5 files changed, 62 insertions, 9 deletions

diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 088987e9a3ea..c1807d14daa3 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -208,8 +208,13 @@
                         __start_lsm_info = .;                           \
                         KEEP(*(.lsm_info.init))                         \
                         __end_lsm_info = .;
+#define EARLY_LSM_TABLE()       . = ALIGN(8);                           \
+                        __start_early_lsm_info = .;                     \
+                        KEEP(*(.early_lsm_info.init))                   \
+                        __end_early_lsm_info = .;
 #else
 #define LSM_TABLE()
+#define EARLY_LSM_TABLE()
 #endif
 
 #define ___OF_TABLE(cfg, name)  _OF_TABLE_##cfg(name)
@@ -609,7 +614,8 @@
         ACPI_PROBE_TABLE(irqchip)                                       \
         ACPI_PROBE_TABLE(timer)                                         \
         EARLYCON_TABLE()                                                \
-        LSM_TABLE()
+        LSM_TABLE()                                                     \
+        EARLY_LSM_TABLE()
 
 #define INIT_TEXT                                                       \
         *(.init.text .init.text.*)                                      \
diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index 47f58cfb6a19..b02e8bb6654d 100644
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -2104,12 +2104,18 @@ struct lsm_info {
 };
 
 extern struct lsm_info __start_lsm_info[], __end_lsm_info[];
+extern struct lsm_info __start_early_lsm_info[], __end_early_lsm_info[];
 
 #define DEFINE_LSM(lsm)                                                 \
         static struct lsm_info __lsm_##lsm                              \
                 __used __section(.lsm_info.init)                        \
                 __aligned(sizeof(unsigned long))
 
+#define DEFINE_EARLY_LSM(lsm)                                           \
+        static struct lsm_info __early_lsm_##lsm                        \
+                __used __section(.early_lsm_info.init)                  \
+                __aligned(sizeof(unsigned long))
+
 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
 /*
  * Assuring the safety of deleting a security module is up to
diff --git a/include/linux/security.h b/include/linux/security.h
index 659071c2e57c..c5dd90981c98 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -195,6 +195,7 @@ int unregister_lsm_notifier(struct notifier_block *nb);
 
 /* prototypes */
 extern int security_init(void);
+extern int early_security_init(void);
 
 /* Security operations */
 int security_binder_set_context_mgr(struct task_struct *mgr);
@@ -423,6 +424,11 @@ static inline int security_init(void)
         return 0;
 }
 
+static inline int early_security_init(void)
+{
+        return 0;
+}
+
 static inline int security_binder_set_context_mgr(struct task_struct *mgr)
 {
         return 0;
diff --git a/init/main.c b/init/main.c
index 66a196c5e4c3..598effd29a0a 100644
--- a/init/main.c
+++ b/init/main.c
@@ -569,6 +569,7 @@ asmlinkage __visible void __init start_kernel(void)
         boot_cpu_init();
         page_address_init();
         pr_notice("%s", linux_banner);
+        early_security_init();
         setup_arch(&command_line);
         mm_init_cpumask(&init_mm);
         setup_command_line(command_line);
diff --git a/security/security.c b/security/security.c
index f493db0bf62a..ef4a0111c8b4 100644
--- a/security/security.c
+++ b/security/security.c
@@ -33,6 +33,7 @@
 
 /* How many LSMs were built into the kernel? */
 #define LSM_COUNT (__end_lsm_info - __start_lsm_info)
+#define EARLY_LSM_COUNT (__end_early_lsm_info - __start_early_lsm_info)
 
 struct security_hook_heads security_hook_heads __lsm_ro_after_init;
 static ATOMIC_NOTIFIER_HEAD(lsm_notifier_chain);
@@ -277,6 +278,8 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
 static void __init lsm_early_cred(struct cred *cred);
 static void __init lsm_early_task(struct task_struct *task);
 
+static int lsm_append(const char *new, char **result);
+
 static void __init ordered_lsm_init(void)
 {
         struct lsm_info **lsm;
@@ -323,6 +326,26 @@ static void __init ordered_lsm_init(void)
         kfree(ordered_lsms);
 }
 
+int __init early_security_init(void)
+{
+        int i;
+        struct hlist_head *list = (struct hlist_head *) &security_hook_heads;
+        struct lsm_info *lsm;
+
+        for (i = 0; i < sizeof(security_hook_heads) / sizeof(struct hlist_head);
+             i++)
+                INIT_HLIST_HEAD(&list[i]);
+
+        for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) {
+                if (!lsm->enabled)
+                        lsm->enabled = &lsm_enabled_true;
+                prepare_lsm(lsm);
+                initialize_lsm(lsm);
+        }
+
+        return 0;
+}
+
 /**
  * security_init - initializes the security framework
  *
@@ -330,14 +353,18 @@ static void __init ordered_lsm_init(void)
  */
 int __init security_init(void)
 {
-        int i;
-        struct hlist_head *list = (struct hlist_head *) &security_hook_heads;
+        struct lsm_info *lsm;
 
         pr_info("Security Framework initializing\n");
 
-        for (i = 0; i < sizeof(security_hook_heads) / sizeof(struct hlist_head);
-             i++)
-                INIT_HLIST_HEAD(&list[i]);
+        /*
+         * Append the names of the early LSM modules now that kmalloc() is
+         * available
+         */
+        for (lsm = __start_early_lsm_info; lsm < __end_early_lsm_info; lsm++) {
+                if (lsm->enabled)
+                        lsm_append(lsm->name, &lsm_names);
+        }
 
         /* Load LSMs in specified order. */
         ordered_lsm_init();
@@ -384,7 +411,7 @@ static bool match_last_lsm(const char *list, const char *lsm)
         return !strcmp(last, lsm);
 }
 
-static int lsm_append(char *new, char **result)
+static int lsm_append(const char *new, char **result)
 {
         char *cp;
 
@@ -422,8 +449,15 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count,
                 hooks[i].lsm = lsm;
                 hlist_add_tail_rcu(&hooks[i].list, hooks[i].head);
         }
-        if (lsm_append(lsm, &lsm_names) < 0)
-                panic("%s - Cannot get early memory.\n", __func__);
+
+        /*
+         * Don't try to append during early_security_init(), we'll come back
+         * and fix this up afterwards.
+         */
+        if (slab_is_available()) {
+                if (lsm_append(lsm, &lsm_names) < 0)
+                        panic("%s - Cannot get early memory.\n", __func__);
+        }
 }
 
 int call_lsm_notifier(enum lsm_event event, void *data)