Re: [RFC PATCH 23/29] apparmor: move initcalls to the LSM framework

[John Johansen]

On 4/9/25 11:50, Paul Moore wrote:

Signed-off-by: Paul Moore <p...@paul-moore.com>

Acked-by: John Johansen <john.johan...@canonical.com>

---
  security/apparmor/apparmorfs.c         | 4 +---
  security/apparmor/crypto.c             | 4 +---
  security/apparmor/include/apparmorfs.h | 2 ++
  security/apparmor/include/crypto.h     | 1 +
  security/apparmor/lsm.c                | 9 ++++++++-
  5 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index 6039afae4bfc..0a7550a5bceb 100644
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -2632,7 +2632,7 @@ static const struct inode_operations policy_link_iops = {
   *
   * Returns: error on failure
   */
-static int __init aa_create_aafs(void)
+int __init aa_create_aafs(void)
  {
        struct dentry *dent;
        int error;
@@ -2711,5 +2711,3 @@ static int __init aa_create_aafs(void)
        AA_ERROR("Error creating AppArmor securityfs\n");
        return error;
  }
-
-fs_initcall(aa_create_aafs);
diff --git a/security/apparmor/crypto.c b/security/apparmor/crypto.c
index aad486b2fca6..e4395c1bfac5 100644
--- a/security/apparmor/crypto.c
+++ b/security/apparmor/crypto.c
@@ -99,7 +99,7 @@ int aa_calc_profile_hash(struct aa_profile *profile, u32 
version, void *start,
        return error;
  }

-static int __init init_profile_hash(void)

+int __init init_profile_hash(void)
  {
        struct crypto_shash *tfm;

@@ -119,5 +119,3 @@ static int __init init_profile_hash(void) return 0;

  }
-
-late_initcall(init_profile_hash);
diff --git a/security/apparmor/include/apparmorfs.h 
b/security/apparmor/include/apparmorfs.h
index 1e94904f68d9..dd580594dfb7 100644
--- a/security/apparmor/include/apparmorfs.h
+++ b/security/apparmor/include/apparmorfs.h
@@ -104,6 +104,8 @@ enum aafs_prof_type {
  #define prof_dir(X) ((X)->dents[AAFS_PROF_DIR])
  #define prof_child_dir(X) ((X)->dents[AAFS_PROF_PROFS])

+int aa_create_aafs(void);

+
  void __aa_bump_ns_revision(struct aa_ns *ns);
  void __aafs_profile_rmdir(struct aa_profile *profile);
  void __aafs_profile_migrate_dents(struct aa_profile *old,
diff --git a/security/apparmor/include/crypto.h 
b/security/apparmor/include/crypto.h
index 636a04e20d91..f3ffd388cc58 100644
--- a/security/apparmor/include/crypto.h
+++ b/security/apparmor/include/crypto.h
@@ -13,6 +13,7 @@
  #include "policy.h"

#ifdef CONFIG_SECURITY_APPARMOR_HASH

+int init_profile_hash(void);
  unsigned int aa_hash_size(void);
  char *aa_calc_hash(void *data, size_t len);
  int aa_calc_profile_hash(struct aa_profile *profile, u32 version, void *start,
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index a7f6a3274682..2fefaab6349f 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -31,6 +31,7 @@
  #include "include/audit.h"
  #include "include/capability.h"
  #include "include/cred.h"
+#include "include/crypto.h"
  #include "include/file.h"
  #include "include/ipc.h"
  #include "include/net.h"
@@ -2146,7 +2147,6 @@ static int __init apparmor_nf_ip_init(void)

return 0;

  }
-__initcall(apparmor_nf_ip_init);
  #endif

static char nulldfa_src[] = {

@@ -2277,4 +2277,11 @@ DEFINE_LSM(apparmor) = {
        .enabled = &apparmor_enabled,
        .blobs = &apparmor_blob_sizes,
        .init = apparmor_init,
+       .initcall_fs = aa_create_aafs,
+#if defined(CONFIG_NETFILTER) && defined(CONFIG_NETWORK_SECMARK)
+       .initcall_device = apparmor_nf_ip_init,
+#endif
+#ifdef CONFIG_SECURITY_APPARMOR_HASH
+       .initcall_late = init_profile_hash,
+#endif
  };