Re: [PATCH security-next v3 06/29] vmlinux.lds.h: Move LSM_TABLE into INIT_DATA

[John Johansen]

On 09/24/2018 05:18 PM, Kees Cook wrote:
> Since the struct lsm_info table is not an initcall, we can just move it
> into INIT_DATA like all the other tables.
> 
> Cc: linux-arch@xxxxxxxxxxxxxxx
> Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>


Reviewed-by: John Johansen <john.johansen@xxxxxxxxxxxxx>


> ---
>  arch/arc/kernel/vmlinux.lds.S        |  1 -
>  arch/arm/kernel/vmlinux-xip.lds.S    |  1 -
>  arch/arm64/kernel/vmlinux.lds.S      |  1 -
>  arch/h8300/kernel/vmlinux.lds.S      |  1 -
>  arch/microblaze/kernel/vmlinux.lds.S |  2 --
>  arch/powerpc/kernel/vmlinux.lds.S    |  2 --
>  arch/um/include/asm/common.lds.S     |  2 --
>  arch/xtensa/kernel/vmlinux.lds.S     |  1 -
>  include/asm-generic/vmlinux.lds.h    | 24 +++++++++++-------------
>  9 files changed, 11 insertions(+), 24 deletions(-)
> 
> diff --git a/arch/arc/kernel/vmlinux.lds.S b/arch/arc/kernel/vmlinux.lds.S
> index f35ed578e007..8fb16bdabdcf 100644
> --- a/arch/arc/kernel/vmlinux.lds.S
> +++ b/arch/arc/kernel/vmlinux.lds.S
> @@ -71,7 +71,6 @@ SECTIONS
>  		INIT_SETUP(L1_CACHE_BYTES)
>  		INIT_CALLS
>  		CON_INITCALL
> -		SECURITY_INITCALL
>  	}
>  
>  	.init.arch.info : {
> diff --git a/arch/arm/kernel/vmlinux-xip.lds.S b/arch/arm/kernel/vmlinux-xip.lds.S
> index 3593d5c1acd2..8c74037ade22 100644
> --- a/arch/arm/kernel/vmlinux-xip.lds.S
> +++ b/arch/arm/kernel/vmlinux-xip.lds.S
> @@ -96,7 +96,6 @@ SECTIONS
>  		INIT_SETUP(16)
>  		INIT_CALLS
>  		CON_INITCALL
> -		SECURITY_INITCALL
>  		INIT_RAM_FS
>  	}
>  
> diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
> index 605d1b60469c..7d23d591b03c 100644
> --- a/arch/arm64/kernel/vmlinux.lds.S
> +++ b/arch/arm64/kernel/vmlinux.lds.S
> @@ -166,7 +166,6 @@ SECTIONS
>  		INIT_SETUP(16)
>  		INIT_CALLS
>  		CON_INITCALL
> -		SECURITY_INITCALL
>  		INIT_RAM_FS
>  		*(.init.rodata.* .init.bss)	/* from the EFI stub */
>  	}
> diff --git a/arch/h8300/kernel/vmlinux.lds.S b/arch/h8300/kernel/vmlinux.lds.S
> index 35716a3048de..49f716c0a1df 100644
> --- a/arch/h8300/kernel/vmlinux.lds.S
> +++ b/arch/h8300/kernel/vmlinux.lds.S
> @@ -56,7 +56,6 @@ SECTIONS
>  	__init_begin = .;
>  	INIT_TEXT_SECTION(4)
>  	INIT_DATA_SECTION(4)
> -	SECURITY_INIT
>  	__init_end = .;
>  	_edata = . ;
>  	_begin_data = LOADADDR(.data);
> diff --git a/arch/microblaze/kernel/vmlinux.lds.S b/arch/microblaze/kernel/vmlinux.lds.S
> index 289d0e7f3e3a..e1f3e8741292 100644
> --- a/arch/microblaze/kernel/vmlinux.lds.S
> +++ b/arch/microblaze/kernel/vmlinux.lds.S
> @@ -117,8 +117,6 @@ SECTIONS {
>  		CON_INITCALL
>  	}
>  
> -	SECURITY_INIT
> -
>  	__init_end_before_initramfs = .;
>  
>  	.init.ramfs : AT(ADDR(.init.ramfs) - LOAD_OFFSET) {
> diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
> index 07ae018e550e..105a976323aa 100644
> --- a/arch/powerpc/kernel/vmlinux.lds.S
> +++ b/arch/powerpc/kernel/vmlinux.lds.S
> @@ -212,8 +212,6 @@ SECTIONS
>  		CON_INITCALL
>  	}
>  
> -	SECURITY_INIT
> -
>  	. = ALIGN(8);
>  	__ftr_fixup : AT(ADDR(__ftr_fixup) - LOAD_OFFSET) {
>  		__start___ftr_fixup = .;
> diff --git a/arch/um/include/asm/common.lds.S b/arch/um/include/asm/common.lds.S
> index 7adb4e6b658a..4049f2c46387 100644
> --- a/arch/um/include/asm/common.lds.S
> +++ b/arch/um/include/asm/common.lds.S
> @@ -53,8 +53,6 @@
>  	CON_INITCALL
>    }
>  
> -  SECURITY_INIT
> -
>    .exitcall : {
>  	__exitcall_begin = .;
>  	*(.exitcall.exit)
> diff --git a/arch/xtensa/kernel/vmlinux.lds.S b/arch/xtensa/kernel/vmlinux.lds.S
> index a1c3edb8ad56..b727b18a68ac 100644
> --- a/arch/xtensa/kernel/vmlinux.lds.S
> +++ b/arch/xtensa/kernel/vmlinux.lds.S
> @@ -197,7 +197,6 @@ SECTIONS
>      INIT_SETUP(XCHAL_ICACHE_LINESIZE)
>      INIT_CALLS
>      CON_INITCALL
> -    SECURITY_INITCALL
>      INIT_RAM_FS
>    }
>  
> diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
> index 5079a969e612..b31ea8bdfef9 100644
> --- a/include/asm-generic/vmlinux.lds.h
> +++ b/include/asm-generic/vmlinux.lds.h
> @@ -203,6 +203,15 @@
>  #define EARLYCON_TABLE()
>  #endif
>  
> +#ifdef CONFIG_SECURITY
> +#define LSM_TABLE()	. = ALIGN(8);					\
> +			__start_lsm_info = .;				\
> +			KEEP(*(.lsm_info.init))				\
> +			__end_lsm_info = .;
> +#else
> +#define LSM_TABLE()
> +#endif
> +
>  #define ___OF_TABLE(cfg, name)	_OF_TABLE_##cfg(name)
>  #define __OF_TABLE(cfg, name)	___OF_TABLE(cfg, name)
>  #define OF_TABLE(cfg, name)	__OF_TABLE(IS_ENABLED(cfg), name)
> @@ -597,7 +606,8 @@
>  	IRQCHIP_OF_MATCH_TABLE()					\
>  	ACPI_PROBE_TABLE(irqchip)					\
>  	ACPI_PROBE_TABLE(timer)						\
> -	EARLYCON_TABLE()
> +	EARLYCON_TABLE()						\
> +	LSM_TABLE()
>  
>  #define INIT_TEXT							\
>  	*(.init.text .init.text.*)					\
> @@ -786,17 +796,6 @@
>  		KEEP(*(.con_initcall.init))				\
>  		__con_initcall_end = .;
>  
> -#define SECURITY_INITCALL						\
> -		__start_lsm_info = .;					\
> -		KEEP(*(.lsm_info.init))					\
> -		__end_lsm_info = .;
> -
> -/* Older linker script style for security init. */
> -#define SECURITY_INIT							\
> -	.lsm_info.init : AT(ADDR(.lsm_info.init) - LOAD_OFFSET) {	\
> -		LSM_INFO						\
> -	}
> -
>  #ifdef CONFIG_BLK_DEV_INITRD
>  #define INIT_RAM_FS							\
>  	. = ALIGN(4);							\
> @@ -963,7 +962,6 @@
>  		INIT_SETUP(initsetup_align)				\
>  		INIT_CALLS						\
>  		CON_INITCALL						\
> -		SECURITY_INITCALL					\
>  		INIT_RAM_FS						\
>  	}
>  
>