| Message ID | 20221102000525.gonna.409-kees@kernel.org (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Paul Moore |
| Headers | show |
| Series | [v2] LSM: Better reporting of actual LSMs at boot | expand |
On 11/1/2022 5:05 PM, Kees Cook wrote: > Enhance the details reported by "lsm.debug" in several ways: > > - report contents of "security=" > - report contents of "CONFIG_LSM" > - report contents of "lsm=" > - report any early LSM details > - whitespace-align the output of similar phases for easier visual parsing > - change "disabled" to more accurate "skipped" > - explain what "skipped" and "ignored" mean in a parenthetical > > Upgrade the "security= is ignored" warning from pr_info to pr_warn, > and include full arguments list to make the cause even more clear. > > Replace static "Security Framework initializing" pr_info with specific > list of the resulting order of enabled LSMs. > > For example, if the kernel is built with: > > CONFIG_SECURITY_SELINUX=y > CONFIG_SECURITY_APPARMOR=y > CONFIG_SECURITY_LOADPIN=y > CONFIG_SECURITY_YAMA=y > CONFIG_SECURITY_SAFESETID=y > CONFIG_SECURITY_LOCKDOWN_LSM=y > CONFIG_SECURITY_LANDLOCK=y > CONFIG_INTEGRITY=y > CONFIG_BPF_LSM=y > CONFIG_DEFAULT_SECURITY_APPARMOR=y > CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf" > > Booting without options will show: > > LSM: initializing lsm=lockdown,capability,landlock,yama,loadpin,safesetid,integrity,selinux,bpf > landlock: Up and running. > Yama: becoming mindful. > LoadPin: ready to pin (currently not enforcing) > SELinux: Initializing. > LSM support for eBPF active > > Boot with "lsm.debug" will show: > > LSM: legacy security= *unspecified* > LSM: CONFIG_LSM=landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf > LSM: boot arg lsm= *unspecified* > LSM: early started: lockdown (enabled) > LSM: first ordered: capability (enabled) > LSM: builtin ordered: landlock (enabled) > LSM: builtin ignored: lockdown (not built into kernel) > LSM: builtin ordered: yama (enabled) > LSM: builtin ordered: loadpin (enabled) > LSM: builtin ordered: safesetid (enabled) > LSM: builtin ordered: integrity (enabled) > LSM: builtin ordered: selinux (enabled) > LSM: builtin ignored: smack (not built into kernel) > LSM: builtin ignored: tomoyo (not built into kernel) > LSM: builtin ordered: apparmor (enabled) > LSM: builtin ordered: bpf (enabled) > LSM: exclusive chosen: selinux > LSM: exclusive disabled: apparmor > LSM: initializing lsm=lockdown,capability,landlock,yama,loadpin,safesetid,integrity,selinux,bpf > LSM: cred blob size = 32 > LSM: file blob size = 16 > LSM: inode blob size = 72 > LSM: ipc blob size = 8 > LSM: msg_msg blob size = 4 > LSM: superblock blob size = 80 > LSM: task blob size = 8 > LSM: initializing capability > LSM: initializing landlock > landlock: Up and running. > LSM: initializing yama > Yama: becoming mindful. > LSM: initializing loadpin > LoadPin: ready to pin (currently not enforcing) > LSM: initializing safesetid > LSM: initializing integrity > LSM: initializing selinux > SELinux: Initializing. > LSM: initializing bpf > LSM support for eBPF active > > And some examples of how the lsm.debug ordering report changes... > > With "lsm.debug security=selinux": > > LSM: legacy security=selinux > LSM: CONFIG_LSM=landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf > LSM: boot arg lsm= *unspecified* > LSM: early started: lockdown (enabled) > LSM: first ordered: capability (enabled) > LSM: security=selinux disabled: apparmor (only one legacy major LSM) > LSM: builtin ordered: landlock (enabled) > LSM: builtin ignored: lockdown (not built into kernel) > LSM: builtin ordered: yama (enabled) > LSM: builtin ordered: loadpin (enabled) > LSM: builtin ordered: safesetid (enabled) > LSM: builtin ordered: integrity (enabled) > LSM: builtin ordered: selinux (enabled) > LSM: builtin ignored: smack (not built into kernel) > LSM: builtin ignored: tomoyo (not built into kernel) > LSM: builtin ordered: apparmor (disabled) > LSM: builtin ordered: bpf (enabled) > LSM: exclusive chosen: selinux > LSM: initializing lsm=lockdown,capability,landlock,yama,loadpin,safesetid,integrity,selinux,bpf > > With "lsm.debug lsm=integrity,selinux,loadpin,crabability,bpf,loadpin,loadpin": > > LSM: legacy security= *unspecified* > LSM: CONFIG_LSM=landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf > LSM: boot arg lsm=integrity,selinux,loadpin,capability,bpf,loadpin,loadpin > LSM: early started: lockdown (enabled) > LSM: first ordered: capability (enabled) > LSM: cmdline ordered: integrity (enabled) > LSM: cmdline ordered: selinux (enabled) > LSM: cmdline ordered: loadpin (enabled) > LSM: cmdline ignored: crabability (not built into kernel) > LSM: cmdline ordered: bpf (enabled) > LSM: cmdline skipped: apparmor (not in requested order) > LSM: cmdline skipped: yama (not in requested order) > LSM: cmdline skipped: safesetid (not in requested order) > LSM: cmdline skipped: landlock (not in requested order) > LSM: exclusive chosen: selinux > LSM: initializing lsm=lockdown,capability,integrity,selinux,loadpin,bpf > > Cc: Paul Moore <paul@paul-moore.com> > Cc: James Morris <jmorris@namei.org> > Cc: "Serge E. Hallyn" <serge@hallyn.com> > Cc: linux-security-module@vger.kernel.org > Signed-off-by: Kees Cook <keescook@chromium.org> Acked-by: Casey Schaufler <casey@schaufler-ca.com> I'm curious about what is driving this change. > --- > v2: en/dis-enabled expanded, example output in commit log, use pr_cont. > v1: https://lore.kernel.org/lkml/20221018064825.never.323-kees@kernel.org/ > --- > security/security.c | 45 ++++++++++++++++++++++++++++++++++++--------- > 1 file changed, 36 insertions(+), 9 deletions(-) > > diff --git a/security/security.c b/security/security.c > index 79d82cb6e469..abceabda103d 100644 > --- a/security/security.c > +++ b/security/security.c > @@ -161,8 +161,8 @@ static void __init append_ordered_lsm(struct lsm_info *lsm, const char *from) > lsm->enabled = &lsm_enabled_true; > ordered_lsms[last_lsm++] = lsm; > > - init_debug("%s ordering: %s (%sabled)\n", from, lsm->name, > - is_enabled(lsm) ? "en" : "dis"); > + init_debug("%s ordered: %s (%s)\n", from, lsm->name, > + is_enabled(lsm) ? "enabled" : "disabled"); > } > > /* Is an LSM allowed to be initialized? */ > @@ -224,7 +224,7 @@ static void __init prepare_lsm(struct lsm_info *lsm) > if (enabled) { > if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && !exclusive) { > exclusive = lsm; > - init_debug("exclusive chosen: %s\n", lsm->name); > + init_debug("exclusive chosen: %s\n", lsm->name); > } > > lsm_set_blob_sizes(lsm->blobs); > @@ -252,7 +252,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) > /* LSM_ORDER_FIRST is always first. */ > for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) { > if (lsm->order == LSM_ORDER_FIRST) > - append_ordered_lsm(lsm, "first"); > + append_ordered_lsm(lsm, " first"); > } > > /* Process "security=", if given. */ > @@ -270,7 +270,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) > if ((major->flags & LSM_FLAG_LEGACY_MAJOR) && > strcmp(major->name, chosen_major_lsm) != 0) { > set_enabled(major, false); > - init_debug("security=%s disabled: %s\n", > + init_debug("security=%s disabled: %s (only one legacy major LSM)\n", > chosen_major_lsm, major->name); > } > } > @@ -291,7 +291,8 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) > } > > if (!found) > - init_debug("%s ignored: %s\n", origin, name); > + init_debug("%s ignored: %s (not built into kernel)\n", > + origin, name); > } > > /* Process "security=", if given. */ > @@ -309,7 +310,8 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) > if (exists_ordered_lsm(lsm)) > continue; > set_enabled(lsm, false); > - init_debug("%s disabled: %s\n", origin, lsm->name); > + init_debug("%s skipped: %s (not in requested order)\n", > + origin, lsm->name); > } > > kfree(sep); > @@ -320,6 +322,24 @@ static void __init lsm_early_task(struct task_struct *task); > > static int lsm_append(const char *new, char **result); > > +static void __init report_lsm_order(void) > +{ > + struct lsm_info **lsm, *early; > + int first = 0; > + > + pr_info("initializing lsm="); > + > + /* Report each enabled LSM name, comma separated. */ > + for (early = __start_early_lsm_info; early < __end_early_lsm_info; early++) > + if (is_enabled(early)) > + pr_cont("%s%s", first++ == 0 ? "" : ",", early->name); > + for (lsm = ordered_lsms; *lsm; lsm++) > + if (is_enabled(*lsm)) > + pr_cont("%s%s", first++ == 0 ? "" : ",", (*lsm)->name); > + > + pr_cont("\n"); > +} > + > static void __init ordered_lsm_init(void) > { > struct lsm_info **lsm; > @@ -329,7 +349,8 @@ static void __init ordered_lsm_init(void) > > if (chosen_lsm_order) { > if (chosen_major_lsm) { > - pr_info("security= is ignored because it is superseded by lsm=\n"); > + pr_warn("security=%s is ignored because it is superseded by lsm=%s\n", > + chosen_major_lsm, chosen_lsm_order); > chosen_major_lsm = NULL; > } > ordered_lsm_parse(chosen_lsm_order, "cmdline"); > @@ -339,6 +360,8 @@ static void __init ordered_lsm_init(void) > for (lsm = ordered_lsms; *lsm; lsm++) > prepare_lsm(*lsm); > > + report_lsm_order(); > + > init_debug("cred blob size = %d\n", blob_sizes.lbs_cred); > init_debug("file blob size = %d\n", blob_sizes.lbs_file); > init_debug("inode blob size = %d\n", blob_sizes.lbs_inode); > @@ -395,13 +418,17 @@ int __init security_init(void) > { > struct lsm_info *lsm; > > - pr_info("Security Framework initializing\n"); > + init_debug("legacy security=%s\n", chosen_major_lsm ?: " *unspecified*"); > + init_debug(" CONFIG_LSM=%s\n", builtin_lsm_order); > + init_debug("boot arg lsm=%s\n", chosen_lsm_order ?: " *unspecified*"); > > /* > * Append the names of the early LSM modules now that kmalloc() is > * available > */ > for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) { > + init_debug(" early started: %s (%s)\n", lsm->name, > + is_enabled(lsm) ? "enabled" : "disabled"); > if (lsm->enabled) > lsm_append(lsm->name, &lsm_names); > }
On November 1, 2022 5:46:55 PM PDT, Casey Schaufler <casey@schaufler-ca.com> wrote: >On 11/1/2022 5:05 PM, Kees Cook wrote: >> Enhance the details reported by "lsm.debug" in several ways: > [...] > >Acked-by: Casey Schaufler <casey@schaufler-ca.com> Thanks! >I'm curious about what is driving this change. I was working on the ima stacking PoC and found the lsm.debug output confusing to read, and I wrote it. :P So, I wanted to clarify things and make sure stuff like lockdown was visible. Additionally, if we're going to keep the "lsm=" param as-is, I wanted it's value visible at boot so people would know what to start from when making changes. -Kees
On 02/11/2022 01:05, Kees Cook wrote: > Enhance the details reported by "lsm.debug" in several ways: > > - report contents of "security=" > - report contents of "CONFIG_LSM" > - report contents of "lsm=" > - report any early LSM details > - whitespace-align the output of similar phases for easier visual parsing > - change "disabled" to more accurate "skipped" > - explain what "skipped" and "ignored" mean in a parenthetical > > Upgrade the "security= is ignored" warning from pr_info to pr_warn, > and include full arguments list to make the cause even more clear. > > Replace static "Security Framework initializing" pr_info with specific > list of the resulting order of enabled LSMs. > > For example, if the kernel is built with: > > CONFIG_SECURITY_SELINUX=y > CONFIG_SECURITY_APPARMOR=y > CONFIG_SECURITY_LOADPIN=y > CONFIG_SECURITY_YAMA=y > CONFIG_SECURITY_SAFESETID=y > CONFIG_SECURITY_LOCKDOWN_LSM=y > CONFIG_SECURITY_LANDLOCK=y > CONFIG_INTEGRITY=y > CONFIG_BPF_LSM=y > CONFIG_DEFAULT_SECURITY_APPARMOR=y > CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf" > > Booting without options will show: > > LSM: initializing lsm=lockdown,capability,landlock,yama,loadpin,safesetid,integrity,selinux,bpf > landlock: Up and running. > Yama: becoming mindful. > LoadPin: ready to pin (currently not enforcing) > SELinux: Initializing. > LSM support for eBPF active > > Boot with "lsm.debug" will show: > > LSM: legacy security= *unspecified* > LSM: CONFIG_LSM=landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf > LSM: boot arg lsm= *unspecified* > LSM: early started: lockdown (enabled) > LSM: first ordered: capability (enabled) > LSM: builtin ordered: landlock (enabled) > LSM: builtin ignored: lockdown (not built into kernel) > LSM: builtin ordered: yama (enabled) > LSM: builtin ordered: loadpin (enabled) > LSM: builtin ordered: safesetid (enabled) > LSM: builtin ordered: integrity (enabled) > LSM: builtin ordered: selinux (enabled) > LSM: builtin ignored: smack (not built into kernel) > LSM: builtin ignored: tomoyo (not built into kernel) > LSM: builtin ordered: apparmor (enabled) > LSM: builtin ordered: bpf (enabled) > LSM: exclusive chosen: selinux > LSM: exclusive disabled: apparmor > LSM: initializing lsm=lockdown,capability,landlock,yama,loadpin,safesetid,integrity,selinux,bpf > LSM: cred blob size = 32 > LSM: file blob size = 16 > LSM: inode blob size = 72 > LSM: ipc blob size = 8 > LSM: msg_msg blob size = 4 > LSM: superblock blob size = 80 > LSM: task blob size = 8 > LSM: initializing capability > LSM: initializing landlock > landlock: Up and running. > LSM: initializing yama > Yama: becoming mindful. > LSM: initializing loadpin > LoadPin: ready to pin (currently not enforcing) > LSM: initializing safesetid > LSM: initializing integrity > LSM: initializing selinux > SELinux: Initializing. > LSM: initializing bpf > LSM support for eBPF active > > And some examples of how the lsm.debug ordering report changes... > > With "lsm.debug security=selinux": > > LSM: legacy security=selinux > LSM: CONFIG_LSM=landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf > LSM: boot arg lsm= *unspecified* > LSM: early started: lockdown (enabled) > LSM: first ordered: capability (enabled) > LSM: security=selinux disabled: apparmor (only one legacy major LSM) > LSM: builtin ordered: landlock (enabled) > LSM: builtin ignored: lockdown (not built into kernel) > LSM: builtin ordered: yama (enabled) > LSM: builtin ordered: loadpin (enabled) > LSM: builtin ordered: safesetid (enabled) > LSM: builtin ordered: integrity (enabled) > LSM: builtin ordered: selinux (enabled) > LSM: builtin ignored: smack (not built into kernel) > LSM: builtin ignored: tomoyo (not built into kernel) > LSM: builtin ordered: apparmor (disabled) > LSM: builtin ordered: bpf (enabled) > LSM: exclusive chosen: selinux > LSM: initializing lsm=lockdown,capability,landlock,yama,loadpin,safesetid,integrity,selinux,bpf > > With "lsm.debug lsm=integrity,selinux,loadpin,crabability,bpf,loadpin,loadpin": > > LSM: legacy security= *unspecified* > LSM: CONFIG_LSM=landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf > LSM: boot arg lsm=integrity,selinux,loadpin,capability,bpf,loadpin,loadpin > LSM: early started: lockdown (enabled) > LSM: first ordered: capability (enabled) > LSM: cmdline ordered: integrity (enabled) > LSM: cmdline ordered: selinux (enabled) > LSM: cmdline ordered: loadpin (enabled) > LSM: cmdline ignored: crabability (not built into kernel) > LSM: cmdline ordered: bpf (enabled) > LSM: cmdline skipped: apparmor (not in requested order) > LSM: cmdline skipped: yama (not in requested order) > LSM: cmdline skipped: safesetid (not in requested order) > LSM: cmdline skipped: landlock (not in requested order) > LSM: exclusive chosen: selinux > LSM: initializing lsm=lockdown,capability,integrity,selinux,loadpin,bpf > > Cc: Paul Moore <paul@paul-moore.com> > Cc: James Morris <jmorris@namei.org> > Cc: "Serge E. Hallyn" <serge@hallyn.com> > Cc: linux-security-module@vger.kernel.org > Signed-off-by: Kees Cook <keescook@chromium.org> I think this change would be useful to help users debug their LSM configuration. I'm not sure about the whitespace-aligned output though, I guess it could break some scripts, but it is not part of the ABI and only relevant for debug purpose. Acked-by: Mickaël Salaün <mic@digikod.net> > --- > v2: en/dis-enabled expanded, example output in commit log, use pr_cont. > v1: https://lore.kernel.org/lkml/20221018064825.never.323-kees@kernel.org/ > --- > security/security.c | 45 ++++++++++++++++++++++++++++++++++++--------- > 1 file changed, 36 insertions(+), 9 deletions(-) > > diff --git a/security/security.c b/security/security.c > index 79d82cb6e469..abceabda103d 100644 > --- a/security/security.c > +++ b/security/security.c > @@ -161,8 +161,8 @@ static void __init append_ordered_lsm(struct lsm_info *lsm, const char *from) > lsm->enabled = &lsm_enabled_true; > ordered_lsms[last_lsm++] = lsm; > > - init_debug("%s ordering: %s (%sabled)\n", from, lsm->name, > - is_enabled(lsm) ? "en" : "dis"); > + init_debug("%s ordered: %s (%s)\n", from, lsm->name, > + is_enabled(lsm) ? "enabled" : "disabled"); > } > > /* Is an LSM allowed to be initialized? */ > @@ -224,7 +224,7 @@ static void __init prepare_lsm(struct lsm_info *lsm) > if (enabled) { > if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && !exclusive) { > exclusive = lsm; > - init_debug("exclusive chosen: %s\n", lsm->name); > + init_debug("exclusive chosen: %s\n", lsm->name); > } > > lsm_set_blob_sizes(lsm->blobs); > @@ -252,7 +252,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) > /* LSM_ORDER_FIRST is always first. */ > for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) { > if (lsm->order == LSM_ORDER_FIRST) > - append_ordered_lsm(lsm, "first"); > + append_ordered_lsm(lsm, " first"); > } > > /* Process "security=", if given. */ > @@ -270,7 +270,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) > if ((major->flags & LSM_FLAG_LEGACY_MAJOR) && > strcmp(major->name, chosen_major_lsm) != 0) { > set_enabled(major, false); > - init_debug("security=%s disabled: %s\n", > + init_debug("security=%s disabled: %s (only one legacy major LSM)\n", > chosen_major_lsm, major->name); > } > } > @@ -291,7 +291,8 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) > } > > if (!found) > - init_debug("%s ignored: %s\n", origin, name); > + init_debug("%s ignored: %s (not built into kernel)\n", > + origin, name); > } > > /* Process "security=", if given. */ > @@ -309,7 +310,8 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) > if (exists_ordered_lsm(lsm)) > continue; > set_enabled(lsm, false); > - init_debug("%s disabled: %s\n", origin, lsm->name); > + init_debug("%s skipped: %s (not in requested order)\n", > + origin, lsm->name); > } > > kfree(sep); > @@ -320,6 +322,24 @@ static void __init lsm_early_task(struct task_struct *task); > > static int lsm_append(const char *new, char **result); > > +static void __init report_lsm_order(void) > +{ > + struct lsm_info **lsm, *early; > + int first = 0; > + > + pr_info("initializing lsm="); > + > + /* Report each enabled LSM name, comma separated. */ > + for (early = __start_early_lsm_info; early < __end_early_lsm_info; early++) > + if (is_enabled(early)) > + pr_cont("%s%s", first++ == 0 ? "" : ",", early->name); > + for (lsm = ordered_lsms; *lsm; lsm++) > + if (is_enabled(*lsm)) > + pr_cont("%s%s", first++ == 0 ? "" : ",", (*lsm)->name); > + > + pr_cont("\n"); > +} > + > static void __init ordered_lsm_init(void) > { > struct lsm_info **lsm; > @@ -329,7 +349,8 @@ static void __init ordered_lsm_init(void) > > if (chosen_lsm_order) { > if (chosen_major_lsm) { > - pr_info("security= is ignored because it is superseded by lsm=\n"); > + pr_warn("security=%s is ignored because it is superseded by lsm=%s\n", > + chosen_major_lsm, chosen_lsm_order); > chosen_major_lsm = NULL; > } > ordered_lsm_parse(chosen_lsm_order, "cmdline"); > @@ -339,6 +360,8 @@ static void __init ordered_lsm_init(void) > for (lsm = ordered_lsms; *lsm; lsm++) > prepare_lsm(*lsm); > > + report_lsm_order(); > + > init_debug("cred blob size = %d\n", blob_sizes.lbs_cred); > init_debug("file blob size = %d\n", blob_sizes.lbs_file); > init_debug("inode blob size = %d\n", blob_sizes.lbs_inode); > @@ -395,13 +418,17 @@ int __init security_init(void) > { > struct lsm_info *lsm; > > - pr_info("Security Framework initializing\n"); > + init_debug("legacy security=%s\n", chosen_major_lsm ?: " *unspecified*"); > + init_debug(" CONFIG_LSM=%s\n", builtin_lsm_order); > + init_debug("boot arg lsm=%s\n", chosen_lsm_order ?: " *unspecified*"); > > /* > * Append the names of the early LSM modules now that kmalloc() is > * available > */ > for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) { > + init_debug(" early started: %s (%s)\n", lsm->name, > + is_enabled(lsm) ? "enabled" : "disabled"); > if (lsm->enabled) > lsm_append(lsm->name, &lsm_names); > }
On Tue, Nov 1, 2022 at 8:05 PM Kees Cook <keescook@chromium.org> wrote: > > Enhance the details reported by "lsm.debug" in several ways: > > - report contents of "security=" > - report contents of "CONFIG_LSM" > - report contents of "lsm=" > - report any early LSM details > - whitespace-align the output of similar phases for easier visual parsing > - change "disabled" to more accurate "skipped" > - explain what "skipped" and "ignored" mean in a parenthetical > > Upgrade the "security= is ignored" warning from pr_info to pr_warn, > and include full arguments list to make the cause even more clear. > > Replace static "Security Framework initializing" pr_info with specific > list of the resulting order of enabled LSMs. > > For example, if the kernel is built with: > > CONFIG_SECURITY_SELINUX=y > CONFIG_SECURITY_APPARMOR=y > CONFIG_SECURITY_LOADPIN=y > CONFIG_SECURITY_YAMA=y > CONFIG_SECURITY_SAFESETID=y > CONFIG_SECURITY_LOCKDOWN_LSM=y > CONFIG_SECURITY_LANDLOCK=y > CONFIG_INTEGRITY=y > CONFIG_BPF_LSM=y > CONFIG_DEFAULT_SECURITY_APPARMOR=y > CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf" > > Booting without options will show: > > LSM: initializing lsm=lockdown,capability,landlock,yama,loadpin,safesetid,integrity,selinux,bpf > landlock: Up and running. > Yama: becoming mindful. > LoadPin: ready to pin (currently not enforcing) > SELinux: Initializing. > LSM support for eBPF active > > Boot with "lsm.debug" will show: > > LSM: legacy security= *unspecified* > LSM: CONFIG_LSM=landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf > LSM: boot arg lsm= *unspecified* > LSM: early started: lockdown (enabled) > LSM: first ordered: capability (enabled) > LSM: builtin ordered: landlock (enabled) > LSM: builtin ignored: lockdown (not built into kernel) > LSM: builtin ordered: yama (enabled) > LSM: builtin ordered: loadpin (enabled) > LSM: builtin ordered: safesetid (enabled) > LSM: builtin ordered: integrity (enabled) > LSM: builtin ordered: selinux (enabled) > LSM: builtin ignored: smack (not built into kernel) > LSM: builtin ignored: tomoyo (not built into kernel) > LSM: builtin ordered: apparmor (enabled) > LSM: builtin ordered: bpf (enabled) > LSM: exclusive chosen: selinux > LSM: exclusive disabled: apparmor > LSM: initializing lsm=lockdown,capability,landlock,yama,loadpin,safesetid,integrity,selinux,bpf > LSM: cred blob size = 32 > LSM: file blob size = 16 > LSM: inode blob size = 72 > LSM: ipc blob size = 8 > LSM: msg_msg blob size = 4 > LSM: superblock blob size = 80 > LSM: task blob size = 8 > LSM: initializing capability > LSM: initializing landlock > landlock: Up and running. > LSM: initializing yama > Yama: becoming mindful. > LSM: initializing loadpin > LoadPin: ready to pin (currently not enforcing) > LSM: initializing safesetid > LSM: initializing integrity > LSM: initializing selinux > SELinux: Initializing. > LSM: initializing bpf > LSM support for eBPF active > > And some examples of how the lsm.debug ordering report changes... > > With "lsm.debug security=selinux": > > LSM: legacy security=selinux > LSM: CONFIG_LSM=landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf > LSM: boot arg lsm= *unspecified* > LSM: early started: lockdown (enabled) > LSM: first ordered: capability (enabled) > LSM: security=selinux disabled: apparmor (only one legacy major LSM) > LSM: builtin ordered: landlock (enabled) > LSM: builtin ignored: lockdown (not built into kernel) > LSM: builtin ordered: yama (enabled) > LSM: builtin ordered: loadpin (enabled) > LSM: builtin ordered: safesetid (enabled) > LSM: builtin ordered: integrity (enabled) > LSM: builtin ordered: selinux (enabled) > LSM: builtin ignored: smack (not built into kernel) > LSM: builtin ignored: tomoyo (not built into kernel) > LSM: builtin ordered: apparmor (disabled) > LSM: builtin ordered: bpf (enabled) > LSM: exclusive chosen: selinux > LSM: initializing lsm=lockdown,capability,landlock,yama,loadpin,safesetid,integrity,selinux,bpf > > With "lsm.debug lsm=integrity,selinux,loadpin,crabability,bpf,loadpin,loadpin": > > LSM: legacy security= *unspecified* > LSM: CONFIG_LSM=landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf > LSM: boot arg lsm=integrity,selinux,loadpin,capability,bpf,loadpin,loadpin > LSM: early started: lockdown (enabled) > LSM: first ordered: capability (enabled) > LSM: cmdline ordered: integrity (enabled) > LSM: cmdline ordered: selinux (enabled) > LSM: cmdline ordered: loadpin (enabled) > LSM: cmdline ignored: crabability (not built into kernel) > LSM: cmdline ordered: bpf (enabled) > LSM: cmdline skipped: apparmor (not in requested order) > LSM: cmdline skipped: yama (not in requested order) > LSM: cmdline skipped: safesetid (not in requested order) > LSM: cmdline skipped: landlock (not in requested order) > LSM: exclusive chosen: selinux > LSM: initializing lsm=lockdown,capability,integrity,selinux,loadpin,bpf > > Cc: Paul Moore <paul@paul-moore.com> > Cc: James Morris <jmorris@namei.org> > Cc: "Serge E. Hallyn" <serge@hallyn.com> > Cc: linux-security-module@vger.kernel.org > Signed-off-by: Kees Cook <keescook@chromium.org> > --- > v2: en/dis-enabled expanded, example output in commit log, use pr_cont. > v1: https://lore.kernel.org/lkml/20221018064825.never.323-kees@kernel.org/ > --- > security/security.c | 45 ++++++++++++++++++++++++++++++++++++--------- > 1 file changed, 36 insertions(+), 9 deletions(-) I tend to agree with Mickaël regarding the aligned output, but that's not worth worrying too much about for debug stuff. Merged into lsm/next, thanks Kees.
diff --git a/security/security.c b/security/security.c index 79d82cb6e469..abceabda103d 100644 --- a/security/security.c +++ b/security/security.c @@ -161,8 +161,8 @@ static void __init append_ordered_lsm(struct lsm_info *lsm, const char *from) lsm->enabled = &lsm_enabled_true; ordered_lsms[last_lsm++] = lsm; - init_debug("%s ordering: %s (%sabled)\n", from, lsm->name, - is_enabled(lsm) ? "en" : "dis"); + init_debug("%s ordered: %s (%s)\n", from, lsm->name, + is_enabled(lsm) ? "enabled" : "disabled"); } /* Is an LSM allowed to be initialized? */ @@ -224,7 +224,7 @@ static void __init prepare_lsm(struct lsm_info *lsm) if (enabled) { if ((lsm->flags & LSM_FLAG_EXCLUSIVE) && !exclusive) { exclusive = lsm; - init_debug("exclusive chosen: %s\n", lsm->name); + init_debug("exclusive chosen: %s\n", lsm->name); } lsm_set_blob_sizes(lsm->blobs); @@ -252,7 +252,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) /* LSM_ORDER_FIRST is always first. */ for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) { if (lsm->order == LSM_ORDER_FIRST) - append_ordered_lsm(lsm, "first"); + append_ordered_lsm(lsm, " first"); } /* Process "security=", if given. */ @@ -270,7 +270,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) if ((major->flags & LSM_FLAG_LEGACY_MAJOR) && strcmp(major->name, chosen_major_lsm) != 0) { set_enabled(major, false); - init_debug("security=%s disabled: %s\n", + init_debug("security=%s disabled: %s (only one legacy major LSM)\n", chosen_major_lsm, major->name); } } @@ -291,7 +291,8 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) } if (!found) - init_debug("%s ignored: %s\n", origin, name); + init_debug("%s ignored: %s (not built into kernel)\n", + origin, name); } /* Process "security=", if given. */ @@ -309,7 +310,8 @@ static void __init ordered_lsm_parse(const char *order, const char *origin) if (exists_ordered_lsm(lsm)) continue; set_enabled(lsm, false); - init_debug("%s disabled: %s\n", origin, lsm->name); + init_debug("%s skipped: %s (not in requested order)\n", + origin, lsm->name); } kfree(sep); @@ -320,6 +322,24 @@ static void __init lsm_early_task(struct task_struct *task); static int lsm_append(const char *new, char **result); +static void __init report_lsm_order(void) +{ + struct lsm_info **lsm, *early; + int first = 0; + + pr_info("initializing lsm="); + + /* Report each enabled LSM name, comma separated. */ + for (early = __start_early_lsm_info; early < __end_early_lsm_info; early++) + if (is_enabled(early)) + pr_cont("%s%s", first++ == 0 ? "" : ",", early->name); + for (lsm = ordered_lsms; *lsm; lsm++) + if (is_enabled(*lsm)) + pr_cont("%s%s", first++ == 0 ? "" : ",", (*lsm)->name); + + pr_cont("\n"); +} + static void __init ordered_lsm_init(void) { struct lsm_info **lsm; @@ -329,7 +349,8 @@ static void __init ordered_lsm_init(void) if (chosen_lsm_order) { if (chosen_major_lsm) { - pr_info("security= is ignored because it is superseded by lsm=\n"); + pr_warn("security=%s is ignored because it is superseded by lsm=%s\n", + chosen_major_lsm, chosen_lsm_order); chosen_major_lsm = NULL; } ordered_lsm_parse(chosen_lsm_order, "cmdline"); @@ -339,6 +360,8 @@ static void __init ordered_lsm_init(void) for (lsm = ordered_lsms; *lsm; lsm++) prepare_lsm(*lsm); + report_lsm_order(); + init_debug("cred blob size = %d\n", blob_sizes.lbs_cred); init_debug("file blob size = %d\n", blob_sizes.lbs_file); init_debug("inode blob size = %d\n", blob_sizes.lbs_inode); @@ -395,13 +418,17 @@ int __init security_init(void) { struct lsm_info *lsm; - pr_info("Security Framework initializing\n"); + init_debug("legacy security=%s\n", chosen_major_lsm ?: " *unspecified*"); + init_debug(" CONFIG_LSM=%s\n", builtin_lsm_order); + init_debug("boot arg lsm=%s\n", chosen_lsm_order ?: " *unspecified*"); /* * Append the names of the early LSM modules now that kmalloc() is * available */ for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) { + init_debug(" early started: %s (%s)\n", lsm->name, + is_enabled(lsm) ? "enabled" : "disabled"); if (lsm->enabled) lsm_append(lsm->name, &lsm_names); }
Enhance the details reported by "lsm.debug" in several ways: - report contents of "security=" - report contents of "CONFIG_LSM" - report contents of "lsm=" - report any early LSM details - whitespace-align the output of similar phases for easier visual parsing - change "disabled" to more accurate "skipped" - explain what "skipped" and "ignored" mean in a parenthetical Upgrade the "security= is ignored" warning from pr_info to pr_warn, and include full arguments list to make the cause even more clear. Replace static "Security Framework initializing" pr_info with specific list of the resulting order of enabled LSMs. For example, if the kernel is built with: CONFIG_SECURITY_SELINUX=y CONFIG_SECURITY_APPARMOR=y CONFIG_SECURITY_LOADPIN=y CONFIG_SECURITY_YAMA=y CONFIG_SECURITY_SAFESETID=y CONFIG_SECURITY_LOCKDOWN_LSM=y CONFIG_SECURITY_LANDLOCK=y CONFIG_INTEGRITY=y CONFIG_BPF_LSM=y CONFIG_DEFAULT_SECURITY_APPARMOR=y CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf" Booting without options will show: LSM: initializing lsm=lockdown,capability,landlock,yama,loadpin,safesetid,integrity,selinux,bpf landlock: Up and running. Yama: becoming mindful. LoadPin: ready to pin (currently not enforcing) SELinux: Initializing. LSM support for eBPF active Boot with "lsm.debug" will show: LSM: legacy security= *unspecified* LSM: CONFIG_LSM=landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf LSM: boot arg lsm= *unspecified* LSM: early started: lockdown (enabled) LSM: first ordered: capability (enabled) LSM: builtin ordered: landlock (enabled) LSM: builtin ignored: lockdown (not built into kernel) LSM: builtin ordered: yama (enabled) LSM: builtin ordered: loadpin (enabled) LSM: builtin ordered: safesetid (enabled) LSM: builtin ordered: integrity (enabled) LSM: builtin ordered: selinux (enabled) LSM: builtin ignored: smack (not built into kernel) LSM: builtin ignored: tomoyo (not built into kernel) LSM: builtin ordered: apparmor (enabled) LSM: builtin ordered: bpf (enabled) LSM: exclusive chosen: selinux LSM: exclusive disabled: apparmor LSM: initializing lsm=lockdown,capability,landlock,yama,loadpin,safesetid,integrity,selinux,bpf LSM: cred blob size = 32 LSM: file blob size = 16 LSM: inode blob size = 72 LSM: ipc blob size = 8 LSM: msg_msg blob size = 4 LSM: superblock blob size = 80 LSM: task blob size = 8 LSM: initializing capability LSM: initializing landlock landlock: Up and running. LSM: initializing yama Yama: becoming mindful. LSM: initializing loadpin LoadPin: ready to pin (currently not enforcing) LSM: initializing safesetid LSM: initializing integrity LSM: initializing selinux SELinux: Initializing. LSM: initializing bpf LSM support for eBPF active And some examples of how the lsm.debug ordering report changes... With "lsm.debug security=selinux": LSM: legacy security=selinux LSM: CONFIG_LSM=landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf LSM: boot arg lsm= *unspecified* LSM: early started: lockdown (enabled) LSM: first ordered: capability (enabled) LSM: security=selinux disabled: apparmor (only one legacy major LSM) LSM: builtin ordered: landlock (enabled) LSM: builtin ignored: lockdown (not built into kernel) LSM: builtin ordered: yama (enabled) LSM: builtin ordered: loadpin (enabled) LSM: builtin ordered: safesetid (enabled) LSM: builtin ordered: integrity (enabled) LSM: builtin ordered: selinux (enabled) LSM: builtin ignored: smack (not built into kernel) LSM: builtin ignored: tomoyo (not built into kernel) LSM: builtin ordered: apparmor (disabled) LSM: builtin ordered: bpf (enabled) LSM: exclusive chosen: selinux LSM: initializing lsm=lockdown,capability,landlock,yama,loadpin,safesetid,integrity,selinux,bpf With "lsm.debug lsm=integrity,selinux,loadpin,crabability,bpf,loadpin,loadpin": LSM: legacy security= *unspecified* LSM: CONFIG_LSM=landlock,lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf LSM: boot arg lsm=integrity,selinux,loadpin,capability,bpf,loadpin,loadpin LSM: early started: lockdown (enabled) LSM: first ordered: capability (enabled) LSM: cmdline ordered: integrity (enabled) LSM: cmdline ordered: selinux (enabled) LSM: cmdline ordered: loadpin (enabled) LSM: cmdline ignored: crabability (not built into kernel) LSM: cmdline ordered: bpf (enabled) LSM: cmdline skipped: apparmor (not in requested order) LSM: cmdline skipped: yama (not in requested order) LSM: cmdline skipped: safesetid (not in requested order) LSM: cmdline skipped: landlock (not in requested order) LSM: exclusive chosen: selinux LSM: initializing lsm=lockdown,capability,integrity,selinux,loadpin,bpf Cc: Paul Moore <paul@paul-moore.com> Cc: James Morris <jmorris@namei.org> Cc: "Serge E. Hallyn" <serge@hallyn.com> Cc: linux-security-module@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> --- v2: en/dis-enabled expanded, example output in commit log, use pr_cont. v1: https://lore.kernel.org/lkml/20221018064825.never.323-kees@kernel.org/ --- security/security.c | 45 ++++++++++++++++++++++++++++++++++++--------- 1 file changed, 36 insertions(+), 9 deletions(-)