[RFC PATCH 23/29] apparmor: move initcalls to the LSM framework
John Johansen
john.johansen at canonical.com
Wed May 14 13:33:07 UTC 2025
On 4/9/25 11:50, Paul Moore wrote:
> Signed-off-by: Paul Moore <paul at paul-moore.com>
Acked-by: John Johansen <john.johansen at canonical.com>
> ---
> security/apparmor/apparmorfs.c | 4 +---
> security/apparmor/crypto.c | 4 +---
> security/apparmor/include/apparmorfs.h | 2 ++
> security/apparmor/include/crypto.h | 1 +
> security/apparmor/lsm.c | 9 ++++++++-
> 5 files changed, 13 insertions(+), 7 deletions(-)
>
> diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
> index 6039afae4bfc..0a7550a5bceb 100644
> --- a/security/apparmor/apparmorfs.c
> +++ b/security/apparmor/apparmorfs.c
> @@ -2632,7 +2632,7 @@ static const struct inode_operations policy_link_iops = {
> *
> * Returns: error on failure
> */
> -static int __init aa_create_aafs(void)
> +int __init aa_create_aafs(void)
> {
> struct dentry *dent;
> int error;
> @@ -2711,5 +2711,3 @@ static int __init aa_create_aafs(void)
> AA_ERROR("Error creating AppArmor securityfs\n");
> return error;
> }
> -
> -fs_initcall(aa_create_aafs);
> diff --git a/security/apparmor/crypto.c b/security/apparmor/crypto.c
> index aad486b2fca6..e4395c1bfac5 100644
> --- a/security/apparmor/crypto.c
> +++ b/security/apparmor/crypto.c
> @@ -99,7 +99,7 @@ int aa_calc_profile_hash(struct aa_profile *profile, u32 version, void *start,
> return error;
> }
>
> -static int __init init_profile_hash(void)
> +int __init init_profile_hash(void)
> {
> struct crypto_shash *tfm;
>
> @@ -119,5 +119,3 @@ static int __init init_profile_hash(void)
>
> return 0;
> }
> -
> -late_initcall(init_profile_hash);
> diff --git a/security/apparmor/include/apparmorfs.h b/security/apparmor/include/apparmorfs.h
> index 1e94904f68d9..dd580594dfb7 100644
> --- a/security/apparmor/include/apparmorfs.h
> +++ b/security/apparmor/include/apparmorfs.h
> @@ -104,6 +104,8 @@ enum aafs_prof_type {
> #define prof_dir(X) ((X)->dents[AAFS_PROF_DIR])
> #define prof_child_dir(X) ((X)->dents[AAFS_PROF_PROFS])
>
> +int aa_create_aafs(void);
> +
> void __aa_bump_ns_revision(struct aa_ns *ns);
> void __aafs_profile_rmdir(struct aa_profile *profile);
> void __aafs_profile_migrate_dents(struct aa_profile *old,
> diff --git a/security/apparmor/include/crypto.h b/security/apparmor/include/crypto.h
> index 636a04e20d91..f3ffd388cc58 100644
> --- a/security/apparmor/include/crypto.h
> +++ b/security/apparmor/include/crypto.h
> @@ -13,6 +13,7 @@
> #include "policy.h"
>
> #ifdef CONFIG_SECURITY_APPARMOR_HASH
> +int init_profile_hash(void);
> unsigned int aa_hash_size(void);
> char *aa_calc_hash(void *data, size_t len);
> int aa_calc_profile_hash(struct aa_profile *profile, u32 version, void *start,
> diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
> index a7f6a3274682..2fefaab6349f 100644
> --- a/security/apparmor/lsm.c
> +++ b/security/apparmor/lsm.c
> @@ -31,6 +31,7 @@
> #include "include/audit.h"
> #include "include/capability.h"
> #include "include/cred.h"
> +#include "include/crypto.h"
> #include "include/file.h"
> #include "include/ipc.h"
> #include "include/net.h"
> @@ -2146,7 +2147,6 @@ static int __init apparmor_nf_ip_init(void)
>
> return 0;
> }
> -__initcall(apparmor_nf_ip_init);
> #endif
>
> static char nulldfa_src[] = {
> @@ -2277,4 +2277,11 @@ DEFINE_LSM(apparmor) = {
> .enabled = &apparmor_enabled,
> .blobs = &apparmor_blob_sizes,
> .init = apparmor_init,
> + .initcall_fs = aa_create_aafs,
> +#if defined(CONFIG_NETFILTER) && defined(CONFIG_NETWORK_SECMARK)
> + .initcall_device = apparmor_nf_ip_init,
> +#endif
> +#ifdef CONFIG_SECURITY_APPARMOR_HASH
> + .initcall_late = init_profile_hash,
> +#endif
> };
More information about the Linux-security-module-archive
mailing list