From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 99B0B3AF669; Mon, 1 Jun 2026 14:28:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780324084; cv=none; b=rApO7uPh93m7uzDb/6/T8/SsL9aZgJUANBU6ker9IXTR7C3H60UlgFsO23HcQ+6Omh//FQSrC6yHI1Fi/A60nIwlflr8opNU1QLFak7HSaBLM8iNGBMV9lLN44pjuaXhszDjxDCvQkNPnFnJnEbqWknaONeR6yy9Y+ltMY6Nn0Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780324084; c=relaxed/simple; bh=GLjR0pOZvKp6t4lRJ9X/m4e9jLFN4QEWM1Bm7UejT0s=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=QbiOkGug4iWtRZNZi0Fo9UtP8sDprGvSeVODaKD31U8bsujG51j0acKz3wPO/ezWs5vQxmEEEi2qP6NgibvT+JyDNi7bQQt0lAIzEzlQkX3U1Gu1FOE26P5Y9VMYNrX3vWVBKXKL9nwtr4iB+VeH/jCjm5UK7ngvWE1VLK50fn0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b=F+Wo+tiF; arc=none smtp.client-ip=217.140.110.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=arm.com header.i=@arm.com header.b="F+Wo+tiF" Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id EAD0F1655; Mon, 1 Jun 2026 07:27:56 -0700 (PDT) Received: from e129823.cambridge.arm.com (e129823.arm.com [10.1.197.6]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 175B63F632; Mon, 1 Jun 2026 07:27:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1780324081; bh=GLjR0pOZvKp6t4lRJ9X/m4e9jLFN4QEWM1Bm7UejT0s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=F+Wo+tiFIW3vfmru7Hu7KHaUMdY55qbRt9bvyD2bPrNE5hJ++C/oomnuc5jQ3uEWO w3LbFRDPC8RlqQBu9ozi0Dc5UceMTW96HDiYl7D8BMQMoxd8FAsUE//Ri2xv2rLikA qMmbp7uSOkfrpgFiEbte1vBTII6PHKRruJBipb84= From: Yeoreum Yun To: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, linux-integrity@vger.kernel.org Cc: paul@paul-moore.com, zohar@linux.ibm.com, roberto.sassu@huaweicloud.com, noodles@earth.li, jarkko@kernel.org, sudeep.holla@kernel.org, jmorris@namei.org, serge@hallyn.com, dmitry.kasatkin@gmail.com, eric.snowberg@oracle.com, jgg@ziepe.ca, Yeoreum Yun Subject: [PATCH v5 1/4] security: lsm: allow LSMs to register for late_initcall_sync init Date: Mon, 1 Jun 2026 15:27:46 +0100 Message-Id: <20260601142749.3379697-2-yeoreum.yun@arm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260601142749.3379697-1-yeoreum.yun@arm.com> References: <20260601142749.3379697-1-yeoreum.yun@arm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit There are situations where LSMs have dependencies that might mean they want to be initialised later in the boot process, to ensure those dependencies are available. In particular there are some TPM setups (Arm FF-A devices, SPI attached TPMs) required by IMA which are not guaranteed to be initialised for regular initcall_late. Add an initcall_late_sync option that can be used in these situations. Signed-off-by: Yeoreum Yun --- include/linux/lsm_hooks.h | 2 ++ security/lsm_init.c | 13 +++++++++++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index b4f8cad53ddb..c4488c4a6d8a 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -167,6 +167,7 @@ enum lsm_order { * @initcall_fs: LSM callback for fs_initcall setup, optional * @initcall_device: LSM callback for device_initcall() setup, optional * @initcall_late: LSM callback for late_initcall() setup, optional + * @initcall_late_sync: LSM callback for late_initcall_sync() setup, optional */ struct lsm_info { const struct lsm_id *id; @@ -182,6 +183,7 @@ struct lsm_info { int (*initcall_fs)(void); int (*initcall_device)(void); int (*initcall_late)(void); + int (*initcall_late_sync)(void); }; #define DEFINE_LSM(lsm) \ diff --git a/security/lsm_init.c b/security/lsm_init.c index 7c0fd17f1601..a1ad641811de 100644 --- a/security/lsm_init.c +++ b/security/lsm_init.c @@ -556,13 +556,22 @@ device_initcall(security_initcall_device); * security_initcall_late - Run the LSM late initcalls */ static int __init security_initcall_late(void) +{ + return lsm_initcall(late); +} +late_initcall(security_initcall_late); + +/** + * security_initcall_late_sync - Run the LSM late initcalls sync + */ +static int __init security_initcall_late_sync(void) { int rc; - rc = lsm_initcall(late); + rc = lsm_initcall(late_sync); lsm_pr_dbg("all enabled LSMs fully activated\n"); call_blocking_lsm_notifier(LSM_STARTED_ALL, NULL); return rc; } -late_initcall(security_initcall_late); +late_initcall_sync(security_initcall_late_sync); -- LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}