From 66f4781f467e03ad8c2896275ed747798f9ca02c Mon Sep 17 00:00:00 2001
From: John Johansen <john.johansen@canonical.com>
Date: Mon, 29 May 2017 12:19:39 -0700
Subject: [PATCH 27/65] apparmor: switch from file_perms to aa_perms
Git-commit: 2d679f3cb0eaa6afa0dc97fe6ad3b797e1c1899a
Patch-mainline: v4.13-rc1
References: FATE#323500
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Goldwyn Rodrigues <rgoldwyn@suse.com>
---
security/apparmor/domain.c | 18 +++++++++---------
security/apparmor/file.c | 31 ++++++++++++++-----------------
security/apparmor/include/file.h | 25 ++++---------------------
security/apparmor/include/perms.h | 2 +-
security/apparmor/lib.c | 1 +
5 files changed, 29 insertions(+), 48 deletions(-)
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index ab8f23cdccff..a0ba33454b8c 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -93,12 +93,12 @@ static int may_change_ptraced_domain(struct aa_profile *to_profile)
*
* Returns: permission set
*/
-static struct file_perms change_profile_perms(struct aa_profile *profile,
- struct aa_ns *ns,
- const char *name, u32 request,
- unsigned int start)
+static struct aa_perms change_profile_perms(struct aa_profile *profile,
+ struct aa_ns *ns,
+ const char *name, u32 request,
+ unsigned int start)
{
- struct file_perms perms;
+ struct aa_perms perms;
struct path_cond cond = { };
unsigned int state;
@@ -342,7 +342,7 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
struct aa_ns *ns;
char *buffer = NULL;
unsigned int state;
- struct file_perms perms = {};
+ struct aa_perms perms = {};
struct path_cond cond = {
file_inode(bprm->file)->i_uid,
file_inode(bprm->file)->i_mode
@@ -400,7 +400,7 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
/* find exec permissions for name */
state = aa_str_perms(profile->file.dfa, state, name, &cond, &perms);
if (ctx->onexec) {
- struct file_perms cp;
+ struct aa_perms cp;
info = "change_profile onexec";
new_profile = aa_get_newest_profile(ctx->onexec);
if (!(perms.allow & AA_MAY_ONEXEC))
@@ -609,7 +609,7 @@ int aa_change_hat(const char *hats[], int count, u64 token, bool permtest)
struct aa_profile *profile, *previous_profile, *hat = NULL;
char *name = NULL;
int i;
- struct file_perms perms = {};
+ struct aa_perms perms = {};
const char *target = NULL, *info = NULL;
int error = 0;
@@ -748,7 +748,7 @@ int aa_change_profile(const char *fqname, bool onexec,
{
const struct cred *cred;
struct aa_profile *profile, *target = NULL;
- struct file_perms perms = {};
+ struct aa_perms perms = {};
const char *info = NULL, *op;
int error = 0;
u32 request;
diff --git a/security/apparmor/file.c b/security/apparmor/file.c
index 1ee656f66aa4..2e128c2aa4dc 100644
--- a/security/apparmor/file.c
+++ b/security/apparmor/file.c
@@ -19,8 +19,6 @@
#include "include/path.h"
#include "include/policy.h"
-struct file_perms nullperms;
-
static u32 map_mask_to_chr_mask(u32 mask)
{
u32 m = mask & PERMS_CHRS_MASK;
@@ -92,7 +90,7 @@ static void file_audit_cb(struct audit_buffer *ab, void *va)
*
* Returns: %0 or error on failure
*/
-int aa_audit_file(struct aa_profile *profile, struct file_perms *perms,
+int aa_audit_file(struct aa_profile *profile, struct aa_perms *perms,
const char *op, u32 request, const char *name,
const char *target, kuid_t ouid, const char *info, int error)
{
@@ -170,7 +168,7 @@ static u32 map_old_perms(u32 old)
}
/**
- * compute_perms - convert dfa compressed perms to internal perms
+ * aa_compute_fperms - convert dfa compressed perms to internal perms
* @dfa: dfa to compute perms for (NOT NULL)
* @state: state in dfa
* @cond: conditions to consider (NOT NULL)
@@ -180,17 +178,21 @@ static u32 map_old_perms(u32 old)
*
* Returns: computed permission set
*/
-static struct file_perms compute_perms(struct aa_dfa *dfa, unsigned int state,
- struct path_cond *cond)
+struct aa_perms aa_compute_fperms(struct aa_dfa *dfa, unsigned int state,
+ struct path_cond *cond)
{
- struct file_perms perms;
+ struct aa_perms perms;
/* FIXME: change over to new dfa format
* currently file perms are encoded in the dfa, new format
* splits the permissions from the dfa. This mapping can be
* done at profile load
*/
- perms.kill = 0;
+ perms.deny = 0;
+ perms.kill = perms.stop = 0;
+ perms.complain = perms.cond = 0;
+ perms.hide = 0;
+ perms.prompt = 0;
if (uid_eq(current_fsuid(), cond->uid)) {
perms.allow = map_old_perms(dfa_user_allow(dfa, state));
@@ -226,16 +228,11 @@ static struct file_perms compute_perms(struct aa_dfa *dfa, unsigned int state,
*/
unsigned int aa_str_perms(struct aa_dfa *dfa, unsigned int start,
const char *name, struct path_cond *cond,
- struct file_perms *perms)
+ struct aa_perms *perms)
{
unsigned int state;
- if (!dfa) {
- *perms = nullperms;
- return DFA_NOMATCH;
- }
-
state = aa_dfa_match(dfa, start, name);
- *perms = compute_perms(dfa, state, cond);
+ *perms = aa_compute_fperms(dfa, state, cond);
return state;
}
@@ -269,7 +266,7 @@ int aa_path_perm(const char *op, struct aa_profile *profile,
struct path_cond *cond)
{
char *buffer = NULL;
- struct file_perms perms = {};
+ struct aa_perms perms = {};
const char *name, *info = NULL;
int error;
@@ -348,7 +345,7 @@ int aa_path_link(struct aa_profile *profile, struct dentry *old_dentry,
};
char *buffer = NULL, *buffer2 = NULL;
const char *lname, *tname = NULL, *info = NULL;
- struct file_perms lperms, perms;
+ struct aa_perms lperms, perms;
u32 request = AA_MAY_LINK;
unsigned int state;
int error;
diff --git a/security/apparmor/include/file.h b/security/apparmor/include/file.h
index fb3642a94e3d..365ca7ead133 100644
--- a/security/apparmor/include/file.h
+++ b/security/apparmor/include/file.h
@@ -90,25 +90,6 @@ struct path_cond {
umode_t mode;
};
-/* struct file_perms - file permission
- * @allow: mask of permissions that are allowed
- * @audit: mask of permissions to force an audit message for
- * @quiet: mask of permissions to quiet audit messages for
- * @kill: mask of permissions that when matched will kill the task
- * @xindex: exec transition index if @allow contains MAY_EXEC
- *
- * The @audit and @queit mask should be mutually exclusive.
- */
-struct file_perms {
- u32 allow;
- u32 audit;
- u32 quiet;
- u32 kill;
- u16 xindex;
-};
-
-extern struct file_perms nullperms;
-
#define COMBINED_PERM_MASK(X) ((X).allow | (X).audit | (X).quiet | (X).kill)
/* FIXME: split perms from dfa and match this to description
@@ -159,7 +140,7 @@ static inline u16 dfa_map_xindex(u16 mask)
#define dfa_other_xindex(dfa, state) \
dfa_map_xindex((ACCEPT_TABLE(dfa)[state] >> 14) & 0x3fff)
-int aa_audit_file(struct aa_profile *profile, struct file_perms *perms,
+int aa_audit_file(struct aa_profile *profile, struct aa_perms *perms,
const char *op, u32 request, const char *name,
const char *target, kuid_t ouid, const char *info, int error);
@@ -182,9 +163,11 @@ struct aa_file_rules {
/* TODO: add delegate table */
};
+struct aa_perms aa_compute_fperms(struct aa_dfa *dfa, unsigned int state,
+ struct path_cond *cond);
unsigned int aa_str_perms(struct aa_dfa *dfa, unsigned int start,
const char *name, struct path_cond *cond,
- struct file_perms *perms);
+ struct aa_perms *perms);
int aa_path_perm(const char *op, struct aa_profile *profile,
const struct path *path, int flags, u32 request,
diff --git a/security/apparmor/include/perms.h b/security/apparmor/include/perms.h
index 6ef23212bd66..82946fb81f91 100644
--- a/security/apparmor/include/perms.h
+++ b/security/apparmor/include/perms.h
@@ -88,7 +88,7 @@ struct aa_perms {
};
#define ALL_PERMS_MASK 0xffffffff
-
+extern struct aa_perms nullperms;
extern struct aa_perms allperms;
struct aa_profile;
diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c
index a50913744823..3e9146e68c4a 100644
--- a/security/apparmor/lib.c
+++ b/security/apparmor/lib.c
@@ -24,6 +24,7 @@
#include "include/perms.h"
#include "include/policy.h"
+struct aa_perms nullperms;
struct aa_perms allperms = { .allow = ALL_PERMS_MASK,
.quiet = ALL_PERMS_MASK,
.hide = ALL_PERMS_MASK };
--
2.12.3