leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

apparmor: rename context abreviation cxt to the more standard ctx

Browse Source 
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen
2017-01-16 00:43:00 -08:00
parent a20aa95fbe
commit 55a26ebf63
5 changed files with 150 additions and 144 deletions
Download Patch File Download Diff File Expand all files Collapse all files

100
security/apparmor/context.c
View File

@@ -13,11 +13,11 @@
* License. * License.
* *
* *
* AppArmor sets confinement on every task, via the the aa_task_cxt and * AppArmor sets confinement on every task, via the the aa_task_ctx and
* the aa_task_cxt.profile, both of which are required and are not allowed * the aa_task_ctx.profile, both of which are required and are not allowed
* to be NULL. The aa_task_cxt is not reference counted and is unique * to be NULL. The aa_task_ctx is not reference counted and is unique
* to each cred (which is reference count). The profile pointed to by * to each cred (which is reference count). The profile pointed to by
* the task_cxt is reference counted. * the task_ctx is reference counted.
* *
* TODO * TODO
* If a task uses change_hat it currently does not return to the old * If a task uses change_hat it currently does not return to the old
@@ -30,28 +30,28 @@
#include "include/policy.h" #include "include/policy.h"
/** /**
* aa_alloc_task_context - allocate a new task_cxt * aa_alloc_task_context - allocate a new task_ctx
* @flags: gfp flags for allocation * @flags: gfp flags for allocation
* *
* Returns: allocated buffer or NULL on failure * Returns: allocated buffer or NULL on failure
*/ */
struct aa_task_cxt *aa_alloc_task_context(gfp_t flags) struct aa_task_ctx *aa_alloc_task_context(gfp_t flags)
{ {
return kzalloc(sizeof(struct aa_task_cxt), flags); return kzalloc(sizeof(struct aa_task_ctx), flags);
} }
/** /**
* aa_free_task_context - free a task_cxt * aa_free_task_context - free a task_ctx
* @cxt: task_cxt to free (MAYBE NULL) * @ctx: task_ctx to free (MAYBE NULL)
*/ */
void aa_free_task_context(struct aa_task_cxt *cxt) void aa_free_task_context(struct aa_task_ctx *ctx)
{ {
if (cxt) { if (ctx) {
aa_put_profile(cxt->profile); aa_put_profile(ctx->profile);
aa_put_profile(cxt->previous); aa_put_profile(ctx->previous);
aa_put_profile(cxt->onexec); aa_put_profile(ctx->onexec);
kzfree(cxt); kzfree(ctx);
} }
} }
@@ -60,7 +60,7 @@ void aa_free_task_context(struct aa_task_cxt *cxt)
* @new: a blank task context (NOT NULL) * @new: a blank task context (NOT NULL)
* @old: the task context to copy (NOT NULL) * @old: the task context to copy (NOT NULL)
*/ */
void aa_dup_task_context(struct aa_task_cxt *new, const struct aa_task_cxt *old) void aa_dup_task_context(struct aa_task_ctx *new, const struct aa_task_ctx *old)
{ {
*new = *old; *new = *old;
aa_get_profile(new->profile); aa_get_profile(new->profile);
@@ -93,11 +93,11 @@ struct aa_profile *aa_get_task_profile(struct task_struct *task)
*/ */
int aa_replace_current_profile(struct aa_profile *profile) int aa_replace_current_profile(struct aa_profile *profile)
{ {
struct aa_task_cxt *cxt = current_cxt(); struct aa_task_ctx *ctx = current_ctx();
struct cred *new; struct cred *new;
BUG_ON(!profile); BUG_ON(!profile);
if (cxt->profile == profile) if (ctx->profile == profile)
return 0; return 0;
if (current_cred() != current_real_cred()) if (current_cred() != current_real_cred())
@@ -107,20 +107,22 @@ int aa_replace_current_profile(struct aa_profile *profile)
if (!new) if (!new)
return -ENOMEM; return -ENOMEM;
cxt = cred_cxt(new); ctx = cred_ctx(new);
if (unconfined(profile) || (cxt->profile->ns != profile->ns)) if (unconfined(profile) || (ctx->profile->ns != profile->ns))
/* if switching to unconfined or a different profile namespace /* if switching to unconfined or a different profile namespace
* clear out context state * clear out context state
*/ */
aa_clear_task_cxt_trans(cxt); aa_clear_task_ctx_trans(ctx);
/* be careful switching cxt->profile, when racing replacement it /*
* is possible that cxt->profile->proxy->profile is the reference * be careful switching ctx->profile, when racing replacement it
* is possible that ctx->profile->proxy->profile is the reference
* keeping @profile valid, so make sure to get its reference before * keeping @profile valid, so make sure to get its reference before
* dropping the reference on cxt->profile */ * dropping the reference on ctx->profile
*/
aa_get_profile(profile); aa_get_profile(profile);
aa_put_profile(cxt->profile); aa_put_profile(ctx->profile);
cxt->profile = profile; ctx->profile = profile;
commit_creds(new); commit_creds(new);
return 0; return 0;
@@ -134,15 +136,15 @@ int aa_replace_current_profile(struct aa_profile *profile)
*/ */
int aa_set_current_onexec(struct aa_profile *profile) int aa_set_current_onexec(struct aa_profile *profile)
{ {
struct aa_task_cxt *cxt; struct aa_task_ctx *ctx;
struct cred *new = prepare_creds(); struct cred *new = prepare_creds();
if (!new) if (!new)
return -ENOMEM; return -ENOMEM;
cxt = cred_cxt(new); ctx = cred_ctx(new);
aa_get_profile(profile); aa_get_profile(profile);
aa_put_profile(cxt->onexec); aa_put_profile(ctx->onexec);
cxt->onexec = profile; ctx->onexec = profile;
commit_creds(new); commit_creds(new);
return 0; return 0;
@@ -160,28 +162,28 @@ int aa_set_current_onexec(struct aa_profile *profile)
*/ */
int aa_set_current_hat(struct aa_profile *profile, u64 token) int aa_set_current_hat(struct aa_profile *profile, u64 token)
{ {
struct aa_task_cxt *cxt; struct aa_task_ctx *ctx;
struct cred *new = prepare_creds(); struct cred *new = prepare_creds();
if (!new) if (!new)
return -ENOMEM; return -ENOMEM;
BUG_ON(!profile); BUG_ON(!profile);
cxt = cred_cxt(new); ctx = cred_ctx(new);
if (!cxt->previous) { if (!ctx->previous) {
/* transfer refcount */ /* transfer refcount */
cxt->previous = cxt->profile; ctx->previous = ctx->profile;
cxt->token = token; ctx->token = token;
} else if (cxt->token == token) { } else if (ctx->token == token) {
aa_put_profile(cxt->profile); aa_put_profile(ctx->profile);
} else { } else {
/* previous_profile && cxt->token != token */ /* previous_profile && ctx->token != token */
abort_creds(new); abort_creds(new);
return -EACCES; return -EACCES;
} }
cxt->profile = aa_get_newest_profile(profile); ctx->profile = aa_get_newest_profile(profile);
/* clear exec on switching context */ /* clear exec on switching context */
aa_put_profile(cxt->onexec); aa_put_profile(ctx->onexec);
cxt->onexec = NULL; ctx->onexec = NULL;
commit_creds(new); commit_creds(new);
return 0; return 0;
@@ -198,27 +200,27 @@ int aa_set_current_hat(struct aa_profile *profile, u64 token)
*/ */
int aa_restore_previous_profile(u64 token) int aa_restore_previous_profile(u64 token)
{ {
struct aa_task_cxt *cxt; struct aa_task_ctx *ctx;
struct cred *new = prepare_creds(); struct cred *new = prepare_creds();
if (!new) if (!new)
return -ENOMEM; return -ENOMEM;
cxt = cred_cxt(new); ctx = cred_ctx(new);
if (cxt->token != token) { if (ctx->token != token) {
abort_creds(new); abort_creds(new);
return -EACCES; return -EACCES;
} }
/* ignore restores when there is no saved profile */ /* ignore restores when there is no saved profile */
if (!cxt->previous) { if (!ctx->previous) {
abort_creds(new); abort_creds(new);
return 0; return 0;
} }
aa_put_profile(cxt->profile); aa_put_profile(ctx->profile);
cxt->profile = aa_get_newest_profile(cxt->previous); ctx->profile = aa_get_newest_profile(ctx->previous);
BUG_ON(!cxt->profile); AA_BUG(!ctx->profile);
/* clear exec && prev information when restoring to previous context */ /* clear exec && prev information when restoring to previous context */
aa_clear_task_cxt_trans(cxt); aa_clear_task_ctx_trans(ctx);
commit_creds(new); commit_creds(new);
return 0; return 0;

42
security/apparmor/domain.c
View File

@@ -337,7 +337,7 @@ static struct aa_profile *x_to_profile(struct aa_profile *profile,
*/ */
int apparmor_bprm_set_creds(struct linux_binprm *bprm) int apparmor_bprm_set_creds(struct linux_binprm *bprm)
{ {
struct aa_task_cxt *cxt; struct aa_task_ctx *ctx;
struct aa_profile *profile, *new_profile = NULL; struct aa_profile *profile, *new_profile = NULL;
struct aa_ns *ns; struct aa_ns *ns;
char *buffer = NULL; char *buffer = NULL;
@@ -353,10 +353,10 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
if (bprm->cred_prepared) if (bprm->cred_prepared)
return 0; return 0;
cxt = cred_cxt(bprm->cred); ctx = cred_ctx(bprm->cred);
BUG_ON(!cxt); AA_BUG(!ctx);
profile = aa_get_newest_profile(cxt->profile); profile = aa_get_newest_profile(ctx->profile);
/* /*
* get the namespace from the replacement profile as replacement * get the namespace from the replacement profile as replacement
* can change the namespace * can change the namespace
@@ -380,9 +380,9 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
*/ */
if (unconfined(profile)) { if (unconfined(profile)) {
/* unconfined task */ /* unconfined task */
if (cxt->onexec) if (ctx->onexec)
/* change_profile on exec already been granted */ /* change_profile on exec already been granted */
new_profile = aa_get_profile(cxt->onexec); new_profile = aa_get_profile(ctx->onexec);
else else
new_profile = find_attach(ns, &ns->base.profiles, name); new_profile = find_attach(ns, &ns->base.profiles, name);
if (!new_profile) if (!new_profile)
@@ -397,10 +397,10 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
/* find exec permissions for name */ /* find exec permissions for name */
state = aa_str_perms(profile->file.dfa, state, name, &cond, &perms); state = aa_str_perms(profile->file.dfa, state, name, &cond, &perms);
if (cxt->onexec) { if (ctx->onexec) {
struct file_perms cp; struct file_perms cp;
info = "change_profile onexec"; info = "change_profile onexec";
new_profile = aa_get_newest_profile(cxt->onexec); new_profile = aa_get_newest_profile(ctx->onexec);
if (!(perms.allow & AA_MAY_ONEXEC)) if (!(perms.allow & AA_MAY_ONEXEC))
goto audit; goto audit;
@@ -409,8 +409,8 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
* exec\0change_profile * exec\0change_profile
*/ */
state = aa_dfa_null_transition(profile->file.dfa, state); state = aa_dfa_null_transition(profile->file.dfa, state);
cp = change_profile_perms(profile, cxt->onexec->ns, cp = change_profile_perms(profile, ctx->onexec->ns,
cxt->onexec->base.name, ctx->onexec->base.name,
AA_MAY_ONEXEC, state); AA_MAY_ONEXEC, state);
if (!(cp.allow & AA_MAY_ONEXEC)) if (!(cp.allow & AA_MAY_ONEXEC))
@@ -499,13 +499,13 @@ apply:
bprm->per_clear |= PER_CLEAR_ON_SETID; bprm->per_clear |= PER_CLEAR_ON_SETID;
x_clear: x_clear:
aa_put_profile(cxt->profile); aa_put_profile(ctx->profile);
/* transfer new profile reference will be released when cxt is freed */ /* transfer new profile reference will be released when ctx is freed */
cxt->profile = new_profile; ctx->profile = new_profile;
new_profile = NULL; new_profile = NULL;
/* clear out all temporary/transitional state from the context */ /* clear out all temporary/transitional state from the context */
aa_clear_task_cxt_trans(cxt); aa_clear_task_ctx_trans(ctx);
audit: audit:
error = aa_audit_file(profile, &perms, GFP_KERNEL, OP_EXEC, MAY_EXEC, error = aa_audit_file(profile, &perms, GFP_KERNEL, OP_EXEC, MAY_EXEC,
@@ -545,17 +545,17 @@ int apparmor_bprm_secureexec(struct linux_binprm *bprm)
void apparmor_bprm_committing_creds(struct linux_binprm *bprm) void apparmor_bprm_committing_creds(struct linux_binprm *bprm)
{ {
struct aa_profile *profile = __aa_current_profile(); struct aa_profile *profile = __aa_current_profile();
struct aa_task_cxt *new_cxt = cred_cxt(bprm->cred); struct aa_task_ctx *new_ctx = cred_ctx(bprm->cred);
/* bail out if unconfined or not changing profile */ /* bail out if unconfined or not changing profile */
if ((new_cxt->profile == profile) || if ((new_ctx->profile == profile) ||
(unconfined(new_cxt->profile))) (unconfined(new_ctx->profile)))
return; return;
current->pdeath_signal = 0; current->pdeath_signal = 0;
/* reset soft limits and set hard limits for the new profile */ /* reset soft limits and set hard limits for the new profile */
__aa_transition_rlimits(profile, new_cxt->profile); __aa_transition_rlimits(profile, new_ctx->profile);
} }
/** /**
@@ -604,7 +604,7 @@ static char *new_compound_name(const char *n1, const char *n2)
int aa_change_hat(const char *hats[], int count, u64 token, bool permtest) int aa_change_hat(const char *hats[], int count, u64 token, bool permtest)
{ {
const struct cred *cred; const struct cred *cred;
struct aa_task_cxt *cxt; struct aa_task_ctx *ctx;
struct aa_profile *profile, *previous_profile, *hat = NULL; struct aa_profile *profile, *previous_profile, *hat = NULL;
char *name = NULL; char *name = NULL;
int i; int i;
@@ -622,9 +622,9 @@ int aa_change_hat(const char *hats[], int count, u64 token, bool permtest)
/* released below */ /* released below */
cred = get_current_cred(); cred = get_current_cred();
cxt = cred_cxt(cred); ctx = cred_ctx(cred);
profile = aa_get_newest_profile(aa_cred_profile(cred)); profile = aa_get_newest_profile(aa_cred_profile(cred));
previous_profile = aa_get_newest_profile(cxt->previous); previous_profile = aa_get_newest_profile(ctx->previous);
if (unconfined(profile)) { if (unconfined(profile)) {
info = "unconfined"; info = "unconfined";

78
security/apparmor/include/context.h
View File

@@ -22,43 +22,43 @@
#include "policy.h" #include "policy.h"
#include "policy_ns.h" #include "policy_ns.h"
#define cred_cxt(X) (X)->security #define cred_ctx(X) ((X)->security)
#define current_cxt() cred_cxt(current_cred()) #define current_ctx() cred_ctx(current_cred())
/* struct aa_file_cxt - the AppArmor context the file was opened in /* struct aa_file_ctx - the AppArmor context the file was opened in
* @perms: the permission the file was opened with * @perms: the permission the file was opened with
* *
* The file_cxt could currently be directly stored in file->f_security * The file_ctx could currently be directly stored in file->f_security
* as the profile reference is now stored in the f_cred. However the * as the profile reference is now stored in the f_cred. However the
* cxt struct will expand in the future so we keep the struct. * ctx struct will expand in the future so we keep the struct.
*/ */
struct aa_file_cxt { struct aa_file_ctx {
u16 allow; u16 allow;
}; };
/** /**
* aa_alloc_file_context - allocate file_cxt * aa_alloc_file_context - allocate file_ctx
* @gfp: gfp flags for allocation * @gfp: gfp flags for allocation
* *
* Returns: file_cxt or NULL on failure * Returns: file_ctx or NULL on failure
*/ */
static inline struct aa_file_cxt *aa_alloc_file_context(gfp_t gfp) static inline struct aa_file_ctx *aa_alloc_file_context(gfp_t gfp)
{ {
return kzalloc(sizeof(struct aa_file_cxt), gfp); return kzalloc(sizeof(struct aa_file_ctx), gfp);
} }
/** /**
* aa_free_file_context - free a file_cxt * aa_free_file_context - free a file_ctx
* @cxt: file_cxt to free (MAYBE_NULL) * @ctx: file_ctx to free (MAYBE_NULL)
*/ */
static inline void aa_free_file_context(struct aa_file_cxt *cxt) static inline void aa_free_file_context(struct aa_file_ctx *ctx)
{ {
if (cxt) if (ctx)
kzfree(cxt); kzfree(ctx);
} }
/** /**
* struct aa_task_cxt - primary label for confined tasks * struct aa_task_ctx - primary label for confined tasks
* @profile: the current profile (NOT NULL) * @profile: the current profile (NOT NULL)
* @exec: profile to transition to on next exec (MAYBE NULL) * @exec: profile to transition to on next exec (MAYBE NULL)
* @previous: profile the task may return to (MAYBE NULL) * @previous: profile the task may return to (MAYBE NULL)
@@ -69,17 +69,17 @@ static inline void aa_free_file_context(struct aa_file_cxt *cxt)
* *
* TODO: make so a task can be confined by a stack of contexts * TODO: make so a task can be confined by a stack of contexts
*/ */
struct aa_task_cxt { struct aa_task_ctx {
struct aa_profile *profile; struct aa_profile *profile;
struct aa_profile *onexec; struct aa_profile *onexec;
struct aa_profile *previous; struct aa_profile *previous;
u64 token; u64 token;
}; };
struct aa_task_cxt *aa_alloc_task_context(gfp_t flags); struct aa_task_ctx *aa_alloc_task_context(gfp_t flags);
void aa_free_task_context(struct aa_task_cxt *cxt); void aa_free_task_context(struct aa_task_ctx *ctx);
void aa_dup_task_context(struct aa_task_cxt *new, void aa_dup_task_context(struct aa_task_ctx *new,
const struct aa_task_cxt *old); const struct aa_task_ctx *old);
int aa_replace_current_profile(struct aa_profile *profile); int aa_replace_current_profile(struct aa_profile *profile);
int aa_set_current_onexec(struct aa_profile *profile); int aa_set_current_onexec(struct aa_profile *profile);
int aa_set_current_hat(struct aa_profile *profile, u64 token); int aa_set_current_hat(struct aa_profile *profile, u64 token);
@@ -97,9 +97,10 @@ struct aa_profile *aa_get_task_profile(struct task_struct *task);
*/ */
static inline struct aa_profile *aa_cred_profile(const struct cred *cred) static inline struct aa_profile *aa_cred_profile(const struct cred *cred)
{ {
struct aa_task_cxt *cxt = cred_cxt(cred); struct aa_task_ctx *ctx = cred_ctx(cred);
BUG_ON(!cxt || !cxt->profile);
return cxt->profile; AA_BUG(!ctx || !ctx->profile);
return ctx->profile;
} }
/** /**
@@ -149,18 +150,19 @@ static inline struct aa_profile *__aa_current_profile(void)
*/ */
static inline struct aa_profile *aa_current_profile(void) static inline struct aa_profile *aa_current_profile(void)
{ {
const struct aa_task_cxt *cxt = current_cxt(); const struct aa_task_ctx *ctx = current_ctx();
struct aa_profile *profile; struct aa_profile *profile;
BUG_ON(!cxt || !cxt->profile);
if (profile_is_stale(cxt->profile)) { AA_BUG(!ctx || !ctx->profile);
profile = aa_get_newest_profile(cxt->profile);
if (profile_is_stale(ctx->profile)) {
profile = aa_get_newest_profile(ctx->profile);
aa_replace_current_profile(profile); aa_replace_current_profile(profile);
aa_put_profile(profile); aa_put_profile(profile);
cxt = current_cxt(); ctx = current_ctx();
} }
return cxt->profile; return ctx->profile;
} }
static inline struct aa_ns *aa_get_current_ns(void) static inline struct aa_ns *aa_get_current_ns(void)
@@ -169,16 +171,16 @@ static inline struct aa_ns *aa_get_current_ns(void)
} }
/** /**
* aa_clear_task_cxt_trans - clear transition tracking info from the cxt * aa_clear_task_ctx_trans - clear transition tracking info from the ctx
* @cxt: task context to clear (NOT NULL) * @ctx: task context to clear (NOT NULL)
*/ */
static inline void aa_clear_task_cxt_trans(struct aa_task_cxt *cxt) static inline void aa_clear_task_ctx_trans(struct aa_task_ctx *ctx)
{ {
aa_put_profile(cxt->previous); aa_put_profile(ctx->previous);
aa_put_profile(cxt->onexec); aa_put_profile(ctx->onexec);
cxt->previous = NULL; ctx->previous = NULL;
cxt->onexec = NULL; ctx->onexec = NULL;
cxt->token = 0; ctx->token = 0;
} }
#endif /* __AA_CONTEXT_H */ #endif /* __AA_CONTEXT_H */

72
security/apparmor/lsm.c
View File

@@ -45,12 +45,12 @@ int apparmor_initialized __initdata;
*/ */
/* /*
* free the associated aa_task_cxt and put its profiles * free the associated aa_task_ctx and put its profiles
*/ */
static void apparmor_cred_free(struct cred *cred) static void apparmor_cred_free(struct cred *cred)
{ {
aa_free_task_context(cred_cxt(cred)); aa_free_task_context(cred_ctx(cred));
cred_cxt(cred) = NULL; cred_ctx(cred) = NULL;
} }
/* /*
@@ -59,27 +59,29 @@ static void apparmor_cred_free(struct cred *cred)
static int apparmor_cred_alloc_blank(struct cred *cred, gfp_t gfp) static int apparmor_cred_alloc_blank(struct cred *cred, gfp_t gfp)
{ {
/* freed by apparmor_cred_free */ /* freed by apparmor_cred_free */
struct aa_task_cxt *cxt = aa_alloc_task_context(gfp); struct aa_task_ctx *ctx = aa_alloc_task_context(gfp);
if (!cxt)
if (!ctx)
return -ENOMEM; return -ENOMEM;
cred_cxt(cred) = cxt; cred_ctx(cred) = ctx;
return 0; return 0;
} }
/* /*
* prepare new aa_task_cxt for modification by prepare_cred block * prepare new aa_task_ctx for modification by prepare_cred block
*/ */
static int apparmor_cred_prepare(struct cred *new, const struct cred *old, static int apparmor_cred_prepare(struct cred *new, const struct cred *old,
gfp_t gfp) gfp_t gfp)
{ {
/* freed by apparmor_cred_free */ /* freed by apparmor_cred_free */
struct aa_task_cxt *cxt = aa_alloc_task_context(gfp); struct aa_task_ctx *ctx = aa_alloc_task_context(gfp);
if (!cxt)
if (!ctx)
return -ENOMEM; return -ENOMEM;
aa_dup_task_context(cxt, cred_cxt(old)); aa_dup_task_context(ctx, cred_ctx(old));
cred_cxt(new) = cxt; cred_ctx(new) = ctx;
return 0; return 0;
} }
@@ -88,10 +90,10 @@ static int apparmor_cred_prepare(struct cred *new, const struct cred *old,
*/ */
static void apparmor_cred_transfer(struct cred *new, const struct cred *old) static void apparmor_cred_transfer(struct cred *new, const struct cred *old)
{ {
const struct aa_task_cxt *old_cxt = cred_cxt(old); const struct aa_task_ctx *old_ctx = cred_ctx(old);
struct aa_task_cxt *new_cxt = cred_cxt(new); struct aa_task_ctx *new_ctx = cred_ctx(new);
aa_dup_task_context(new_cxt, old_cxt); aa_dup_task_context(new_ctx, old_ctx);
} }
static int apparmor_ptrace_access_check(struct task_struct *child, static int apparmor_ptrace_access_check(struct task_struct *child,
@@ -345,7 +347,7 @@ static int apparmor_inode_getattr(const struct path *path)
static int apparmor_file_open(struct file *file, const struct cred *cred) static int apparmor_file_open(struct file *file, const struct cred *cred)
{ {
struct aa_file_cxt *fcxt = file->f_security; struct aa_file_ctx *fctx = file->f_security;
struct aa_profile *profile; struct aa_profile *profile;
int error = 0; int error = 0;
@@ -358,7 +360,7 @@ static int apparmor_file_open(struct file *file, const struct cred *cred)
* actually execute the image. * actually execute the image.
*/ */
if (current->in_execve) { if (current->in_execve) {
fcxt->allow = MAY_EXEC | MAY_READ | AA_EXEC_MMAP; fctx->allow = MAY_EXEC | MAY_READ | AA_EXEC_MMAP;
return 0; return 0;
} }
@@ -370,7 +372,7 @@ static int apparmor_file_open(struct file *file, const struct cred *cred)
error = aa_path_perm(OP_OPEN, profile, &file->f_path, 0, error = aa_path_perm(OP_OPEN, profile, &file->f_path, 0,
aa_map_file_to_perms(file), &cond); aa_map_file_to_perms(file), &cond);
/* todo cache full allowed permissions set and state */ /* todo cache full allowed permissions set and state */
fcxt->allow = aa_map_file_to_perms(file); fctx->allow = aa_map_file_to_perms(file);
} }
return error; return error;
@@ -388,14 +390,14 @@ static int apparmor_file_alloc_security(struct file *file)
static void apparmor_file_free_security(struct file *file) static void apparmor_file_free_security(struct file *file)
{ {
struct aa_file_cxt *cxt = file->f_security; struct aa_file_ctx *ctx = file->f_security;
aa_free_file_context(cxt); aa_free_file_context(ctx);
} }
static int common_file_perm(int op, struct file *file, u32 mask) static int common_file_perm(int op, struct file *file, u32 mask)
{ {
struct aa_file_cxt *fcxt = file->f_security; struct aa_file_ctx *fctx = file->f_security;
struct aa_profile *profile, *fprofile = aa_cred_profile(file->f_cred); struct aa_profile *profile, *fprofile = aa_cred_profile(file->f_cred);
int error = 0; int error = 0;
@@ -415,7 +417,7 @@ static int common_file_perm(int op, struct file *file, u32 mask)
* delegation from unconfined tasks * delegation from unconfined tasks
*/ */
if (!unconfined(profile) && !unconfined(fprofile) && if (!unconfined(profile) && !unconfined(fprofile) &&
((fprofile != profile) || (mask & ~fcxt->allow))) ((fprofile != profile) || (mask & ~fctx->allow)))
error = aa_file_perm(op, profile, file, mask); error = aa_file_perm(op, profile, file, mask);
return error; return error;
@@ -477,15 +479,15 @@ static int apparmor_getprocattr(struct task_struct *task, char *name,
int error = -ENOENT; int error = -ENOENT;
/* released below */ /* released below */
const struct cred *cred = get_task_cred(task); const struct cred *cred = get_task_cred(task);
struct aa_task_cxt *cxt = cred_cxt(cred); struct aa_task_ctx *ctx = cred_ctx(cred);
struct aa_profile *profile = NULL; struct aa_profile *profile = NULL;
if (strcmp(name, "current") == 0) if (strcmp(name, "current") == 0)
profile = aa_get_newest_profile(cxt->profile); profile = aa_get_newest_profile(ctx->profile);
else if (strcmp(name, "prev") == 0 && cxt->previous) else if (strcmp(name, "prev") == 0 && ctx->previous)
profile = aa_get_newest_profile(cxt->previous); profile = aa_get_newest_profile(ctx->previous);
else if (strcmp(name, "exec") == 0 && cxt->onexec) else if (strcmp(name, "exec") == 0 && ctx->onexec)
profile = aa_get_newest_profile(cxt->onexec); profile = aa_get_newest_profile(ctx->onexec);
else else
error = -EINVAL; error = -EINVAL;
@@ -849,21 +851,21 @@ static int param_set_mode(const char *val, struct kernel_param *kp)
*/ */
/** /**
* set_init_cxt - set a task context and profile on the first task. * set_init_ctx - set a task context and profile on the first task.
* *
* TODO: allow setting an alternate profile than unconfined * TODO: allow setting an alternate profile than unconfined
*/ */
static int __init set_init_cxt(void) static int __init set_init_ctx(void)
{ {
struct cred *cred = (struct cred *)current->real_cred; struct cred *cred = (struct cred *)current->real_cred;
struct aa_task_cxt *cxt; struct aa_task_ctx *ctx;
cxt = aa_alloc_task_context(GFP_KERNEL); ctx = aa_alloc_task_context(GFP_KERNEL);
if (!cxt) if (!ctx)
return -ENOMEM; return -ENOMEM;
cxt->profile = aa_get_profile(root_ns->unconfined); ctx->profile = aa_get_profile(root_ns->unconfined);
cred_cxt(cred) = cxt; cred_ctx(cred) = ctx;
return 0; return 0;
} }
@@ -890,7 +892,7 @@ static int __init apparmor_init(void)
goto alloc_out; goto alloc_out;
} }
error = set_init_cxt(); error = set_init_ctx();
if (error) { if (error) {
AA_ERROR("Failed to set context on init task\n"); AA_ERROR("Failed to set context on init task\n");
aa_free_root_ns(); aa_free_root_ns();

2
security/apparmor/policy.c
View File

@@ -808,7 +808,7 @@ static int __lookup_replace(struct aa_ns *ns, const char *hname,
* @udata: serialized data stream (NOT NULL) * @udata: serialized data stream (NOT NULL)
* *
* unpack and replace a profile on the profile list and uses of that profile * unpack and replace a profile on the profile list and uses of that profile
* by any aa_task_cxt. If the profile does not exist on the profile list * by any aa_task_ctx. If the profile does not exist on the profile list
* it is added. * it is added.
* *
* Returns: size of data consumed else error code on failure. * Returns: size of data consumed else error code on failure.