selinux: move initcalls to the LSM framework

SELinux currently has a number of initcalls so we've created a new
function, selinux_initcall(), which wraps all of these initcalls so
that we have a single initcall function that can be registered with the
LSM framework.

Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/security/selinux/Makefile b/security/selinux/Makefile
index 66e56e9011dfa4474ac51f00c7595946785273fe..72d3baf7900cfb2e169c8bc4eedbda58cf7b6e3e 100644 (file)
--- a/security/selinux/Makefile
+++ b/security/selinux/Makefile
@@ -15,7 +15,7 @@ ccflags-y := -I$(srctree)/security/selinux -I$(srctree)/security/selinux/include
 ccflags-$(CONFIG_SECURITY_SELINUX_DEBUG) += -DDEBUG
 
 selinux-y := avc.o hooks.o selinuxfs.o netlink.o nlmsgtab.o netif.o \
-            netnode.o netport.o status.o \
+            netnode.o netport.o status.o initcalls.o \
             ss/ebitmap.o ss/hashtab.o ss/symtab.o ss/sidtab.o ss/avtab.o \
             ss/policydb.o ss/services.o ss/conditional.o ss/mls.o ss/context.o
 

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 299b656ac00777f60a37c9384e36fe458edc0421..cd5f6974f9e6187bbf2a6a3e2bef9d9139fab985 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -94,6 +94,7 @@
 #include <linux/io_uring/cmd.h>
 #include <uapi/linux/lsm.h>
 
+#include "initcalls.h"
 #include "avc.h"
 #include "objsec.h"
 #include "netif.h"
@@ -7612,6 +7613,10 @@ static __init int selinux_init(void)
        if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
                panic("SELinux: Unable to register AVC LSM notifier callback\n");
 
+       if (avc_add_callback(selinux_audit_rule_avc_callback,
+                            AVC_CALLBACK_RESET))
+               panic("SELinux: Unable to register AVC audit callback\n");
+
        if (selinux_enforcing_boot)
                pr_debug("SELinux:  Starting in enforcing mode\n");
        else
@@ -7644,6 +7649,7 @@ DEFINE_LSM(selinux) = {
        .enabled = &selinux_enabled_boot,
        .blobs = &selinux_blob_sizes,
        .init = selinux_init,
+       .initcall_device = selinux_initcall,
 };
 
 #if defined(CONFIG_NETFILTER)
@@ -7705,7 +7711,7 @@ static struct pernet_operations selinux_net_ops = {
        .exit = selinux_nf_unregister,
 };
 
-static int __init selinux_nf_ip_init(void)
+int __init selinux_nf_ip_init(void)
 {
        int err;
 
@@ -7720,5 +7726,4 @@ static int __init selinux_nf_ip_init(void)
 
        return 0;
 }
-__initcall(selinux_nf_ip_init);
 #endif /* CONFIG_NETFILTER */

diff --git a/security/selinux/ibpkey.c b/security/selinux/ibpkey.c
index 470481cfe0e81142e5d0afa28c11b5b91718fb5a..ea1d9b2c7d2ba4b8098a3022ec32dc23666e9259 100644 (file)
--- a/security/selinux/ibpkey.c
+++ b/security/selinux/ibpkey.c
@@ -23,6 +23,7 @@
 #include <linux/list.h>
 #include <linux/spinlock.h>
 
+#include "initcalls.h"
 #include "ibpkey.h"
 #include "objsec.h"
 
@@ -218,7 +219,7 @@ void sel_ib_pkey_flush(void)
        spin_unlock_irqrestore(&sel_ib_pkey_lock, flags);
 }
 
-static __init int sel_ib_pkey_init(void)
+int __init sel_ib_pkey_init(void)
 {
        int iter;
 
@@ -232,5 +233,3 @@ static __init int sel_ib_pkey_init(void)
 
        return 0;
 }
-
-subsys_initcall(sel_ib_pkey_init);

diff --git a/security/selinux/include/audit.h b/security/selinux/include/audit.h
index d5b0425055e4249fbdde0a4fc27d18f55104bcab..85a531ac737ba4d0ec101cd57388094b48b50e49 100644 (file)
--- a/security/selinux/include/audit.h
+++ b/security/selinux/include/audit.h
@@ -15,6 +15,15 @@
 #include <linux/audit.h>
 #include <linux/types.h>
 
+/**
+ * selinux_audit_rule_avc_callback - update the audit LSM rules on AVC events.
+ * @event: the AVC event
+ *
+ * Update any audit LSM rules based on the AVC event specified in @event.
+ * Returns 0 on success, negative values otherwise.
+ */
+int selinux_audit_rule_avc_callback(u32 event);
+
 /**
  * selinux_audit_rule_init - alloc/init an selinux audit rule structure.
  * @field: the field this rule refers to

diff --git a/security/selinux/include/initcalls.h b/security/selinux/include/initcalls.h
new file mode 100644 (file)
index 0000000..6674cf4
--- /dev/null
+++ b/security/selinux/include/initcalls.h
@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * SELinux initcalls
+ */
+
+#ifndef _SELINUX_INITCALLS_H
+#define _SELINUX_INITCALLS_H
+
+int init_sel_fs(void);
+int sel_netport_init(void);
+int sel_netnode_init(void);
+int sel_netif_init(void);
+int sel_netlink_init(void);
+int sel_ib_pkey_init(void);
+int selinux_nf_ip_init(void);
+
+int selinux_initcall(void);
+
+#endif

diff --git a/security/selinux/initcalls.c b/security/selinux/initcalls.c
new file mode 100644 (file)
index 0000000..f6716a1
--- /dev/null
+++ b/security/selinux/initcalls.c
@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * SELinux initcalls
+ */
+
+#include <linux/init.h>
+
+#include "initcalls.h"
+
+/**
+ * selinux_initcall - Perform the SELinux initcalls
+ *
+ * Used as a device initcall in the SELinux LSM definition.
+ */
+int __init selinux_initcall(void)
+{
+       int rc = 0, rc_tmp = 0;
+
+       rc_tmp = init_sel_fs();
+       if (!rc && rc_tmp)
+               rc = rc_tmp;
+
+       rc_tmp = sel_netport_init();
+       if (!rc && rc_tmp)
+               rc = rc_tmp;
+
+       rc_tmp = sel_netnode_init();
+       if (!rc && rc_tmp)
+               rc = rc_tmp;
+
+       rc_tmp = sel_netif_init();
+       if (!rc && rc_tmp)
+               rc = rc_tmp;
+
+       rc_tmp = sel_netlink_init();
+       if (!rc && rc_tmp)
+               rc = rc_tmp;
+
+#if defined(CONFIG_SECURITY_INFINIBAND)
+       rc_tmp = sel_ib_pkey_init();
+       if (!rc && rc_tmp)
+               rc = rc_tmp;
+#endif
+
+#if defined(CONFIG_NETFILTER)
+       rc_tmp = selinux_nf_ip_init();
+       if (!rc && rc_tmp)
+               rc = rc_tmp;
+#endif
+
+       return rc;
+}

diff --git a/security/selinux/netif.c b/security/selinux/netif.c
index 78afbecdbe57c80e5d86c618269b57e87a8cab4f..e24b2cba28ea2e3261452cc04d104f5f6539e1d6 100644 (file)
--- a/security/selinux/netif.c
+++ b/security/selinux/netif.c
@@ -22,6 +22,7 @@
 #include <linux/rcupdate.h>
 #include <net/net_namespace.h>
 
+#include "initcalls.h"
 #include "security.h"
 #include "objsec.h"
 #include "netif.h"
@@ -265,7 +266,7 @@ static struct notifier_block sel_netif_netdev_notifier = {
        .notifier_call = sel_netif_netdev_notifier_handler,
 };
 
-static __init int sel_netif_init(void)
+int __init sel_netif_init(void)
 {
        int i;
 
@@ -280,5 +281,3 @@ static __init int sel_netif_init(void)
        return 0;
 }
 
-__initcall(sel_netif_init);
-

diff --git a/security/selinux/netlink.c b/security/selinux/netlink.c
index 1760aee712fd2ef4ed805d6f0a9edffedd547e58..eb40e460347525e674e2d03675c0888d0399d639 100644 (file)
--- a/security/selinux/netlink.c
+++ b/security/selinux/netlink.c
@@ -17,6 +17,7 @@
 #include <net/net_namespace.h>
 #include <net/netlink.h>
 
+#include "initcalls.h"
 #include "security.h"
 
 static struct sock *selnl __ro_after_init;
@@ -105,7 +106,7 @@ void selnl_notify_policyload(u32 seqno)
        selnl_notify(SELNL_MSG_POLICYLOAD, &seqno);
 }
 
-static int __init selnl_init(void)
+int __init sel_netlink_init(void)
 {
        struct netlink_kernel_cfg cfg = {
                .groups = SELNLGRP_MAX,
@@ -117,5 +118,3 @@ static int __init selnl_init(void)
                panic("SELinux:  Cannot create netlink socket.");
        return 0;
 }
-
-__initcall(selnl_init);

diff --git a/security/selinux/netnode.c b/security/selinux/netnode.c
index 5d0ed08d46e5ea81ff191d22dff9974e4824add4..9b3da5ce8d3939f94c471fd09bfbc214372bd7da 100644 (file)
--- a/security/selinux/netnode.c
+++ b/security/selinux/netnode.c
@@ -30,6 +30,7 @@
 #include <net/ip.h>
 #include <net/ipv6.h>
 
+#include "initcalls.h"
 #include "netnode.h"
 #include "objsec.h"
 
@@ -290,7 +291,7 @@ void sel_netnode_flush(void)
        spin_unlock_bh(&sel_netnode_lock);
 }
 
-static __init int sel_netnode_init(void)
+int __init sel_netnode_init(void)
 {
        int iter;
 
@@ -304,5 +305,3 @@ static __init int sel_netnode_init(void)
 
        return 0;
 }
-
-__initcall(sel_netnode_init);

diff --git a/security/selinux/netport.c b/security/selinux/netport.c
index 6fd7da4b35763084c4d98be25279ce71bed3e985..9e62f7285e81ba698836bbfa58ab8b6e645dc11a 100644 (file)
--- a/security/selinux/netport.c
+++ b/security/selinux/netport.c
@@ -29,6 +29,7 @@
 #include <net/ip.h>
 #include <net/ipv6.h>
 
+#include "initcalls.h"
 #include "netport.h"
 #include "objsec.h"
 
@@ -218,7 +219,7 @@ void sel_netport_flush(void)
        spin_unlock_bh(&sel_netport_lock);
 }
 
-static __init int sel_netport_init(void)
+int __init sel_netport_init(void)
 {
        int iter;
 
@@ -232,5 +233,3 @@ static __init int sel_netport_init(void)
 
        return 0;
 }
-
-__initcall(sel_netport_init);

diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 232e087bce3eeafe9f3ee03999bf6ca9e74f973d..93ea27acbfef76e39d3f7d9654a13017b0891cab 100644 (file)
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -35,6 +35,7 @@
 /* selinuxfs pseudo filesystem for exporting the security policy API.
    Based on the proc code and the fs/nfsd/nfsctl.c code. */
 
+#include "initcalls.h"
 #include "flask.h"
 #include "avc.h"
 #include "avc_ss.h"
@@ -2122,7 +2123,7 @@ static struct file_system_type sel_fs_type = {
 
 struct path selinux_null __ro_after_init;
 
-static int __init init_sel_fs(void)
+int __init init_sel_fs(void)
 {
        struct qstr null_name = QSTR_INIT(NULL_FILE_NAME,
                                          sizeof(NULL_FILE_NAME)-1);
@@ -2166,5 +2167,3 @@ static int __init init_sel_fs(void)
 
        return err;
 }
-
-__initcall(init_sel_fs);

diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 713130bd43c474d9f928923cabcaa89c0e8513a1..13fc712d59231fc299bb309362679560ce75669c 100644 (file)
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -3570,6 +3570,13 @@ struct selinux_audit_rule {
        struct context au_ctxt;
 };
 
+int selinux_audit_rule_avc_callback(u32 event)
+{
+       if (event == AVC_CALLBACK_RESET)
+               return audit_update_lsm_rules();
+       return 0;
+}
+
 void selinux_audit_rule_free(void *vrule)
 {
        struct selinux_audit_rule *rule = vrule;
@@ -3820,25 +3827,6 @@ int selinux_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op, void *vru
        return match;
 }
 
-static int aurule_avc_callback(u32 event)
-{
-       if (event == AVC_CALLBACK_RESET)
-               return audit_update_lsm_rules();
-       return 0;
-}
-
-static int __init aurule_init(void)
-{
-       int err;
-
-       err = avc_add_callback(aurule_avc_callback, AVC_CALLBACK_RESET);
-       if (err)
-               panic("avc_add_callback() failed, error %d\n", err);
-
-       return err;
-}
-__initcall(aurule_init);
-
 #ifdef CONFIG_NETLABEL
 /**
  * security_netlbl_cache_add - Add an entry to the NetLabel cache