[RFC PATCH 26/29] selinux: move initcalls to the LSM framework

Casey Schaufler casey at schaufler-ca.com
Fri May 23 15:12:22 UTC 2025


On 4/9/2025 11:50 AM, Paul Moore wrote:
> SELinux currently has a number of initcalls so we've created a new
> function, selinux_initcall(), which wraps all of these initcalls so
> that we have a single initcall function that can be registered with the
> LSM framework.
>
> Signed-off-by: Paul Moore <paul at paul-moore.com>
> ---
>  security/selinux/Makefile            |  2 +-
>  security/selinux/hooks.c             |  9 +++--
>  security/selinux/ibpkey.c            |  5 ++-
>  security/selinux/include/audit.h     |  5 +++
>  security/selinux/include/initcalls.h | 19 +++++++++++
>  security/selinux/initcalls.c         | 50 ++++++++++++++++++++++++++++
>  security/selinux/netif.c             |  5 ++-
>  security/selinux/netlink.c           |  5 ++-
>  security/selinux/netnode.c           |  5 ++-
>  security/selinux/netport.c           |  5 ++-
>  security/selinux/selinuxfs.c         |  5 ++-
>  security/selinux/ss/services.c       | 26 ++++-----------
>  12 files changed, 101 insertions(+), 40 deletions(-)
>  create mode 100644 security/selinux/include/initcalls.h
>  create mode 100644 security/selinux/initcalls.c
>
> diff --git a/security/selinux/Makefile b/security/selinux/Makefile
> index 66e56e9011df..72d3baf7900c 100644
> --- a/security/selinux/Makefile
> +++ b/security/selinux/Makefile
> @@ -15,7 +15,7 @@ ccflags-y := -I$(srctree)/security/selinux -I$(srctree)/security/selinux/include
>  ccflags-$(CONFIG_SECURITY_SELINUX_DEBUG) += -DDEBUG
>  
>  selinux-y := avc.o hooks.o selinuxfs.o netlink.o nlmsgtab.o netif.o \
> -	     netnode.o netport.o status.o \
> +	     netnode.o netport.o status.o initcalls.o \
>  	     ss/ebitmap.o ss/hashtab.o ss/symtab.o ss/sidtab.o ss/avtab.o \
>  	     ss/policydb.o ss/services.o ss/conditional.o ss/mls.o ss/context.o
>  
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index f28a12a0a1c8..95b2399b1f4d 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -95,6 +95,7 @@
>  #include <linux/io_uring/cmd.h>
>  #include <uapi/linux/lsm.h>
>  
> +#include "initcalls.h"
>  #include "avc.h"
>  #include "objsec.h"
>  #include "netif.h"
> @@ -7535,6 +7536,10 @@ static __init int selinux_init(void)
>  	if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
>  		panic("SELinux: Unable to register AVC LSM notifier callback\n");
>  
> +	if (avc_add_callback(selinux_audit_rule_avc_callback,
> +			     AVC_CALLBACK_RESET))
> +		panic("SELinux: Unable to register AVC audit callback\n");
> +
>  	if (selinux_enforcing_boot)
>  		pr_debug("SELinux:  Starting in enforcing mode\n");
>  	else
> @@ -7567,6 +7572,7 @@ DEFINE_LSM(selinux) = {
>  	.enabled = &selinux_enabled_boot,
>  	.blobs = &selinux_blob_sizes,
>  	.init = selinux_init,
> +	.initcall_device = selinux_initcall,
>  };
>  
>  #if defined(CONFIG_NETFILTER)
> @@ -7628,7 +7634,7 @@ static struct pernet_operations selinux_net_ops = {
>  	.exit = selinux_nf_unregister,
>  };
>  
> -static int __init selinux_nf_ip_init(void)
> +int __init selinux_nf_ip_init(void)
>  {
>  	int err;
>  
> @@ -7643,5 +7649,4 @@ static int __init selinux_nf_ip_init(void)
>  
>  	return 0;
>  }
> -__initcall(selinux_nf_ip_init);
>  #endif /* CONFIG_NETFILTER */
> diff --git a/security/selinux/ibpkey.c b/security/selinux/ibpkey.c
> index 48f537b41c58..2609913f338a 100644
> --- a/security/selinux/ibpkey.c
> +++ b/security/selinux/ibpkey.c
> @@ -23,6 +23,7 @@
>  #include <linux/list.h>
>  #include <linux/spinlock.h>
>  
> +#include "initcalls.h"
>  #include "ibpkey.h"
>  #include "objsec.h"
>  
> @@ -219,7 +220,7 @@ void sel_ib_pkey_flush(void)
>  	spin_unlock_irqrestore(&sel_ib_pkey_lock, flags);
>  }
>  
> -static __init int sel_ib_pkey_init(void)
> +int __init sel_ib_pkey_init(void)

Build failure if CONFIG_SECURITY_INFINIBAND is not set.

>  {
>  	int iter;
>  
> @@ -233,5 +234,3 @@ static __init int sel_ib_pkey_init(void)
>  
>  	return 0;
>  }
> -
> -subsys_initcall(sel_ib_pkey_init);
> diff --git a/security/selinux/include/audit.h b/security/selinux/include/audit.h
> index d5b0425055e4..5989f8dd1e86 100644
> --- a/security/selinux/include/audit.h
> +++ b/security/selinux/include/audit.h
> @@ -15,6 +15,11 @@
>  #include <linux/audit.h>
>  #include <linux/types.h>
>  
> +/**
> + * XXX
> + */
> +int selinux_audit_rule_avc_callback(u32 event);
> +
>  /**
>   * selinux_audit_rule_init - alloc/init an selinux audit rule structure.
>   * @field: the field this rule refers to
> diff --git a/security/selinux/include/initcalls.h b/security/selinux/include/initcalls.h
> new file mode 100644
> index 000000000000..6674cf489473
> --- /dev/null
> +++ b/security/selinux/include/initcalls.h
> @@ -0,0 +1,19 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/*
> + * SELinux initcalls
> + */
> +
> +#ifndef _SELINUX_INITCALLS_H
> +#define _SELINUX_INITCALLS_H
> +
> +int init_sel_fs(void);
> +int sel_netport_init(void);
> +int sel_netnode_init(void);
> +int sel_netif_init(void);
> +int sel_netlink_init(void);
> +int sel_ib_pkey_init(void);
> +int selinux_nf_ip_init(void);
> +
> +int selinux_initcall(void);
> +
> +#endif
> diff --git a/security/selinux/initcalls.c b/security/selinux/initcalls.c
> new file mode 100644
> index 000000000000..81f01f8ad215
> --- /dev/null
> +++ b/security/selinux/initcalls.c
> @@ -0,0 +1,50 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/*
> + * SELinux initcalls
> + */
> +
> +#include <linux/init.h>
> +
> +#include "initcalls.h"
> +
> +/**
> + * selinux_initcall - Perform the SELinux initcalls
> + *
> + * Used as a device initcall in the SELinux LSM definition.
> + */
> +int __init selinux_initcall(void)
> +{
> +	int rc = 0, rc_tmp = 0;
> +
> +	rc_tmp = init_sel_fs();
> +	if (!rc && rc_tmp)
> +		rc = rc_tmp;
> +
> +	rc_tmp = sel_netport_init();
> +	if (!rc && rc_tmp)
> +		rc = rc_tmp;
> +
> +	rc_tmp = sel_netnode_init();
> +	if (!rc && rc_tmp)
> +		rc = rc_tmp;
> +
> +	rc_tmp = sel_netif_init();
> +	if (!rc && rc_tmp)
> +		rc = rc_tmp;
> +
> +	rc_tmp = sel_netlink_init();
> +	if (!rc && rc_tmp)
> +		rc = rc_tmp;
> +
> +	rc_tmp = sel_ib_pkey_init();
> +	if (!rc && rc_tmp)
> +		rc = rc_tmp;
> +
> +#if defined(CONFIG_NETFILTER)
> +	rc_tmp = selinux_nf_ip_init();
> +	if (!rc && rc_tmp)
> +		rc = rc_tmp;
> +#endif
> +
> +	return rc;
> +}
> diff --git a/security/selinux/netif.c b/security/selinux/netif.c
> index 43a0d3594b72..69f660721dc8 100644
> --- a/security/selinux/netif.c
> +++ b/security/selinux/netif.c
> @@ -22,6 +22,7 @@
>  #include <linux/rcupdate.h>
>  #include <net/net_namespace.h>
>  
> +#include "initcalls.h"
>  #include "security.h"
>  #include "objsec.h"
>  #include "netif.h"
> @@ -261,7 +262,7 @@ static struct notifier_block sel_netif_netdev_notifier = {
>  	.notifier_call = sel_netif_netdev_notifier_handler,
>  };
>  
> -static __init int sel_netif_init(void)
> +int __init sel_netif_init(void)
>  {
>  	int i;
>  
> @@ -276,5 +277,3 @@ static __init int sel_netif_init(void)
>  	return 0;
>  }
>  
> -__initcall(sel_netif_init);
> -
> diff --git a/security/selinux/netlink.c b/security/selinux/netlink.c
> index 1760aee712fd..eb40e4603475 100644
> --- a/security/selinux/netlink.c
> +++ b/security/selinux/netlink.c
> @@ -17,6 +17,7 @@
>  #include <net/net_namespace.h>
>  #include <net/netlink.h>
>  
> +#include "initcalls.h"
>  #include "security.h"
>  
>  static struct sock *selnl __ro_after_init;
> @@ -105,7 +106,7 @@ void selnl_notify_policyload(u32 seqno)
>  	selnl_notify(SELNL_MSG_POLICYLOAD, &seqno);
>  }
>  
> -static int __init selnl_init(void)
> +int __init sel_netlink_init(void)
>  {
>  	struct netlink_kernel_cfg cfg = {
>  		.groups	= SELNLGRP_MAX,
> @@ -117,5 +118,3 @@ static int __init selnl_init(void)
>  		panic("SELinux:  Cannot create netlink socket.");
>  	return 0;
>  }
> -
> -__initcall(selnl_init);
> diff --git a/security/selinux/netnode.c b/security/selinux/netnode.c
> index 5c8c77e50aad..11b5eac30641 100644
> --- a/security/selinux/netnode.c
> +++ b/security/selinux/netnode.c
> @@ -30,6 +30,7 @@
>  #include <net/ip.h>
>  #include <net/ipv6.h>
>  
> +#include "initcalls.h"
>  #include "netnode.h"
>  #include "objsec.h"
>  
> @@ -287,7 +288,7 @@ void sel_netnode_flush(void)
>  	spin_unlock_bh(&sel_netnode_lock);
>  }
>  
> -static __init int sel_netnode_init(void)
> +int __init sel_netnode_init(void)
>  {
>  	int iter;
>  
> @@ -301,5 +302,3 @@ static __init int sel_netnode_init(void)
>  
>  	return 0;
>  }
> -
> -__initcall(sel_netnode_init);
> diff --git a/security/selinux/netport.c b/security/selinux/netport.c
> index 2e22ad9c2bd0..d1c12f58a628 100644
> --- a/security/selinux/netport.c
> +++ b/security/selinux/netport.c
> @@ -29,6 +29,7 @@
>  #include <net/ip.h>
>  #include <net/ipv6.h>
>  
> +#include "initcalls.h"
>  #include "netport.h"
>  #include "objsec.h"
>  
> @@ -220,7 +221,7 @@ void sel_netport_flush(void)
>  	spin_unlock_bh(&sel_netport_lock);
>  }
>  
> -static __init int sel_netport_init(void)
> +int __init sel_netport_init(void)
>  {
>  	int iter;
>  
> @@ -234,5 +235,3 @@ static __init int sel_netport_init(void)
>  
>  	return 0;
>  }
> -
> -__initcall(sel_netport_init);
> diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
> index 47480eb2189b..88d16c1dbb5a 100644
> --- a/security/selinux/selinuxfs.c
> +++ b/security/selinux/selinuxfs.c
> @@ -35,6 +35,7 @@
>  /* selinuxfs pseudo filesystem for exporting the security policy API.
>     Based on the proc code and the fs/nfsd/nfsctl.c code. */
>  
> +#include "initcalls.h"
>  #include "flask.h"
>  #include "avc.h"
>  #include "avc_ss.h"
> @@ -2131,7 +2132,7 @@ static struct file_system_type sel_fs_type = {
>  
>  struct path selinux_null __ro_after_init;
>  
> -static int __init init_sel_fs(void)
> +int __init init_sel_fs(void)
>  {
>  	struct qstr null_name = QSTR_INIT(NULL_FILE_NAME,
>  					  sizeof(NULL_FILE_NAME)-1);
> @@ -2175,5 +2176,3 @@ static int __init init_sel_fs(void)
>  
>  	return err;
>  }
> -
> -__initcall(init_sel_fs);
> diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
> index e431772c6168..d84a496e5f7f 100644
> --- a/security/selinux/ss/services.c
> +++ b/security/selinux/ss/services.c
> @@ -3534,6 +3534,13 @@ struct selinux_audit_rule {
>  	struct context au_ctxt;
>  };
>  
> +int selinux_audit_rule_avc_callback(u32 event)
> +{
> +	if (event == AVC_CALLBACK_RESET)
> +		return audit_update_lsm_rules();
> +	return 0;
> +}
> +
>  void selinux_audit_rule_free(void *vrule)
>  {
>  	struct selinux_audit_rule *rule = vrule;
> @@ -3784,25 +3791,6 @@ int selinux_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op, void *vru
>  	return match;
>  }
>  
> -static int aurule_avc_callback(u32 event)
> -{
> -	if (event == AVC_CALLBACK_RESET)
> -		return audit_update_lsm_rules();
> -	return 0;
> -}
> -
> -static int __init aurule_init(void)
> -{
> -	int err;
> -
> -	err = avc_add_callback(aurule_avc_callback, AVC_CALLBACK_RESET);
> -	if (err)
> -		panic("avc_add_callback() failed, error %d\n", err);
> -
> -	return err;
> -}
> -__initcall(aurule_init);
> -
>  #ifdef CONFIG_NETLABEL
>  /**
>   * security_netlbl_cache_add - Add an entry to the NetLabel cache



More information about the Linux-security-module-archive mailing list