Pull security module updates from Paul Moore: - Add three new syscalls: lsm_list_modules(), lsm_get_self_attr(), and lsm_set_self_attr(). The first syscall simply lists the LSMs enabled, while the second and third get and set the current process' LSM attributes. Yes, these syscalls may provide similar functionality to what can be found under /proc or /sys, but they were designed to support multiple, simultaneaous (stacked) LSMs from the start as opposed to the current /proc based solutions which were created at a time when only one LSM was allowed to be active at a given time. We have spent considerable time discussing ways to extend the existing /proc interfaces to support multiple, simultaneaous LSMs and even our best ideas have been far too ugly to support as a kernel API; after +20 years in the kernel, I felt the LSM layer had established itself enough to justify a handful of syscalls. Support amongst the individual LSM developers has been nearly unanimous, with a single objection coming from Tetsuo (TOMOYO) as he is worried that the LSM_ID_XXX token concept will make it more difficult for out-of-tree LSMs to survive. Several members of the LSM community have demonstrated the ability for out-of-tree LSMs to continue to exist by picking high/unused LSM_ID values as well as pointing out that many kernel APIs rely on integer identifiers, e.g. syscalls (!), but unfortunately Tetsuo's objections remain. My personal opinion is that while I have no interest in penalizing out-of-tree LSMs, I'm not going to penalize in-tree development to support out-of-tree development, and I view this as a necessary step forward to support the push for expanded LSM stacking and reduce our reliance on /proc and /sys which has occassionally been problematic for some container users. Finally, we have included the linux-api folks on (all?) recent revisions of the patchset and addressed all of their concerns. - Add a new security_file_ioctl_compat() LSM hook to handle the 32-bit ioctls on 64-bit systems problem. This patch includes support for all of the existing LSMs which provide ioctl hooks, although it turns out only SELinux actually cares about the individual ioctls. It is worth noting that while Casey (Smack) and Tetsuo (TOMOYO) did not give explicit ACKs to this patch, they did both indicate they are okay with the changes. - Fix a potential memory leak in the CALIPSO code when IPv6 is disabled at boot. While it's good that we are fixing this, I doubt this is something users are seeing in the wild as you need to both disable IPv6 and then attempt to configure IPv6 labeled networking via NetLabel/CALIPSO; that just doesn't make much sense. Normally this would go through netdev, but Jakub asked me to take this patch and of all the trees I maintain, the LSM tree seemed like the best fit. - Update the LSM MAINTAINERS entry with additional information about our process docs, patchwork, bug reporting, etc. I also noticed that the Lockdown LSM is missing a dedicated MAINTAINERS entry so I've added that to the pull request. I've been working with one of the major Lockdown authors/contributors to see if they are willing to step up and assume a Lockdown maintainer role; hopefully that will happen soon, but in the meantime I'll continue to look after it. - Add a handful of mailmap entries for Serge Hallyn and myself. * tag 'lsm-pr-20240105' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: (27 commits) lsm: new security_file_ioctl_compat() hook lsm: Add a __counted_by() annotation to lsm_ctx.ctx calipso: fix memory leak in netlbl_calipso_add_pass() selftests: remove the LSM_ID_IMA check in lsm/lsm_list_modules_test MAINTAINERS: add an entry for the lockdown LSM MAINTAINERS: update the LSM entry mailmap: add entries for Serge Hallyn's dead accounts mailmap: update/replace my old email addresses lsm: mark the lsm_id variables are marked as static lsm: convert security_setselfattr() to use memdup_user() lsm: align based on pointer length in lsm_fill_user_ctx() lsm: consolidate buffer size handling into lsm_fill_user_ctx() lsm: correct error codes in security_getselfattr() lsm: cleanup the size counters in security_getselfattr() lsm: don't yet account for IMA in LSM_CONFIG_COUNT calculation lsm: drop LSM_ID_IMA LSM: selftests for Linux Security Module syscalls SELinux: Add selfattr hooks AppArmor: Add selfattr hooks Smack: implement setselfattr and getselfattr hooks ...
279 lines
7.7 KiB
Makefile
279 lines
7.7 KiB
Makefile
# SPDX-License-Identifier: GPL-2.0
|
|
TARGETS += alsa
|
|
TARGETS += amd-pstate
|
|
TARGETS += arm64
|
|
TARGETS += bpf
|
|
TARGETS += breakpoints
|
|
TARGETS += cachestat
|
|
TARGETS += capabilities
|
|
TARGETS += cgroup
|
|
TARGETS += clone3
|
|
TARGETS += connector
|
|
TARGETS += core
|
|
TARGETS += cpufreq
|
|
TARGETS += cpu-hotplug
|
|
TARGETS += damon
|
|
TARGETS += dmabuf-heaps
|
|
TARGETS += drivers/dma-buf
|
|
TARGETS += drivers/s390x/uvdevice
|
|
TARGETS += drivers/net/bonding
|
|
TARGETS += drivers/net/team
|
|
TARGETS += dt
|
|
TARGETS += efivarfs
|
|
TARGETS += exec
|
|
TARGETS += fchmodat2
|
|
TARGETS += filesystems
|
|
TARGETS += filesystems/binderfs
|
|
TARGETS += filesystems/epoll
|
|
TARGETS += filesystems/fat
|
|
TARGETS += filesystems/overlayfs
|
|
TARGETS += filesystems/statmount
|
|
TARGETS += firmware
|
|
TARGETS += fpu
|
|
TARGETS += ftrace
|
|
TARGETS += futex
|
|
TARGETS += gpio
|
|
TARGETS += hid
|
|
TARGETS += intel_pstate
|
|
TARGETS += iommu
|
|
TARGETS += ipc
|
|
TARGETS += ir
|
|
TARGETS += kcmp
|
|
TARGETS += kexec
|
|
TARGETS += kvm
|
|
TARGETS += landlock
|
|
TARGETS += lib
|
|
TARGETS += livepatch
|
|
TARGETS += lkdtm
|
|
TARGETS += lsm
|
|
TARGETS += membarrier
|
|
TARGETS += memfd
|
|
TARGETS += memory-hotplug
|
|
TARGETS += mincore
|
|
TARGETS += mount
|
|
TARGETS += mount_setattr
|
|
TARGETS += move_mount_set_group
|
|
TARGETS += mqueue
|
|
TARGETS += nci
|
|
TARGETS += net
|
|
TARGETS += net/af_unix
|
|
TARGETS += net/forwarding
|
|
TARGETS += net/hsr
|
|
TARGETS += net/mptcp
|
|
TARGETS += net/openvswitch
|
|
TARGETS += netfilter
|
|
TARGETS += nsfs
|
|
TARGETS += perf_events
|
|
TARGETS += pidfd
|
|
TARGETS += pid_namespace
|
|
TARGETS += powerpc
|
|
TARGETS += prctl
|
|
TARGETS += proc
|
|
TARGETS += pstore
|
|
TARGETS += ptrace
|
|
TARGETS += openat2
|
|
TARGETS += resctrl
|
|
TARGETS += riscv
|
|
TARGETS += rlimits
|
|
TARGETS += rseq
|
|
TARGETS += rtc
|
|
TARGETS += seccomp
|
|
TARGETS += sgx
|
|
TARGETS += sigaltstack
|
|
TARGETS += size
|
|
TARGETS += sparc64
|
|
TARGETS += splice
|
|
TARGETS += static_keys
|
|
TARGETS += sync
|
|
TARGETS += syscall_user_dispatch
|
|
TARGETS += sysctl
|
|
TARGETS += tc-testing
|
|
TARGETS += tdx
|
|
TARGETS += thermal/intel/power_floor
|
|
TARGETS += thermal/intel/workload_hint
|
|
TARGETS += timens
|
|
ifneq (1, $(quicktest))
|
|
TARGETS += timers
|
|
endif
|
|
TARGETS += tmpfs
|
|
TARGETS += tpm2
|
|
TARGETS += tty
|
|
TARGETS += uevent
|
|
TARGETS += user
|
|
TARGETS += user_events
|
|
TARGETS += vDSO
|
|
TARGETS += mm
|
|
TARGETS += x86
|
|
TARGETS += zram
|
|
#Please keep the TARGETS list alphabetically sorted
|
|
# Run "make quicktest=1 run_tests" or
|
|
# "make quicktest=1 kselftest" from top level Makefile
|
|
|
|
TARGETS_HOTPLUG = cpu-hotplug
|
|
TARGETS_HOTPLUG += memory-hotplug
|
|
|
|
# User can optionally provide a TARGETS skiplist. By default we skip
|
|
# BPF since it has cutting edge build time dependencies which require
|
|
# more effort to install.
|
|
SKIP_TARGETS ?= bpf
|
|
ifneq ($(SKIP_TARGETS),)
|
|
TMP := $(filter-out $(SKIP_TARGETS), $(TARGETS))
|
|
override TARGETS := $(TMP)
|
|
endif
|
|
|
|
# User can set FORCE_TARGETS to 1 to require all targets to be successfully
|
|
# built; make will fail if any of the targets cannot be built. If
|
|
# FORCE_TARGETS is not set (the default), make will succeed if at least one
|
|
# of the targets gets built.
|
|
FORCE_TARGETS ?=
|
|
|
|
# Clear LDFLAGS and MAKEFLAGS when implicit rules are missing. This provides
|
|
# implicit rules to sub-test Makefiles which avoids build failures in test
|
|
# Makefile that don't have explicit build rules.
|
|
ifeq (,$(LINK.c))
|
|
override LDFLAGS =
|
|
override MAKEFLAGS =
|
|
endif
|
|
|
|
# Append kselftest to KBUILD_OUTPUT and O to avoid cluttering
|
|
# KBUILD_OUTPUT with selftest objects and headers installed
|
|
# by selftests Makefile or lib.mk.
|
|
ifdef building_out_of_srctree
|
|
override LDFLAGS =
|
|
endif
|
|
|
|
top_srcdir ?= ../../..
|
|
|
|
ifeq ("$(origin O)", "command line")
|
|
KBUILD_OUTPUT := $(O)
|
|
endif
|
|
|
|
ifneq ($(KBUILD_OUTPUT),)
|
|
# Make's built-in functions such as $(abspath ...), $(realpath ...) cannot
|
|
# expand a shell special character '~'. We use a somewhat tedious way here.
|
|
abs_objtree := $(shell cd $(top_srcdir) && mkdir -p $(KBUILD_OUTPUT) && cd $(KBUILD_OUTPUT) && pwd)
|
|
$(if $(abs_objtree),, \
|
|
$(error failed to create output directory "$(KBUILD_OUTPUT)"))
|
|
# $(realpath ...) resolves symlinks
|
|
abs_objtree := $(realpath $(abs_objtree))
|
|
BUILD := $(abs_objtree)/kselftest
|
|
KHDR_INCLUDES := -isystem ${abs_objtree}/usr/include
|
|
else
|
|
BUILD := $(CURDIR)
|
|
abs_srctree := $(shell cd $(top_srcdir) && pwd)
|
|
KHDR_INCLUDES := -isystem ${abs_srctree}/usr/include
|
|
DEFAULT_INSTALL_HDR_PATH := 1
|
|
endif
|
|
|
|
# Prepare for headers install
|
|
include $(top_srcdir)/scripts/subarch.include
|
|
ARCH ?= $(SUBARCH)
|
|
export BUILD
|
|
export KHDR_INCLUDES
|
|
|
|
# set default goal to all, so make without a target runs all, even when
|
|
# all isn't the first target in the file.
|
|
.DEFAULT_GOAL := all
|
|
|
|
all:
|
|
@ret=1; \
|
|
for TARGET in $(TARGETS); do \
|
|
BUILD_TARGET=$$BUILD/$$TARGET; \
|
|
mkdir $$BUILD_TARGET -p; \
|
|
$(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET \
|
|
O=$(abs_objtree) \
|
|
$(if $(FORCE_TARGETS),|| exit); \
|
|
ret=$$((ret * $$?)); \
|
|
done; exit $$ret;
|
|
|
|
run_tests: all
|
|
@for TARGET in $(TARGETS); do \
|
|
BUILD_TARGET=$$BUILD/$$TARGET; \
|
|
$(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET run_tests \
|
|
O=$(abs_objtree); \
|
|
done;
|
|
|
|
hotplug:
|
|
@for TARGET in $(TARGETS_HOTPLUG); do \
|
|
BUILD_TARGET=$$BUILD/$$TARGET; \
|
|
$(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET;\
|
|
done;
|
|
|
|
run_hotplug: hotplug
|
|
@for TARGET in $(TARGETS_HOTPLUG); do \
|
|
BUILD_TARGET=$$BUILD/$$TARGET; \
|
|
$(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET run_full_test;\
|
|
done;
|
|
|
|
clean_hotplug:
|
|
@for TARGET in $(TARGETS_HOTPLUG); do \
|
|
BUILD_TARGET=$$BUILD/$$TARGET; \
|
|
$(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET clean;\
|
|
done;
|
|
|
|
run_pstore_crash:
|
|
$(MAKE) -C pstore run_crash
|
|
|
|
# Use $BUILD as the default install root. $BUILD points to the
|
|
# right output location for the following cases:
|
|
# 1. output_dir=kernel_src
|
|
# 2. a separate output directory is specified using O= KBUILD_OUTPUT
|
|
# 3. a separate output directory is specified using KBUILD_OUTPUT
|
|
# Avoid conflict with INSTALL_PATH set by the main Makefile
|
|
#
|
|
KSFT_INSTALL_PATH ?= $(BUILD)/kselftest_install
|
|
KSFT_INSTALL_PATH := $(abspath $(KSFT_INSTALL_PATH))
|
|
# Avoid changing the rest of the logic here and lib.mk.
|
|
INSTALL_PATH := $(KSFT_INSTALL_PATH)
|
|
ALL_SCRIPT := $(INSTALL_PATH)/run_kselftest.sh
|
|
TEST_LIST := $(INSTALL_PATH)/kselftest-list.txt
|
|
|
|
install: all
|
|
ifdef INSTALL_PATH
|
|
@# Ask all targets to install their files
|
|
mkdir -p $(INSTALL_PATH)/kselftest
|
|
install -m 744 kselftest/module.sh $(INSTALL_PATH)/kselftest/
|
|
install -m 744 kselftest/runner.sh $(INSTALL_PATH)/kselftest/
|
|
install -m 744 kselftest/prefix.pl $(INSTALL_PATH)/kselftest/
|
|
install -m 744 run_kselftest.sh $(INSTALL_PATH)/
|
|
rm -f $(TEST_LIST)
|
|
@ret=1; \
|
|
for TARGET in $(TARGETS); do \
|
|
BUILD_TARGET=$$BUILD/$$TARGET; \
|
|
$(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET INSTALL_PATH=$(INSTALL_PATH)/$$TARGET install \
|
|
O=$(abs_objtree) \
|
|
$(if $(FORCE_TARGETS),|| exit); \
|
|
ret=$$((ret * $$?)); \
|
|
done; exit $$ret;
|
|
|
|
|
|
@# Ask all targets to emit their test scripts
|
|
@# While building kselftest-list.text skip also non-existent TARGET dirs:
|
|
@# they could be the result of a build failure and should NOT be
|
|
@# included in the generated runlist.
|
|
for TARGET in $(TARGETS); do \
|
|
BUILD_TARGET=$$BUILD/$$TARGET; \
|
|
[ ! -d $(INSTALL_PATH)/$$TARGET ] && printf "Skipping non-existent dir: $$TARGET\n" && continue; \
|
|
printf "Emit Tests for $$TARGET\n"; \
|
|
$(MAKE) -s --no-print-directory OUTPUT=$$BUILD_TARGET COLLECTION=$$TARGET \
|
|
-C $$TARGET emit_tests >> $(TEST_LIST); \
|
|
done;
|
|
else
|
|
$(error Error: set INSTALL_PATH to use install)
|
|
endif
|
|
|
|
FORMAT ?= .gz
|
|
TAR_PATH = $(abspath ${INSTALL_PATH}/kselftest-packages/kselftest.tar${FORMAT})
|
|
gen_tar: install
|
|
@mkdir -p ${INSTALL_PATH}/kselftest-packages/
|
|
@tar caf ${TAR_PATH} --exclude=kselftest-packages -C ${INSTALL_PATH} .
|
|
@echo "Created ${TAR_PATH}"
|
|
|
|
clean:
|
|
@for TARGET in $(TARGETS); do \
|
|
BUILD_TARGET=$$BUILD/$$TARGET; \
|
|
$(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET clean;\
|
|
done;
|
|
|
|
.PHONY: all run_tests hotplug run_hotplug clean_hotplug run_pstore_crash install clean gen_tar
|