From: "Ahmed S. Darwish" <darwish.07@gmail.com>
To: Casey Schaufler <casey@schaufler-ca.com>
Cc: LKML <linux-kernel@vger.kernel.org>,
Linus <torvalds@linux-foundation.org>
Subject: [PATCH BUGFIX -rc3] Smack: Don't register smackfs if we're not loaded
Date: Tue, 4 Mar 2008 15:10:55 +0200 [thread overview]
Message-ID: <20080304131055.GA25577@ubuntu> (raw)
Hi all,
Smackfs initialization without an enabled Smack leads to
an early Oops that renders the system unusable.
Introduce a global smack_enabled variable that will be used
to make sure that no smack components will be registered
(ala smackfs) if we are not already enabled.
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
---
The Oops is triggered by the security= patch that will be sent
soon.
I can't imagine an SELinux guru finding /smackfs instead of
his usual /selinuxfs when he hits a tab completion after 's' ;).
As a bonus, this patch will handle that case too.
smack.h | 9 +++++++++
smack_lsm.c | 8 ++++++++
smackfs.c | 3 +++
3 files changed, 20 insertions(+)
diff --git a/security/smack/smack.h b/security/smack/smack.h
index a21a0e9..17c55ad 100644
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -18,6 +18,15 @@
#include <net/netlabel.h>
/*
+ * We must not bother the rest of the kernel by exporting our
+ * own stuff if we are not already enabled. We may not be loaded
+ * if another or no LSM was chosen on boot.
+ * Smackfs is currently the only exported component, but this
+ * may change in the future.
+ */
+extern int smack_enabled;
+
+/*
* Why 23? CIPSO is constrained to 30, so a 32 byte buffer is
* bigger than can be used, and 24 is the next lower multiple
* of 8, and there are too many issues if there isn't space set
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 770eb06..6fe7869 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -36,6 +36,8 @@
#define SOCKFS_MAGIC 0x534F434B
#define TMPFS_MAGIC 0x01021994
+int smack_enabled;
+
/**
* smk_fetch - Fetch the smack label from a file.
* @ip: a pointer to the inode
@@ -2589,6 +2591,12 @@ static __init int smack_init(void)
if (register_security(&smack_ops))
panic("smack: Unable to register with kernel.\n");
+ /*
+ * Notify other Smack components that it's now safe to
+ * to register themselves.
+ */
+ smack_enabled = 1;
+
return 0;
}
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 358c92c..e1687c0 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -992,6 +992,9 @@ static int __init init_smk_fs(void)
{
int err;
+ if (!smack_enabled)
+ return 0;
+
err = register_filesystem(&smk_fs_type);
if (!err) {
smackfs_mount = kern_mount(&smk_fs_type);
--
"Better to light a candle, than curse the darkness"
Ahmed S. Darwish
Homepage: http://darwish.07.googlepages.com
Blog: http://darwish-07.blogspot.com
next reply other threads:[~2008-03-04 13:14 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-03-04 13:10 Ahmed S. Darwish [this message]
2008-03-04 13:58 ` [PATCH -rc3] Security: Introduce security= boot parameter Ahmed S. Darwish
2008-03-05 15:29 ` [PATCH -v7 " Ahmed S. Darwish
2008-03-05 16:33 ` Casey Schaufler
2008-03-05 16:55 ` Ahmed S. Darwish
2008-03-05 17:43 ` Casey Schaufler
2008-03-05 18:46 ` [PATCH -v7b " Ahmed S. Darwish
2008-03-04 17:21 ` [PATCH BUGFIX -rc3] Smack: Don't register smackfs if we're not loaded Linus Torvalds
2008-03-04 18:24 ` Ahmed S. Darwish
2008-03-04 16:42 Casey Schaufler
2008-03-04 17:45 Casey Schaufler
2008-03-04 18:12 ` Linus Torvalds
2008-03-05 0:58 ` James Morris
2008-03-05 12:12 ` Ahmed S. Darwish
2008-03-05 12:44 ` Ahmed S. Darwish
2008-03-05 12:51 ` Ahmed S. Darwish
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20080304131055.GA25577@ubuntu \
--to=darwish.07@gmail.com \
--cc=casey@schaufler-ca.com \
--cc=linux-kernel@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).