Merge branch 'next-general' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

Pull security subsystem updates from James Morris:
 "In this patchset, there are a couple of minor updates, as well as some
  reworking of the LSM initialization code from Kees Cook (these prepare
  the way for ordered stackable LSMs, but are a valuable cleanup on
  their own)"

* 'next-general' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  LSM: Don't ignore initialization failures
  LSM: Provide init debugging infrastructure
  LSM: Record LSM name in struct lsm_info
  LSM: Convert security_initcall() into DEFINE_LSM()
  vmlinux.lds.h: Move LSM_TABLE into INIT_DATA
  LSM: Convert from initcall to struct lsm_info
  LSM: Remove initcall tracing
  LSM: Rename .security_initcall section to .lsm_info
  vmlinux.lds.h: Avoid copy/paste of security_init section
  LSM: Correctly announce start of LSM initialization
  security: fix LSM description location
  keys: Fix the use of the C++ keyword "private" in uapi/linux/keyctl.h
  seccomp: remove unnecessary unlikely()
  security: tomoyo: Fix obsolete function
  security/capabilities: remove check for -EINVAL

1 files changed, 27 insertions, 16 deletions

diff --git a/security/security.c b/security/security.c
index 0d504fceda8b..04d173eb93f6 100644
--- a/security/security.c
+++ b/security/security.c
@@ -12,6 +12,8 @@
  *      (at your option) any later version.
  */
 
+#define pr_fmt(fmt) "LSM: " fmt
+
 #include <linux/bpf.h>
 #include <linux/capability.h>
 #include <linux/dcache.h>
@@ -30,8 +32,6 @@
 #include <linux/string.h>
 #include <net/flow.h>
 
-#include <trace/events/initcall.h>
-
 #define MAX_LSM_EVM_XATTR       2
 
 /* Maximum number of letters for an LSM name string */
@@ -45,20 +45,22 @@ char *lsm_names;
 static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] =
         CONFIG_DEFAULT_SECURITY;
 
-static void __init do_security_initcalls(void)
+static __initdata bool debug;
+#define init_debug(...)                                         \
+        do {                                                    \
+                if (debug)                                      \
+                        pr_info(__VA_ARGS__);                   \
+        } while (0)
+
+static void __init major_lsm_init(void)
 {
+        struct lsm_info *lsm;
         int ret;
-        initcall_t call;
-        initcall_entry_t *ce;
-
-        ce = __security_initcall_start;
-        trace_initcall_level("security");
-        while (ce < __security_initcall_end) {
-                call = initcall_from_entry(ce);
-                trace_initcall_start(call);
-                ret = call();
-                trace_initcall_finish(call, ret);
-                ce++;
+
+        for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
+                init_debug("initializing %s\n", lsm->name);
+                ret = lsm->init();
+                WARN(ret, "%s failed to initialize: %d\n", lsm->name, ret);
         }
 }
 
@@ -72,10 +74,11 @@ int __init security_init(void)
         int i;
         struct hlist_head *list = (struct hlist_head *) &security_hook_heads;
 
+        pr_info("Security Framework initializing\n");
+
         for (i = 0; i < sizeof(security_hook_heads) / sizeof(struct hlist_head);
              i++)
                 INIT_HLIST_HEAD(&list[i]);
-        pr_info("Security Framework initialized\n");
 
         /*
          * Load minor LSMs, with the capability module always first.
@@ -87,7 +90,7 @@ int __init security_init(void)
         /*
          * Load all the remaining security modules.
          */
-        do_security_initcalls();
+        major_lsm_init();
 
         return 0;
 }
@@ -100,6 +103,14 @@ static int __init choose_lsm(char *str)
 }
 __setup("security=", choose_lsm);
 
+/* Enable LSM order debugging. */
+static int __init enable_debug(char *str)
+{
+        debug = true;
+        return 1;
+}
+__setup("lsm.debug", enable_debug);
+
 static bool match_last_lsm(const char *list, const char *lsm)
 {
         const char *last;