[PATCH v3 29/34] apparmor: move initcalls to the LSM framework

[John Johansen]

On 9/3/25 13:34, Paul Moore wrote:
> On Thu, Aug 14, 2025 at 6:54 PM Paul Moore <paul at paul-moore.com> wrote:
>>
>> Reviewed-by: Kees Cook <kees at kernel.org>
>> Signed-off-by: Paul Moore <paul at paul-moore.com>
>> ---
>>   security/apparmor/apparmorfs.c         | 4 +---
>>   security/apparmor/crypto.c             | 3 +--
>>   security/apparmor/include/apparmorfs.h | 2 ++
>>   security/apparmor/include/crypto.h     | 1 +
>>   security/apparmor/lsm.c                | 9 ++++++++-
>>   5 files changed, 13 insertions(+), 6 deletions(-)
> 
> Thanks for reviewing all the other patches John.  Assuming you are
> okay with this patch, can I get an ACK?
> 
I'm working on it. I managed to get down to I think 3 patches remaining to review/ack, and I wanted to get some testing on this one before acking. Hopefully will get that done today

>> diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
>> index 391a586d0557..ee04c1ac9d6e 100644
>> --- a/security/apparmor/apparmorfs.c
>> +++ b/security/apparmor/apparmorfs.c
>> @@ -2649,7 +2649,7 @@ static const struct inode_operations policy_link_iops = {
>>    *
>>    * Returns: error on failure
>>    */
>> -static int __init aa_create_aafs(void)
>> +int __init aa_create_aafs(void)
>>   {
>>          struct dentry *dent;
>>          int error;
>> @@ -2728,5 +2728,3 @@ static int __init aa_create_aafs(void)
>>          AA_ERROR("Error creating AppArmor securityfs\n");
>>          return error;
>>   }
>> -
>> -fs_initcall(aa_create_aafs);
>> diff --git a/security/apparmor/crypto.c b/security/apparmor/crypto.c
>> index 227d47c14907..d8a7bde94d79 100644
>> --- a/security/apparmor/crypto.c
>> +++ b/security/apparmor/crypto.c
>> @@ -53,10 +53,9 @@ int aa_calc_profile_hash(struct aa_profile *profile, u32 version, void *start,
>>          return 0;
>>   }
>>
>> -static int __init init_profile_hash(void)
>> +int __init init_profile_hash(void)
>>   {
>>          if (apparmor_initialized)
>>                  aa_info_message("AppArmor sha256 policy hashing enabled");
>>          return 0;
>>   }
>> -late_initcall(init_profile_hash);
>> diff --git a/security/apparmor/include/apparmorfs.h b/security/apparmor/include/apparmorfs.h
>> index 1e94904f68d9..dd580594dfb7 100644
>> --- a/security/apparmor/include/apparmorfs.h
>> +++ b/security/apparmor/include/apparmorfs.h
>> @@ -104,6 +104,8 @@ enum aafs_prof_type {
>>   #define prof_dir(X) ((X)->dents[AAFS_PROF_DIR])
>>   #define prof_child_dir(X) ((X)->dents[AAFS_PROF_PROFS])
>>
>> +int aa_create_aafs(void);
>> +
>>   void __aa_bump_ns_revision(struct aa_ns *ns);
>>   void __aafs_profile_rmdir(struct aa_profile *profile);
>>   void __aafs_profile_migrate_dents(struct aa_profile *old,
>> diff --git a/security/apparmor/include/crypto.h b/security/apparmor/include/crypto.h
>> index 636a04e20d91..f3ffd388cc58 100644
>> --- a/security/apparmor/include/crypto.h
>> +++ b/security/apparmor/include/crypto.h
>> @@ -13,6 +13,7 @@
>>   #include "policy.h"
>>
>>   #ifdef CONFIG_SECURITY_APPARMOR_HASH
>> +int init_profile_hash(void);
>>   unsigned int aa_hash_size(void);
>>   char *aa_calc_hash(void *data, size_t len);
>>   int aa_calc_profile_hash(struct aa_profile *profile, u32 version, void *start,
>> diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
>> index 45b3a304d525..647c13e13e63 100644
>> --- a/security/apparmor/lsm.c
>> +++ b/security/apparmor/lsm.c
>> @@ -32,6 +32,7 @@
>>   #include "include/audit.h"
>>   #include "include/capability.h"
>>   #include "include/cred.h"
>> +#include "include/crypto.h"
>>   #include "include/file.h"
>>   #include "include/ipc.h"
>>   #include "include/net.h"
>> @@ -2426,7 +2427,6 @@ static int __init apparmor_nf_ip_init(void)
>>
>>          return 0;
>>   }
>> -__initcall(apparmor_nf_ip_init);
>>   #endif
>>
>>   static char nulldfa_src[] __aligned(8) = {
>> @@ -2557,4 +2557,11 @@ DEFINE_LSM(apparmor) = {
>>          .enabled = &apparmor_enabled,
>>          .blobs = &apparmor_blob_sizes,
>>          .init = apparmor_init,
>> +       .initcall_fs = aa_create_aafs,
>> +#if defined(CONFIG_NETFILTER) && defined(CONFIG_NETWORK_SECMARK)
>> +       .initcall_device = apparmor_nf_ip_init,
>> +#endif
>> +#ifdef CONFIG_SECURITY_APPARMOR_HASH
>> +       .initcall_late = init_profile_hash,
>> +#endif
>>   };
>> --
>> 2.50.1
>