ima: initialize ima before inodes can be allocated

ima wants to create an inode information struct (iint) when inodes are
allocated.  This means that at least the part of ima which does this
allocation (the allocation is filled with information later) should
before any inodes are created.  To accomplish this we split the ima
initialization routine placing the kmem cache allocator inside a
security_initcall() function.  Since this makes use of radix trees we also
need to make sure that is initialized before security_initcall().

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/init/main.c b/init/main.c
index dac44a9356a52637e56669989c303f0b792aaa11..4cb47a159f028fa48a114efbf74cf79a9d828883 100644 (file)
--- a/init/main.c
+++ b/init/main.c
@@ -657,9 +657,9 @@ asmlinkage void __init start_kernel(void)
        proc_caches_init();
        buffer_init();
        key_init();
+       radix_tree_init();
        security_init();
        vfs_caches_init(totalram_pages);
-       radix_tree_init();
        signals_init();
        /* rootfs populating might need page-writeback */
        page_writeback_init();

diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index c41afe6639a09559248f36eb672bcedf141eca49..aa25a7eb2d0ee3b9244c338c6309d26dc1ba9ee1 100644 (file)
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -65,7 +65,6 @@ void integrity_audit_msg(int audit_msgno, struct inode *inode,
                         const char *cause, int result, int info);
 
 /* Internal IMA function definitions */
-void ima_iintcache_init(void);
 int ima_init(void);
 void ima_cleanup(void);
 int ima_fs_init(void);

diff --git a/security/integrity/ima/ima_iint.c b/security/integrity/ima/ima_iint.c
index fa592ff1ac1c4f7b24394baf6a2155dc1fb911a6..0d83edcfc4028620d9f9dee37fe826c8c50b5712 100644 (file)
--- a/security/integrity/ima/ima_iint.c
+++ b/security/integrity/ima/ima_iint.c
@@ -52,9 +52,6 @@ int ima_inode_alloc(struct inode *inode)
        struct ima_iint_cache *iint = NULL;
        int rc = 0;
 
-       if (!ima_initialized)
-               return 0;
-
        iint = kmem_cache_alloc(iint_cache, GFP_NOFS);
        if (!iint)
                return -ENOMEM;
@@ -118,8 +115,6 @@ void ima_inode_free(struct inode *inode)
 {
        struct ima_iint_cache *iint;
 
-       if (!ima_initialized)
-               return;
        spin_lock(&ima_iint_lock);
        iint = radix_tree_delete(&ima_iint_store, (unsigned long)inode);
        spin_unlock(&ima_iint_lock);
@@ -141,9 +136,11 @@ static void init_once(void *foo)
        kref_set(&iint->refcount, 1);
 }
 
-void __init ima_iintcache_init(void)
+static int __init ima_iintcache_init(void)
 {
        iint_cache =
            kmem_cache_create("iint_cache", sizeof(struct ima_iint_cache), 0,
                              SLAB_PANIC, init_once);
+       return 0;
 }
+security_initcall(ima_iintcache_init);

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 75aee18f61631b7bdf9f7fe6ceb5c00d2c064510..eb1cf6498cc91e4c95a8a8672ae9f3c29fa65ac2 100644 (file)
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -321,7 +321,6 @@ static int __init init_ima(void)
 {
        int error;
 
-       ima_iintcache_init();
        error = ima_init();
        ima_initialized = 1;
        return error;