Andrew Lukoshko
0eab958d1f
Add the RHEL 211.21.1..211.22.1 backports (1288-1351) from centos-stream-10 and upstream stable, on top of 211.20.1. Bump pkgrelease and specrelease to 211.22.1. (The redhat/ automotive rebuild-changelog tooling change is omitted: it patches redhat/scripts not present in this build base and does not affect the kernel.)
87 lines
2.5 KiB
Diff
87 lines
2.5 KiB
Diff
From 4190f2549074d006122a76cdcb2a5b361d59d650 Mon Sep 17 00:00:00 2001
|
|
From: Ondrej Mosnacek <omosnace@redhat.com>
|
|
Date: Mon, 1 Jun 2026 10:20:31 +0200
|
|
Subject: [PATCH] lsm: integrate report_lsm_order() code into caller
|
|
|
|
JIRA: https://issues.redhat.com/browse/RHEL-179440
|
|
CVE: CVE-2026-46054
|
|
|
|
commit cb1513db7a6ed82d22853608d78bbf72ad8c67c1
|
|
Author: Paul Moore <paul@paul-moore.com>
|
|
Date: Sat Jul 12 16:10:15 2025 -0400
|
|
|
|
lsm: integrate report_lsm_order() code into caller
|
|
|
|
With only one caller of report_lsm_order(), insert the function's code
|
|
directly into the caller and ger rid of report_lsm_order().
|
|
|
|
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
|
|
Reviewed-by: John Johansen <john.johhansen@canonical.com>
|
|
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
|
|
Signed-off-by: Paul Moore <paul@paul-moore.com>
|
|
|
|
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
|
|
|
|
diff --git a/security/lsm_init.c b/security/lsm_init.c
|
|
index 2424975ca0eb..fc40d37c3321 100644
|
|
--- a/security/lsm_init.c
|
|
+++ b/security/lsm_init.c
|
|
@@ -288,26 +288,6 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
|
|
kfree(sep);
|
|
}
|
|
|
|
-static void __init report_lsm_order(void)
|
|
-{
|
|
- struct lsm_info **lsm, *early;
|
|
- int first = 0;
|
|
-
|
|
- pr_info("initializing lsm=");
|
|
-
|
|
- /* Report each enabled LSM name, comma separated. */
|
|
- lsm_early_for_each_raw(early) {
|
|
- if (is_enabled(early))
|
|
- pr_cont("%s%s", first++ == 0 ? "" : ",", early->name);
|
|
- }
|
|
- lsm_order_for_each(lsm) {
|
|
- if (is_enabled(*lsm))
|
|
- pr_cont("%s%s", first++ == 0 ? "" : ",", (*lsm)->name);
|
|
- }
|
|
-
|
|
- pr_cont("\n");
|
|
-}
|
|
-
|
|
/**
|
|
* lsm_early_cred - during initialization allocate a composite cred blob
|
|
* @cred: the cred that needs a blob
|
|
@@ -338,7 +318,9 @@ static void __init lsm_early_task(struct task_struct *task)
|
|
|
|
static void __init ordered_lsm_init(void)
|
|
{
|
|
+ unsigned int first = 0;
|
|
struct lsm_info **lsm;
|
|
+ struct lsm_info *early;
|
|
|
|
if (chosen_lsm_order) {
|
|
if (chosen_major_lsm) {
|
|
@@ -354,7 +336,16 @@ static void __init ordered_lsm_init(void)
|
|
lsm_prepare(*lsm);
|
|
}
|
|
|
|
- report_lsm_order();
|
|
+ pr_info("initializing lsm=");
|
|
+ lsm_early_for_each_raw(early) {
|
|
+ if (is_enabled(early))
|
|
+ pr_cont("%s%s", first++ == 0 ? "" : ",", early->name);
|
|
+ }
|
|
+ lsm_order_for_each(lsm) {
|
|
+ if (is_enabled(*lsm))
|
|
+ pr_cont("%s%s", first++ == 0 ? "" : ",", (*lsm)->name);
|
|
+ }
|
|
+ pr_cont("\n");
|
|
|
|
init_debug("cred blob size = %d\n", blob_sizes.lbs_cred);
|
|
init_debug("file blob size = %d\n", blob_sizes.lbs_file);
|
|
--
|
|
2.50.1 (Apple Git-155)
|
|
|