Hi all,
Smackfs initialization without an enabled Smack leads to
an early Oops that renders the system unusable.
Introduce a global smack_enabled variable that will be used
to make sure that no smack components will be registered
(ala smackfs) if we are not already enabled.
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
---
The Oops is triggered by the security= patch that will be sent
soon.
I can't imagine an SELinux guru finding /smackfs instead of
his usual /selinuxfs when he hits a tab completion after 's' ;).
As a bonus, this patch will handle that case too.
smack.h | 9 +++++++++
smack_lsm.c | 8 ++++++++
smackfs.c | 3 +++
3 files changed, 20 insertions(+)
diff --git a/security/smack/smack.h b/security/smack/smack.h
index a21a0e9..17c55ad 100644
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -18,6 +18,15 @@
#include <net/netlabel.h>
/*
+ * We must not bother the rest of the kernel by exporting our
+ * own stuff if we are not already enabled. We may not be loaded
+ * if another or no LSM was chosen on boot.
+ * Smackfs is currently the only exported component, but this
+ * may change in the future.
+ */
+extern int smack_enabled;
+
+/*
* Why 23? CIPSO is constrained to 30, so a 32 byte buffer is
* bigger than can be used, and 24 is the next lower multiple
* of 8, and there are too many issues if there isn't space set
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 770eb06..6fe7869 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -36,6 +36,8 @@
#define SOCKFS_MAGIC 0x534F434B
#define TMPFS_MAGIC 0x01021994
+int smack_enabled;
+
/**
* smk_fetch - Fetch the smack label from a file.
* @ip: a pointer to the inode
@@ -2589,6 +2591,12 @@ static __init int smack_init(void)
if (register_security(&smack_ops))
panic("smack: Unable to register with kernel.\n");
+ /*
+ * Notify other Smack components that it's now safe to
+ * to register themselves.
+ */
+ smack_enabled = 1;
+
return 0;
}
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 358c92c..e1687c0 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -992,6 +992,9 @@ static int __init init_smk_fs(void)
{
int err;
+ if (!smack_enabled)
+ return 0;
+
err = register_filesystem(&smk_fs_type);
if (!err) {
smackfs_mount = kern_mount(&smk_fs_type);
--
"Better to light a candle, than curse the darkness"
Ahmed S. Darwish
Homepage: http://darwish.07.googlepages.com
Blog: http://darwish-07.blogspot.com
--
