[PATCH -next 7/9] lockdown: move lockdown_reasons next to its only user
flat view
HOTtoday
From: Cai Xinchen <hidden>
Date: 2026-11-03 07:51:29
Also in:
bpf, linux-kselftest, lkml
Subsystem:
lockdown security module, security subsystem, the rest · Maintainers:
Nicolas Bouchinet, Xiu Jianfeng, Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds
lockdown_reasons[] is only used by the lockdown LSM after the audit data was removed from lsm_audit. Move it into security/lockdown/lockdown.c, make it static, drop the now stale extern declaration, and point the enum comment at the new location. No functional change. Signed-off-by: Cai Xinchen <redacted> --- include/linux/security.h | 2 -- security/lockdown/lockdown.c | 39 +++++++++++++++++++++++++++++++++++ security/security.c | 40 ------------------------------------ 3 files changed, 39 insertions(+), 42 deletions(-)
diff --git a/include/linux/security.h b/include/linux/security.h
index 40831fab5470..9d3a1eaa90ff 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h@@ -170,8 +170,6 @@ struct lsm_prop { struct lsm_prop_bpf bpf; }; -extern const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1]; - /* These functions are in security/commoncap.c */ extern int cap_capable(const struct cred *cred, struct user_namespace *ns, int cap, unsigned int opts);
diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c
index 08a30cd471e0..8c6344399967 100644
--- a/security/lockdown/lockdown.c
+++ b/security/lockdown/lockdown.c@@ -14,6 +14,45 @@ #include <linux/lsm_hooks.h> #include <uapi/linux/lsm.h> +/* + * These are descriptions of the reasons that can be passed to the + * security_locked_down() LSM hook, used for the denial message and the + * securityfs status file. + */ +static const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX + 1] = { + [LOCKDOWN_NONE] = "none", + [LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading", + [LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port", + [LOCKDOWN_EFI_TEST] = "/dev/efi_test access", + [LOCKDOWN_KEXEC] = "kexec of unsigned images", + [LOCKDOWN_HIBERNATION] = "hibernation", + [LOCKDOWN_PCI_ACCESS] = "direct PCI access", + [LOCKDOWN_IOPORT] = "raw io port access", + [LOCKDOWN_MSR] = "raw MSR access", + [LOCKDOWN_ACPI_TABLES] = "modifying ACPI tables", + [LOCKDOWN_DEVICE_TREE] = "modifying device tree contents", + [LOCKDOWN_PCMCIA_CIS] = "direct PCMCIA CIS storage", + [LOCKDOWN_TIOCSSERIAL] = "reconfiguration of serial port IO", + [LOCKDOWN_MODULE_PARAMETERS] = "unsafe module parameters", + [LOCKDOWN_MMIOTRACE] = "unsafe mmio", + [LOCKDOWN_DEBUGFS] = "debugfs access", + [LOCKDOWN_XMON_WR] = "xmon write access", + [LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM", + [LOCKDOWN_DBG_WRITE_KERNEL] = "use of kgdb/kdb to write kernel RAM", + [LOCKDOWN_RTAS_ERROR_INJECTION] = "RTAS error injection", + [LOCKDOWN_XEN_USER_ACTIONS] = "Xen guest user action", + [LOCKDOWN_INTEGRITY_MAX] = "integrity", + [LOCKDOWN_KCORE] = "/proc/kcore access", + [LOCKDOWN_KPROBES] = "use of kprobes", + [LOCKDOWN_BPF_READ_KERNEL] = "use of bpf to read kernel RAM", + [LOCKDOWN_DBG_READ_KERNEL] = "use of kgdb/kdb to read kernel RAM", + [LOCKDOWN_PERF] = "unsafe use of perf", + [LOCKDOWN_TRACEFS] = "use of tracefs", + [LOCKDOWN_XMON_RW] = "xmon read and write access", + [LOCKDOWN_XFRM_SECRET] = "xfrm SA secret", + [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality", +}; + static enum lockdown_reason kernel_locked_down; static const enum lockdown_reason lockdown_levels[] = {LOCKDOWN_NONE,
diff --git a/security/security.c b/security/security.c
index f6583d507395..71cc823881b8 100644
--- a/security/security.c
+++ b/security/security.c@@ -35,46 +35,6 @@ #include "lsm.h" -/* - * These are descriptions of the reasons that can be passed to the - * security_locked_down() LSM hook. Placing this array here allows - * all security modules to use the same descriptions for auditing - * purposes. - */ -const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX + 1] = { - [LOCKDOWN_NONE] = "none", - [LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading", - [LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port", - [LOCKDOWN_EFI_TEST] = "/dev/efi_test access", - [LOCKDOWN_KEXEC] = "kexec of unsigned images", - [LOCKDOWN_HIBERNATION] = "hibernation", - [LOCKDOWN_PCI_ACCESS] = "direct PCI access", - [LOCKDOWN_IOPORT] = "raw io port access", - [LOCKDOWN_MSR] = "raw MSR access", - [LOCKDOWN_ACPI_TABLES] = "modifying ACPI tables", - [LOCKDOWN_DEVICE_TREE] = "modifying device tree contents", - [LOCKDOWN_PCMCIA_CIS] = "direct PCMCIA CIS storage", - [LOCKDOWN_TIOCSSERIAL] = "reconfiguration of serial port IO", - [LOCKDOWN_MODULE_PARAMETERS] = "unsafe module parameters", - [LOCKDOWN_MMIOTRACE] = "unsafe mmio", - [LOCKDOWN_DEBUGFS] = "debugfs access", - [LOCKDOWN_XMON_WR] = "xmon write access", - [LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM", - [LOCKDOWN_DBG_WRITE_KERNEL] = "use of kgdb/kdb to write kernel RAM", - [LOCKDOWN_RTAS_ERROR_INJECTION] = "RTAS error injection", - [LOCKDOWN_XEN_USER_ACTIONS] = "Xen guest user action", - [LOCKDOWN_INTEGRITY_MAX] = "integrity", - [LOCKDOWN_KCORE] = "/proc/kcore access", - [LOCKDOWN_KPROBES] = "use of kprobes", - [LOCKDOWN_BPF_READ_KERNEL] = "use of bpf to read kernel RAM", - [LOCKDOWN_DBG_READ_KERNEL] = "use of kgdb/kdb to read kernel RAM", - [LOCKDOWN_PERF] = "unsafe use of perf", - [LOCKDOWN_TRACEFS] = "use of tracefs", - [LOCKDOWN_XMON_RW] = "xmon read and write access", - [LOCKDOWN_XFRM_SECRET] = "xfrm SA secret", - [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality", -}; - bool lsm_debug __ro_after_init; unsigned int lsm_active_cnt __ro_after_init;
--
2.18.0.huawei.25