On 6/25/25 03:08, Tetsuo Handa wrote:
> On 2025/06/24 23:30, Maxime Bélair wrote:
>> +config LSM_CONFIG_SELF_POLICY_MAX_BUFFER_SIZE
>> + int "Maximum buffer size for lsm_config_self_policy"
>> + range 16384 1073741824
>> + depends on SECURITY
>> + default 4194304
>> + help
>> + The maximum size of the buffer argument of lsm_config_self_policy.
>> +
>> + The default value of 4194304 (4MiB) is reasonable and should be large
>> + enough to fit policies in for most cases.
>> +
>
> Do we want to define LSM_CONFIG_{SELF,SYSTEM}_POLICY_MAX_BUFFER_SIZE as
> Kconfig?
>
> If security_lsm_config_{self,system}_policy() are meant to be used by multiple
> LSM modules, the upper limit each LSM module wants to impose would vary. Also,
> 1073741824 is larger than KMALLOC_MAX_SIZE; kmalloc()-based memory copying
> functions will hit WARN_ON_ONCE_GFP() at __alloc_frozen_pages_noprof().
>
> Since some of LSM modules might use vmalloc()-based memory copying functions
> from
> security_lsm_config_{self,system}_policy(), the upper limit should be imposed
> by
> individual LSM module which provides
> security_lsm_config_{self,system}_policy().
>
That makes sense. I removed this global Kconfig and the maximum buffer
size is now defined per module.
