Merge tag 'loadpin-v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees...

Pull security/loadpin updates from Kees Cook:

 - Allow exclusion of specific file types (Ke Wu)

* tag 'loadpin-v5.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  security/loadpin: Allow to exclude specific file types

diff --combined security/loadpin/loadpin.c
index 79131efa963431736f3b11435a1cff7865ff3978,9e826041da41b2598b4dda8b2b14e4e486f48134..81519c804888c613fb86afc164f67238fcd333ba
--- 1/security/loadpin/loadpin.c
--- 2/security/loadpin/loadpin.c
+++ b/security/loadpin/loadpin.c
@@@ -1,10 -1,18 +1,10 @@@
 +// SPDX-License-Identifier: GPL-2.0-only
  /*
   * Module and Firmware Pinning Security Module
   *
   * Copyright 2011-2016 Google Inc.
   *
   * Author: Kees Cook <[email protected]>
 - *
 - * This software is licensed under the terms of the GNU General Public
 - * License version 2, as published by the Free Software Foundation, and
 - * may be copied, distributed, and modified under those terms.
 - *
 - * This program is distributed in the hope that it will be useful,
 - * but WITHOUT ANY WARRANTY; without even the implied warranty of
 - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 - * GNU General Public License for more details.
   */
  
  #define pr_fmt(fmt) "LoadPin: " fmt
@@@ -37,6 -45,8 +37,8 @@@ static void report_load(const char *ori
  }
  
  static int enforce = IS_ENABLED(CONFIG_SECURITY_LOADPIN_ENFORCE);
+ static char *exclude_read_files[READING_MAX_ID];
+ static int ignore_read_file_id[READING_MAX_ID] __ro_after_init;
  static struct super_block *pinned_root;
  static DEFINE_SPINLOCK(pinned_root_spinlock);
  
@@@ -121,6 -131,13 +123,13 @@@ static int loadpin_read_file(struct fil
        struct super_block *load_root;
        const char *origin = kernel_read_file_id_str(id);
  
+       /* If the file id is excluded, ignore the pinning. */
+       if ((unsigned int)id < ARRAY_SIZE(ignore_read_file_id) &&
+           ignore_read_file_id[id]) {
+               report_load(origin, file, "pinning-excluded");
+               return 0;
+       }
+ 
        /* This handles the older init_module API that has a NULL file. */
        if (!file) {
                if (!enforce) {
@@@ -179,10 -196,47 +188,47 @@@ static struct security_hook_list loadpi
        LSM_HOOK_INIT(kernel_load_data, loadpin_load_data),
  };
  
+ static void __init parse_exclude(void)
+ {
+       int i, j;
+       char *cur;
+ 
+       /*
+        * Make sure all the arrays stay within expected sizes. This
+        * is slightly weird because kernel_read_file_str[] includes
+        * READING_MAX_ID, which isn't actually meaningful here.
+        */
+       BUILD_BUG_ON(ARRAY_SIZE(exclude_read_files) !=
+                    ARRAY_SIZE(ignore_read_file_id));
+       BUILD_BUG_ON(ARRAY_SIZE(kernel_read_file_str) <
+                    ARRAY_SIZE(ignore_read_file_id));
+ 
+       for (i = 0; i < ARRAY_SIZE(exclude_read_files); i++) {
+               cur = exclude_read_files[i];
+               if (!cur)
+                       break;
+               if (*cur == '\0')
+                       continue;
+ 
+               for (j = 0; j < ARRAY_SIZE(ignore_read_file_id); j++) {
+                       if (strcmp(cur, kernel_read_file_str[j]) == 0) {
+                               pr_info("excluding: %s\n",
+                                       kernel_read_file_str[j]);
+                               ignore_read_file_id[j] = 1;
+                               /*
+                                * Can not break, because one read_file_str
+                                * may map to more than on read_file_id.
+                                */
+                       }
+               }
+       }
+ }
+ 
  static int __init loadpin_init(void)
  {
        pr_info("ready to pin (currently %senforcing)\n",
                enforce ? "" : "not ");
+       parse_exclude();
        security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks), "loadpin");
        return 0;
  }
@@@ -195,3 -249,5 +241,5 @@@ DEFINE_LSM(loadpin) = 
  /* Should not be mutable after boot, so not listed in sysfs (perm == 0). */
  module_param(enforce, int, 0);
  MODULE_PARM_DESC(enforce, "Enforce module/firmware pinning");
+ module_param_array_named(exclude, exclude_read_files, charp, NULL, 0);
+ MODULE_PARM_DESC(exclude, "Exclude pinning specific read file types");