Re: [PATCH -v5 -mm] LSM: Add security= boot parameter

[James Morris]

On Wed, 5 Mar 2008, Andrew Morton wrote:

> > +/* Maximum number of letters for an LSM name string */
> > +#define SECURITY_NAME_MAX	10
> 
> Is this long enough?

I almost flagged this earlier, but I don't think we've ever seen an LSM 
with a longer name, and it can be expanded if needed.  32 or something 
seems similarly arbitrary.

> Please remove this and use compile-time initialisation with DEFINE_SPINLOCK.
> 
> Do we actually need the lock?  This code is only called at boot-time if I
> understand it correctly?

Theoretically, security_module_enable() could be called at any time, 
although it does seem unlikely never to be called at boot, especially if 
multiple LSMs are compiled in.

In that case, perhaps mark the function as __init, and require it be 
called only at boot time.

> Can chosen_lsm[] be __initdata?

With the above, yes.

> > +int security_module_enable(struct security_operations *ops)
> > +}
> 
> I believe this can be __init.

Indeed :-)


- James
-- 
James Morris
<jmorris@xxxxxxxxx>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/