diff options
| author | Casey Schaufler <casey@schaufler-ca.com> | 2017-01-18 17:09:05 -0800 |
|---|---|---|
| committer | James Morris <james.l.morris@oracle.com> | 2017-01-19 13:18:29 +1100 |
| commit | d69dece5f5b6bc7a5e39d2b6136ddc69469331fe (patch) | |
| tree | b4c23177baf246a1f64b83442fc3359cbc0d8f38 /security/inode.c | |
| parent | 3ccb76c5dfe0d25c1d0168d5b726d0b43d19a485 (diff) | |
LSM: Add /sys/kernel/security/lsm
I am still tired of having to find indirect ways to determine
what security modules are active on a system. I have added
/sys/kernel/security/lsm, which contains a comma separated
list of the active security modules. No more groping around
in /proc/filesystems or other clever hacks.
Unchanged from previous versions except for being updated
to the latest security next branch.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Diffstat (limited to 'security/inode.c')
| -rw-r--r-- | security/inode.c | 26 |
1 files changed, 24 insertions, 2 deletions
diff --git a/security/inode.c b/security/inode.c index c83db05c15ab..2cb14162ff8d 100644 --- a/security/inode.c +++ b/security/inode.c @@ -20,6 +20,7 @@ #include <linux/init.h> #include <linux/namei.h> #include <linux/security.h> +#include <linux/lsm_hooks.h> #include <linux/magic.h> static struct vfsmount *mount; @@ -204,6 +205,21 @@ void securityfs_remove(struct dentry *dentry) } EXPORT_SYMBOL_GPL(securityfs_remove); +#ifdef CONFIG_SECURITY +static struct dentry *lsm_dentry; +static ssize_t lsm_read(struct file *filp, char __user *buf, size_t count, + loff_t *ppos) +{ + return simple_read_from_buffer(buf, count, ppos, lsm_names, + strlen(lsm_names)); +} + +static const struct file_operations lsm_ops = { + .read = lsm_read, + .llseek = generic_file_llseek, +}; +#endif + static int __init securityfs_init(void) { int retval; @@ -213,9 +229,15 @@ static int __init securityfs_init(void) return retval; retval = register_filesystem(&fs_type); - if (retval) + if (retval) { sysfs_remove_mount_point(kernel_kobj, "security"); - return retval; + return retval; + } +#ifdef CONFIG_SECURITY + lsm_dentry = securityfs_create_file("lsm", 0444, NULL, NULL, + &lsm_ops); +#endif + return 0; } core_initcall(securityfs_init); |