On Wed, Apr 9, 2025 at 2:55 PM Paul Moore <p...@paul-moore.com> wrote:
>
> SELinux currently has a number of initcalls so we've created a new
> function, selinux_initcall(), which wraps all of these initcalls so
> that we have a single initcall function that can be registered with the
> LSM framework.
>
> Signed-off-by: Paul Moore <p...@paul-moore.com>
> ---
> diff --git a/security/selinux/include/audit.h
> b/security/selinux/include/audit.h
> index d5b0425055e4..5989f8dd1e86 100644
> --- a/security/selinux/include/audit.h
> +++ b/security/selinux/include/audit.h
> @@ -15,6 +15,11 @@
> #include <linux/audit.h>
> #include <linux/types.h>
>
> +/**
> + * XXX
> + */
Assuming this will be fixed before merge.
> +int selinux_audit_rule_avc_callback(u32 event);
> +
> /**
> * selinux_audit_rule_init - alloc/init an selinux audit rule structure.
> * @field: the field this rule refers to
> diff --git a/security/selinux/include/initcalls.h
> b/security/selinux/include/initcalls.h
> new file mode 100644
> index 000000000000..6674cf489473
> --- /dev/null
> +++ b/security/selinux/include/initcalls.h
> @@ -0,0 +1,19 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/*
> + * SELinux initcalls
> + */
> +
> +#ifndef _SELINUX_INITCALLS_H
> +#define _SELINUX_INITCALLS_H
> +
> +int init_sel_fs(void);
> +int sel_netport_init(void);
> +int sel_netnode_init(void);
> +int sel_netif_init(void);
> +int sel_netlink_init(void);
> +int sel_ib_pkey_init(void);
> +int selinux_nf_ip_init(void);
The last two only exist if certain Kconfig options are set.
> +
> +int selinux_initcall(void);
> +
> +#endif
> diff --git a/security/selinux/initcalls.c b/security/selinux/initcalls.c
> new file mode 100644
> index 000000000000..81f01f8ad215
> --- /dev/null
> +++ b/security/selinux/initcalls.c
> @@ -0,0 +1,50 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/*
> + * SELinux initcalls
> + */
> +
> +#include <linux/init.h>
> +
> +#include "initcalls.h"
> +
> +/**
> + * selinux_initcall - Perform the SELinux initcalls
> + *
> + * Used as a device initcall in the SELinux LSM definition.
> + */
> +int __init selinux_initcall(void)
> +{
> + int rc = 0, rc_tmp = 0;
> +
> + rc_tmp = init_sel_fs();
> + if (!rc && rc_tmp)
> + rc = rc_tmp;
> +
> + rc_tmp = sel_netport_init();
> + if (!rc && rc_tmp)
> + rc = rc_tmp;
> +
> + rc_tmp = sel_netnode_init();
> + if (!rc && rc_tmp)
> + rc = rc_tmp;
> +
> + rc_tmp = sel_netif_init();
> + if (!rc && rc_tmp)
> + rc = rc_tmp;
> +
> + rc_tmp = sel_netlink_init();
> + if (!rc && rc_tmp)
> + rc = rc_tmp;
> +
> + rc_tmp = sel_ib_pkey_init();
This one depends on CONFIG_SECURITY_INFINIBAND.
> + if (!rc && rc_tmp)
> + rc = rc_tmp;
> +
> +#if defined(CONFIG_NETFILTER)
> + rc_tmp = selinux_nf_ip_init();
> + if (!rc && rc_tmp)
> + rc = rc_tmp;
> +#endif
> +
> + return rc;
> +}
