[RFC PATCH 06/29] lsm: cleanup and normalize the LSM order symbols naming

[John Johansen]

On 4/9/25 11:49, Paul Moore wrote:
> One part of a larger effort to cleanup the LSM framework initialization
> code.
> 
> Signed-off-by: Paul Moore <paul at paul-moore.com>

with the commit message updates already brought up, code looks good

Reviewed-by: John Johansen <john.johansen at canonical.com>

> ---
>   security/lsm_init.c | 88 +++++++++++++++++++++++++--------------------
>   1 file changed, 49 insertions(+), 39 deletions(-)
> 
> diff --git a/security/lsm_init.c b/security/lsm_init.c
> index d458a365b0d5..edf2f4140eaa 100644
> --- a/security/lsm_init.c
> +++ b/security/lsm_init.c
> @@ -16,14 +16,14 @@ char *lsm_names;
>   extern struct lsm_info __start_lsm_info[], __end_lsm_info[];
>   extern struct lsm_info __start_early_lsm_info[], __end_early_lsm_info[];
>   
> -/* Boot-time LSM user choice */
> -static __initconst const char *const builtin_lsm_order = CONFIG_LSM;
> -static __initdata const char *chosen_lsm_order;
> -static __initdata const char *chosen_major_lsm;
> +/* Build and boot-time LSM ordering. */
> +static __initconst const char *const lsm_order_builtin = CONFIG_LSM;
> +static __initdata const char *lsm_order_cmdline;
> +static __initdata const char *lsm_order_legacy;
>   
>   /* Ordered list of LSMs to initialize. */
> -static __initdata struct lsm_info *ordered_lsms[MAX_LSM_COUNT + 1];
> -static __initdata struct lsm_info *exclusive;
> +static __initdata struct lsm_info *lsm_order[MAX_LSM_COUNT + 1];
> +static __initdata struct lsm_info *lsm_exclusive;
>   
>   static __initdata bool debug;
>   #define init_debug(...)							\
> @@ -33,36 +33,46 @@ static __initdata bool debug;
>   	} while (0)
>   
>   #define lsm_order_for_each(iter)					\
> -	for ((iter) = ordered_lsms; *(iter); (iter)++)
> +	for ((iter) = lsm_order; *(iter); (iter)++)
>   #define lsm_early_for_each_raw(iter)					\
>   	for ((iter) = __start_early_lsm_info;				\
>   	     (iter) < __end_early_lsm_info; (iter)++)
>   
> -static int lsm_append(const char *new, char **result);
> -
> -/* Save user chosen LSM */
> -static int __init choose_major_lsm(char *str)
> +/**
> + * lsm_choose_security - Legacy "major" LSM selection
> + * @str: kernel command line parameter
> + */
> +static int __init lsm_choose_security(char *str)
>   {
> -	chosen_major_lsm = str;
> +	lsm_order_legacy = str;
>   	return 1;
>   }
> -__setup("security=", choose_major_lsm);
> +__setup("security=", lsm_choose_security);
>   
> -/* Explicitly choose LSM initialization order. */
> -static int __init choose_lsm_order(char *str)
> +/**
> + * lsm_choose_lsm - Modern LSM selection
> + * @str: kernel command line parameter
> + */
> +static int __init lsm_choose_lsm(char *str)
>   {
> -	chosen_lsm_order = str;
> +	lsm_order_cmdline = str;
>   	return 1;
>   }
> -__setup("lsm=", choose_lsm_order);
> +__setup("lsm=", lsm_choose_lsm);
>   
> -/* Enable LSM order debugging. */
> -static int __init enable_debug(char *str)
> +/**
> + * lsm_debug_enable - Enable LSM framework debugging
> + * @str: kernel command line parameter
> + *
> + * Currently we only provide debug info during LSM initialization, but we may
> + * want to expand this in the future.
> + */
> +static int __init lsm_debug_enable(char *str)
>   {
>   	debug = true;
>   	return 1;
>   }
> -__setup("lsm.debug", enable_debug);
> +__setup("lsm.debug", lsm_debug_enable);
>   
>   /* Mark an LSM's enabled flag. */
>   static int lsm_enabled_true __initdata = 1;
> @@ -124,7 +134,7 @@ static void __init append_ordered_lsm(struct lsm_info *lsm, const char *from)
>   	/* Enable this LSM, if it is not already set. */
>   	if (!lsm->enabled)
>   		lsm->enabled = &lsm_enabled_true;
> -	ordered_lsms[last_lsm] = lsm;
> +	lsm_order[last_lsm] = lsm;
>   	lsm_idlist[last_lsm++] = lsm->id;
>   
>   	init_debug("%s ordered: %s (%s)\n", from, lsm->id->name,
> @@ -154,7 +164,7 @@ static void __init lsm_prep_single(struct lsm_info *lsm)
>   	if (!is_enabled(lsm)) {
>   		set_enabled(lsm, false);
>   		return;
> -	} else if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && exclusive) {
> +	} else if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && lsm_exclusive) {
>   		init_debug("exclusive disabled: %s\n", lsm->id->name);
>   		set_enabled(lsm, false);
>   		return;
> @@ -162,9 +172,9 @@ static void __init lsm_prep_single(struct lsm_info *lsm)
>   
>   	/* Mark the LSM as enabled. */
>   	set_enabled(lsm, true);
> -	if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && !exclusive) {
> +	if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && !lsm_exclusive) {
>   		init_debug("exclusive chosen:   %s\n", lsm->id->name);
> -		exclusive = lsm;
> +		lsm_exclusive = lsm;
>   	}
>   
>   	/* Register the LSM blob sizes. */
> @@ -220,7 +230,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
>   	}
>   
>   	/* Process "security=", if given. */
> -	if (chosen_major_lsm) {
> +	if (lsm_order_legacy) {
>   		struct lsm_info *major;
>   
>   		/*
> @@ -232,10 +242,10 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
>   		for (major = __start_lsm_info; major < __end_lsm_info;
>   		     major++) {
>   			if ((major->flags & LSM_FLAG_LEGACY_MAJOR) &&
> -			    strcmp(major->id->name, chosen_major_lsm) != 0) {
> +			    strcmp(major->id->name, lsm_order_legacy) != 0) {
>   				set_enabled(major, false);
>   				init_debug("security=%s disabled: %s (only one legacy major LSM)\n",
> -					   chosen_major_lsm, major->id->name);
> +					   lsm_order_legacy, major->id->name);
>   			}
>   		}
>   	}
> @@ -260,11 +270,11 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
>   	}
>   
>   	/* Process "security=", if given. */
> -	if (chosen_major_lsm) {
> +	if (lsm_order_legacy) {
>   		for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
>   			if (exists_ordered_lsm(lsm))
>   				continue;
> -			if (strcmp(lsm->id->name, chosen_major_lsm) == 0)
> +			if (strcmp(lsm->id->name, lsm_order_legacy) == 0)
>   				append_ordered_lsm(lsm, "security=");
>   		}
>   	}
> @@ -295,15 +305,15 @@ static void __init lsm_init_ordered(void)
>   	struct lsm_info **lsm;
>   	struct lsm_info *early;
>   
> -	if (chosen_lsm_order) {
> -		if (chosen_major_lsm) {
> +	if (lsm_order_cmdline) {
> +		if (lsm_order_legacy) {
>   			pr_warn("security=%s is ignored because it is superseded by lsm=%s\n",
> -				chosen_major_lsm, chosen_lsm_order);
> -			chosen_major_lsm = NULL;
> +				lsm_order_legacy, lsm_order_cmdline);
> +			lsm_order_legacy = NULL;
>   		}
> -		ordered_lsm_parse(chosen_lsm_order, "cmdline");
> +		ordered_lsm_parse(lsm_order_cmdline, "cmdline");
>   	} else
> -		ordered_lsm_parse(builtin_lsm_order, "builtin");
> +		ordered_lsm_parse(lsm_order_builtin, "builtin");
>   
>   	lsm_order_for_each(lsm) {
>   		lsm_prep_single(*lsm);
> @@ -319,7 +329,7 @@ static void __init lsm_init_ordered(void)
>   	lsm_order_for_each(lsm) {
>   		if (is_enabled(*lsm))
>   			pr_cont("%s%s",
> -				lsm == ordered_lsms ? "" : ",", (*lsm)->id->name);
> +				lsm == lsm_order ? "" : ",", (*lsm)->id->name);
>   	}
>   	pr_cont("\n");
>   
> @@ -465,9 +475,9 @@ int __init security_init(void)
>   {
>   	struct lsm_info *lsm;
>   
> -	init_debug("legacy security=%s\n", chosen_major_lsm ? : " *unspecified*");
> -	init_debug("  CONFIG_LSM=%s\n", builtin_lsm_order);
> -	init_debug("boot arg lsm=%s\n", chosen_lsm_order ? : " *unspecified*");
> +	init_debug("legacy security=%s\n", lsm_order_legacy ? : " *unspecified*");
> +	init_debug("  CONFIG_LSM=%s\n", lsm_order_builtin);
> +	init_debug("boot arg lsm=%s\n", lsm_order_cmdline ? : " *unspecified*");
>   
>   	/*
>   	 * Append the names of the early LSM modules now that kmalloc() is