lsm: output available LSMs when debugging

This will display all of the LSMs built into the kernel, regardless
of if they are enabled or not.

Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: John Johansen <john.johhansen@canonical.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/security/lsm_init.c b/security/lsm_init.c
index cd1779e034975ce9792d82437af49627412212eb..cfcf3bf7127ff15c8a5e5cf222ca08da0fb4aae4 100644 (file)
--- a/security/lsm_init.c
+++ b/security/lsm_init.c
@@ -363,6 +363,8 @@ int __init early_security_init(void)
 {
        struct lsm_info *lsm;
 
+       /* NOTE: lsm_pr_dbg() doesn't work here as lsm_debug is not yet set */
+
        lsm_early_for_each_raw(lsm) {
                lsm_enabled_set(lsm, true);
                lsm_order_append(lsm, "early");
@@ -385,9 +387,24 @@ int __init security_init(void)
        struct lsm_info **lsm;
 
        if (lsm_debug) {
-               lsm_pr("built-in LSM list: %s\n", lsm_order_builtin);
+               struct lsm_info *i;
+
+               cnt = 0;
+               lsm_pr("available LSMs: ");
+               lsm_early_for_each_raw(i)
+                       lsm_pr_cont("%s%s(E)", (cnt++ ? "," : ""), i->id->name);
+               lsm_for_each_raw(i)
+                       lsm_pr_cont("%s%s", (cnt++ ? "," : ""), i->id->name);
+               lsm_pr_cont("\n");
+
+               lsm_pr("built-in LSM config: %s\n", lsm_order_builtin);
+
                lsm_pr("legacy LSM parameter: %s\n", lsm_order_legacy);
                lsm_pr("boot LSM parameter: %s\n", lsm_order_cmdline);
+
+               /* see the note about lsm_pr_dbg() in early_security_init() */
+               lsm_early_for_each_raw(i)
+                       lsm_pr("enabled LSM early:%s\n", i->id->name);
        }
 
        if (lsm_order_cmdline) {