| Message ID | 20200706232309.12010-2-scott.branden@broadcom.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | firmware: add request_partial_firmware_into_buf | expand |
On Mon, Jul 06, 2020 at 04:23:01PM -0700, Scott Branden wrote: > Move kernel_read_file* out of linux/fs.h to its own linux/kernel_read_file.h > include file. That header gets pulled in just about everywhere > and doesn't really need functions not related to the general fs interface. > > Suggested-by: Christoph Hellwig <hch@lst.de> > Signed-off-by: Scott Branden <scott.branden@broadcom.com> > Reviewed-by: Christoph Hellwig <hch@lst.de> > Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > --- > drivers/base/firmware_loader/main.c | 1 + > fs/exec.c | 1 + > include/linux/fs.h | 39 ---------------------- > include/linux/ima.h | 1 + > include/linux/kernel_read_file.h | 52 +++++++++++++++++++++++++++++ > include/linux/security.h | 1 + > kernel/kexec_file.c | 1 + > kernel/module.c | 1 + > security/integrity/digsig.c | 1 + > security/integrity/ima/ima_fs.c | 1 + > security/integrity/ima/ima_main.c | 1 + > security/integrity/ima/ima_policy.c | 1 + > security/loadpin/loadpin.c | 1 + > security/security.c | 1 + > security/selinux/hooks.c | 1 + > 15 files changed, 65 insertions(+), 39 deletions(-) > create mode 100644 include/linux/kernel_read_file.h This looks like too many files are getting touched. If it got added to security.h, very few of the above .c files will need it explicitly added (maybe none). You can test future versions of this change with an allmodconfig build and make sure you have a matching .o for each .c file that calls kernel_read_file(). :) But otherwise, sure, seems good.
On 2020-07-07 4:40 p.m., Kees Cook wrote: > On Mon, Jul 06, 2020 at 04:23:01PM -0700, Scott Branden wrote: >> Move kernel_read_file* out of linux/fs.h to its own linux/kernel_read_file.h >> include file. That header gets pulled in just about everywhere >> and doesn't really need functions not related to the general fs interface. >> >> Suggested-by: Christoph Hellwig <hch@lst.de> >> Signed-off-by: Scott Branden <scott.branden@broadcom.com> >> Reviewed-by: Christoph Hellwig <hch@lst.de> >> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> >> --- >> drivers/base/firmware_loader/main.c | 1 + >> fs/exec.c | 1 + >> include/linux/fs.h | 39 ---------------------- >> include/linux/ima.h | 1 + >> include/linux/kernel_read_file.h | 52 +++++++++++++++++++++++++++++ >> include/linux/security.h | 1 + >> kernel/kexec_file.c | 1 + >> kernel/module.c | 1 + >> security/integrity/digsig.c | 1 + >> security/integrity/ima/ima_fs.c | 1 + >> security/integrity/ima/ima_main.c | 1 + >> security/integrity/ima/ima_policy.c | 1 + >> security/loadpin/loadpin.c | 1 + >> security/security.c | 1 + >> security/selinux/hooks.c | 1 + >> 15 files changed, 65 insertions(+), 39 deletions(-) >> create mode 100644 include/linux/kernel_read_file.h > This looks like too many files are getting touched. If it got added to > security.h, very few of the above .c files will need it explicitly > added (maybe none). Some people want the header file added to each file that uses it, others want it in a common header file. I tried to add it to each file that uses it. But if the other approach is to be followed that could be done. > You can test future versions of this change with an > allmodconfig build and make sure you have a matching .o for each .c > file that calls kernel_read_file(). :) > > But otherwise, sure, seems good. >
diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c index 9da0c9d5f538..7ca229760dfc 100644 --- a/drivers/base/firmware_loader/main.c +++ b/drivers/base/firmware_loader/main.c @@ -12,6 +12,7 @@ #include <linux/capability.h> #include <linux/device.h> +#include <linux/kernel_read_file.h> #include <linux/module.h> #include <linux/init.h> #include <linux/timer.h> diff --git a/fs/exec.c b/fs/exec.c index 7b7cbb180785..4ea87db5e4d5 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -23,6 +23,7 @@ * formats. */ +#include <linux/kernel_read_file.h> #include <linux/slab.h> #include <linux/file.h> #include <linux/fdtable.h> diff --git a/include/linux/fs.h b/include/linux/fs.h index f15848899945..7ea4709a1298 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2857,45 +2857,6 @@ static inline void i_readcount_inc(struct inode *inode) #endif extern int do_pipe_flags(int *, int); -#define __kernel_read_file_id(id) \ - id(UNKNOWN, unknown) \ - id(FIRMWARE, firmware) \ - id(FIRMWARE_PREALLOC_BUFFER, firmware) \ - id(FIRMWARE_EFI_EMBEDDED, firmware) \ - id(MODULE, kernel-module) \ - id(KEXEC_IMAGE, kexec-image) \ - id(KEXEC_INITRAMFS, kexec-initramfs) \ - id(POLICY, security-policy) \ - id(X509_CERTIFICATE, x509-certificate) \ - id(MAX_ID, ) - -#define __fid_enumify(ENUM, dummy) READING_ ## ENUM, -#define __fid_stringify(dummy, str) #str, - -enum kernel_read_file_id { - __kernel_read_file_id(__fid_enumify) -}; - -static const char * const kernel_read_file_str[] = { - __kernel_read_file_id(__fid_stringify) -}; - -static inline const char *kernel_read_file_id_str(enum kernel_read_file_id id) -{ - if ((unsigned)id >= READING_MAX_ID) - return kernel_read_file_str[READING_UNKNOWN]; - - return kernel_read_file_str[id]; -} - -extern int kernel_read_file(struct file *, void **, loff_t *, loff_t, - enum kernel_read_file_id); -extern int kernel_read_file_from_path(const char *, void **, loff_t *, loff_t, - enum kernel_read_file_id); -extern int kernel_read_file_from_path_initns(const char *, void **, loff_t *, loff_t, - enum kernel_read_file_id); -extern int kernel_read_file_from_fd(int, void **, loff_t *, loff_t, - enum kernel_read_file_id); extern ssize_t kernel_read(struct file *, void *, size_t, loff_t *); extern ssize_t kernel_write(struct file *, const void *, size_t, loff_t *); extern ssize_t __kernel_write(struct file *, const void *, size_t, loff_t *); diff --git a/include/linux/ima.h b/include/linux/ima.h index 9164e1534ec9..148636bfcc8f 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -7,6 +7,7 @@ #ifndef _LINUX_IMA_H #define _LINUX_IMA_H +#include <linux/kernel_read_file.h> #include <linux/fs.h> #include <linux/security.h> #include <linux/kexec.h> diff --git a/include/linux/kernel_read_file.h b/include/linux/kernel_read_file.h new file mode 100644 index 000000000000..53f5ca41519a --- /dev/null +++ b/include/linux/kernel_read_file.h @@ -0,0 +1,52 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _LINUX_KERNEL_READ_FILE_H +#define _LINUX_KERNEL_READ_FILE_H + +#include <linux/file.h> +#include <linux/types.h> + +#define __kernel_read_file_id(id) \ + id(UNKNOWN, unknown) \ + id(FIRMWARE, firmware) \ + id(FIRMWARE_PREALLOC_BUFFER, firmware) \ + id(FIRMWARE_EFI_EMBEDDED, firmware) \ + id(MODULE, kernel-module) \ + id(KEXEC_IMAGE, kexec-image) \ + id(KEXEC_INITRAMFS, kexec-initramfs) \ + id(POLICY, security-policy) \ + id(X509_CERTIFICATE, x509-certificate) \ + id(MAX_ID, ) + +#define __fid_enumify(ENUM, dummy) READING_ ## ENUM, +#define __fid_stringify(dummy, str) #str, + +enum kernel_read_file_id { + __kernel_read_file_id(__fid_enumify) +}; + +static const char * const kernel_read_file_str[] = { + __kernel_read_file_id(__fid_stringify) +}; + +static inline const char *kernel_read_file_id_str(enum kernel_read_file_id id) +{ + if ((unsigned int)id >= READING_MAX_ID) + return kernel_read_file_str[READING_UNKNOWN]; + + return kernel_read_file_str[id]; +} + +int kernel_read_file(struct file *file, + void **buf, loff_t *size, loff_t max_size, + enum kernel_read_file_id id); +int kernel_read_file_from_path(const char *path, + void **buf, loff_t *size, loff_t max_size, + enum kernel_read_file_id id); +int kernel_read_file_from_path_initns(const char *path, + void **buf, loff_t *size, loff_t max_size, + enum kernel_read_file_id id); +int kernel_read_file_from_fd(int fd, + void **buf, loff_t *size, loff_t max_size, + enum kernel_read_file_id id); + +#endif /* _LINUX_KERNEL_READ_FILE_H */ diff --git a/include/linux/security.h b/include/linux/security.h index 2797e7f6418e..fc1c6af331bd 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -23,6 +23,7 @@ #ifndef __LINUX_SECURITY_H #define __LINUX_SECURITY_H +#include <linux/kernel_read_file.h> #include <linux/key.h> #include <linux/capability.h> #include <linux/fs.h> diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c index 09cc78df53c6..1358069ce9e9 100644 --- a/kernel/kexec_file.c +++ b/kernel/kexec_file.c @@ -24,6 +24,7 @@ #include <linux/elf.h> #include <linux/elfcore.h> #include <linux/kernel.h> +#include <linux/kernel_read_file.h> #include <linux/syscalls.h> #include <linux/vmalloc.h> #include "kexec_internal.h" diff --git a/kernel/module.c b/kernel/module.c index aa183c9ac0a2..97da0e97c0a0 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -18,6 +18,7 @@ #include <linux/fs.h> #include <linux/sysfs.h> #include <linux/kernel.h> +#include <linux/kernel_read_file.h> #include <linux/slab.h> #include <linux/vmalloc.h> #include <linux/elf.h> diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index e9cbadade74b..d09602aab7bd 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -10,6 +10,7 @@ #include <linux/sched.h> #include <linux/slab.h> #include <linux/cred.h> +#include <linux/kernel_read_file.h> #include <linux/key-type.h> #include <linux/digsig.h> #include <linux/vmalloc.h> diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c index e3fcad871861..57ecbf285fc7 100644 --- a/security/integrity/ima/ima_fs.c +++ b/security/integrity/ima/ima_fs.c @@ -13,6 +13,7 @@ */ #include <linux/fcntl.h> +#include <linux/kernel_read_file.h> #include <linux/slab.h> #include <linux/init.h> #include <linux/seq_file.h> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index c1583d98c5e5..15f29fed6d9f 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -18,6 +18,7 @@ #include <linux/module.h> #include <linux/file.h> #include <linux/binfmts.h> +#include <linux/kernel_read_file.h> #include <linux/mount.h> #include <linux/mman.h> #include <linux/slab.h> diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index e493063a3c34..f8390f6081f0 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -9,6 +9,7 @@ #include <linux/init.h> #include <linux/list.h> +#include <linux/kernel_read_file.h> #include <linux/fs.h> #include <linux/security.h> #include <linux/magic.h> diff --git a/security/loadpin/loadpin.c b/security/loadpin/loadpin.c index 670a1aebb8a1..163c48216d13 100644 --- a/security/loadpin/loadpin.c +++ b/security/loadpin/loadpin.c @@ -11,6 +11,7 @@ #include <linux/module.h> #include <linux/fs.h> +#include <linux/kernel_read_file.h> #include <linux/lsm_hooks.h> #include <linux/mount.h> #include <linux/blkdev.h> diff --git a/security/security.c b/security/security.c index 3ec3216c7d1f..7ff16c56df91 100644 --- a/security/security.c +++ b/security/security.c @@ -16,6 +16,7 @@ #include <linux/export.h> #include <linux/init.h> #include <linux/kernel.h> +#include <linux/kernel_read_file.h> #include <linux/lsm_hooks.h> #include <linux/integrity.h> #include <linux/ima.h> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index ca901025802a..2f1809ae0e3e 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -24,6 +24,7 @@ #include <linux/init.h> #include <linux/kd.h> #include <linux/kernel.h> +#include <linux/kernel_read_file.h> #include <linux/tracehook.h> #include <linux/errno.h> #include <linux/sched/signal.h>