1 files changed, 87 insertions, 2 deletions

diff --git a/security/security.c b/security/security.c
index 60b39db95c2f..09be8ce007a2 100644
--- a/security/security.c
+++ b/security/security.c
@@ -41,6 +41,8 @@ struct security_hook_heads security_hook_heads __lsm_ro_after_init;
 static ATOMIC_NOTIFIER_HEAD(lsm_notifier_chain);
 
 char *lsm_names;
+static struct lsm_blob_sizes blob_sizes __lsm_ro_after_init;
+
 /* Boot-time LSM user choice */
 static __initdata const char *chosen_lsm_order;
 static __initdata const char *chosen_major_lsm;
@@ -139,6 +141,25 @@ static bool __init lsm_allowed(struct lsm_info *lsm)
         return true;
 }
 
+static void __init lsm_set_blob_size(int *need, int *lbs)
+{
+        int offset;
+
+        if (*need > 0) {
+                offset = *lbs;
+                *lbs += *need;
+                *need = offset;
+        }
+}
+
+static void __init lsm_set_blob_sizes(struct lsm_blob_sizes *needed)
+{
+        if (!needed)
+                return;
+
+        lsm_set_blob_size(&needed->lbs_cred, &blob_sizes.lbs_cred);
+}
+
 /* Prepare LSM for initialization. */
 static void __init prepare_lsm(struct lsm_info *lsm)
 {
@@ -153,6 +174,8 @@ static void __init prepare_lsm(struct lsm_info *lsm)
                         exclusive = lsm;
                         init_debug("exclusive chosen: %s\n", lsm->name);
                 }
+
+                lsm_set_blob_sizes(lsm->blobs);
         }
 }
 
@@ -255,6 +278,8 @@ static void __init ordered_lsm_init(void)
         for (lsm = ordered_lsms; *lsm; lsm++)
                 prepare_lsm(*lsm);
 
+        init_debug("cred blob size     = %d\n", blob_sizes.lbs_cred);
+
         for (lsm = ordered_lsms; *lsm; lsm++)
                 initialize_lsm(*lsm);
 
@@ -382,6 +407,47 @@ int unregister_lsm_notifier(struct notifier_block *nb)
 }
 EXPORT_SYMBOL(unregister_lsm_notifier);
 
+/**
+ * lsm_cred_alloc - allocate a composite cred blob
+ * @cred: the cred that needs a blob
+ * @gfp: allocation type
+ *
+ * Allocate the cred blob for all the modules
+ *
+ * Returns 0, or -ENOMEM if memory can't be allocated.
+ */
+static int lsm_cred_alloc(struct cred *cred, gfp_t gfp)
+{
+        if (blob_sizes.lbs_cred == 0) {
+                cred->security = NULL;
+                return 0;
+        }
+
+        cred->security = kzalloc(blob_sizes.lbs_cred, gfp);
+        if (cred->security == NULL)
+                return -ENOMEM;
+        return 0;
+}
+
+/**
+ * lsm_early_cred - during initialization allocate a composite cred blob
+ * @cred: the cred that needs a blob
+ *
+ * Allocate the cred blob for all the modules if it's not already there
+ */
+void __init lsm_early_cred(struct cred *cred)
+{
+        int rc;
+
+        if (cred == NULL)
+                panic("%s: NULL cred.\n", __func__);
+        if (cred->security != NULL)
+                return;
+        rc = lsm_cred_alloc(cred, GFP_KERNEL);
+        if (rc)
+                panic("%s: Early cred alloc failed.\n", __func__);
+}
+
 /*
  * Hook list operation macros.
  *
@@ -1195,17 +1261,36 @@ void security_task_free(struct task_struct *task)
 
 int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)
 {
-        return call_int_hook(cred_alloc_blank, 0, cred, gfp);
+        int rc = lsm_cred_alloc(cred, gfp);
+
+        if (rc)
+                return rc;
+
+        rc = call_int_hook(cred_alloc_blank, 0, cred, gfp);
+        if (rc)
+                security_cred_free(cred);
+        return rc;
 }
 
 void security_cred_free(struct cred *cred)
 {
         call_void_hook(cred_free, cred);
+
+        kfree(cred->security);
+        cred->security = NULL;
 }
 
 int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp)
 {
-        return call_int_hook(cred_prepare, 0, new, old, gfp);
+        int rc = lsm_cred_alloc(new, gfp);
+
+        if (rc)
+                return rc;
+
+        rc = call_int_hook(cred_prepare, 0, new, old, gfp);
+        if (rc)
+                security_cred_free(new);
+        return rc;
 }
 
 void security_transfer_creds(struct cred *new, const struct cred *old)