Commit ca97d939 authored by James Morris's avatar James Morris Committed by James Morris

security: mark LSM hooks as __ro_after_init

Mark all of the registration hooks as __ro_after_init (via the
__lsm_ro_after_init macro).
Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
Acked-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
Acked-by: default avatarKees Cook <keescook@chromium.org>
parent dd0859dc
...@@ -587,7 +587,7 @@ static int apparmor_task_setrlimit(struct task_struct *task, ...@@ -587,7 +587,7 @@ static int apparmor_task_setrlimit(struct task_struct *task,
return error; return error;
} }
static struct security_hook_list apparmor_hooks[] = { static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check), LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check),
LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme), LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme),
LSM_HOOK_INIT(capget, apparmor_capget), LSM_HOOK_INIT(capget, apparmor_capget),
......
...@@ -1071,7 +1071,7 @@ int cap_mmap_file(struct file *file, unsigned long reqprot, ...@@ -1071,7 +1071,7 @@ int cap_mmap_file(struct file *file, unsigned long reqprot,
#ifdef CONFIG_SECURITY #ifdef CONFIG_SECURITY
struct security_hook_list capability_hooks[] = { struct security_hook_list capability_hooks[] __lsm_ro_after_init = {
LSM_HOOK_INIT(capable, cap_capable), LSM_HOOK_INIT(capable, cap_capable),
LSM_HOOK_INIT(settime, cap_settime), LSM_HOOK_INIT(settime, cap_settime),
LSM_HOOK_INIT(ptrace_access_check, cap_ptrace_access_check), LSM_HOOK_INIT(ptrace_access_check, cap_ptrace_access_check),
......
...@@ -174,7 +174,7 @@ static int loadpin_read_file(struct file *file, enum kernel_read_file_id id) ...@@ -174,7 +174,7 @@ static int loadpin_read_file(struct file *file, enum kernel_read_file_id id)
return 0; return 0;
} }
static struct security_hook_list loadpin_hooks[] = { static struct security_hook_list loadpin_hooks[] __lsm_ro_after_init = {
LSM_HOOK_INIT(sb_free_security, loadpin_sb_free_security), LSM_HOOK_INIT(sb_free_security, loadpin_sb_free_security),
LSM_HOOK_INIT(kernel_read_file, loadpin_read_file), LSM_HOOK_INIT(kernel_read_file, loadpin_read_file),
}; };
......
...@@ -1628,7 +1628,7 @@ int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule, ...@@ -1628,7 +1628,7 @@ int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule,
} }
#endif /* CONFIG_AUDIT */ #endif /* CONFIG_AUDIT */
struct security_hook_heads security_hook_heads = { struct security_hook_heads security_hook_heads __lsm_ro_after_init = {
.binder_set_context_mgr = .binder_set_context_mgr =
LIST_HEAD_INIT(security_hook_heads.binder_set_context_mgr), LIST_HEAD_INIT(security_hook_heads.binder_set_context_mgr),
.binder_transaction = .binder_transaction =
......
...@@ -6123,7 +6123,7 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer) ...@@ -6123,7 +6123,7 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer)
#endif #endif
static struct security_hook_list selinux_hooks[] = { static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr), LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction), LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder), LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
......
...@@ -4633,7 +4633,7 @@ static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen) ...@@ -4633,7 +4633,7 @@ static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
return 0; return 0;
} }
static struct security_hook_list smack_hooks[] = { static struct security_hook_list smack_hooks[] __lsm_ro_after_init = {
LSM_HOOK_INIT(ptrace_access_check, smack_ptrace_access_check), LSM_HOOK_INIT(ptrace_access_check, smack_ptrace_access_check),
LSM_HOOK_INIT(ptrace_traceme, smack_ptrace_traceme), LSM_HOOK_INIT(ptrace_traceme, smack_ptrace_traceme),
LSM_HOOK_INIT(syslog, smack_syslog), LSM_HOOK_INIT(syslog, smack_syslog),
......
...@@ -496,7 +496,7 @@ static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg, ...@@ -496,7 +496,7 @@ static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg,
* tomoyo_security_ops is a "struct security_operations" which is used for * tomoyo_security_ops is a "struct security_operations" which is used for
* registering TOMOYO. * registering TOMOYO.
*/ */
static struct security_hook_list tomoyo_hooks[] = { static struct security_hook_list tomoyo_hooks[] __lsm_ro_after_init = {
LSM_HOOK_INIT(cred_alloc_blank, tomoyo_cred_alloc_blank), LSM_HOOK_INIT(cred_alloc_blank, tomoyo_cred_alloc_blank),
LSM_HOOK_INIT(cred_prepare, tomoyo_cred_prepare), LSM_HOOK_INIT(cred_prepare, tomoyo_cred_prepare),
LSM_HOOK_INIT(cred_transfer, tomoyo_cred_transfer), LSM_HOOK_INIT(cred_transfer, tomoyo_cred_transfer),
......
...@@ -428,7 +428,7 @@ int yama_ptrace_traceme(struct task_struct *parent) ...@@ -428,7 +428,7 @@ int yama_ptrace_traceme(struct task_struct *parent)
return rc; return rc;
} }
static struct security_hook_list yama_hooks[] = { static struct security_hook_list yama_hooks[] __lsm_ro_after_init = {
LSM_HOOK_INIT(ptrace_access_check, yama_ptrace_access_check), LSM_HOOK_INIT(ptrace_access_check, yama_ptrace_access_check),
LSM_HOOK_INIT(ptrace_traceme, yama_ptrace_traceme), LSM_HOOK_INIT(ptrace_traceme, yama_ptrace_traceme),
LSM_HOOK_INIT(task_prctl, yama_task_prctl), LSM_HOOK_INIT(task_prctl, yama_task_prctl),
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment