Re: [RFC PATCH 23/29] apparmor: move initcalls to the LSM framework
From: John Johansen <john.johansen@canonical.com>
Date: 2025-05-14 13:33:10
Also in:
linux-integrity, selinux
On 4/9/25 11:50, Paul Moore wrote:
Signed-off-by: Paul Moore <paul@paul-moore.com>
Acked-by: John Johansen <john.johansen@canonical.com>
quoted hunk ↗ jump to hunk
--- security/apparmor/apparmorfs.c | 4 +--- security/apparmor/crypto.c | 4 +--- security/apparmor/include/apparmorfs.h | 2 ++ security/apparmor/include/crypto.h | 1 + security/apparmor/lsm.c | 9 ++++++++- 5 files changed, 13 insertions(+), 7 deletions(-)diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c index 6039afae4bfc..0a7550a5bceb 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c@@ -2632,7 +2632,7 @@ static const struct inode_operations policy_link_iops = { * * Returns: error on failure */ -static int __init aa_create_aafs(void) +int __init aa_create_aafs(void) { struct dentry *dent; int error;@@ -2711,5 +2711,3 @@ static int __init aa_create_aafs(void) AA_ERROR("Error creating AppArmor securityfs\n"); return error; } - -fs_initcall(aa_create_aafs);diff --git a/security/apparmor/crypto.c b/security/apparmor/crypto.c index aad486b2fca6..e4395c1bfac5 100644 --- a/security/apparmor/crypto.c +++ b/security/apparmor/crypto.c@@ -99,7 +99,7 @@ int aa_calc_profile_hash(struct aa_profile *profile, u32 version, void *start, return error; } -static int __init init_profile_hash(void) +int __init init_profile_hash(void) { struct crypto_shash *tfm;@@ -119,5 +119,3 @@ static int __init init_profile_hash(void) return 0; } - -late_initcall(init_profile_hash);diff --git a/security/apparmor/include/apparmorfs.h b/security/apparmor/include/apparmorfs.h index 1e94904f68d9..dd580594dfb7 100644 --- a/security/apparmor/include/apparmorfs.h +++ b/security/apparmor/include/apparmorfs.h@@ -104,6 +104,8 @@ enum aafs_prof_type { #define prof_dir(X) ((X)->dents[AAFS_PROF_DIR]) #define prof_child_dir(X) ((X)->dents[AAFS_PROF_PROFS]) +int aa_create_aafs(void); + void __aa_bump_ns_revision(struct aa_ns *ns); void __aafs_profile_rmdir(struct aa_profile *profile); void __aafs_profile_migrate_dents(struct aa_profile *old,diff --git a/security/apparmor/include/crypto.h b/security/apparmor/include/crypto.h index 636a04e20d91..f3ffd388cc58 100644 --- a/security/apparmor/include/crypto.h +++ b/security/apparmor/include/crypto.h@@ -13,6 +13,7 @@ #include "policy.h" #ifdef CONFIG_SECURITY_APPARMOR_HASH +int init_profile_hash(void); unsigned int aa_hash_size(void); char *aa_calc_hash(void *data, size_t len); int aa_calc_profile_hash(struct aa_profile *profile, u32 version, void *start,diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index a7f6a3274682..2fefaab6349f 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c@@ -31,6 +31,7 @@ #include "include/audit.h" #include "include/capability.h" #include "include/cred.h" +#include "include/crypto.h" #include "include/file.h" #include "include/ipc.h" #include "include/net.h"@@ -2146,7 +2147,6 @@ static int __init apparmor_nf_ip_init(void) return 0; } -__initcall(apparmor_nf_ip_init); #endif static char nulldfa_src[] = {@@ -2277,4 +2277,11 @@ DEFINE_LSM(apparmor) = { .enabled = &apparmor_enabled, .blobs = &apparmor_blob_sizes, .init = apparmor_init, + .initcall_fs = aa_create_aafs, +#if defined(CONFIG_NETFILTER) && defined(CONFIG_NETWORK_SECMARK) + .initcall_device = apparmor_nf_ip_init, +#endif +#ifdef CONFIG_SECURITY_APPARMOR_HASH + .initcall_late = init_profile_hash, +#endif };