LSM: Plumb visibility into optional "enabled" state

In preparation for lifting the "is this LSM enabled?" logic out of the
individual LSMs, pass in any special enabled state tracking (as needed
for SELinux, AppArmor, and LoadPin). This should be an "int" to include
handling any future cases where "enabled" is exposed via sysctl which
has no "bool" type.

Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: John Johansen <john.johansen@canonical.com>

diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index 318d93f918c3d1ef685cd739170481e7148beaad..7bbe5e287161956047aff5c7537b6a1c8c88cce7 100644 (file)
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -2047,6 +2047,7 @@ extern void security_add_hooks(struct security_hook_list *hooks, int count,
 struct lsm_info {
        const char *name;       /* Required. */
        unsigned long flags;    /* Optional: flags describing LSM */
+       int *enabled;           /* Optional: NULL means enabled. */
        int (*init)(void);      /* Required. */
 };
 

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index e49c50e0d5ab424a21a62095e6216ad7016aae5a..a4652ff622cfd8a8e091851fb25bdc4fc159c98b 100644 (file)
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -1333,8 +1333,8 @@ bool aa_g_paranoid_load = true;
 module_param_named(paranoid_load, aa_g_paranoid_load, aabool, S_IRUGO);
 
 /* Boot time disable flag */
-static bool apparmor_enabled = CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE;
-module_param_named(enabled, apparmor_enabled, bool, S_IRUGO);
+static int apparmor_enabled = CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE;
+module_param_named(enabled, apparmor_enabled, int, 0444);
 
 static int __init apparmor_enabled_setup(char *str)
 {
@@ -1730,5 +1730,6 @@ alloc_out:
 DEFINE_LSM(apparmor) = {
        .name = "apparmor",
        .flags = LSM_FLAG_LEGACY_MAJOR,
+       .enabled = &apparmor_enabled,
        .init = apparmor_init,
 };

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 41908d2d61490f7aac16fc3614eee7b43d35177c..f847514d6f03d9f2771cf073fac75c3bb66f177a 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -7000,6 +7000,7 @@ void selinux_complete_init(void)
 DEFINE_LSM(selinux) = {
        .name = "selinux",
        .flags = LSM_FLAG_LEGACY_MAJOR,
+       .enabled = &selinux_enabled,
        .init = selinux_init,
 };