[SENT at 2003-03-09]
[RESENT at 2003-03-13]

  Hello,

  the following patch (against 2.5.64) introduces kobject infrastructure
scaffolding to the LSM framework. It does nothing but allocating security root
subsystem for the LSMs, so that they are tied to one specific point in the
kobject hierarchy. They are suggested to create own subsystems under the
security subsystem, however such things are completely up to the individual
LSMs and not regulated by core in any way (it's not that I would so much like
such an approach, but I was advised so by GregKH and it makes sense in its own
way as well).

  A lot of LSMs use various ad hoc methods for communication with the userspace
and using the sysfs framework could be very convient for them, and there is at
least one real-world (altough yet a bit primitive) LSM which already uses the
security subsystem: http://pasky.ji.cz/securitylevels/.

  It works fine for me and it should be pretty trivial. Please consider
applying.

 include/linux/security.h |    2 ++
 security/security.c      |   30 ++++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+)

  Note that this is the second version of the patch, containing changes based
on GregKH's remarks. It fixes missing patch for include/linux/security.h and
exports security_subsys GPL'd.

  Kind regards,
				Petr Baudis

diff -ru linux/security/security.c linux+pasky/security/security.c
--- linux/security/security.c	Sun Mar  9 00:40:32 2003
+++ linux+pasky/security/security.c	Thu Mar 13 00:15:21 2003
@@ -9,11 +9,15 @@
  *	it under the terms of the GNU General Public License as published by
  *	the Free Software Foundation; either version 2 of the License, or
  *	(at your option) any later version.
+ *
+ * Introduced kobject infrastructure.
+ * 2003-02-27 Petr Baudis <pasky@ucw.cz>
  */
 
 #include <linux/config.h>
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/kobject.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/security.h>
@@ -38,6 +42,7 @@
 	return 0;
 }
 
+
 /**
  * security_scaffolding_startup - initialzes the security scaffolding framework
  *
@@ -59,6 +64,30 @@
 	return 0;
 }
 
+
+/* kobject stuff */
+
+/* We define only the base subsystem here and leave everything to a LSM. It is
+ * heavily recommended that the LSM should create own subsystem under this one,
+ * so that it can be easily made stackable and it doesn't confuse userland by
+ * exporting its stuff directly to /sys/security/. */
+decl_subsys(security,NULL);
+
+/**
+ * security_kobj_init - initializes the security kobject subsystem
+ *
+ * This is called after security_scaffolding_startup as a regular initcall,
+ * since we need sysfs mounted already.
+ */
+static int __init security_kobj_init (void)
+{
+	subsystem_register (&security_subsys);
+	return 0;
+}
+
+subsys_initcall(security_kobj_init);
+
+
 /**
  * register_security - registers a security framework with the kernel
  * @ops: a pointer to the struct security_options that is to be registered
@@ -195,5 +224,6 @@
 EXPORT_SYMBOL_GPL(unregister_security);
 EXPORT_SYMBOL_GPL(mod_reg_security);
 EXPORT_SYMBOL_GPL(mod_unreg_security);
+EXPORT_SYMBOL_GPL(security_subsys);
 EXPORT_SYMBOL(capable);
 EXPORT_SYMBOL(security_ops);
diff -ru linux/include/linux/security.h linux+pasky/include/linux/security.h
--- linux/include/linux/security.h	Thu Mar  6 20:31:29 2003
+++ linux+pasky/include/linux/security.h	Thu Mar  6 23:18:46 2003
@@ -22,6 +22,7 @@
 #ifndef __LINUX_SECURITY_H
 #define __LINUX_SECURITY_H
 
+#include <linux/kobject.h>
 #include <linux/fs.h>
 #include <linux/binfmts.h>
 #include <linux/signal.h>
@@ -1745,6 +1746,7 @@
 extern int unregister_security	(struct security_operations *ops);
 extern int mod_reg_security	(const char *name, struct security_operations *ops);
 extern int mod_unreg_security	(const char *name, struct security_operations *ops);
+extern struct subsystem		security_subsys;
 
 
 #else /* CONFIG_SECURITY */