LSM: Identify modules by more than name

Create a struct lsm_id to contain identifying information about Linux
Security Modules (LSMs). At inception this contains the name of the
module and an identifier associated with the security module.  Change
the security_add_hooks() interface to use this structure.  Change the
individual modules to maintain their own struct lsm_id and pass it to
security_add_hooks().

The values are for LSM identifiers are defined in a new UAPI
header file linux/lsm.h. Each existing LSM has been updated to
include it's LSMID in the lsm_id.

The LSM ID values are sequential, with the oldest module
LSM_ID_CAPABILITY being the lowest value and the existing modules
numbered in the order they were included in the main line kernel.
This is an arbitrary convention for assigning the values, but
none better presents itself. The value 0 is defined as being invalid.
The values 1-99 are reserved for any special case uses which may
arise in the future. This may include attributes of the LSM
infrastructure itself, possibly related to namespacing or network
attribute management. A special range is identified for such attributes
to help reduce confusion for developers unfamiliar with LSMs.

LSM attribute values are defined for the attributes presented by
modules that are available today. As with the LSM IDs, The value 0
is defined as being invalid. The values 1-99 are reserved for any
special case uses which may arise in the future.

Cc: linux-security-module <linux-security-module@vger.kernel.org>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
Reviewed-by: Mickael Salaun <mic@digikod.net>
Reviewed-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Nacked-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
[PM: forward ported beyond v6.6 due merge window changes]
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/Documentation/userspace-api/index.rst b/Documentation/userspace-api/index.rst
index 031df47a7c1933349f01e0f5b9d264301b9140d6..8be8b1979194b145b4b32cfcbc44e3be39caa828 100644 (file)
--- a/Documentation/userspace-api/index.rst
+++ b/Documentation/userspace-api/index.rst
@@ -33,6 +33,7 @@ place where this information is gathered.
    sysfs-platform_profile
    vduse
    futex2
+   lsm
 
 .. only::  subproject and html
 

diff --git a/MAINTAINERS b/MAINTAINERS
index 97f51d5ec1cfd715487a616c78afd40324082dfc..f1d41fd9159a7aaf134e09170b6de63a95f15488 100644 (file)
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -19511,6 +19511,7 @@ L:      linux-security-module@vger.kernel.org (suggested Cc:)
 S:     Supported
 W:     http://kernsec.org/
 T:     git git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm.git
+F:     include/uapi/linux/lsm.h
 F:     security/
 X:     security/selinux/
 

diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index dcb5e5b5eb135283de821772b80c12ef0f6d6e7c..7f0adb33caaae6205cc1f3e7fa32f3c53e7fb845 100644 (file)
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -42,6 +42,18 @@ struct security_hook_heads {
        #undef LSM_HOOK
 } __randomize_layout;
 
+/**
+ * struct lsm_id - Identify a Linux Security Module.
+ * @lsm: name of the LSM, must be approved by the LSM maintainers
+ * @id: LSM ID number from uapi/linux/lsm.h
+ *
+ * Contains the information that identifies the LSM.
+ */
+struct lsm_id {
+       const char      *name;
+       u64             id;
+};
+
 /*
  * Security module hook list structure.
  * For use with generic list macros for common operations.
@@ -50,7 +62,7 @@ struct security_hook_list {
        struct hlist_node               list;
        struct hlist_head               *head;
        union security_list_options     hook;
-       const char                      *lsm;
+       const struct lsm_id             *lsmid;
 } __randomize_layout;
 
 /*
@@ -104,7 +116,7 @@ extern struct security_hook_heads security_hook_heads;
 extern char *lsm_names;
 
 extern void security_add_hooks(struct security_hook_list *hooks, int count,
-                               const char *lsm);
+                              const struct lsm_id *lsmid);
 
 #define LSM_FLAG_LEGACY_MAJOR  BIT(0)
 #define LSM_FLAG_EXCLUSIVE     BIT(1)

diff --git a/include/uapi/linux/lsm.h b/include/uapi/linux/lsm.h
new file mode 100644 (file)
index 0000000..f27c9a9
--- /dev/null
+++ b/include/uapi/linux/lsm.h
@@ -0,0 +1,54 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Linux Security Modules (LSM) - User space API
+ *
+ * Copyright (C) 2022 Casey Schaufler <casey@schaufler-ca.com>
+ * Copyright (C) 2022 Intel Corporation
+ */
+
+#ifndef _UAPI_LINUX_LSM_H
+#define _UAPI_LINUX_LSM_H
+
+/*
+ * ID tokens to identify Linux Security Modules (LSMs)
+ *
+ * These token values are used to uniquely identify specific LSMs
+ * in the kernel as well as in the kernel's LSM userspace API.
+ *
+ * A value of zero/0 is considered undefined and should not be used
+ * outside the kernel. Values 1-99 are reserved for potential
+ * future use.
+ */
+#define LSM_ID_UNDEF           0
+#define LSM_ID_CAPABILITY      100
+#define LSM_ID_SELINUX         101
+#define LSM_ID_SMACK           102
+#define LSM_ID_TOMOYO          103
+#define LSM_ID_IMA             104
+#define LSM_ID_APPARMOR                105
+#define LSM_ID_YAMA            106
+#define LSM_ID_LOADPIN         107
+#define LSM_ID_SAFESETID       108
+#define LSM_ID_LOCKDOWN                109
+#define LSM_ID_BPF             110
+#define LSM_ID_LANDLOCK                111
+
+/*
+ * LSM_ATTR_XXX definitions identify different LSM attributes
+ * which are used in the kernel's LSM userspace API. Support
+ * for these attributes vary across the different LSMs. None
+ * are required.
+ *
+ * A value of zero/0 is considered undefined and should not be used
+ * outside the kernel. Values 1-99 are reserved for potential
+ * future use.
+ */
+#define LSM_ATTR_UNDEF         0
+#define LSM_ATTR_CURRENT       100
+#define LSM_ATTR_EXEC          101
+#define LSM_ATTR_FSCREATE      102
+#define LSM_ATTR_KEYCREATE     103
+#define LSM_ATTR_PREV          104
+#define LSM_ATTR_SOCKCREATE    105
+
+#endif /* _UAPI_LINUX_LSM_H */

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 4981bdf0299315e24f44ca8d65b38c48bd1247c3..093da0a9dbd857fc3566af5b9b2731ee8e728721 100644 (file)
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -24,6 +24,7 @@
 #include <linux/zstd.h>
 #include <net/sock.h>
 #include <uapi/linux/mount.h>
+#include <uapi/linux/lsm.h>
 
 #include "include/apparmor.h"
 #include "include/apparmorfs.h"
@@ -1385,6 +1386,11 @@ struct lsm_blob_sizes apparmor_blob_sizes __ro_after_init = {
        .lbs_task = sizeof(struct aa_task_ctx),
 };
 
+const struct lsm_id apparmor_lsmid = {
+       .name = "apparmor",
+       .id = LSM_ID_APPARMOR,
+};
+
 static struct security_hook_list apparmor_hooks[] __ro_after_init = {
        LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check),
        LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme),
@@ -2202,7 +2208,7 @@ static int __init apparmor_init(void)
                goto buffers_out;
        }
        security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks),
-                               "apparmor");
+                               &apparmor_lsmid);
 
        /* Report that AppArmor successfully initialized */
        apparmor_initialized = 1;

diff --git a/security/bpf/hooks.c b/security/bpf/hooks.c
index cfaf1d0e6a5f5143af2cbf93c942db65e9c42fbf..91011e0c361ac0f1157b0f077a0e1d333b492bf0 100644 (file)
--- a/security/bpf/hooks.c
+++ b/security/bpf/hooks.c
@@ -5,6 +5,7 @@
  */
 #include <linux/lsm_hooks.h>
 #include <linux/bpf_lsm.h>
+#include <uapi/linux/lsm.h>
 
 static struct security_hook_list bpf_lsm_hooks[] __ro_after_init = {
        #define LSM_HOOK(RET, DEFAULT, NAME, ...) \
@@ -15,9 +16,15 @@ static struct security_hook_list bpf_lsm_hooks[] __ro_after_init = {
        LSM_HOOK_INIT(task_free, bpf_task_storage_free),
 };
 
+const struct lsm_id bpf_lsmid = {
+       .name = "bpf",
+       .id = LSM_ID_BPF,
+};
+
 static int __init bpf_lsm_init(void)
 {
-       security_add_hooks(bpf_lsm_hooks, ARRAY_SIZE(bpf_lsm_hooks), "bpf");
+       security_add_hooks(bpf_lsm_hooks, ARRAY_SIZE(bpf_lsm_hooks),
+                          &bpf_lsmid);
        pr_info("LSM support for eBPF active\n");
        return 0;
 }

diff --git a/security/commoncap.c b/security/commoncap.c
index 8e8c630ce2049e017d8ca78987381cd30c6a6504..a64c0c8592bb3146f88c1ab1e558277f00dda704 100644 (file)
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -25,6 +25,7 @@
 #include <linux/binfmts.h>
 #include <linux/personality.h>
 #include <linux/mnt_idmapping.h>
+#include <uapi/linux/lsm.h>
 
 /*
  * If a non-root user executes a setuid-root binary in
@@ -1440,6 +1441,11 @@ int cap_mmap_file(struct file *file, unsigned long reqprot,
 
 #ifdef CONFIG_SECURITY
 
+const struct lsm_id capability_lsmid = {
+       .name = "capability",
+       .id = LSM_ID_CAPABILITY,
+};
+
 static struct security_hook_list capability_hooks[] __ro_after_init = {
        LSM_HOOK_INIT(capable, cap_capable),
        LSM_HOOK_INIT(settime, cap_settime),
@@ -1464,7 +1470,7 @@ static struct security_hook_list capability_hooks[] __ro_after_init = {
 static int __init capability_init(void)
 {
        security_add_hooks(capability_hooks, ARRAY_SIZE(capability_hooks),
-                               "capability");
+                          &capability_lsmid);
        return 0;
 }
 

diff --git a/security/landlock/cred.c b/security/landlock/cred.c
index 13dff2a3154513fa719a33233716b542306dc0de..786af18c4a1ca84f95d0d37c41af6b77f091aaa8 100644 (file)
--- a/security/landlock/cred.c
+++ b/security/landlock/cred.c
@@ -42,5 +42,5 @@ static struct security_hook_list landlock_hooks[] __ro_after_init = {
 __init void landlock_add_cred_hooks(void)
 {
        security_add_hooks(landlock_hooks, ARRAY_SIZE(landlock_hooks),
-                          LANDLOCK_NAME);
+                          &landlock_lsmid);
 }

diff --git a/security/landlock/fs.c b/security/landlock/fs.c
index bc7c126deea2f77428e8df76ba2132259557964c..490655d09b43a67dda7d60a0140389086921ec3c 100644 (file)
--- a/security/landlock/fs.c
+++ b/security/landlock/fs.c
@@ -1223,5 +1223,5 @@ static struct security_hook_list landlock_hooks[] __ro_after_init = {
 __init void landlock_add_fs_hooks(void)
 {
        security_add_hooks(landlock_hooks, ARRAY_SIZE(landlock_hooks),
-                          LANDLOCK_NAME);
+                          &landlock_lsmid);
 }

diff --git a/security/landlock/net.c b/security/landlock/net.c
index aaa92c2b1f0862dd864b41da944984e79499db79..efa1b644a4afafb15b4b5664c299e9c38e215f03 100644 (file)
--- a/security/landlock/net.c
+++ b/security/landlock/net.c
@@ -196,5 +196,5 @@ static struct security_hook_list landlock_hooks[] __ro_after_init = {
 __init void landlock_add_net_hooks(void)
 {
        security_add_hooks(landlock_hooks, ARRAY_SIZE(landlock_hooks),
-                          LANDLOCK_NAME);
+                          &landlock_lsmid);
 }

diff --git a/security/landlock/ptrace.c b/security/landlock/ptrace.c
index 8a06d6c492bf3e8237174bd93353682638ff1c21..2bfc533d36e429ebbad13e51ebce5e8033d2e401 100644 (file)
--- a/security/landlock/ptrace.c
+++ b/security/landlock/ptrace.c
@@ -116,5 +116,5 @@ static struct security_hook_list landlock_hooks[] __ro_after_init = {
 __init void landlock_add_ptrace_hooks(void)
 {
        security_add_hooks(landlock_hooks, ARRAY_SIZE(landlock_hooks),
-                          LANDLOCK_NAME);
+                          &landlock_lsmid);
 }

diff --git a/security/landlock/setup.c b/security/landlock/setup.c
index 3e11d303542fa30db22ce18d2472c5f03f0de878..f6dd33143b7fc58769eab4534fc9a8e225bcba78 100644 (file)
--- a/security/landlock/setup.c
+++ b/security/landlock/setup.c
@@ -8,6 +8,7 @@
 
 #include <linux/init.h>
 #include <linux/lsm_hooks.h>
+#include <uapi/linux/lsm.h>
 
 #include "common.h"
 #include "cred.h"
@@ -25,6 +26,11 @@ struct lsm_blob_sizes landlock_blob_sizes __ro_after_init = {
        .lbs_superblock = sizeof(struct landlock_superblock_security),
 };
 
+const struct lsm_id landlock_lsmid = {
+       .name = LANDLOCK_NAME,
+       .id = LSM_ID_LANDLOCK,
+};
+
 static int __init landlock_init(void)
 {
        landlock_add_cred_hooks();

diff --git a/security/landlock/setup.h b/security/landlock/setup.h
index 1daffab1ab4bda8130c2c43f3462763b5ea2c6ee..c4252d46d49d484ef4b6db359307a69bbe4abdd1 100644 (file)
--- a/security/landlock/setup.h
+++ b/security/landlock/setup.h
@@ -14,5 +14,6 @@
 extern bool landlock_initialized;
 
 extern struct lsm_blob_sizes landlock_blob_sizes;
+extern const struct lsm_id landlock_lsmid;
 
 #endif /* _SECURITY_LANDLOCK_SETUP_H */

diff --git a/security/loadpin/loadpin.c b/security/loadpin/loadpin.c
index a9d40456a064579dbf6cef774410806efd62d890..d682a851de58aa5fa84fa34da97177815612669d 100644 (file)
--- a/security/loadpin/loadpin.c
+++ b/security/loadpin/loadpin.c
@@ -20,6 +20,7 @@
 #include <linux/string_helpers.h>
 #include <linux/dm-verity-loadpin.h>
 #include <uapi/linux/loadpin.h>
+#include <uapi/linux/lsm.h>
 
 #define VERITY_DIGEST_FILE_HEADER "# LOADPIN_TRUSTED_VERITY_ROOT_DIGESTS"
 
@@ -208,6 +209,11 @@ static int loadpin_load_data(enum kernel_load_data_id id, bool contents)
        return loadpin_check(NULL, (enum kernel_read_file_id) id);
 }
 
+const struct lsm_id loadpin_lsmid = {
+       .name = "loadpin",
+       .id = LSM_ID_LOADPIN,
+};
+
 static struct security_hook_list loadpin_hooks[] __ro_after_init = {
        LSM_HOOK_INIT(sb_free_security, loadpin_sb_free_security),
        LSM_HOOK_INIT(kernel_read_file, loadpin_read_file),
@@ -259,7 +265,8 @@ static int __init loadpin_init(void)
        if (!register_sysctl("kernel/loadpin", loadpin_sysctl_table))
                pr_notice("sysctl registration failed!\n");
 #endif
-       security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks), "loadpin");
+       security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks),
+                          &loadpin_lsmid);
 
        return 0;
 }

diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
index 68d19632aeb7251d0ae40859b169c68693963a74..cd84d8ea1dfbfa09eba96072f5ee4433fcab5df4 100644 (file)
--- a/security/lockdown/lockdown.c
+++ b/security/lockdown/lockdown.c
@@ -13,6 +13,7 @@
 #include <linux/security.h>
 #include <linux/export.h>
 #include <linux/lsm_hooks.h>
+#include <uapi/linux/lsm.h>
 
 static enum lockdown_reason kernel_locked_down;
 
@@ -75,6 +76,11 @@ static struct security_hook_list lockdown_hooks[] __ro_after_init = {
        LSM_HOOK_INIT(locked_down, lockdown_is_locked_down),
 };
 
+const struct lsm_id lockdown_lsmid = {
+       .name = "lockdown",
+       .id = LSM_ID_LOCKDOWN,
+};
+
 static int __init lockdown_lsm_init(void)
 {
 #if defined(CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY)
@@ -83,7 +89,7 @@ static int __init lockdown_lsm_init(void)
        lock_kernel_down("Kernel configuration", LOCKDOWN_CONFIDENTIALITY_MAX);
 #endif
        security_add_hooks(lockdown_hooks, ARRAY_SIZE(lockdown_hooks),
-                          "lockdown");
+                          &lockdown_lsmid);
        return 0;
 }
 

diff --git a/security/safesetid/lsm.c b/security/safesetid/lsm.c
index 5be5894aa0ea021b48e8db09eec7d67fa4aac014..f42d5af5ffb0584c9c5b34b1dc63054b0ca08210 100644 (file)
--- a/security/safesetid/lsm.c
+++ b/security/safesetid/lsm.c
@@ -19,6 +19,7 @@
 #include <linux/ptrace.h>
 #include <linux/sched/task_stack.h>
 #include <linux/security.h>
+#include <uapi/linux/lsm.h>
 #include "lsm.h"
 
 /* Flag indicating whether initialization completed */
@@ -261,6 +262,11 @@ static int safesetid_task_fix_setgroups(struct cred *new, const struct cred *old
        return 0;
 }
 
+const struct lsm_id safesetid_lsmid = {
+       .name = "safesetid",
+       .id = LSM_ID_SAFESETID,
+};
+
 static struct security_hook_list safesetid_security_hooks[] = {
        LSM_HOOK_INIT(task_fix_setuid, safesetid_task_fix_setuid),
        LSM_HOOK_INIT(task_fix_setgid, safesetid_task_fix_setgid),
@@ -271,7 +277,8 @@ static struct security_hook_list safesetid_security_hooks[] = {
 static int __init safesetid_security_init(void)
 {
        security_add_hooks(safesetid_security_hooks,
-                          ARRAY_SIZE(safesetid_security_hooks), "safesetid");
+                          ARRAY_SIZE(safesetid_security_hooks),
+                          &safesetid_lsmid);
 
        /* Report that SafeSetID successfully initialized */
        safesetid_initialized = 1;

diff --git a/security/security.c b/security/security.c
index dcb3e7014f9bdd4b6115f0407c5b1d7d3a588e9c..08b1bd9457a9abf398d6ba2274bca54bcf45559d 100644 (file)
--- a/security/security.c
+++ b/security/security.c
@@ -513,17 +513,17 @@ static int lsm_append(const char *new, char **result)
  * security_add_hooks - Add a modules hooks to the hook lists.
  * @hooks: the hooks to add
  * @count: the number of hooks to add
- * @lsm: the name of the security module
+ * @lsmid: the identification information for the security module
  *
  * Each LSM has to register its hooks with the infrastructure.
  */
 void __init security_add_hooks(struct security_hook_list *hooks, int count,
-                              const char *lsm)
+                              const struct lsm_id *lsmid)
 {
        int i;
 
        for (i = 0; i < count; i++) {
-               hooks[i].lsm = lsm;
+               hooks[i].lsmid = lsmid;
                hlist_add_tail_rcu(&hooks[i].list, hooks[i].head);
        }
 
@@ -532,7 +532,7 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count,
         * and fix this up afterwards.
         */
        if (slab_is_available()) {
-               if (lsm_append(lsm, &lsm_names) < 0)
+               if (lsm_append(lsmid->name, &lsm_names) < 0)
                        panic("%s - Cannot get early memory.\n", __func__);
        }
 }
@@ -3817,7 +3817,7 @@ int security_getprocattr(struct task_struct *p, const char *lsm,
        struct security_hook_list *hp;
 
        hlist_for_each_entry(hp, &security_hook_heads.getprocattr, list) {
-               if (lsm != NULL && strcmp(lsm, hp->lsm))
+               if (lsm != NULL && strcmp(lsm, hp->lsmid->name))
                        continue;
                return hp->hook.getprocattr(p, name, value);
        }
@@ -3842,7 +3842,7 @@ int security_setprocattr(const char *lsm, const char *name, void *value,
        struct security_hook_list *hp;
 
        hlist_for_each_entry(hp, &security_hook_heads.setprocattr, list) {
-               if (lsm != NULL && strcmp(lsm, hp->lsm))
+               if (lsm != NULL && strcmp(lsm, hp->lsmid->name))
                        continue;
                return hp->hook.setprocattr(name, value, size);
        }

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index feda711c6b7b84c19099568b96b3b5cbf121886d..f2423dfd19cd41dae69e9d737fdee6deb7baf15e 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -92,6 +92,7 @@
 #include <linux/fsnotify.h>
 #include <linux/fanotify.h>
 #include <linux/io_uring.h>
+#include <uapi/linux/lsm.h>
 
 #include "avc.h"
 #include "objsec.h"
@@ -6950,6 +6951,11 @@ static int selinux_uring_cmd(struct io_uring_cmd *ioucmd)
 }
 #endif /* CONFIG_IO_URING */
 
+const struct lsm_id selinux_lsmid = {
+       .name = "selinux",
+       .id = LSM_ID_SELINUX,
+};
+
 /*
  * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order:
  * 1. any hooks that don't belong to (2.) or (3.) below,
@@ -7270,7 +7276,8 @@ static __init int selinux_init(void)
 
        hashtab_cache_init();
 
-       security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
+       security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks),
+                          &selinux_lsmid);
 
        if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
                panic("SELinux: Unable to register AVC netcache callback\n");

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 65130a791f5730c4f1e1eb6e442d0c31684c66ad..f73f9a2834eb7e7f8d0eac194bb9d54dad748840 100644 (file)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -43,6 +43,7 @@
 #include <linux/fs_parser.h>
 #include <linux/watch_queue.h>
 #include <linux/io_uring.h>
+#include <uapi/linux/lsm.h>
 #include "smack.h"
 
 #define TRANS_TRUE     "TRUE"
@@ -4933,6 +4934,11 @@ struct lsm_blob_sizes smack_blob_sizes __ro_after_init = {
        .lbs_xattr_count = SMACK_INODE_INIT_XATTRS,
 };
 
+const struct lsm_id smack_lsmid = {
+       .name = "smack",
+       .id = LSM_ID_SMACK,
+};
+
 static struct security_hook_list smack_hooks[] __ro_after_init = {
        LSM_HOOK_INIT(ptrace_access_check, smack_ptrace_access_check),
        LSM_HOOK_INIT(ptrace_traceme, smack_ptrace_traceme),
@@ -5140,7 +5146,7 @@ static __init int smack_init(void)
        /*
         * Register with LSM
         */
-       security_add_hooks(smack_hooks, ARRAY_SIZE(smack_hooks), "smack");
+       security_add_hooks(smack_hooks, ARRAY_SIZE(smack_hooks), &smack_lsmid);
        smack_enabled = 1;
 
        pr_info("Smack:  Initializing.\n");

diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c
index 255f1b4702955b355a0ae5c678443cd55119ef2c..7222054331052ef553500729dbade5c73cd61611 100644 (file)
--- a/security/tomoyo/tomoyo.c
+++ b/security/tomoyo/tomoyo.c
@@ -6,6 +6,7 @@
  */
 
 #include <linux/lsm_hooks.h>
+#include <uapi/linux/lsm.h>
 #include "common.h"
 
 /**
@@ -542,6 +543,11 @@ static void tomoyo_task_free(struct task_struct *task)
        }
 }
 
+const struct lsm_id tomoyo_lsmid = {
+       .name = "tomoyo",
+       .id = LSM_ID_TOMOYO,
+};
+
 /*
  * tomoyo_security_ops is a "struct security_operations" which is used for
  * registering TOMOYO.
@@ -595,7 +601,8 @@ static int __init tomoyo_init(void)
        struct tomoyo_task *s = tomoyo_task(current);
 
        /* register ourselves with the security framework */
-       security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks), "tomoyo");
+       security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks),
+                          &tomoyo_lsmid);
        pr_info("TOMOYO Linux initialized\n");
        s->domain_info = &tomoyo_kernel_domain;
        atomic_inc(&tomoyo_kernel_domain.users);

diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
index 2503cf153d4ad80a28be9869c81fe17b6849897f..5cdff292fcae8eb98073b2c647e324b8624ee141 100644 (file)
--- a/security/yama/yama_lsm.c
+++ b/security/yama/yama_lsm.c
@@ -18,6 +18,7 @@
 #include <linux/task_work.h>
 #include <linux/sched.h>
 #include <linux/spinlock.h>
+#include <uapi/linux/lsm.h>
 
 #define YAMA_SCOPE_DISABLED    0
 #define YAMA_SCOPE_RELATIONAL  1
@@ -421,6 +422,11 @@ static int yama_ptrace_traceme(struct task_struct *parent)
        return rc;
 }
 
+const struct lsm_id yama_lsmid = {
+       .name = "yama",
+       .id = LSM_ID_YAMA,
+};
+
 static struct security_hook_list yama_hooks[] __ro_after_init = {
        LSM_HOOK_INIT(ptrace_access_check, yama_ptrace_access_check),
        LSM_HOOK_INIT(ptrace_traceme, yama_ptrace_traceme),
@@ -471,7 +477,7 @@ static inline void yama_init_sysctl(void) { }
 static int __init yama_init(void)
 {
        pr_info("Yama: becoming mindful.\n");
-       security_add_hooks(yama_hooks, ARRAY_SIZE(yama_hooks), "yama");
+       security_add_hooks(yama_hooks, ARRAY_SIZE(yama_hooks), &yama_lsmid);
        yama_init_sysctl();
        return 0;
 }