summaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
authorKees Cook <keescook@chromium.org>2022-12-09 11:57:44 -0800
committerKees Cook <keescook@chromium.org>2023-01-19 15:18:20 -0800
commit2cfaa84efc25e52f116507a2e69781a40c4dda41 (patch)
tree090ccd8eebe808c35e4cd953799c9102959c70b0 /security
parent60ba1028fc7b73e3cfbcfe7087a2e87e8b1fd208 (diff)
downloadlinux-stable-2cfaa84efc25e52f116507a2e69781a40c4dda41.tar.gz
linux-stable-2cfaa84efc25e52f116507a2e69781a40c4dda41.tar.bz2
linux-stable-2cfaa84efc25e52f116507a2e69781a40c4dda41.zip
LoadPin: Move pin reporting cleanly out of locking
Refactor the pin reporting to be more cleanly outside the locking. It was already, but moving it around helps clear the path for the root to switch when not enforcing. Cc: Paul Moore <paul@paul-moore.com> Cc: James Morris <jmorris@namei.org> Cc: "Serge E. Hallyn" <serge@hallyn.com> Cc: linux-security-module@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Serge Hallyn <serge@hallyn.com> Link: https://lore.kernel.org/r/20221209195746.1366607-3-keescook@chromium.org
Diffstat (limited to 'security')
-rw-r--r--security/loadpin/loadpin.c15
1 files changed, 6 insertions, 9 deletions
diff --git a/security/loadpin/loadpin.c b/security/loadpin/loadpin.c
index 5b15f8f7268d..ef12d77548ae 100644
--- a/security/loadpin/loadpin.c
+++ b/security/loadpin/loadpin.c
@@ -131,6 +131,7 @@ static int loadpin_check(struct file *file, enum kernel_read_file_id id)
{
struct super_block *load_root;
const char *origin = kernel_read_file_id_str(id);
+ bool first_root_pin = false;
bool load_root_writable;
/* If the file id is excluded, ignore the pinning. */
@@ -162,18 +163,14 @@ static int loadpin_check(struct file *file, enum kernel_read_file_id id)
*/
if (!pinned_root) {
pinned_root = load_root;
- /*
- * Unlock now since it's only pinned_root we care about.
- * In the worst case, we will (correctly) report pinning
- * failures before we have announced that pinning is
- * enforcing. This would be purely cosmetic.
- */
- spin_unlock(&pinned_root_spinlock);
+ first_root_pin = true;
+ }
+ spin_unlock(&pinned_root_spinlock);
+
+ if (first_root_pin) {
report_writable(pinned_root, load_root_writable);
set_sysctl(load_root_writable);
report_load(origin, file, "pinned");
- } else {
- spin_unlock(&pinned_root_spinlock);
}
if (IS_ERR_OR_NULL(pinned_root) ||