| Message ID | 20230120000818.1324170-3-kpsingh@kernel.org (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Paul Moore |
| Headers | show |
| Series | Reduce overhead of LSMs with static calls | expand |
On Fri, Jan 20, 2023 at 01:08:16AM +0100, KP Singh wrote: > The header defines a MAX_LSM_COUNT constant which is used in a > subsequent patch to generate the static calls for each LSM hook which > are named using preprocessor token pasting. Since token pasting does not > work with arithmetic expressions, generate a simple lsm_count.h header > which represents the subset of LSMs that can be enabled on a given > kernel based on the config. > > While one can generate static calls for all the possible LSMs that the > kernel has, this is actually wasteful as most kernels only enable a > handful of LSMs. This is a frustrating bit of complexity to deal with it, but it seems worse to leave each security_... callsite with a huge swath of NOPs. > > Signed-off-by: KP Singh <kpsingh@kernel.org> > --- > scripts/Makefile | 1 + > scripts/security/.gitignore | 1 + > scripts/security/Makefile | 4 +++ > scripts/security/gen_lsm_count.c | 57 ++++++++++++++++++++++++++++++++ > security/Makefile | 11 ++++++ > 5 files changed, 74 insertions(+) > create mode 100644 scripts/security/.gitignore > create mode 100644 scripts/security/Makefile > create mode 100644 scripts/security/gen_lsm_count.c > > diff --git a/scripts/Makefile b/scripts/Makefile > index 1575af84d557..9712249c0fb3 100644 > --- a/scripts/Makefile > +++ b/scripts/Makefile > @@ -41,6 +41,7 @@ targets += module.lds > subdir-$(CONFIG_GCC_PLUGINS) += gcc-plugins > subdir-$(CONFIG_MODVERSIONS) += genksyms > subdir-$(CONFIG_SECURITY_SELINUX) += selinux > +subdir-$(CONFIG_SECURITY) += security > > # Let clean descend into subdirs > subdir- += basic dtc gdb kconfig mod > diff --git a/scripts/security/.gitignore b/scripts/security/.gitignore > new file mode 100644 > index 000000000000..684af16735f1 > --- /dev/null > +++ b/scripts/security/.gitignore > @@ -0,0 +1 @@ > +gen_lsm_count > diff --git a/scripts/security/Makefile b/scripts/security/Makefile > new file mode 100644 > index 000000000000..05f7e4109052 > --- /dev/null > +++ b/scripts/security/Makefile > @@ -0,0 +1,4 @@ > +# SPDX-License-Identifier: GPL-2.0 > +hostprogs-always-y += gen_lsm_count > +HOST_EXTRACFLAGS += \ > + -I$(srctree)/include/uapi -I$(srctree)/include > diff --git a/scripts/security/gen_lsm_count.c b/scripts/security/gen_lsm_count.c > new file mode 100644 > index 000000000000..a9a227724d84 > --- /dev/null > +++ b/scripts/security/gen_lsm_count.c > @@ -0,0 +1,57 @@ > +// SPDX-License-Identifier: GPL-2.0 > + > +/* NOTE: we really do want to use the kernel headers here */ > +#define __EXPORTED_HEADERS__ > + > +#include <stdio.h> > +#include <stdlib.h> > +#include <unistd.h> > +#include <string.h> > +#include <errno.h> > +#include <ctype.h> > + > +#include <linux/kconfig.h> > + > +#define GEN_MAX_LSM_COUNT ( \ > + /* Capabilities */ \ > + IS_ENABLED(CONFIG_SECURITY) + \ > + IS_ENABLED(CONFIG_SECURITY_SELINUX) + \ > + IS_ENABLED(CONFIG_SECURITY_SMACK) + \ > + IS_ENABLED(CONFIG_SECURITY_TOMOYO) + \ > + IS_ENABLED(CONFIG_SECURITY_APPARMOR) + \ > + IS_ENABLED(CONFIG_SECURITY_YAMA) + \ > + IS_ENABLED(CONFIG_SECURITY_LOADPIN) + \ > + IS_ENABLED(CONFIG_SECURITY_SAFESETID) + \ > + IS_ENABLED(CONFIG_SECURITY_LOCKDOWN_LSM) + \ > + IS_ENABLED(CONFIG_BPF_LSM) + \ > + IS_ENABLED(CONFIG_SECURITY_LANDLOCK)) I'm bothered that we have another place to collect a list of "all" the LSMs. The stacking design went out of its way to create DEFINE_LSM() so there didn't need to be this kind of centralized list. I don't have a better suggestion, though. Casey has a centralized list too, so it might make sense (as he mentioned) to use something like that. It can be arranged to provide a MAX_... macro (that could be BUILD_BUG_ON checked against a similarly named enum). I'm thinking: enum lsm_list { LSM_SELINUX, LSM_SMACK, ... __LSM_MAX, }; /* * We can't use __LSM_MAX directly because we need it for macro * concatenation, so just check it against __LSM_MAX at build time. */ #define LSM_MAX 15 ... BUILD_BUG_ON(LSM_MAX != __LSM_MAX); > + > +const char *progname; > + > +static void usage(void) > +{ > + printf("usage: %s lsm_count.h\n", progname); > + exit(1); > +} > + > +int main(int argc, char *argv[]) > +{ > + FILE *fout; > + > + progname = argv[0]; > + > + if (argc < 2) > + usage(); > + > + fout = fopen(argv[1], "w"); > + if (!fout) { > + fprintf(stderr, "Could not open %s for writing: %s\n", > + argv[1], strerror(errno)); > + exit(2); > + } > + > + fprintf(fout, "#ifndef _LSM_COUNT_H_\n#define _LSM_COUNT_H_\n\n"); > + fprintf(fout, "\n#define MAX_LSM_COUNT %d\n", GEN_MAX_LSM_COUNT); > + fprintf(fout, "#endif /* _LSM_COUNT_H_ */\n"); > + exit(0); > +} > diff --git a/security/Makefile b/security/Makefile > index 18121f8f85cd..7a47174831f4 100644 > --- a/security/Makefile > +++ b/security/Makefile > @@ -3,6 +3,7 @@ > # Makefile for the kernel security code > # > > +gen := include/generated > obj-$(CONFIG_KEYS) += keys/ > > # always enable default capabilities > @@ -27,3 +28,13 @@ obj-$(CONFIG_SECURITY_LANDLOCK) += landlock/ > > # Object integrity file lists > obj-$(CONFIG_INTEGRITY) += integrity/ Or, if the enum/#define doesn't work, it might be possible to just do this in the Makefile more directly? ${gen}/lsm_count.h: FORCE (echo "#ifndef _LSM_COUNT_H_"; \ echo "#define _LSM_COUNT_H_"; \ echo -n "#define MAX_LSM_COUNT "; \ echo $(CONFIG_SECURITY_SELINUX) \ $(CONFIG_SECURITY_SMACK) \ ... | wc -w; \ echo "#endif /* _LSM_COUNT_H_") >$@ > + > +$(addprefix $(obj)/,$(obj-y)): $(gen)/lsm_count.h > + > +quiet_cmd_lsm_count = GEN ${gen}/lsm_count.h > + cmd_lsm_count = scripts/security/gen_lsm_count ${gen}/lsm_count.h > + > +targets += lsm_count.h > + > +${gen}/lsm_count.h: FORCE > + $(call if_changed,lsm_count) > -- > 2.39.0.246.g2a6d74b583-goog >
Hi KP,
I love your patch! Yet something to improve:
[auto build test ERROR on bpf-next/master]
url: https://github.com/intel-lab-lkp/linux/commits/KP-Singh/kernel-Add-helper-macros-for-loop-unrolling/20230120-133309
base: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
patch link: https://lore.kernel.org/r/20230120000818.1324170-3-kpsingh%40kernel.org
patch subject: [PATCH RESEND bpf-next 2/4] security: Generate a header with the count of enabled LSMs
config: i386-tinyconfig (https://download.01.org/0day-ci/archive/20230120/202301201525.vZDnlpJ2-lkp@intel.com/config)
compiler: gcc-11 (Debian 11.3.0-8) 11.3.0
reproduce (this is a W=1 build):
# https://github.com/intel-lab-lkp/linux/commit/831b06220bb29c6db171467b13903dac0ef2faa5
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review KP-Singh/kernel-Add-helper-macros-for-loop-unrolling/20230120-133309
git checkout 831b06220bb29c6db171467b13903dac0ef2faa5
# save the config file
mkdir build_dir && cp config build_dir/.config
make W=1 O=build_dir ARCH=i386 olddefconfig
make W=1 O=build_dir ARCH=i386 SHELL=/bin/bash
If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@intel.com>
All errors (new ones prefixed by >>):
>> /bin/bash: line 1: scripts/security/gen_lsm_count: No such file or directory
Hi KP,
I love your patch! Yet something to improve:
[auto build test ERROR on bpf-next/master]
url: https://github.com/intel-lab-lkp/linux/commits/KP-Singh/kernel-Add-helper-macros-for-loop-unrolling/20230120-133309
base: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
patch link: https://lore.kernel.org/r/20230120000818.1324170-3-kpsingh%40kernel.org
patch subject: [PATCH RESEND bpf-next 2/4] security: Generate a header with the count of enabled LSMs
config: ia64-allmodconfig (https://download.01.org/0day-ci/archive/20230120/202301201746.Q5765zQF-lkp@intel.com/config)
compiler: ia64-linux-gcc (GCC) 12.1.0
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/intel-lab-lkp/linux/commit/831b06220bb29c6db171467b13903dac0ef2faa5
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review KP-Singh/kernel-Add-helper-macros-for-loop-unrolling/20230120-133309
git checkout 831b06220bb29c6db171467b13903dac0ef2faa5
# save the config file
mkdir build_dir && cp config build_dir/.config
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross W=1 O=build_dir ARCH=ia64 olddefconfig
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross W=1 O=build_dir ARCH=ia64 prepare
If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@intel.com>
All errors (new ones prefixed by >>):
In file included from scripts/security/gen_lsm_count.c:13:
>> include/linux/kconfig.h:5:10: fatal error: generated/autoconf.h: No such file or directory
5 | #include <generated/autoconf.h>
| ^~~~~~~~~~~~~~~~~~~~~~
compilation terminated.
make[3]: *** [scripts/Makefile.host:111: scripts/security/gen_lsm_count] Error 1
make[3]: Target 'scripts/security/' not remade because of errors.
make[2]: *** [scripts/Makefile.build:504: scripts/security] Error 2
make[2]: Target 'scripts/' not remade because of errors.
make[1]: *** [Makefile:1270: scripts] Error 2
make[1]: Target 'prepare' not remade because of errors.
make: *** [Makefile:242: __sub-make] Error 2
make: Target 'prepare' not remade because of errors.
vim +5 include/linux/kconfig.h
2a11c8ea20bf85 Michal Marek 2011-07-20 4
2a11c8ea20bf85 Michal Marek 2011-07-20 @5 #include <generated/autoconf.h>
2a11c8ea20bf85 Michal Marek 2011-07-20 6
Hi KP,
I love your patch! Yet something to improve:
[auto build test ERROR on bpf-next/master]
url: https://github.com/intel-lab-lkp/linux/commits/KP-Singh/kernel-Add-helper-macros-for-loop-unrolling/20230120-133309
base: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
patch link: https://lore.kernel.org/r/20230120000818.1324170-3-kpsingh%40kernel.org
patch subject: [PATCH RESEND bpf-next 2/4] security: Generate a header with the count of enabled LSMs
config: s390-randconfig-r044-20230119 (https://download.01.org/0day-ci/archive/20230120/202301201738.WShrQVx6-lkp@intel.com/config)
compiler: clang version 16.0.0 (https://github.com/llvm/llvm-project 4196ca3278f78c6e19246e54ab0ecb364e37d66a)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# install s390 cross compiling tool for clang build
# apt-get install binutils-s390x-linux-gnu
# https://github.com/intel-lab-lkp/linux/commit/831b06220bb29c6db171467b13903dac0ef2faa5
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review KP-Singh/kernel-Add-helper-macros-for-loop-unrolling/20230120-133309
git checkout 831b06220bb29c6db171467b13903dac0ef2faa5
# save the config file
mkdir build_dir && cp config build_dir/.config
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=s390 olddefconfig
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=s390 prepare
If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@intel.com>
All errors (new ones prefixed by >>):
In file included from scripts/security/gen_lsm_count.c:13:
>> include/linux/kconfig.h:5:10: fatal error: 'generated/autoconf.h' file not found
#include <generated/autoconf.h>
^~~~~~~~~~~~~~~~~~~~~~
1 error generated.
make[3]: *** [scripts/Makefile.host:111: scripts/security/gen_lsm_count] Error 1
make[3]: Target 'scripts/security/' not remade because of errors.
make[2]: *** [scripts/Makefile.build:504: scripts/security] Error 2
make[2]: Target 'scripts/' not remade because of errors.
make[1]: *** [Makefile:1270: scripts] Error 2
make[1]: Target 'prepare' not remade because of errors.
make: *** [Makefile:242: __sub-make] Error 2
make: Target 'prepare' not remade because of errors.
vim +5 include/linux/kconfig.h
2a11c8ea20bf85 Michal Marek 2011-07-20 4
2a11c8ea20bf85 Michal Marek 2011-07-20 @5 #include <generated/autoconf.h>
2a11c8ea20bf85 Michal Marek 2011-07-20 6
diff --git a/scripts/Makefile b/scripts/Makefile index 1575af84d557..9712249c0fb3 100644 --- a/scripts/Makefile +++ b/scripts/Makefile @@ -41,6 +41,7 @@ targets += module.lds subdir-$(CONFIG_GCC_PLUGINS) += gcc-plugins subdir-$(CONFIG_MODVERSIONS) += genksyms subdir-$(CONFIG_SECURITY_SELINUX) += selinux +subdir-$(CONFIG_SECURITY) += security # Let clean descend into subdirs subdir- += basic dtc gdb kconfig mod diff --git a/scripts/security/.gitignore b/scripts/security/.gitignore new file mode 100644 index 000000000000..684af16735f1 --- /dev/null +++ b/scripts/security/.gitignore @@ -0,0 +1 @@ +gen_lsm_count diff --git a/scripts/security/Makefile b/scripts/security/Makefile new file mode 100644 index 000000000000..05f7e4109052 --- /dev/null +++ b/scripts/security/Makefile @@ -0,0 +1,4 @@ +# SPDX-License-Identifier: GPL-2.0 +hostprogs-always-y += gen_lsm_count +HOST_EXTRACFLAGS += \ + -I$(srctree)/include/uapi -I$(srctree)/include diff --git a/scripts/security/gen_lsm_count.c b/scripts/security/gen_lsm_count.c new file mode 100644 index 000000000000..a9a227724d84 --- /dev/null +++ b/scripts/security/gen_lsm_count.c @@ -0,0 +1,57 @@ +// SPDX-License-Identifier: GPL-2.0 + +/* NOTE: we really do want to use the kernel headers here */ +#define __EXPORTED_HEADERS__ + +#include <stdio.h> +#include <stdlib.h> +#include <unistd.h> +#include <string.h> +#include <errno.h> +#include <ctype.h> + +#include <linux/kconfig.h> + +#define GEN_MAX_LSM_COUNT ( \ + /* Capabilities */ \ + IS_ENABLED(CONFIG_SECURITY) + \ + IS_ENABLED(CONFIG_SECURITY_SELINUX) + \ + IS_ENABLED(CONFIG_SECURITY_SMACK) + \ + IS_ENABLED(CONFIG_SECURITY_TOMOYO) + \ + IS_ENABLED(CONFIG_SECURITY_APPARMOR) + \ + IS_ENABLED(CONFIG_SECURITY_YAMA) + \ + IS_ENABLED(CONFIG_SECURITY_LOADPIN) + \ + IS_ENABLED(CONFIG_SECURITY_SAFESETID) + \ + IS_ENABLED(CONFIG_SECURITY_LOCKDOWN_LSM) + \ + IS_ENABLED(CONFIG_BPF_LSM) + \ + IS_ENABLED(CONFIG_SECURITY_LANDLOCK)) + +const char *progname; + +static void usage(void) +{ + printf("usage: %s lsm_count.h\n", progname); + exit(1); +} + +int main(int argc, char *argv[]) +{ + FILE *fout; + + progname = argv[0]; + + if (argc < 2) + usage(); + + fout = fopen(argv[1], "w"); + if (!fout) { + fprintf(stderr, "Could not open %s for writing: %s\n", + argv[1], strerror(errno)); + exit(2); + } + + fprintf(fout, "#ifndef _LSM_COUNT_H_\n#define _LSM_COUNT_H_\n\n"); + fprintf(fout, "\n#define MAX_LSM_COUNT %d\n", GEN_MAX_LSM_COUNT); + fprintf(fout, "#endif /* _LSM_COUNT_H_ */\n"); + exit(0); +} diff --git a/security/Makefile b/security/Makefile index 18121f8f85cd..7a47174831f4 100644 --- a/security/Makefile +++ b/security/Makefile @@ -3,6 +3,7 @@ # Makefile for the kernel security code # +gen := include/generated obj-$(CONFIG_KEYS) += keys/ # always enable default capabilities @@ -27,3 +28,13 @@ obj-$(CONFIG_SECURITY_LANDLOCK) += landlock/ # Object integrity file lists obj-$(CONFIG_INTEGRITY) += integrity/ + +$(addprefix $(obj)/,$(obj-y)): $(gen)/lsm_count.h + +quiet_cmd_lsm_count = GEN ${gen}/lsm_count.h + cmd_lsm_count = scripts/security/gen_lsm_count ${gen}/lsm_count.h + +targets += lsm_count.h + +${gen}/lsm_count.h: FORCE + $(call if_changed,lsm_count)
The header defines a MAX_LSM_COUNT constant which is used in a subsequent patch to generate the static calls for each LSM hook which are named using preprocessor token pasting. Since token pasting does not work with arithmetic expressions, generate a simple lsm_count.h header which represents the subset of LSMs that can be enabled on a given kernel based on the config. While one can generate static calls for all the possible LSMs that the kernel has, this is actually wasteful as most kernels only enable a handful of LSMs. Signed-off-by: KP Singh <kpsingh@kernel.org> --- scripts/Makefile | 1 + scripts/security/.gitignore | 1 + scripts/security/Makefile | 4 +++ scripts/security/gen_lsm_count.c | 57 ++++++++++++++++++++++++++++++++ security/Makefile | 11 ++++++ 5 files changed, 74 insertions(+) create mode 100644 scripts/security/.gitignore create mode 100644 scripts/security/Makefile create mode 100644 scripts/security/gen_lsm_count.c