This patchset introduces a new syscall, lsm_manage_policy(), and the associated Linux Security Module hook security_lsm_manage_policy(), providing a unified interface for loading and managing LSM policies. This syscall complements the existing per‑LSM pseudo‑filesystem mechanism and works even when those filesystems are not mounted or available. With this new syscall, administrators may lock down access to the pseudo‑filesystem yet still manage LSM policies. A single, tightly scoped entry point then replaces the many file operations exposed by those filesystems, significantly reducing the attack surface. This is particularly useful in containers or processes already confined by Landlock, where these pseudo‑filesystems are typically unavailable. Because it provides a logical and unified interface, lsm_manage_policy() is simpler to use than several heterogeneous pseudo‑filesystems and avoids edge cases such as partially loaded policies. It also eliminates VFS overhead, yielding performance gains notably when many policies are loaded, for instance at boot time. This initial implementation is intentionally minimal to limit the scope of changes. Currently, only policy loading is supported, and only AppArmor registers this LSM hook. However, any LSM can adopt this interface, and future patches could extend this syscall to support more operations, such as replacing, removing, or querying loaded policies. Landlock already provides three Landlock‑specific syscalls (e.g. landlock_add_rule()) to restrict ambient rights for sets of processes without touching any pseudo-filesystem. lsm_manage_policy() generalizes that approach to the entire LSM layer, so any module can expose its policy operations through one uniform interface and reap the advantages outlined above. This patchset is available at [1] and a minimal user space example showing how to use this syscall with AppArmor is at [2]. [1] https://github.com/emixam16/linux/tree/lsm_syscall [2] https://gitlab.com/emixam16/apparmor/tree/lsm_syscall Maxime Bélair (3): Wire up the lsm_manage_policy syscall lsm: introduce security_lsm_manage_policy hook AppArmor: add support for lsm_manage_policy arch/alpha/kernel/syscalls/syscall.tbl | 1 + arch/arm/tools/syscall.tbl | 1 + arch/x86/entry/syscalls/syscall_32.tbl | 1 + arch/x86/entry/syscalls/syscall_64.tbl | 1 + include/linux/lsm_hook_defs.h | 2 ++ include/linux/security.h | 7 +++++++ include/linux/syscalls.h | 4 ++++ include/uapi/asm-generic/unistd.h | 4 +++- include/uapi/linux/lsm.h | 8 +++++++ kernel/sys_ni.c | 1 + security/apparmor/apparmorfs.c | 19 +++++++++++++++++ security/apparmor/include/apparmorfs.h | 3 +++ security/apparmor/lsm.c | 16 ++++++++++++++ security/lsm_syscalls.c | 11 ++++++++++ security/security.c | 21 +++++++++++++++++++ tools/include/uapi/asm-generic/unistd.h | 4 +++- .../arch/x86/entry/syscalls/syscall_64.tbl | 1 + 17 files changed, 103 insertions(+), 2 deletions(-) base-commit: 9c32cda43eb78f78c73aee4aa344b777714e259b -- 2.48.1
