On Wed, Apr 09, 2025 at 02:50:13PM -0400, Paul Moore wrote:
> Add a new LSM notifier event, LSM_STARTED_ALL, which is fired once at
> boot when all of the LSMs have been started.
This is where the lsm_names string could be built too...
Reviewed-by: Kees Cook <k...@kernel.org>
>
> Signed-off-by: Paul Moore <p...@paul-moore.com>
> ---
> include/linux/security.h | 1 +
> security/lsm_init.c | 1 +
> 2 files changed, 2 insertions(+)
>
> diff --git a/include/linux/security.h b/include/linux/security.h
> index 8aac21787a9f..a0ff4fc69375 100644
> --- a/include/linux/security.h
> +++ b/include/linux/security.h
> @@ -85,6 +85,7 @@ struct timezone;
>
> enum lsm_event {
> LSM_POLICY_CHANGE,
> + LSM_STARTED_ALL,
> };
>
> struct dm_verity_digest {
> diff --git a/security/lsm_init.c b/security/lsm_init.c
> index c0881407ca3f..cad6d243a2a6 100644
> --- a/security/lsm_init.c
> +++ b/security/lsm_init.c
> @@ -553,6 +553,7 @@ static int __init security_initcall_late(void)
>
> rc = lsm_initcall(late);
> lsm_pr_dbg("all enabled LSMs fully activated\n");
> + call_blocking_lsm_notifier(LSM_STARTED_ALL, NULL);
>
> return rc;
> }
> --
> 2.49.0
>
--
Kees Cook
