On 1/15/24 13:18, Roberto Sassu wrote:
From: Roberto Sassu roberto.sassu@huawei.com
As for IMA, move hardcoded EVM function calls from various places in the kernel to the LSM infrastructure, by introducing a new LSM named 'evm' (last and always enabled like 'ima'). The order in the Makefile ensures that 'evm' hooks are executed after 'ima' ones.
Make EVM functions as static (except for evm_inode_init_security(), which is exported), and register them as hook implementations in init_evm_lsm(). Also move the inline functions evm_inode_remove_acl(), evm_inode_post_remove_acl(), and evm_inode_post_set_acl() from the public evm.h header to evm_main.c.
Unlike before (see commit to move IMA to the LSM infrastructure), evm_inode_post_setattr(), evm_inode_post_set_acl(), evm_inode_post_remove_acl(), and evm_inode_post_removexattr() are not executed for private inodes.
Finally, add the LSM_ID_EVM case in lsm_list_modules_test.c
Signed-off-by: Roberto Sassu roberto.sassu@huawei.com Reviewed-by: Casey Schaufler casey@schaufler-ca.com
} +static struct security_hook_list evm_hooks[] __ro_after_init = {
- LSM_HOOK_INIT(inode_setattr, evm_inode_setattr),
- LSM_HOOK_INIT(inode_post_setattr, evm_inode_post_setattr),
- LSM_HOOK_INIT(inode_copy_up_xattr, evm_inode_copy_up_xattr),
- LSM_HOOK_INIT(inode_setxattr, evm_inode_setxattr),
- LSM_HOOK_INIT(inode_set_acl, evm_inode_set_acl),
- LSM_HOOK_INIT(inode_post_set_acl, evm_inode_post_set_acl),
- LSM_HOOK_INIT(inode_remove_acl, evm_inode_remove_acl),
- LSM_HOOK_INIT(inode_post_remove_acl, evm_inode_post_remove_acl),
- LSM_HOOK_INIT(inode_post_setxattr, evm_inode_post_setxattr),
nit: move this one up after inode_setxattr.
Reviewed-by: Stefan Berger stefanb@linux.ibm.com