explicitly ignore "security=" when "lsm=" is
used on the command line, and report that it is happening.

Suggested-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: James Morris <james.morris@microsoft.com>
This commit is contained in:
Kees Cook 2019-02-12 10:23:18 -08:00 committed by James Morris
parent e88ed488af
commit 89a9684ea1
2 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
Documentation/admin-guide/kernel-parameters.txt
View File

@ -2321,7 +2321,7 @@
lsm=lsm1,...,lsmN lsm=lsm1,...,lsmN
[SECURITY] Choose order of LSM initialization. This [SECURITY] Choose order of LSM initialization. This
overrides CONFIG_LSM. overrides CONFIG_LSM, and the "security=" parameter.
machvec= [IA-64] Force the use of a particular machine-vector machvec= [IA-64] Force the use of a particular machine-vector
(machvec) in a generic kernel. (machvec) in a generic kernel.
@ -4094,11 +4094,9 @@
Note: increases power consumption, thus should only be Note: increases power consumption, thus should only be
enabled if running jitter sensitive (HPC/RT) workloads. enabled if running jitter sensitive (HPC/RT) workloads.
security= [SECURITY] Choose a security module to enable at boot. security= [SECURITY] Choose a legacy "major" security module to
If this boot parameter is not specified, only the first enable at boot. This has been deprecated by the
security module asking for security registration will be "lsm=" parameter.
loaded. An invalid security module name will be treated
as if no module has been chosen.
selinux= [SELINUX] Disable or enable SELinux at boot time. selinux= [SELINUX] Disable or enable SELinux at boot time.
Format: { "0" | "1" } Format: { "0" | "1" }

8
security/security.c
View File

@ -288,9 +288,13 @@ static void __init ordered_lsm_init(void)
ordered_lsms = kcalloc(LSM_COUNT + 1, sizeof(*ordered_lsms), ordered_lsms = kcalloc(LSM_COUNT + 1, sizeof(*ordered_lsms),
GFP_KERNEL); GFP_KERNEL);
if (chosen_lsm_order) if (chosen_lsm_order) {
if (chosen_major_lsm) {
pr_info("security= is ignored because it is superseded by lsm=\n");
chosen_major_lsm = NULL;
}
ordered_lsm_parse(chosen_lsm_order, "cmdline"); ordered_lsm_parse(chosen_lsm_order, "cmdline");
else } else
ordered_lsm_parse(builtin_lsm_order, "builtin"); ordered_lsm_parse(builtin_lsm_order, "builtin");
for (lsm = ordered_lsms; *lsm; lsm++) for (lsm = ordered_lsms; *lsm; lsm++)