Re: [RFC PATCH 28/29] lsm: add a LSM_STARTED_ALL notification event

[John Johansen]

On 4/9/25 11:50, Paul Moore wrote:

Add a new LSM notifier event, LSM_STARTED_ALL, which is fired once at
boot when all of the LSMs have been started.

Signed-off-by: Paul Moore <p...@paul-moore.com>

Reviewed-by: John Johansen <john.johan...@canonical.com>

---
  include/linux/security.h | 1 +
  security/lsm_init.c      | 1 +
  2 files changed, 2 insertions(+)

diff --git a/include/linux/security.h b/include/linux/security.h
index 8aac21787a9f..a0ff4fc69375 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -85,6 +85,7 @@ struct timezone;

enum lsm_event {

        LSM_POLICY_CHANGE,
+       LSM_STARTED_ALL,
  };

struct dm_verity_digest {

diff --git a/security/lsm_init.c b/security/lsm_init.c
index c0881407ca3f..cad6d243a2a6 100644
--- a/security/lsm_init.c
+++ b/security/lsm_init.c
@@ -553,6 +553,7 @@ static int __init security_initcall_late(void)

rc = lsm_initcall(late);

        lsm_pr_dbg("all enabled LSMs fully activated\n");
+       call_blocking_lsm_notifier(LSM_STARTED_ALL, NULL);

return rc;

  }