From: Chris Wright <chris@wirex.com>
As discussed before, this allows for early initialization of security
modules when compiled statically into the kernel. The standard
do_initcalls is too late for complete coverage of all filesystems and
threads, for example.
arch/alpha/vmlinux.lds.S | 3 +++
arch/arm/vmlinux-armo.lds.in | 1 +
arch/arm/vmlinux-armv.lds.in | 1 +
arch/cris/vmlinux.lds.S | 7 ++++++-
arch/h8300/platform/h8300h/generic/rom.ld | 1 +
arch/i386/vmlinux.lds.S | 1 +
arch/ia64/vmlinux.lds.S | 4 ++++
arch/m68k/vmlinux-std.lds | 1 +
arch/m68k/vmlinux-sun3.lds | 1 +
arch/m68knommu/vmlinux.lds.S | 4 +---
arch/mips/vmlinux.lds.S | 1 +
arch/mips64/vmlinux.lds.S | 1 +
arch/parisc/vmlinux.lds.S | 1 +
arch/ppc/vmlinux.lds.S | 2 ++
arch/ppc64/vmlinux.lds.S | 1 +
arch/s390/vmlinux.lds.S | 1 +
arch/sh/vmlinux.lds.S | 1 +
arch/sparc/vmlinux.lds.S | 1 +
arch/sparc64/vmlinux.lds.S | 1 +
arch/x86_64/vmlinux.lds.S | 1 +
include/asm-generic/vmlinux.lds.h | 6 ++++++
include/linux/init.h | 6 ++++++
init/main.c | 2 +-
security/capability.c | 2 +-
security/root_plug.c | 2 +-
security/security.c | 13 ++++++++++++-
26 files changed, 58 insertions(+), 8 deletions(-)
diff -puN arch/alpha/vmlinux.lds.S~lsm-1-early-init arch/alpha/vmlinux.lds.S
--- 25/arch/alpha/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/arch/alpha/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700
@@ -74,6 +74,9 @@ SECTIONS
__con_initcall_end = .;
}
+ . = ALIGN(8);
+ SECURITY_INIT
+
. = ALIGN(64);
__per_cpu_start = .;
.data.percpu : { *(.data.percpu) }
diff -puN arch/arm/vmlinux-armo.lds.in~lsm-1-early-init arch/arm/vmlinux-armo.lds.in
--- 25/arch/arm/vmlinux-armo.lds.in~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/arch/arm/vmlinux-armo.lds.in 2003-06-13 00:54:01.000000000 -0700
@@ -43,6 +43,7 @@ SECTIONS
__con_initcall_start = .;
*(.con_initcall.init)
__con_initcall_end = .;
+ SECURITY_INIT
. = ALIGN(32768);
__init_end = .;
}
diff -puN arch/arm/vmlinux-armv.lds.in~lsm-1-early-init arch/arm/vmlinux-armv.lds.in
--- 25/arch/arm/vmlinux-armv.lds.in~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/arch/arm/vmlinux-armv.lds.in 2003-06-13 00:54:01.000000000 -0700
@@ -53,6 +53,7 @@ SECTIONS
__con_initcall_start = .;
*(.con_initcall.init)
__con_initcall_end = .;
+ SECURITY_INIT
. = ALIGN(32);
__initramfs_start = .;
usr/built-in.o(.init.ramfs)
diff -puN arch/cris/vmlinux.lds.S~lsm-1-early-init arch/cris/vmlinux.lds.S
--- 25/arch/cris/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/arch/cris/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700
@@ -74,7 +74,12 @@ SECTIONS
__con_initcall_start = .;
*(.con_initcall.init)
__con_initcall_end = .;
-
+ }
+ .security_initcall.init : {
+ __security_initcall_start = .;
+ *(.security_initcall.init)
+ __security_initcall_end = .;
+
/* We fill to the next page, so we can discard all init
pages without needing to consider what payload might be
appended to the kernel image. */
diff -puN arch/h8300/platform/h8300h/generic/rom.ld~lsm-1-early-init arch/h8300/platform/h8300h/generic/rom.ld
--- 25/arch/h8300/platform/h8300h/generic/rom.ld~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/arch/h8300/platform/h8300h/generic/rom.ld 2003-06-13 00:54:01.000000000 -0700
@@ -83,6 +83,7 @@ SECTIONS
___con_initcall_start = .;
*(.con_initcall.init)
___con_initcall_end = .;
+ SECURITY_INIT
. = ALIGN(4);
___initramfs_start = .;
*(.init.ramfs)
diff -puN arch/i386/vmlinux.lds.S~lsm-1-early-init arch/i386/vmlinux.lds.S
--- 25/arch/i386/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/arch/i386/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700
@@ -81,6 +81,7 @@ SECTIONS
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
+ SECURITY_INIT
. = ALIGN(4);
__alt_instructions = .;
.altinstructions : { *(.altinstructions) }
diff -puN arch/ia64/vmlinux.lds.S~lsm-1-early-init arch/ia64/vmlinux.lds.S
--- 25/arch/ia64/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/arch/ia64/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700
@@ -141,6 +141,10 @@ SECTIONS
.con_initcall.init : AT(ADDR(.con_initcall.init) - PAGE_OFFSET)
{ *(.con_initcall.init) }
__con_initcall_end = .;
+ __security_initcall_start = .;
+ .security_initcall.init : AT(ADDR(.security_initcall.init) - PAGE_OFFSET)
+ { *(.security_initcall.init) }
+ __security_initcall_end = .;
. = ALIGN(PAGE_SIZE);
__init_end = .;
diff -puN arch/m68knommu/vmlinux.lds.S~lsm-1-early-init arch/m68knommu/vmlinux.lds.S
--- 25/arch/m68knommu/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/arch/m68knommu/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700
@@ -277,9 +277,7 @@ SECTIONS {
__con_initcall_start = .;
*(.con_initcall.init)
__con_initcall_end = .;
- __security_initcall_start = .;
- *(.security_initcall.init)
- __security_initcall_end = .;
+ SECURITY_INIT
. = ALIGN(4);
__initramfs_start = .;
*(.init.ramfs)
diff -puN arch/m68k/vmlinux-std.lds~lsm-1-early-init arch/m68k/vmlinux-std.lds
--- 25/arch/m68k/vmlinux-std.lds~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/arch/m68k/vmlinux-std.lds 2003-06-13 00:54:01.000000000 -0700
@@ -67,6 +67,7 @@ SECTIONS
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
+ SECURITY_INIT
. = ALIGN(8192);
__initramfs_start = .;
.init.ramfs : { *(.init.ramfs) }
diff -puN arch/m68k/vmlinux-sun3.lds~lsm-1-early-init arch/m68k/vmlinux-sun3.lds
--- 25/arch/m68k/vmlinux-sun3.lds~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/arch/m68k/vmlinux-sun3.lds 2003-06-13 00:54:01.000000000 -0700
@@ -61,6 +61,7 @@ __init_begin = .;
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
+ SECURITY_INIT
. = ALIGN(8192);
__initramfs_start = .;
.init.ramfs : { *(.init.ramfs) }
diff -puN arch/mips64/vmlinux.lds.S~lsm-1-early-init arch/mips64/vmlinux.lds.S
--- 25/arch/mips64/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/arch/mips64/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700
@@ -53,6 +53,7 @@ SECTIONS
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
+ SECURITY_INIT
. = ALIGN(4096); /* Align double page for init_task_union */
__init_end = .;
diff -puN arch/mips/vmlinux.lds.S~lsm-1-early-init arch/mips/vmlinux.lds.S
--- 25/arch/mips/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/arch/mips/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700
@@ -54,6 +54,7 @@ SECTIONS
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
+ SECURITY_INIT
. = ALIGN(4096); /* Align double page for init_task_union */
__init_end = .;
diff -puN arch/parisc/vmlinux.lds.S~lsm-1-early-init arch/parisc/vmlinux.lds.S
--- 25/arch/parisc/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/arch/parisc/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700
@@ -80,6 +80,7 @@ SECTIONS
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
+ SECURITY_INIT
. = ALIGN(4096);
__initramfs_start = .;
.init.ramfs : { *(.init.ramfs) }
diff -puN arch/ppc64/vmlinux.lds.S~lsm-1-early-init arch/ppc64/vmlinux.lds.S
--- 25/arch/ppc64/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/arch/ppc64/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700
@@ -104,6 +104,7 @@ SECTIONS
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
+ SECURITY_INIT
. = ALIGN(4096);
__initramfs_start = .;
.init.ramfs : { *(.init.ramfs) }
diff -puN arch/ppc/vmlinux.lds.S~lsm-1-early-init arch/ppc/vmlinux.lds.S
--- 25/arch/ppc/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/arch/ppc/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700
@@ -119,6 +119,8 @@ SECTIONS
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
+ SECURITY_INIT
+
__start___ftr_fixup = .;
__ftr_fixup : { *(__ftr_fixup) }
__stop___ftr_fixup = .;
diff -puN arch/s390/vmlinux.lds.S~lsm-1-early-init arch/s390/vmlinux.lds.S
--- 25/arch/s390/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/arch/s390/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700
@@ -94,6 +94,7 @@ SECTIONS
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
+ SECURITY_INIT
. = ALIGN(256);
__initramfs_start = .;
.init.ramfs : { *(.init.initramfs) }
diff -puN arch/sh/vmlinux.lds.S~lsm-1-early-init arch/sh/vmlinux.lds.S
--- 25/arch/sh/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/arch/sh/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700
@@ -71,6 +71,7 @@ SECTIONS
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
+ SECURITY_INIT
__machvec_start = .;
.machvec.init : { *(.machvec.init) }
__machvec_end = .;
diff -puN arch/sparc64/vmlinux.lds.S~lsm-1-early-init arch/sparc64/vmlinux.lds.S
--- 25/arch/sparc64/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/arch/sparc64/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700
@@ -68,6 +68,7 @@ SECTIONS
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
+ SECURITY_INIT
. = ALIGN(8192);
__initramfs_start = .;
.init.ramfs : { *(.init.ramfs) }
diff -puN arch/sparc/vmlinux.lds.S~lsm-1-early-init arch/sparc/vmlinux.lds.S
--- 25/arch/sparc/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/arch/sparc/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700
@@ -62,6 +62,7 @@ SECTIONS
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
+ SECURITY_INIT
. = ALIGN(4096);
__initramfs_start = .;
.init.ramfs : { *(.init.ramfs) }
diff -puN arch/x86_64/vmlinux.lds.S~lsm-1-early-init arch/x86_64/vmlinux.lds.S
--- 25/arch/x86_64/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/arch/x86_64/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700
@@ -105,6 +105,7 @@ SECTIONS
__con_initcall_start = .;
.con_initcall.init : { *(.con_initcall.init) }
__con_initcall_end = .;
+ SECURITY_INIT
. = ALIGN(4096);
__initramfs_start = .;
.init.ramfs : { *(.init.ramfs) }
diff -puN include/asm-generic/vmlinux.lds.h~lsm-1-early-init include/asm-generic/vmlinux.lds.h
--- 25/include/asm-generic/vmlinux.lds.h~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/include/asm-generic/vmlinux.lds.h 2003-06-13 00:54:01.000000000 -0700
@@ -45,3 +45,9 @@
*(__ksymtab_strings) \
}
+#define SECURITY_INIT \
+ .security_initcall.init : { \
+ __security_initcall_start = .; \
+ *(.security_initcall.init) \
+ __security_initcall_end = .; \
+ }
diff -puN include/linux/init.h~lsm-1-early-init include/linux/init.h
--- 25/include/linux/init.h~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/include/linux/init.h 2003-06-13 00:54:01.000000000 -0700
@@ -64,6 +64,7 @@ typedef int (*initcall_t)(void);
typedef void (*exitcall_t)(void);
extern initcall_t __con_initcall_start, __con_initcall_end;
+extern initcall_t __security_initcall_start, __security_initcall_end;
#endif
#ifndef MODULE
@@ -96,6 +97,9 @@ extern initcall_t __con_initcall_start,
#define console_initcall(fn) \
static initcall_t __initcall_##fn __attribute__ ((unused,__section__ (".con_initcall.init")))=fn
+#define security_initcall(fn) \
+ static initcall_t __initcall_##fn __attribute__ ((unused,__section__ (".security_initcall.init"))) = fn
+
struct obs_kernel_param {
const char *str;
int (*setup_func)(char *);
@@ -143,6 +147,8 @@ struct obs_kernel_param {
#define device_initcall(fn) module_init(fn)
#define late_initcall(fn) module_init(fn)
+#define security_initcall(fn) module_init(fn)
+
/* These macros create a dummy inline: gcc 2.9x does not count alias
as usage, hence the `unused function' warning when __init functions
are declared static. We use the dummy __*_module_inline functions
diff -puN init/main.c~lsm-1-early-init init/main.c
--- 25/init/main.c~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/init/main.c 2003-06-13 00:54:01.000000000 -0700
@@ -439,8 +439,8 @@ asmlinkage void __init start_kernel(void
pte_chain_init();
fork_init(num_physpages);
proc_caches_init();
- security_scaffolding_startup();
buffer_init();
+ security_scaffolding_startup();
vfs_caches_init(num_physpages);
radix_tree_init();
signals_init();
diff -puN security/capability.c~lsm-1-early-init security/capability.c
--- 25/security/capability.c~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/security/capability.c 2003-06-13 00:54:01.000000000 -0700
@@ -348,7 +348,7 @@ static void __exit capability_exit (void
}
}
-module_init (capability_init);
+security_initcall (capability_init);
module_exit (capability_exit);
MODULE_DESCRIPTION("Standard Linux Capabilities Security Module");
diff -puN security/root_plug.c~lsm-1-early-init security/root_plug.c
--- 25/security/root_plug.c~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/security/root_plug.c 2003-06-13 00:54:01.000000000 -0700
@@ -135,7 +135,7 @@ static void __exit rootplug_exit (void)
printk (KERN_INFO "Root Plug module removed\n");
}
-module_init (rootplug_init);
+security_initcall (rootplug_init);
module_exit (rootplug_exit);
MODULE_DESCRIPTION("Root Plug sample LSM module, written for Linux Journal article");
diff -puN security/security.c~lsm-1-early-init security/security.c
--- 25/security/security.c~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700
+++ 25-akpm/security/security.c 2003-06-13 00:54:01.000000000 -0700
@@ -38,12 +38,22 @@ static inline int verify (struct securit
return 0;
}
+static void __init do_security_initcalls(void)
+{
+ initcall_t *call;
+ call = &__security_initcall_start;
+ while (call < &__security_initcall_end) {
+ (*call)();
+ call++;
+ }
+}
+
/**
* security_scaffolding_startup - initialzes the security scaffolding framework
*
* This should be called early in the kernel initialization sequence.
*/
-int security_scaffolding_startup (void)
+int __init security_scaffolding_startup (void)
{
printk (KERN_INFO "Security Scaffold v" SECURITY_SCAFFOLD_VERSION
" initialized\n");
@@ -55,6 +65,7 @@ int security_scaffolding_startup (void)
}
security_ops = &dummy_security_ops;
+ do_security_initcalls();
return 0;
}
_