Commit d117a154 authored Sep 14, 2018 by Kees Cook

capability: Initialize as LSM_ORDER_FIRST



This converts capabilities to use the new LSM_ORDER_FIRST position.

Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>

parent e2bc445b

include/linux/lsm_hooks.h

+0 −2

Original line number	Diff line number	Diff line
		@@ -2095,6 +2095,4 @@ static inline void security_delete_hooks(struct security_hook_list *hooks,
		#define __lsm_ro_after_init __ro_after_init
		#endif /* CONFIG_SECURITY_WRITABLE_HOOKS */

		extern void __init capability_add_hooks(void);

		#endif /* ! __LINUX_LSM_HOOKS_H */

security/commoncap.c

+8 −1

Original line number	Diff line number	Diff line
		@@ -1362,10 +1362,17 @@ struct security_hook_list capability_hooks[] __lsm_ro_after_init = {
		LSM_HOOK_INIT(vm_enough_memory, cap_vm_enough_memory),
		};

		void __init capability_add_hooks(void)
		static int __init capability_init(void)
		{
		security_add_hooks(capability_hooks, ARRAY_SIZE(capability_hooks),
		"capability");
		return 0;
		}

		DEFINE_LSM(capability) = {
		.name = "capability",
		.order = LSM_ORDER_FIRST,
		.init = capability_init,
		};

		#endif /* CONFIG_SECURITY */

security/security.c

+0 −5

Original line number	Diff line number	Diff line
		@@ -277,11 +277,6 @@ int __init security_init(void)
		i++)
		INIT_HLIST_HEAD(&list[i]);

		/*
		* Load minor LSMs, with the capability module always first.
		*/
		capability_add_hooks();

		/* Load LSMs in specified order. */
		ordered_lsm_init();