| Message ID | 20180925001832.18322-7-keescook@chromium.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | LSM: Explict LSM ordering | expand |
On 09/24/2018 05:18 PM, Kees Cook wrote: > Since the struct lsm_info table is not an initcall, we can just move it > into INIT_DATA like all the other tables. > > Cc: linux-arch@vger.kernel.org > Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: John Johansen <john.johansen@canonical.com> > --- > arch/arc/kernel/vmlinux.lds.S | 1 - > arch/arm/kernel/vmlinux-xip.lds.S | 1 - > arch/arm64/kernel/vmlinux.lds.S | 1 - > arch/h8300/kernel/vmlinux.lds.S | 1 - > arch/microblaze/kernel/vmlinux.lds.S | 2 -- > arch/powerpc/kernel/vmlinux.lds.S | 2 -- > arch/um/include/asm/common.lds.S | 2 -- > arch/xtensa/kernel/vmlinux.lds.S | 1 - > include/asm-generic/vmlinux.lds.h | 24 +++++++++++------------- > 9 files changed, 11 insertions(+), 24 deletions(-) > > diff --git a/arch/arc/kernel/vmlinux.lds.S b/arch/arc/kernel/vmlinux.lds.S > index f35ed578e007..8fb16bdabdcf 100644 > --- a/arch/arc/kernel/vmlinux.lds.S > +++ b/arch/arc/kernel/vmlinux.lds.S > @@ -71,7 +71,6 @@ SECTIONS > INIT_SETUP(L1_CACHE_BYTES) > INIT_CALLS > CON_INITCALL > - SECURITY_INITCALL > } > > .init.arch.info : { > diff --git a/arch/arm/kernel/vmlinux-xip.lds.S b/arch/arm/kernel/vmlinux-xip.lds.S > index 3593d5c1acd2..8c74037ade22 100644 > --- a/arch/arm/kernel/vmlinux-xip.lds.S > +++ b/arch/arm/kernel/vmlinux-xip.lds.S > @@ -96,7 +96,6 @@ SECTIONS > INIT_SETUP(16) > INIT_CALLS > CON_INITCALL > - SECURITY_INITCALL > INIT_RAM_FS > } > > diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S > index 605d1b60469c..7d23d591b03c 100644 > --- a/arch/arm64/kernel/vmlinux.lds.S > +++ b/arch/arm64/kernel/vmlinux.lds.S > @@ -166,7 +166,6 @@ SECTIONS > INIT_SETUP(16) > INIT_CALLS > CON_INITCALL > - SECURITY_INITCALL > INIT_RAM_FS > *(.init.rodata.* .init.bss) /* from the EFI stub */ > } > diff --git a/arch/h8300/kernel/vmlinux.lds.S b/arch/h8300/kernel/vmlinux.lds.S > index 35716a3048de..49f716c0a1df 100644 > --- a/arch/h8300/kernel/vmlinux.lds.S > +++ b/arch/h8300/kernel/vmlinux.lds.S > @@ -56,7 +56,6 @@ SECTIONS > __init_begin = .; > INIT_TEXT_SECTION(4) > INIT_DATA_SECTION(4) > - SECURITY_INIT > __init_end = .; > _edata = . ; > _begin_data = LOADADDR(.data); > diff --git a/arch/microblaze/kernel/vmlinux.lds.S b/arch/microblaze/kernel/vmlinux.lds.S > index 289d0e7f3e3a..e1f3e8741292 100644 > --- a/arch/microblaze/kernel/vmlinux.lds.S > +++ b/arch/microblaze/kernel/vmlinux.lds.S > @@ -117,8 +117,6 @@ SECTIONS { > CON_INITCALL > } > > - SECURITY_INIT > - > __init_end_before_initramfs = .; > > .init.ramfs : AT(ADDR(.init.ramfs) - LOAD_OFFSET) { > diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S > index 07ae018e550e..105a976323aa 100644 > --- a/arch/powerpc/kernel/vmlinux.lds.S > +++ b/arch/powerpc/kernel/vmlinux.lds.S > @@ -212,8 +212,6 @@ SECTIONS > CON_INITCALL > } > > - SECURITY_INIT > - > . = ALIGN(8); > __ftr_fixup : AT(ADDR(__ftr_fixup) - LOAD_OFFSET) { > __start___ftr_fixup = .; > diff --git a/arch/um/include/asm/common.lds.S b/arch/um/include/asm/common.lds.S > index 7adb4e6b658a..4049f2c46387 100644 > --- a/arch/um/include/asm/common.lds.S > +++ b/arch/um/include/asm/common.lds.S > @@ -53,8 +53,6 @@ > CON_INITCALL > } > > - SECURITY_INIT > - > .exitcall : { > __exitcall_begin = .; > *(.exitcall.exit) > diff --git a/arch/xtensa/kernel/vmlinux.lds.S b/arch/xtensa/kernel/vmlinux.lds.S > index a1c3edb8ad56..b727b18a68ac 100644 > --- a/arch/xtensa/kernel/vmlinux.lds.S > +++ b/arch/xtensa/kernel/vmlinux.lds.S > @@ -197,7 +197,6 @@ SECTIONS > INIT_SETUP(XCHAL_ICACHE_LINESIZE) > INIT_CALLS > CON_INITCALL > - SECURITY_INITCALL > INIT_RAM_FS > } > > diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h > index 5079a969e612..b31ea8bdfef9 100644 > --- a/include/asm-generic/vmlinux.lds.h > +++ b/include/asm-generic/vmlinux.lds.h > @@ -203,6 +203,15 @@ > #define EARLYCON_TABLE() > #endif > > +#ifdef CONFIG_SECURITY > +#define LSM_TABLE() . = ALIGN(8); \ > + __start_lsm_info = .; \ > + KEEP(*(.lsm_info.init)) \ > + __end_lsm_info = .; > +#else > +#define LSM_TABLE() > +#endif > + > #define ___OF_TABLE(cfg, name) _OF_TABLE_##cfg(name) > #define __OF_TABLE(cfg, name) ___OF_TABLE(cfg, name) > #define OF_TABLE(cfg, name) __OF_TABLE(IS_ENABLED(cfg), name) > @@ -597,7 +606,8 @@ > IRQCHIP_OF_MATCH_TABLE() \ > ACPI_PROBE_TABLE(irqchip) \ > ACPI_PROBE_TABLE(timer) \ > - EARLYCON_TABLE() > + EARLYCON_TABLE() \ > + LSM_TABLE() > > #define INIT_TEXT \ > *(.init.text .init.text.*) \ > @@ -786,17 +796,6 @@ > KEEP(*(.con_initcall.init)) \ > __con_initcall_end = .; > > -#define SECURITY_INITCALL \ > - __start_lsm_info = .; \ > - KEEP(*(.lsm_info.init)) \ > - __end_lsm_info = .; > - > -/* Older linker script style for security init. */ > -#define SECURITY_INIT \ > - .lsm_info.init : AT(ADDR(.lsm_info.init) - LOAD_OFFSET) { \ > - LSM_INFO \ > - } > - > #ifdef CONFIG_BLK_DEV_INITRD > #define INIT_RAM_FS \ > . = ALIGN(4); \ > @@ -963,7 +962,6 @@ > INIT_SETUP(initsetup_align) \ > INIT_CALLS \ > CON_INITCALL \ > - SECURITY_INITCALL \ > INIT_RAM_FS \ > } > >
diff --git a/arch/arc/kernel/vmlinux.lds.S b/arch/arc/kernel/vmlinux.lds.S index f35ed578e007..8fb16bdabdcf 100644 --- a/arch/arc/kernel/vmlinux.lds.S +++ b/arch/arc/kernel/vmlinux.lds.S @@ -71,7 +71,6 @@ SECTIONS INIT_SETUP(L1_CACHE_BYTES) INIT_CALLS CON_INITCALL - SECURITY_INITCALL } .init.arch.info : { diff --git a/arch/arm/kernel/vmlinux-xip.lds.S b/arch/arm/kernel/vmlinux-xip.lds.S index 3593d5c1acd2..8c74037ade22 100644 --- a/arch/arm/kernel/vmlinux-xip.lds.S +++ b/arch/arm/kernel/vmlinux-xip.lds.S @@ -96,7 +96,6 @@ SECTIONS INIT_SETUP(16) INIT_CALLS CON_INITCALL - SECURITY_INITCALL INIT_RAM_FS } diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S index 605d1b60469c..7d23d591b03c 100644 --- a/arch/arm64/kernel/vmlinux.lds.S +++ b/arch/arm64/kernel/vmlinux.lds.S @@ -166,7 +166,6 @@ SECTIONS INIT_SETUP(16) INIT_CALLS CON_INITCALL - SECURITY_INITCALL INIT_RAM_FS *(.init.rodata.* .init.bss) /* from the EFI stub */ } diff --git a/arch/h8300/kernel/vmlinux.lds.S b/arch/h8300/kernel/vmlinux.lds.S index 35716a3048de..49f716c0a1df 100644 --- a/arch/h8300/kernel/vmlinux.lds.S +++ b/arch/h8300/kernel/vmlinux.lds.S @@ -56,7 +56,6 @@ SECTIONS __init_begin = .; INIT_TEXT_SECTION(4) INIT_DATA_SECTION(4) - SECURITY_INIT __init_end = .; _edata = . ; _begin_data = LOADADDR(.data); diff --git a/arch/microblaze/kernel/vmlinux.lds.S b/arch/microblaze/kernel/vmlinux.lds.S index 289d0e7f3e3a..e1f3e8741292 100644 --- a/arch/microblaze/kernel/vmlinux.lds.S +++ b/arch/microblaze/kernel/vmlinux.lds.S @@ -117,8 +117,6 @@ SECTIONS { CON_INITCALL } - SECURITY_INIT - __init_end_before_initramfs = .; .init.ramfs : AT(ADDR(.init.ramfs) - LOAD_OFFSET) { diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S index 07ae018e550e..105a976323aa 100644 --- a/arch/powerpc/kernel/vmlinux.lds.S +++ b/arch/powerpc/kernel/vmlinux.lds.S @@ -212,8 +212,6 @@ SECTIONS CON_INITCALL } - SECURITY_INIT - . = ALIGN(8); __ftr_fixup : AT(ADDR(__ftr_fixup) - LOAD_OFFSET) { __start___ftr_fixup = .; diff --git a/arch/um/include/asm/common.lds.S b/arch/um/include/asm/common.lds.S index 7adb4e6b658a..4049f2c46387 100644 --- a/arch/um/include/asm/common.lds.S +++ b/arch/um/include/asm/common.lds.S @@ -53,8 +53,6 @@ CON_INITCALL } - SECURITY_INIT - .exitcall : { __exitcall_begin = .; *(.exitcall.exit) diff --git a/arch/xtensa/kernel/vmlinux.lds.S b/arch/xtensa/kernel/vmlinux.lds.S index a1c3edb8ad56..b727b18a68ac 100644 --- a/arch/xtensa/kernel/vmlinux.lds.S +++ b/arch/xtensa/kernel/vmlinux.lds.S @@ -197,7 +197,6 @@ SECTIONS INIT_SETUP(XCHAL_ICACHE_LINESIZE) INIT_CALLS CON_INITCALL - SECURITY_INITCALL INIT_RAM_FS } diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h index 5079a969e612..b31ea8bdfef9 100644 --- a/include/asm-generic/vmlinux.lds.h +++ b/include/asm-generic/vmlinux.lds.h @@ -203,6 +203,15 @@ #define EARLYCON_TABLE() #endif +#ifdef CONFIG_SECURITY +#define LSM_TABLE() . = ALIGN(8); \ + __start_lsm_info = .; \ + KEEP(*(.lsm_info.init)) \ + __end_lsm_info = .; +#else +#define LSM_TABLE() +#endif + #define ___OF_TABLE(cfg, name) _OF_TABLE_##cfg(name) #define __OF_TABLE(cfg, name) ___OF_TABLE(cfg, name) #define OF_TABLE(cfg, name) __OF_TABLE(IS_ENABLED(cfg), name) @@ -597,7 +606,8 @@ IRQCHIP_OF_MATCH_TABLE() \ ACPI_PROBE_TABLE(irqchip) \ ACPI_PROBE_TABLE(timer) \ - EARLYCON_TABLE() + EARLYCON_TABLE() \ + LSM_TABLE() #define INIT_TEXT \ *(.init.text .init.text.*) \ @@ -786,17 +796,6 @@ KEEP(*(.con_initcall.init)) \ __con_initcall_end = .; -#define SECURITY_INITCALL \ - __start_lsm_info = .; \ - KEEP(*(.lsm_info.init)) \ - __end_lsm_info = .; - -/* Older linker script style for security init. */ -#define SECURITY_INIT \ - .lsm_info.init : AT(ADDR(.lsm_info.init) - LOAD_OFFSET) { \ - LSM_INFO \ - } - #ifdef CONFIG_BLK_DEV_INITRD #define INIT_RAM_FS \ . = ALIGN(4); \ @@ -963,7 +962,6 @@ INIT_SETUP(initsetup_align) \ INIT_CALLS \ CON_INITCALL \ - SECURITY_INITCALL \ INIT_RAM_FS \ }
Since the struct lsm_info table is not an initcall, we can just move it into INIT_DATA like all the other tables. Cc: linux-arch@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> --- arch/arc/kernel/vmlinux.lds.S | 1 - arch/arm/kernel/vmlinux-xip.lds.S | 1 - arch/arm64/kernel/vmlinux.lds.S | 1 - arch/h8300/kernel/vmlinux.lds.S | 1 - arch/microblaze/kernel/vmlinux.lds.S | 2 -- arch/powerpc/kernel/vmlinux.lds.S | 2 -- arch/um/include/asm/common.lds.S | 2 -- arch/xtensa/kernel/vmlinux.lds.S | 1 - include/asm-generic/vmlinux.lds.h | 24 +++++++++++------------- 9 files changed, 11 insertions(+), 24 deletions(-)