[PATCH -next -v2 0/8] lockdown: fix the securityfs interface and add tests

[Cai Xinchen <caixinchen1@huawei.com>]

The lockdown LSM provides /sys/kernel/security/lockdown, but the file is
neither documented nor covered by a selftest.  While reviewing the
interface, we also found a Kconfig bug and a few accumulated cleanups.

The series is organized as follows:

  - patches 1-2 are small cleanups in lockdown_write(): stop scanning
    after the matching level, and drop an update to a length variable
    that is not used afterwards.
  - patch 3 makes the LSM select SECURITYFS.  Without it, a kernel built
    with CONFIG_SECURITYFS=n logs "failed LSM lockdown core initcall with
    errno -19" and does not create the file advertised by the Kconfig
    help text.
  - patch 4 removes LSM_AUDIT_DATA_LOCKDOWN and its formatting code,
    which became dead when the SELinux lockdown implementation was
    removed by commit f5d0e5e9d72d.
  - patch 5 drops an unused include and moves lockdown_reasons[] next to
    its only user.
  - patch 6 replaces sprintf() with scnprintf() so that the status
    buffer
    is bounded explicitly if more levels are added later, and adds a
    BUILD_BUG_ON() that checks at compile time that all level labels,
    their separators, and the terminating NUL still fit.
  - patch 7 documents the ABI and adds the new file to the LOCKDOWN
    SECURITY MODULE entry in MAINTAINERS.
  - patch 8 adds a kselftest covering the read format, invalid levels,
    the rejection of the current or a lower level, and an upgrade to the
    next level.

The only functional change is patch 3; the rest are cleanups,
documentation, or test coverage.

Changes since v1:

  - The scnprintf()/BUILD_BUG_ON() patch now comes after the audit and
    cleanup patches.
  - The lockdown_reasons move patch has a corrected commit message: the
    enum comment already pointed at security/lockdown/lockdown.c.
  - The ABI documentation now mentions CONFIG_LSM as a way to order
    lockdown in, and states that the FORCE_* options only take effect
    when the lockdown LSM is active.
  - The selftest patch moves the read-format string checks before the
    active-level checks, corrects the no-downgrade skip message, and adds
    an upgrade test.  Because that test irreversibly raises the lockdown
    level, the test is kept out of the default run
    (TEST_GEN_PROGS_EXTENDED and run_lockdown_test),
    CONFIG_SECURITY_LOCKDOWN_LSM is enabled in the selftest config
    fragment, and non-ENOENT read failures now fail instead of being
    skipped.
  - The break, decrement, SECURITYFS, and audit patches are unchanged.

The upgrade test irreversibly raises the lockdown level, so lockdown_test
is built but not run by default.  Use "make run_lockdown_test" to run it
explicitly, preferably on a disposable test system.  The shared
selftests/lsm config fragment now enables CONFIG_SECURITY_LOCKDOWN_LSM so
that the test has something to exercise.

Cai Xinchen (7):
  lockdown: Add break in lockdown_write
  lockdown: select SECURITYFS
  lsm: remove unused lockdown audit data
  lockdown: drop an unused include and move lockdown_reasons
  lockdown: bound the status string with scnprintf
  Documentation/ABI: document the lockdown securityfs file
  selftests/lsm: add lockdown securityfs test

Kalevi Kolttonen (1):
  lockdown: remove useless decrement operation

 Documentation/ABI/testing/securityfs-lockdown |  43 ++++
 MAINTAINERS                                   |   1 +
 include/linux/lsm_audit.h                     |   2 -
 include/linux/security.h                      |   2 -
 security/lockdown/Kconfig                     |   1 +
 security/lockdown/lockdown.c                  |  70 +++++-
 security/lsm_audit.c                          |   4 -
 security/security.c                           |  40 ---
 tools/testing/selftests/lsm/Makefile          |   8 +
 tools/testing/selftests/lsm/common.c          |  35 ++-
 tools/testing/selftests/lsm/common.h          |   2 +
 tools/testing/selftests/lsm/config            |   1 +
 tools/testing/selftests/lsm/lockdown_test.c   | 230 ++++++++++++++++++
 13 files changed, 375 insertions(+), 64 deletions(-)
 create mode 100644 Documentation/ABI/testing/securityfs-lockdown
 create mode 100644 tools/testing/selftests/lsm/lockdown_test.c

-- 
2.18.0.huawei.25