From patchwork Mon Mar 26 11:07:48 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tetsuo Handa X-Patchwork-Id: 10307631 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E6FB060212 for ; Mon, 26 Mar 2018 11:08:07 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DA42828BC6 for ; Mon, 26 Mar 2018 11:08:07 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id CED1128C02; Mon, 26 Mar 2018 11:08:07 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4434328BC6 for ; Mon, 26 Mar 2018 11:08:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751099AbeCZLIF (ORCPT ); Mon, 26 Mar 2018 07:08:05 -0400 Received: from www262.sakura.ne.jp ([202.181.97.72]:54529 "EHLO www262.sakura.ne.jp" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751071AbeCZLIE (ORCPT ); Mon, 26 Mar 2018 07:08:04 -0400 Received: from fsav405.sakura.ne.jp (fsav405.sakura.ne.jp [133.242.250.104]) by www262.sakura.ne.jp (8.14.5/8.14.5) with ESMTP id w2QB7pEf068024; Mon, 26 Mar 2018 20:07:51 +0900 (JST) (envelope-from penguin-kernel@I-love.SAKURA.ne.jp) Received: from www262.sakura.ne.jp (202.181.97.72) by fsav405.sakura.ne.jp (F-Secure/fsigk_smtp/530/fsav405.sakura.ne.jp); Mon, 26 Mar 2018 20:07:51 +0900 (JST) X-Virus-Status: clean(F-Secure/fsigk_smtp/530/fsav405.sakura.ne.jp) Received: from AQUA (softbank126099184120.bbtec.net [126.99.184.120]) (authenticated bits=0) by www262.sakura.ne.jp (8.14.5/8.14.5) with ESMTP id w2QB7oll068020; Mon, 26 Mar 2018 20:07:51 +0900 (JST) (envelope-from penguin-kernel@I-love.SAKURA.ne.jp) To: casey@schaufler-ca.com, sargun@sargun.me, linux-security-module@vger.kernel.org Cc: keescook@chromium.org, igor.stoppa@huawei.com Subject: Re: [PATCH] security: convert security hooks to use hlist From: Tetsuo Handa References: <6f9d93bdf8122230ea53823a07a9d79f0c3fdafe.1521972503.git.sargun@sargun.me> <39e2dfa9-8063-1aa5-cd69-5a57d4b8a231@schaufler-ca.com> In-Reply-To: <39e2dfa9-8063-1aa5-cd69-5a57d4b8a231@schaufler-ca.com> Message-Id: <201803262007.BDF21886.OJOFLVMHFQSFOt@I-love.SAKURA.ne.jp> X-Mailer: Winbiff [Version 2.51 PL2] X-Accept-Language: ja,en,zh Date: Mon, 26 Mar 2018 20:07:48 +0900 Mime-Version: 1.0 Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Casey Schaufler wrote: > On 3/25/2018 3:08 AM, Sargun Dhillon wrote: > > This changes security_hook_heads to use hlist_heads instead of > > the circular doubly-linked list heads. This should cut down > > the size of the struct by about half. > > My only concern is with the possibility of making > security modules dynamically loadable and unloadable. > I know that Tetsuo is still hoping to have that, and > I have worked to make sure that we don't do anything > to preclude it. If he has no objection, I don't either. > Changing from "struct list_head" to "struct hlist_head" does not affect LKM-based LSMs. If Sargun makes that change, please fold below changes because for (i = 0; i < sizeof(security_hook_heads) / sizeof(struct hlist_head); i++) INIT_HLIST_HEAD(&list[i]); is equivalent to memset(&security_hook_heads, 0, sizeof(security_hook_heads)); which is not required because security_hook_heads is automatically initialized with 0, and we can also revert commit fd466e068e5adef5 ("randstruct: Whitelist struct security_hook_heads cast"). --- scripts/gcc-plugins/randomize_layout_plugin.c | 2 -- security/security.c | 6 ------ 2 files changed, 8 deletions(-) diff --git a/scripts/gcc-plugins/randomize_layout_plugin.c b/scripts/gcc-plugins/randomize_layout_plugin.c index c4a345c..d941389 100644 --- a/scripts/gcc-plugins/randomize_layout_plugin.c +++ b/scripts/gcc-plugins/randomize_layout_plugin.c @@ -52,8 +52,6 @@ struct whitelist_entry { { "net/unix/af_unix.c", "unix_skb_parms", "char" }, /* big_key payload.data struct splashing */ { "security/keys/big_key.c", "path", "void *" }, - /* walk struct security_hook_heads as an array of struct list_head */ - { "security/security.c", "list_head", "security_hook_heads" }, { } }; diff --git a/security/security.c b/security/security.c index 3cafff6..90d53c5 100644 --- a/security/security.c +++ b/security/security.c @@ -60,12 +60,6 @@ static void __init do_security_initcalls(void) */ int __init security_init(void) { - int i; - struct hlist_head *list = (struct hlist_head *) &security_hook_heads; - - for (i = 0; i < sizeof(security_hook_heads) / sizeof(struct hlist_head); - i++) - INIT_HLIST_HEAD(&list[i]); pr_info("Security Framework initialized\n"); /*