ima,evm: move initcalls to the LSM framework

This patch converts IMA and EVM to use the LSM frameworks's initcall
mechanism. It moved the integrity_fs_init() call to ima_fs_init() and
evm_init_secfs(), to work around the fact that there is no "integrity" LSM,
and introduced integrity_fs_fini() to remove the integrity directory, if
empty. Both integrity_fs_init() and integrity_fs_fini() support the
scenario of being called by both the IMA and EVM LSMs.

This patch does not touch any of the platform certificate code that
lives under the security/integrity/platform_certs directory as the
IMA/EVM developers would prefer to address that in a future patchset.

Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Acked-by: Mimi Zohar <zohar@linux.ibm.com>
[PM: adjust description as discussed over email]
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index db8e324ed4e6cf75d54b663224c60e5497ca7b09..73d500a375cb37a54f295b0e1e93fd6e5d9ecddc 100644 (file)
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -1179,6 +1179,5 @@ DEFINE_LSM(evm) = {
        .init = init_evm_lsm,
        .order = LSM_ORDER_LAST,
        .blobs = &evm_blob_sizes,
+       .initcall_late = init_evm,
 };
-
-late_initcall(init_evm);

diff --git a/security/integrity/evm/evm_secfs.c b/security/integrity/evm/evm_secfs.c
index b0d2aad2785071295698fe1db26c36a4b152e73c..c26724690cec53fd385121ac32999a46c906d48f 100644 (file)
--- a/security/integrity/evm/evm_secfs.c
+++ b/security/integrity/evm/evm_secfs.c
@@ -302,10 +302,16 @@ int __init evm_init_secfs(void)
        int error = 0;
        struct dentry *dentry;
 
-       evm_dir = securityfs_create_dir("evm", integrity_dir);
-       if (IS_ERR(evm_dir))
+       error = integrity_fs_init();
+       if (error < 0)
                return -EFAULT;
 
+       evm_dir = securityfs_create_dir("evm", integrity_dir);
+       if (IS_ERR(evm_dir)) {
+               error = -EFAULT;
+               goto out;
+       }
+
        dentry = securityfs_create_file("evm", 0660,
                                      evm_dir, NULL, &evm_key_ops);
        if (IS_ERR(dentry)) {
@@ -329,5 +335,6 @@ int __init evm_init_secfs(void)
 out:
        securityfs_remove(evm_symlink);
        securityfs_remove(evm_dir);
+       integrity_fs_fini();
        return error;
 }

diff --git a/security/integrity/iint.c b/security/integrity/iint.c
index 068ac6c2ae1e7a8432c93c9044e81fbdc2f1147f..8ec1a3436a71eb65ffb7384969b54d05e0dc6a8e 100644 (file)
--- a/security/integrity/iint.c
+++ b/security/integrity/iint.c
@@ -42,8 +42,11 @@ void __init integrity_load_keys(void)
                evm_load_x509();
 }
 
-static int __init integrity_fs_init(void)
+int __init integrity_fs_init(void)
 {
+       if (integrity_dir)
+               return 0;
+
        integrity_dir = securityfs_create_dir("integrity", NULL);
        if (IS_ERR(integrity_dir)) {
                int ret = PTR_ERR(integrity_dir);
@@ -58,4 +61,11 @@ static int __init integrity_fs_init(void)
        return 0;
 }
 
-late_initcall(integrity_fs_init)
+void __init integrity_fs_fini(void)
+{
+       if (!integrity_dir || !simple_empty(integrity_dir))
+               return;
+
+       securityfs_remove(integrity_dir);
+       integrity_dir = NULL;
+}

diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index 87045b09f1206c125037d3e2c4c326a979d406bf..012a58959ff022e29f09d7408aa6eb2966e66162 100644 (file)
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c
@@ -499,9 +499,15 @@ int __init ima_fs_init(void)
        struct dentry *dentry;
        int ret;
 
+       ret = integrity_fs_init();
+       if (ret < 0)
+               return ret;
+
        ima_dir = securityfs_create_dir("ima", integrity_dir);
-       if (IS_ERR(ima_dir))
-               return PTR_ERR(ima_dir);
+       if (IS_ERR(ima_dir)) {
+               ret = PTR_ERR(ima_dir);
+               goto out;
+       }
 
        ima_symlink = securityfs_create_symlink("ima", NULL, "integrity/ima",
                                                NULL);
@@ -555,6 +561,7 @@ int __init ima_fs_init(void)
 out:
        securityfs_remove(ima_symlink);
        securityfs_remove(ima_dir);
+       integrity_fs_fini();
 
        return ret;
 }

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index eade8e1e3cb1f75c528f36950f7c86d8dbcaf6b3..b703bfc2f4704def8eb5f563195f0db69d487fce 100644 (file)
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -1283,6 +1283,6 @@ DEFINE_LSM(ima) = {
        .init = init_ima_lsm,
        .order = LSM_ORDER_LAST,
        .blobs = &ima_blob_sizes,
+       /* Start IMA after the TPM is available */
+       .initcall_late = init_ima,
 };
-
-late_initcall(init_ima);       /* Start IMA after the TPM is available */

diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index c2c2da6911233bac1a7a41a52ae2c249b45bbcef..7b388b66cf80d5bc92b4e28ac1d66ed671b5fe92 100644 (file)
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -114,6 +114,8 @@ struct ima_file_id {
 
 int integrity_kernel_read(struct file *file, loff_t offset,
                          void *addr, unsigned long count);
+int __init integrity_fs_init(void);
+void __init integrity_fs_fini(void);
 
 #define INTEGRITY_KEYRING_EVM          0
 #define INTEGRITY_KEYRING_IMA          1