diff mbox series

[UBUNTU,OEM-6.0,1/1] UBUNTU: SAUCE: LSM: Change Landlock from LSMBLOB_NEEDED to LSMBLOB_NOT_NEEDED

Message ID 20230209193539.597030-2-cascardo@canonical.com
State New
Headers show
Series LP: #1987998 | expand

Commit Message

Thadeu Lima de Souza Cascardo Feb. 9, 2023, 7:35 p.m. UTC 
From: Matthew Ruffell <matthew.ruffell@canonical.com>

BugLink: https://bugs.launchpad.net/bugs/1987998

The Landlock LSM does not register any hooks which use struct lsmblob, and does
not require a slot in the secid array of struct lsmblob.

Change LSMBLOB_NEEDED to LSMBLOB_NOT_NEEDED.

This is required to fix a panic on boot where too many LSMs can be configured,
since while we currently mark Landlock as LSMBLOB_NEEDED, we do not actually
make LSMBLOB_ENTRIES large enough to fit it, and we panic when more than 2
LSMs are configured, like:

GRUB_CMDLINE_LINUX_DEFAULT="lsm=landlock,bpf,apparmor"

LSM: Security Framework initializing
landlock: Up and running.
LSM support for eBPF active
Kernel panic - not syncing: security_add_hooks Too many LSMs registered.
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.15.0-46-generic #49-Ubuntu
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
Call Trace:
 <TASK>
 show_stack+0x52/0x5c
 dump_stack_lvl+0x4a/0x63
 dump_stack+0x10/0x16
 panic+0x149/0x321
 security_add_hooks+0x45/0x13a
 apparmor_init+0x189/0x1ef
 initialize_lsm+0x54/0x74
 ordered_lsm_init+0x379/0x392
 security_init+0x40/0x49
 start_kernel+0x466/0x4dc
 x86_64_start_reservations+0x24/0x2a
 x86_64_start_kernel+0xe4/0xef
 secondary_startup_64_no_verify+0xc2/0xcb
 </TASK>
---[ end Kernel panic - not syncing: security_add_hooks Too many LSMs registered. ]---

Also refactor the Landlock support by going to just one struct lsm_id, and
extern it from setup.h, following upstream development.

Fixes: f17b27a2790e ("UBUNTU: SAUCE: LSM: Create and manage the lsmblob data structure.") ubuntu-jammy
Signed-off-by: Matthew Ruffell <matthew.ruffell@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Andrea Righi <andrea.righi@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
---
 security/landlock/cred.c   | 5 -----
 security/landlock/fs.c     | 5 -----
 security/landlock/ptrace.c | 5 -----
 security/landlock/setup.c  | 5 +++++
 security/landlock/setup.h  | 1 +
 5 files changed, 6 insertions(+), 15 deletions(-)
diff mbox series

Patch

diff --git a/security/landlock/cred.c b/security/landlock/cred.c
index fa20865f4f8e..c4c47c6889f6 100644
--- a/security/landlock/cred.c
+++ b/security/landlock/cred.c
@@ -14,11 +14,6 @@ 
 #include "ruleset.h"
 #include "setup.h"
 
-static struct lsm_id landlock_lsmid __lsm_ro_after_init = {
-	.lsm  = "landlock",
-	.slot = LSMBLOB_NEEDED
-};
-
 static int hook_cred_prepare(struct cred *const new,
 			     const struct cred *const old, const gfp_t gfp)
 {
diff --git a/security/landlock/fs.c b/security/landlock/fs.c
index e71354998361..4b368fa3138e 100644
--- a/security/landlock/fs.c
+++ b/security/landlock/fs.c
@@ -38,11 +38,6 @@ 
 #include "ruleset.h"
 #include "setup.h"
 
-static struct lsm_id landlock_lsmid __lsm_ro_after_init = {
-	.lsm  = "landlock",
-	.slot = LSMBLOB_NEEDED
-};
-
 /* Underlying object management */
 
 static void release_inode(struct landlock_object *const object)
diff --git a/security/landlock/ptrace.c b/security/landlock/ptrace.c
index d22af4973ef8..7443b35f66e6 100644
--- a/security/landlock/ptrace.c
+++ b/security/landlock/ptrace.c
@@ -20,11 +20,6 @@ 
 #include "ruleset.h"
 #include "setup.h"
 
-static struct lsm_id landlock_lsmid __lsm_ro_after_init = {
-       .lsm  = "landlock",
-       .slot = LSMBLOB_NEEDED
-};
-
 /**
  * domain_scope_le - Checks domain ordering for scoped ptrace
  *
diff --git a/security/landlock/setup.c b/security/landlock/setup.c
index f8e8e980454c..759e00b9436c 100644
--- a/security/landlock/setup.c
+++ b/security/landlock/setup.c
@@ -23,6 +23,11 @@  struct lsm_blob_sizes landlock_blob_sizes __lsm_ro_after_init = {
 	.lbs_superblock = sizeof(struct landlock_superblock_security),
 };
 
+struct lsm_id landlock_lsmid __lsm_ro_after_init = {
+	.lsm = LANDLOCK_NAME,
+	.slot = LSMBLOB_NOT_NEEDED,
+};
+
 static int __init landlock_init(void)
 {
 	landlock_add_cred_hooks();
diff --git a/security/landlock/setup.h b/security/landlock/setup.h
index 1daffab1ab4b..38bce5b172dc 100644
--- a/security/landlock/setup.h
+++ b/security/landlock/setup.h
@@ -14,5 +14,6 @@ 
 extern bool landlock_initialized;
 
 extern struct lsm_blob_sizes landlock_blob_sizes;
+extern struct lsm_id landlock_lsmid;
 
 #endif /* _SECURITY_LANDLOCK_SETUP_H */