leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

apparmor: add support for absolute root view based labels

Browse Source 
With apparmor policy virtualization based on policy namespace View's
we don't generally want/need absolute root based views, however there
are cases like debugging and some secid based conversions where
using a root based view is important.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
This commit is contained in:
John Johansen 2017-08-06 05:39:08 -07:00
parent f872af75d3
commit 26b7899510
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
security/apparmor/include/label.h
View File

@ -310,6 +310,7 @@ bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp);
#define FLAG_SHOW_MODE 1 #define FLAG_SHOW_MODE 1
#define FLAG_VIEW_SUBNS 2 #define FLAG_VIEW_SUBNS 2
#define FLAG_HIDDEN_UNCONFINED 4 #define FLAG_HIDDEN_UNCONFINED 4
#define FLAG_ABS_ROOT 8
int aa_label_snxprint(char *str, size_t size, struct aa_ns *view, int aa_label_snxprint(char *str, size_t size, struct aa_ns *view,
struct aa_label *label, int flags); struct aa_label *label, int flags);
int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label, int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,

10
security/apparmor/label.c
View File

@ -1607,8 +1607,13 @@ int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns,
AA_BUG(!str && size != 0); AA_BUG(!str && size != 0);
AA_BUG(!label); AA_BUG(!label);
if (!ns) if (flags & FLAG_ABS_ROOT) {
ns = root_ns;
len = snprintf(str, size, "=");
update_for_len(total, len, size, str);
} else if (!ns) {
ns = labels_ns(label); ns = labels_ns(label);
}
label_for_each(i, label, profile) { label_for_each(i, label, profile) {
if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) { if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
@ -1868,6 +1873,9 @@ struct aa_label *aa_label_parse(struct aa_label *base, const char *str,
if (*str == '&') if (*str == '&')
str++; str++;
} }
if (*str == '=')
base = &root_ns->unconfined->label;
error = vec_setup(profile, vec, len, gfp); error = vec_setup(profile, vec, len, gfp);
if (error) if (error)
return ERR_PTR(error); return ERR_PTR(error);