Commit 1ad22fcc authored by John Johansen's avatar John Johansen
Browse files

apparmor: rework profile->rules to be a list 



Convert profile->rules to a list as the next step towards supporting
multiple rulesets in a profile. For this step only support a single
list entry item. The logic for iterating the list will come as a
separate step.

Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
parent 217af7e2

security/apparmor/apparmorfs.c

+2 −1
Original line number Diff line number Diff line
@@ -611,7 +611,8 @@ static const struct file_operations aa_fs_ns_revision_fops = { 
static void profile_query_cb(struct aa_profile *profile, struct aa_perms *perms,

			     const char *match_str, size_t match_len)

{

	struct aa_ruleset *rules = &profile->rules;

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_perms tmp = { };

	aa_state_t state = DFA_NOMATCH;

security/apparmor/capability.c

+4 −2
Original line number Diff line number Diff line
@@ -64,7 +64,8 @@ static void audit_cb(struct audit_buffer *ab, void *va) 
static int audit_caps(struct common_audit_data *sa, struct aa_profile *profile,

		      int cap, int error)

{

	struct aa_ruleset *rules = &profile->rules;

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct audit_cache *ent;

	int type = AUDIT_APPARMOR_AUTO;
@@ -115,7 +116,8 @@ static int audit_caps(struct common_audit_data *sa, struct aa_profile *profile, 
static int profile_capable(struct aa_profile *profile, int cap,

			   unsigned int opts, struct common_audit_data *sa)

{

	struct aa_ruleset *rules = &profile->rules;

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	int error;



	if (cap_raised(rules->caps.allow, cap) &&

security/apparmor/domain.c

+16 −8
Original line number Diff line number Diff line
@@ -81,7 +81,8 @@ static inline aa_state_t match_component(struct aa_profile *profile, 
					 struct aa_profile *tp,

					 bool stack, aa_state_t state)

{

	struct aa_ruleset *rules = &profile->rules;

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	const char *ns_name;



	if (stack)
@@ -118,7 +119,8 @@ static int label_compound_match(struct aa_profile *profile, 
				aa_state_t state, bool subns, u32 request,

				struct aa_perms *perms)

{

	struct aa_ruleset *rules = &profile->rules;

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_profile *tp;

	struct label_it i;

	struct path_cond cond = { };
@@ -179,7 +181,8 @@ static int label_components_match(struct aa_profile *profile, 
				  aa_state_t start, bool subns, u32 request,

				  struct aa_perms *perms)

{

	struct aa_ruleset *rules = &profile->rules;

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_profile *tp;

	struct label_it i;

	struct aa_perms tmp;
@@ -503,7 +506,8 @@ static const char *next_name(int xtype, const char *name) 
struct aa_label *x_table_lookup(struct aa_profile *profile, u32 xindex,

				const char **name)

{

	struct aa_ruleset *rules = &profile->rules;

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_label *label = NULL;

	u32 xtype = xindex & AA_X_TYPE_MASK;

	int index = xindex & AA_X_INDEX_MASK;
@@ -553,7 +557,8 @@ static struct aa_label *x_to_label(struct aa_profile *profile, 
				   const char **lookupname,

				   const char **info)

{

	struct aa_ruleset *rules = &profile->rules;

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_label *new = NULL;

	struct aa_ns *ns = profile->ns;

	u32 xtype = xindex & AA_X_TYPE_MASK;
@@ -620,7 +625,8 @@ static struct aa_label *profile_transition(struct aa_profile *profile, 
					   char *buffer, struct path_cond *cond,

					   bool *secure_exec)

{

	struct aa_ruleset *rules = &profile->rules;

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_label *new = NULL;

	const char *info = NULL, *name = NULL, *target = NULL;

	aa_state_t state = rules->file.start[AA_CLASS_FILE];
@@ -719,7 +725,8 @@ static int profile_onexec(struct aa_profile *profile, struct aa_label *onexec, 
			  char *buffer, struct path_cond *cond,

			  bool *secure_exec)

{

	struct aa_ruleset *rules = &profile->rules;

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	aa_state_t state = rules->file.start[AA_CLASS_FILE];

	struct aa_perms perms = {};

	const char *xname = NULL, *info = "change_profile onexec";
@@ -1259,7 +1266,8 @@ static int change_profile_perms_wrapper(const char *op, const char *name, 
					struct aa_label *target, bool stack,

					u32 request, struct aa_perms *perms)

{

	struct aa_ruleset *rules = &profile->rules;

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	const char *info = NULL;

	int error = 0;

security/apparmor/file.c

+4 −2
Original line number Diff line number Diff line
@@ -224,7 +224,8 @@ int __aa_path_perm(const char *op, struct aa_profile *profile, const char *name, 
		   u32 request, struct path_cond *cond, int flags,

		   struct aa_perms *perms)

{

	struct aa_ruleset *rules = &profile->rules;

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	int e = 0;



	if (profile_unconfined(profile))
@@ -317,7 +318,8 @@ static int profile_path_link(struct aa_profile *profile, 
			     const struct path *target, char *buffer2,

			     struct path_cond *cond)

{

	struct aa_ruleset *rules = &profile->rules;

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	const char *lname, *tname = NULL;

	struct aa_perms lperms = {}, perms;

	const char *info = NULL;

security/apparmor/include/policy.h

+16 −1
Original line number Diff line number Diff line
@@ -124,6 +124,7 @@ struct aa_data { 
};



/* struct aa_ruleset - data covering mediation rules

 * @list: list the rule is on

 * @size: the memory consumed by this ruleset

 * @policy: general match rules governing policy

 * @file: The set of rules governing basic file access and domain transitions
@@ -133,6 +134,8 @@ struct aa_data { 
 * @secmark: secmark label match info

 */

struct aa_ruleset {

	struct list_head list;



	int size;



	/* TODO: merge policy and file */
@@ -147,6 +150,7 @@ struct aa_ruleset { 
};



/* struct aa_attachment - data and rules for a profiles attachment

 * @list:

 * @xmatch_str: human readable attachment string

 * @xmatch: optional extended matching for unconfined executables names

 * @xmatch_len: xmatch prefix len, used to determine xmatch priority
@@ -204,7 +208,7 @@ struct aa_profile { 
	const char *disconnected;



	struct aa_attachment attach;

	struct aa_ruleset rules;

	struct list_head rules;



	struct aa_loaddata *rawdata;

	unsigned char *hash;
@@ -227,6 +231,7 @@ void aa_add_profile(struct aa_policy *common, struct aa_profile *profile); 




void aa_free_proxy_kref(struct kref *kref);

struct aa_ruleset *aa_alloc_ruleset(gfp_t gfp);

struct aa_profile *aa_alloc_profile(const char *name, struct aa_proxy *proxy,

				    gfp_t gfp);

struct aa_profile *aa_new_null_profile(struct aa_profile *parent, bool hat,
@@ -285,6 +290,16 @@ static inline aa_state_t RULE_MEDIATES_AF(struct aa_ruleset *rules, u16 AF) 
	return aa_dfa_match_len(rules->policy.dfa, state, (char *) &be_af, 2);

}



static inline aa_state_t ANY_RULE_MEDIATES(struct list_head *head,

					   unsigned char class)

{

	struct aa_ruleset *rule;



	/* TODO: change to list walk */

	rule = list_first_entry(head, typeof(*rule), list);

	return RULE_MEDIATES(rule, class);

}



/**

 * aa_get_profile - increment refcount on profile @p

 * @p: profile  (MAYBE NULL)