From: Chris Wright As discussed before, this allows for early initialization of security modules when compiled statically into the kernel. The standard do_initcalls is too late for complete coverage of all filesystems and threads, for example. arch/alpha/vmlinux.lds.S | 3 +++ arch/arm/vmlinux-armo.lds.in | 1 + arch/arm/vmlinux-armv.lds.in | 1 + arch/cris/vmlinux.lds.S | 7 ++++++- arch/h8300/platform/h8300h/generic/rom.ld | 1 + arch/i386/vmlinux.lds.S | 1 + arch/ia64/vmlinux.lds.S | 4 ++++ arch/m68k/vmlinux-std.lds | 1 + arch/m68k/vmlinux-sun3.lds | 1 + arch/m68knommu/vmlinux.lds.S | 4 +--- arch/mips/vmlinux.lds.S | 1 + arch/mips64/vmlinux.lds.S | 1 + arch/parisc/vmlinux.lds.S | 1 + arch/ppc/vmlinux.lds.S | 2 ++ arch/ppc64/vmlinux.lds.S | 1 + arch/s390/vmlinux.lds.S | 1 + arch/sh/vmlinux.lds.S | 1 + arch/sparc/vmlinux.lds.S | 1 + arch/sparc64/vmlinux.lds.S | 1 + arch/x86_64/vmlinux.lds.S | 1 + include/asm-generic/vmlinux.lds.h | 6 ++++++ include/linux/init.h | 6 ++++++ init/main.c | 2 +- security/capability.c | 2 +- security/root_plug.c | 2 +- security/security.c | 13 ++++++++++++- 26 files changed, 58 insertions(+), 8 deletions(-) diff -puN arch/alpha/vmlinux.lds.S~lsm-1-early-init arch/alpha/vmlinux.lds.S --- 25/arch/alpha/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/arch/alpha/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700 @@ -74,6 +74,9 @@ SECTIONS __con_initcall_end = .; } + . = ALIGN(8); + SECURITY_INIT + . = ALIGN(64); __per_cpu_start = .; .data.percpu : { *(.data.percpu) } diff -puN arch/arm/vmlinux-armo.lds.in~lsm-1-early-init arch/arm/vmlinux-armo.lds.in --- 25/arch/arm/vmlinux-armo.lds.in~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/arch/arm/vmlinux-armo.lds.in 2003-06-13 00:54:01.000000000 -0700 @@ -43,6 +43,7 @@ SECTIONS __con_initcall_start = .; *(.con_initcall.init) __con_initcall_end = .; + SECURITY_INIT . = ALIGN(32768); __init_end = .; } diff -puN arch/arm/vmlinux-armv.lds.in~lsm-1-early-init arch/arm/vmlinux-armv.lds.in --- 25/arch/arm/vmlinux-armv.lds.in~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/arch/arm/vmlinux-armv.lds.in 2003-06-13 00:54:01.000000000 -0700 @@ -53,6 +53,7 @@ SECTIONS __con_initcall_start = .; *(.con_initcall.init) __con_initcall_end = .; + SECURITY_INIT . = ALIGN(32); __initramfs_start = .; usr/built-in.o(.init.ramfs) diff -puN arch/cris/vmlinux.lds.S~lsm-1-early-init arch/cris/vmlinux.lds.S --- 25/arch/cris/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/arch/cris/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700 @@ -74,7 +74,12 @@ SECTIONS __con_initcall_start = .; *(.con_initcall.init) __con_initcall_end = .; - + } + .security_initcall.init : { + __security_initcall_start = .; + *(.security_initcall.init) + __security_initcall_end = .; + /* We fill to the next page, so we can discard all init pages without needing to consider what payload might be appended to the kernel image. */ diff -puN arch/h8300/platform/h8300h/generic/rom.ld~lsm-1-early-init arch/h8300/platform/h8300h/generic/rom.ld --- 25/arch/h8300/platform/h8300h/generic/rom.ld~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/arch/h8300/platform/h8300h/generic/rom.ld 2003-06-13 00:54:01.000000000 -0700 @@ -83,6 +83,7 @@ SECTIONS ___con_initcall_start = .; *(.con_initcall.init) ___con_initcall_end = .; + SECURITY_INIT . = ALIGN(4); ___initramfs_start = .; *(.init.ramfs) diff -puN arch/i386/vmlinux.lds.S~lsm-1-early-init arch/i386/vmlinux.lds.S --- 25/arch/i386/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/arch/i386/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700 @@ -81,6 +81,7 @@ SECTIONS __con_initcall_start = .; .con_initcall.init : { *(.con_initcall.init) } __con_initcall_end = .; + SECURITY_INIT . = ALIGN(4); __alt_instructions = .; .altinstructions : { *(.altinstructions) } diff -puN arch/ia64/vmlinux.lds.S~lsm-1-early-init arch/ia64/vmlinux.lds.S --- 25/arch/ia64/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/arch/ia64/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700 @@ -141,6 +141,10 @@ SECTIONS .con_initcall.init : AT(ADDR(.con_initcall.init) - PAGE_OFFSET) { *(.con_initcall.init) } __con_initcall_end = .; + __security_initcall_start = .; + .security_initcall.init : AT(ADDR(.security_initcall.init) - PAGE_OFFSET) + { *(.security_initcall.init) } + __security_initcall_end = .; . = ALIGN(PAGE_SIZE); __init_end = .; diff -puN arch/m68knommu/vmlinux.lds.S~lsm-1-early-init arch/m68knommu/vmlinux.lds.S --- 25/arch/m68knommu/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/arch/m68knommu/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700 @@ -277,9 +277,7 @@ SECTIONS { __con_initcall_start = .; *(.con_initcall.init) __con_initcall_end = .; - __security_initcall_start = .; - *(.security_initcall.init) - __security_initcall_end = .; + SECURITY_INIT . = ALIGN(4); __initramfs_start = .; *(.init.ramfs) diff -puN arch/m68k/vmlinux-std.lds~lsm-1-early-init arch/m68k/vmlinux-std.lds --- 25/arch/m68k/vmlinux-std.lds~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/arch/m68k/vmlinux-std.lds 2003-06-13 00:54:01.000000000 -0700 @@ -67,6 +67,7 @@ SECTIONS __con_initcall_start = .; .con_initcall.init : { *(.con_initcall.init) } __con_initcall_end = .; + SECURITY_INIT . = ALIGN(8192); __initramfs_start = .; .init.ramfs : { *(.init.ramfs) } diff -puN arch/m68k/vmlinux-sun3.lds~lsm-1-early-init arch/m68k/vmlinux-sun3.lds --- 25/arch/m68k/vmlinux-sun3.lds~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/arch/m68k/vmlinux-sun3.lds 2003-06-13 00:54:01.000000000 -0700 @@ -61,6 +61,7 @@ __init_begin = .; __con_initcall_start = .; .con_initcall.init : { *(.con_initcall.init) } __con_initcall_end = .; + SECURITY_INIT . = ALIGN(8192); __initramfs_start = .; .init.ramfs : { *(.init.ramfs) } diff -puN arch/mips64/vmlinux.lds.S~lsm-1-early-init arch/mips64/vmlinux.lds.S --- 25/arch/mips64/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/arch/mips64/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700 @@ -53,6 +53,7 @@ SECTIONS __con_initcall_start = .; .con_initcall.init : { *(.con_initcall.init) } __con_initcall_end = .; + SECURITY_INIT . = ALIGN(4096); /* Align double page for init_task_union */ __init_end = .; diff -puN arch/mips/vmlinux.lds.S~lsm-1-early-init arch/mips/vmlinux.lds.S --- 25/arch/mips/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/arch/mips/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700 @@ -54,6 +54,7 @@ SECTIONS __con_initcall_start = .; .con_initcall.init : { *(.con_initcall.init) } __con_initcall_end = .; + SECURITY_INIT . = ALIGN(4096); /* Align double page for init_task_union */ __init_end = .; diff -puN arch/parisc/vmlinux.lds.S~lsm-1-early-init arch/parisc/vmlinux.lds.S --- 25/arch/parisc/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/arch/parisc/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700 @@ -80,6 +80,7 @@ SECTIONS __con_initcall_start = .; .con_initcall.init : { *(.con_initcall.init) } __con_initcall_end = .; + SECURITY_INIT . = ALIGN(4096); __initramfs_start = .; .init.ramfs : { *(.init.ramfs) } diff -puN arch/ppc64/vmlinux.lds.S~lsm-1-early-init arch/ppc64/vmlinux.lds.S --- 25/arch/ppc64/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/arch/ppc64/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700 @@ -104,6 +104,7 @@ SECTIONS __con_initcall_start = .; .con_initcall.init : { *(.con_initcall.init) } __con_initcall_end = .; + SECURITY_INIT . = ALIGN(4096); __initramfs_start = .; .init.ramfs : { *(.init.ramfs) } diff -puN arch/ppc/vmlinux.lds.S~lsm-1-early-init arch/ppc/vmlinux.lds.S --- 25/arch/ppc/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/arch/ppc/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700 @@ -119,6 +119,8 @@ SECTIONS .con_initcall.init : { *(.con_initcall.init) } __con_initcall_end = .; + SECURITY_INIT + __start___ftr_fixup = .; __ftr_fixup : { *(__ftr_fixup) } __stop___ftr_fixup = .; diff -puN arch/s390/vmlinux.lds.S~lsm-1-early-init arch/s390/vmlinux.lds.S --- 25/arch/s390/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/arch/s390/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700 @@ -94,6 +94,7 @@ SECTIONS __con_initcall_start = .; .con_initcall.init : { *(.con_initcall.init) } __con_initcall_end = .; + SECURITY_INIT . = ALIGN(256); __initramfs_start = .; .init.ramfs : { *(.init.initramfs) } diff -puN arch/sh/vmlinux.lds.S~lsm-1-early-init arch/sh/vmlinux.lds.S --- 25/arch/sh/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/arch/sh/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700 @@ -71,6 +71,7 @@ SECTIONS __con_initcall_start = .; .con_initcall.init : { *(.con_initcall.init) } __con_initcall_end = .; + SECURITY_INIT __machvec_start = .; .machvec.init : { *(.machvec.init) } __machvec_end = .; diff -puN arch/sparc64/vmlinux.lds.S~lsm-1-early-init arch/sparc64/vmlinux.lds.S --- 25/arch/sparc64/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/arch/sparc64/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700 @@ -68,6 +68,7 @@ SECTIONS __con_initcall_start = .; .con_initcall.init : { *(.con_initcall.init) } __con_initcall_end = .; + SECURITY_INIT . = ALIGN(8192); __initramfs_start = .; .init.ramfs : { *(.init.ramfs) } diff -puN arch/sparc/vmlinux.lds.S~lsm-1-early-init arch/sparc/vmlinux.lds.S --- 25/arch/sparc/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/arch/sparc/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700 @@ -62,6 +62,7 @@ SECTIONS __con_initcall_start = .; .con_initcall.init : { *(.con_initcall.init) } __con_initcall_end = .; + SECURITY_INIT . = ALIGN(4096); __initramfs_start = .; .init.ramfs : { *(.init.ramfs) } diff -puN arch/x86_64/vmlinux.lds.S~lsm-1-early-init arch/x86_64/vmlinux.lds.S --- 25/arch/x86_64/vmlinux.lds.S~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/arch/x86_64/vmlinux.lds.S 2003-06-13 00:54:01.000000000 -0700 @@ -105,6 +105,7 @@ SECTIONS __con_initcall_start = .; .con_initcall.init : { *(.con_initcall.init) } __con_initcall_end = .; + SECURITY_INIT . = ALIGN(4096); __initramfs_start = .; .init.ramfs : { *(.init.ramfs) } diff -puN include/asm-generic/vmlinux.lds.h~lsm-1-early-init include/asm-generic/vmlinux.lds.h --- 25/include/asm-generic/vmlinux.lds.h~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/include/asm-generic/vmlinux.lds.h 2003-06-13 00:54:01.000000000 -0700 @@ -45,3 +45,9 @@ *(__ksymtab_strings) \ } +#define SECURITY_INIT \ + .security_initcall.init : { \ + __security_initcall_start = .; \ + *(.security_initcall.init) \ + __security_initcall_end = .; \ + } diff -puN include/linux/init.h~lsm-1-early-init include/linux/init.h --- 25/include/linux/init.h~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/include/linux/init.h 2003-06-13 00:54:01.000000000 -0700 @@ -64,6 +64,7 @@ typedef int (*initcall_t)(void); typedef void (*exitcall_t)(void); extern initcall_t __con_initcall_start, __con_initcall_end; +extern initcall_t __security_initcall_start, __security_initcall_end; #endif #ifndef MODULE @@ -96,6 +97,9 @@ extern initcall_t __con_initcall_start, #define console_initcall(fn) \ static initcall_t __initcall_##fn __attribute__ ((unused,__section__ (".con_initcall.init")))=fn +#define security_initcall(fn) \ + static initcall_t __initcall_##fn __attribute__ ((unused,__section__ (".security_initcall.init"))) = fn + struct obs_kernel_param { const char *str; int (*setup_func)(char *); @@ -143,6 +147,8 @@ struct obs_kernel_param { #define device_initcall(fn) module_init(fn) #define late_initcall(fn) module_init(fn) +#define security_initcall(fn) module_init(fn) + /* These macros create a dummy inline: gcc 2.9x does not count alias as usage, hence the `unused function' warning when __init functions are declared static. We use the dummy __*_module_inline functions diff -puN init/main.c~lsm-1-early-init init/main.c --- 25/init/main.c~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/init/main.c 2003-06-13 00:54:01.000000000 -0700 @@ -439,8 +439,8 @@ asmlinkage void __init start_kernel(void pte_chain_init(); fork_init(num_physpages); proc_caches_init(); - security_scaffolding_startup(); buffer_init(); + security_scaffolding_startup(); vfs_caches_init(num_physpages); radix_tree_init(); signals_init(); diff -puN security/capability.c~lsm-1-early-init security/capability.c --- 25/security/capability.c~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/security/capability.c 2003-06-13 00:54:01.000000000 -0700 @@ -348,7 +348,7 @@ static void __exit capability_exit (void } } -module_init (capability_init); +security_initcall (capability_init); module_exit (capability_exit); MODULE_DESCRIPTION("Standard Linux Capabilities Security Module"); diff -puN security/root_plug.c~lsm-1-early-init security/root_plug.c --- 25/security/root_plug.c~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/security/root_plug.c 2003-06-13 00:54:01.000000000 -0700 @@ -135,7 +135,7 @@ static void __exit rootplug_exit (void) printk (KERN_INFO "Root Plug module removed\n"); } -module_init (rootplug_init); +security_initcall (rootplug_init); module_exit (rootplug_exit); MODULE_DESCRIPTION("Root Plug sample LSM module, written for Linux Journal article"); diff -puN security/security.c~lsm-1-early-init security/security.c --- 25/security/security.c~lsm-1-early-init 2003-06-13 00:54:01.000000000 -0700 +++ 25-akpm/security/security.c 2003-06-13 00:54:01.000000000 -0700 @@ -38,12 +38,22 @@ static inline int verify (struct securit return 0; } +static void __init do_security_initcalls(void) +{ + initcall_t *call; + call = &__security_initcall_start; + while (call < &__security_initcall_end) { + (*call)(); + call++; + } +} + /** * security_scaffolding_startup - initialzes the security scaffolding framework * * This should be called early in the kernel initialization sequence. */ -int security_scaffolding_startup (void) +int __init security_scaffolding_startup (void) { printk (KERN_INFO "Security Scaffold v" SECURITY_SCAFFOLD_VERSION " initialized\n"); @@ -55,6 +65,7 @@ int security_scaffolding_startup (void) } security_ops = &dummy_security_ops; + do_security_initcalls(); return 0; } _