lsm: preserve /proc/sys/vm/mmap_min_addr when !CONFIG_SECURITY

While reworking the LSM initialization code the
/proc/sys/vm/mmap_min_addr handler was inadvertently caught up in the
change and the procfs entry wasn't setup when CONFIG_SECURITY was not
selected at kernel build time.  This patch restores the previous behavior
and ensures that the procfs entry is setup regardless of the
CONFIG_SECURITY state.

Future work will improve upon this, likely by moving the procfs handler
into the mm subsystem, but this patch should resolve the immediate
regression.

Fixes: 4ab5efcc2829 ("lsm: consolidate all of the LSM framework initcalls")
Reported-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Tested-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Reviewed-by: Kees Cook <kees@kernel.org>
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/security/lsm.h b/security/lsm.h
index 81aadbc61685cd105ddd31813cc2effb7e502f15..db77cc83e1582b38fc8e08807c667cea0c68c146 100644 (file)
--- a/security/lsm.h
+++ b/security/lsm.h
@@ -37,15 +37,6 @@ int lsm_task_alloc(struct task_struct *task);
 
 /* LSM framework initializers */
 
-#ifdef CONFIG_MMU
-int min_addr_init(void);
-#else
-static inline int min_addr_init(void)
-{
-       return 0;
-}
-#endif /* CONFIG_MMU */
-
 #ifdef CONFIG_SECURITYFS
 int securityfs_init(void);
 #else

diff --git a/security/lsm_init.c b/security/lsm_init.c
index 05bd52e6b1f25d4e534cda3b057dfb23565b4c9f..573e2a7250c41618740f96b44f05151d9fab6d31 100644 (file)
--- a/security/lsm_init.c
+++ b/security/lsm_init.c
@@ -489,12 +489,7 @@ int __init security_init(void)
  */
 static int __init security_initcall_pure(void)
 {
-       int rc_adr, rc_lsm;
-
-       rc_adr = min_addr_init();
-       rc_lsm = lsm_initcall(pure);
-
-       return (rc_adr ? rc_adr : rc_lsm);
+       return lsm_initcall(pure);
 }
 pure_initcall(security_initcall_pure);
 

diff --git a/security/min_addr.c b/security/min_addr.c
index 0fde5ec9abc8a0bd7b5c2f3862340a1c92729e45..56e4f9d25929b0706b32ced610fecac2c6485afc 100644 (file)
--- a/security/min_addr.c
+++ b/security/min_addr.c
@@ -5,8 +5,6 @@
 #include <linux/sysctl.h>
 #include <linux/minmax.h>
 
-#include "lsm.h"
-
 /* amount of vm to protect from userspace access by both DAC and the LSM*/
 unsigned long mmap_min_addr;
 /* amount of vm to protect from userspace using CAP_SYS_RAWIO (DAC) */
@@ -54,10 +52,11 @@ static const struct ctl_table min_addr_sysctl_table[] = {
        },
 };
 
-int __init min_addr_init(void)
+static int __init mmap_min_addr_init(void)
 {
        register_sysctl_init("vm", min_addr_sysctl_table);
        update_mmap_min_addr();
 
        return 0;
 }
+pure_initcall(mmap_min_addr_init);