From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=113.46.200.217 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794315361; b=hOoxUcn7pHRUH2ozhvxNrMfsbaG/LMX4g4eNeamKz+pRTzxx7+leWES1hmVAYWrh8epv En16N5YtVh1Je0synGi7MzD8mOpJcqGt5PVGDT6GWoLcb/+Nui9STXokXsM4kebsduyNX 0VCNxb4l3f2jWDu9jDZUxEHyiuCChRROWoP5xRJmpcZ89BQ57GOkWijA8t/zfGReWHqHQ IZREGZnkLpm2xp5HmjtDhXNJiVcSVXOOsShCHvoboGg03NAjUFHz0dWS0A98SsIKhFtMa sBAl7lL/xF9yMA/nqI+xIdGA7XfLQ186L29X6jStjtQg3elupdtD6JVtrRWSqgfAf7w== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794315361; h=DMARC-Filter:dkim-signature:Received:Received:Received:From:To:CC: Subject:Date:Message-ID:X-Mailer:In-Reply-To:References:MIME-Version: Content-Type:X-Originating-IP:X-ClientProxiedBy; bh=93+ZQwm+DNkWk71P4jKy7TUg9uFCSB2ry6oq/yrZ8iU=; b=pvGRBQa2Hdp2w93zqRsEdhDmgUWFgQixHJDyvFWxEHuFIgHhE+1CjyFIY5sfN1BrXTzF xpT2VlwJW3uK7Kqdthn10+MlwmVs015UY+/D5/D0fTr6GcgIxusu32k0PbjhVZiITNeGl uhfE8L+zpvG0sXT9fXjcw1IZtbrt12wLOAdid845p5MEEip2q3TAivMe+aoEXds0tvX1o K5kKFCJypWSH6rvG5uE2Q4THE7M8G4HHO4+z8lcIR/rfZuZE9189fonnooaOWqQnQSpnB Xgs+kMXM3VtFBzSdCLNBGdSlC1YYBmzVEbz9Sgzp1uRp6dsKGvJ93o2kBlWHjB29UAQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass header.d=huawei.com header.i=@huawei.com header.a=rsa-sha256 header.s=dkim header.b=xo9mPU9b; arc=none smtp.remote-ip=113.46.200.217 Received: from canpmsgout02.his.huawei.com (canpmsgout02.his.huawei.com [113.46.200.217]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DBCA760A2625; Tue, 10 Nov 2026 12:55:57 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org DBCA760A2625 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.a=rsa-sha256 header.s=dkim header.b=xo9mPU9b dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=93+ZQwm+DNkWk71P4jKy7TUg9uFCSB2ry6oq/yrZ8iU=; b=xo9mPU9bnTy/5Mihx/y9s0VnoMn+qG9AbJsqdSpLpPJDNIlYCaYZln1yFvhEYgDIBBDMu7eIl ZjWNLTofVcTY6wMYdSciX/R27G5L6ipdJbDN8CWxbtQP4XX00FPw6XBRQHmkj+FPffziB3ggBro S2nXm0K3mbrnYehmZoiQu4Y= Received: from mail.maildlp.com (unknown [172.19.163.0]) by canpmsgout02.his.huawei.com (SkyGuard) with ESMTPS id 4jP67p026HzcZyY; Tue, 10 Nov 2026 20:55:18 +0800 (CST) Received: from whupemk100010.china.huawei.com (unknown [7.152.184.41]) by mail.maildlp.com (Postfix) with ESMTPS id 12F0440561; Tue, 10 Nov 2026 20:55:56 +0800 (CST) Received: from octopus.huawei.com (10.67.174.191) by whupemk100010.china.huawei.com (7.152.184.41) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.45; Tue, 10 Nov 2026 20:55:54 +0800 From: Cai Xinchen To: , , , , , , , CC: , , , , Subject: [PATCH -next -v2 5/8] lockdown: drop an unused include and move lockdown_reasons Date: Tue, 10 Nov 2026 21:28:15 +0800 Message-ID: <20261110132818.2231593-6-caixinchen1@huawei.com> X-Mailer: git-send-email 2.18.0.huawei.25 In-Reply-To: <20261110132818.2231593-1-caixinchen1@huawei.com> References: <20261110132818.2231593-1-caixinchen1@huawei.com> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain X-ClientProxiedBy: kwepems100001.china.huawei.com (7.221.188.238) To whupemk100010.china.huawei.com (7.152.184.41) linux/export.h is not needed since the file has no EXPORT_SYMBOL() usage. lockdown_reasons[] is only used by the lockdown LSM after the audit data was removed from lsm_audit. Move it into security/lockdown/lockdown.c, make it static, and drop the now stale extern declaration. The existing enum comment in include/linux/security.h already pointed at security/lockdown/lockdown.c and becomes accurate now that the array has moved there. No functional change. Signed-off-by: Cai Xinchen --- include/linux/security.h | 2 -- security/lockdown/lockdown.c | 40 +++++++++++++++++++++++++++++++++++- security/security.c | 40 ------------------------------------ 3 files changed, 39 insertions(+), 43 deletions(-) diff --git a/include/linux/security.h b/include/linux/security.h index 40831fab5470..9d3a1eaa90ff 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -170,8 +170,6 @@ struct lsm_prop { struct lsm_prop_bpf bpf; }; -extern const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1]; - /* These functions are in security/commoncap.c */ extern int cap_capable(const struct cred *cred, struct user_namespace *ns, int cap, unsigned int opts); diff --git a/security/lockdown/lockdown.c b/security/lockdown/lockdown.c index 8648508d49b2..84efd533fe5a 100644 --- a/security/lockdown/lockdown.c +++ b/security/lockdown/lockdown.c @@ -11,10 +11,48 @@ */ #include -#include #include #include +/* + * These are descriptions of the reasons that can be passed to the + * security_locked_down() LSM hook, used for the denial message and the + * securityfs status file. + */ +static const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX + 1] = { + [LOCKDOWN_NONE] = "none", + [LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading", + [LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port", + [LOCKDOWN_EFI_TEST] = "/dev/efi_test access", + [LOCKDOWN_KEXEC] = "kexec of unsigned images", + [LOCKDOWN_HIBERNATION] = "hibernation", + [LOCKDOWN_PCI_ACCESS] = "direct PCI access", + [LOCKDOWN_IOPORT] = "raw io port access", + [LOCKDOWN_MSR] = "raw MSR access", + [LOCKDOWN_ACPI_TABLES] = "modifying ACPI tables", + [LOCKDOWN_DEVICE_TREE] = "modifying device tree contents", + [LOCKDOWN_PCMCIA_CIS] = "direct PCMCIA CIS storage", + [LOCKDOWN_TIOCSSERIAL] = "reconfiguration of serial port IO", + [LOCKDOWN_MODULE_PARAMETERS] = "unsafe module parameters", + [LOCKDOWN_MMIOTRACE] = "unsafe mmio", + [LOCKDOWN_DEBUGFS] = "debugfs access", + [LOCKDOWN_XMON_WR] = "xmon write access", + [LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM", + [LOCKDOWN_DBG_WRITE_KERNEL] = "use of kgdb/kdb to write kernel RAM", + [LOCKDOWN_RTAS_ERROR_INJECTION] = "RTAS error injection", + [LOCKDOWN_XEN_USER_ACTIONS] = "Xen guest user action", + [LOCKDOWN_INTEGRITY_MAX] = "integrity", + [LOCKDOWN_KCORE] = "/proc/kcore access", + [LOCKDOWN_KPROBES] = "use of kprobes", + [LOCKDOWN_BPF_READ_KERNEL] = "use of bpf to read kernel RAM", + [LOCKDOWN_DBG_READ_KERNEL] = "use of kgdb/kdb to read kernel RAM", + [LOCKDOWN_PERF] = "unsafe use of perf", + [LOCKDOWN_TRACEFS] = "use of tracefs", + [LOCKDOWN_XMON_RW] = "xmon read and write access", + [LOCKDOWN_XFRM_SECRET] = "xfrm SA secret", + [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality", +}; + static enum lockdown_reason kernel_locked_down; static const enum lockdown_reason lockdown_levels[] = {LOCKDOWN_NONE, diff --git a/security/security.c b/security/security.c index 4727b8347fc4..68cf2ab9174f 100644 --- a/security/security.c +++ b/security/security.c @@ -35,46 +35,6 @@ #include "lsm.h" -/* - * These are descriptions of the reasons that can be passed to the - * security_locked_down() LSM hook. Placing this array here allows - * all security modules to use the same descriptions for auditing - * purposes. - */ -const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX + 1] = { - [LOCKDOWN_NONE] = "none", - [LOCKDOWN_MODULE_SIGNATURE] = "unsigned module loading", - [LOCKDOWN_DEV_MEM] = "/dev/mem,kmem,port", - [LOCKDOWN_EFI_TEST] = "/dev/efi_test access", - [LOCKDOWN_KEXEC] = "kexec of unsigned images", - [LOCKDOWN_HIBERNATION] = "hibernation", - [LOCKDOWN_PCI_ACCESS] = "direct PCI access", - [LOCKDOWN_IOPORT] = "raw io port access", - [LOCKDOWN_MSR] = "raw MSR access", - [LOCKDOWN_ACPI_TABLES] = "modifying ACPI tables", - [LOCKDOWN_DEVICE_TREE] = "modifying device tree contents", - [LOCKDOWN_PCMCIA_CIS] = "direct PCMCIA CIS storage", - [LOCKDOWN_TIOCSSERIAL] = "reconfiguration of serial port IO", - [LOCKDOWN_MODULE_PARAMETERS] = "unsafe module parameters", - [LOCKDOWN_MMIOTRACE] = "unsafe mmio", - [LOCKDOWN_DEBUGFS] = "debugfs access", - [LOCKDOWN_XMON_WR] = "xmon write access", - [LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM", - [LOCKDOWN_DBG_WRITE_KERNEL] = "use of kgdb/kdb to write kernel RAM", - [LOCKDOWN_RTAS_ERROR_INJECTION] = "RTAS error injection", - [LOCKDOWN_XEN_USER_ACTIONS] = "Xen guest user action", - [LOCKDOWN_INTEGRITY_MAX] = "integrity", - [LOCKDOWN_KCORE] = "/proc/kcore access", - [LOCKDOWN_KPROBES] = "use of kprobes", - [LOCKDOWN_BPF_READ_KERNEL] = "use of bpf to read kernel RAM", - [LOCKDOWN_DBG_READ_KERNEL] = "use of kgdb/kdb to read kernel RAM", - [LOCKDOWN_PERF] = "unsafe use of perf", - [LOCKDOWN_TRACEFS] = "use of tracefs", - [LOCKDOWN_XMON_RW] = "xmon read and write access", - [LOCKDOWN_XFRM_SECRET] = "xfrm SA secret", - [LOCKDOWN_CONFIDENTIALITY_MAX] = "confidentiality", -}; - bool lsm_debug __ro_after_init; unsigned int lsm_active_cnt __ro_after_init; -- 2.18.0.huawei.25