Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a4987857 authored by John Johansen's avatar John Johansen
Browse files

apparmor: remove sid from profiles 



The sid is not going to be a direct property of a profile anymore, instead
it will be directly related to the label, and the profile will pickup
a label back reference.

For null-profiles replace the use of sid with a per namespace unique
id.

Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
Acked-by: default avatarKees Cook <kees@ubuntu.com>
parent 180a6f59

security/apparmor/include/policy.h

+2 −2
Original line number Diff line number Diff line
@@ -105,6 +105,7 @@ struct aa_ns_acct { 
 * @acct: accounting for the namespace

 * @unconfined: special unconfined profile for the namespace

 * @sub_ns: list of namespaces under the current namespace.

 * @uniq_null: uniq value used for null learning profiles

 *

 * An aa_namespace defines the set profiles that are searched to determine

 * which profile to attach to a task.  Profiles can not be shared between
@@ -127,6 +128,7 @@ struct aa_namespace { 
	struct aa_ns_acct acct;

	struct aa_profile *unconfined;

	struct list_head sub_ns;

	atomic_t uniq_null;

};



/* struct aa_policydb - match engine for a policy
@@ -148,7 +150,6 @@ struct aa_policydb { 
 * @rename: optional profile name that this profile renamed

 * @xmatch: optional extended matching for unconfined executables names

 * @xmatch_len: xmatch prefix len, used to determine xmatch priority

 * @sid: the unique security id number of this profile

 * @audit: the auditing mode of the profile

 * @mode: the enforcement mode of the profile

 * @flags: flags controlling profile behavior
@@ -184,7 +185,6 @@ struct aa_profile { 


	struct aa_dfa *xmatch;

	int xmatch_len;

	u32 sid;

	enum audit_mode audit;

	enum profile_mode mode;

	u32 flags;

security/apparmor/include/sid.h

+3 −1
Original line number Diff line number Diff line
@@ -16,7 +16,9 @@ 


#include <linux/types.h>



struct aa_profile;

/* sid value that will not be allocated */

#define AA_SID_INVALID 0

#define AA_SID_ALLOC AA_SID_INVALID



u32 aa_alloc_sid(void);

void aa_free_sid(u32 sid);

security/apparmor/policy.c

+6 −17
Original line number Diff line number Diff line
@@ -87,7 +87,6 @@ 
#include "include/policy.h"

#include "include/policy_unpack.h"

#include "include/resource.h"

#include "include/sid.h"





/* root profile namespace */
@@ -292,7 +291,6 @@ static struct aa_namespace *alloc_namespace(const char *prefix, 
	if (!ns->unconfined)

		goto fail_unconfined;



	ns->unconfined->sid = aa_alloc_sid();

	ns->unconfined->flags = PFLAG_UNCONFINED | PFLAG_IX_ON_NAME_ERROR |

	    PFLAG_IMMUTABLE;
@@ -303,6 +301,8 @@ static struct aa_namespace *alloc_namespace(const char *prefix, 
	 */

	ns->unconfined->ns = aa_get_namespace(ns);



	atomic_set(&ns->uniq_null, 0);



	return ns;



fail_unconfined:
@@ -497,7 +497,6 @@ static void __replace_profile(struct aa_profile *old, struct aa_profile *new) 
	/* released when @new is freed */

	new->parent = aa_get_profile(old->parent);

	new->ns = aa_get_namespace(old->ns);

	new->sid = old->sid;

	__list_add_profile(&policy->profiles, new);

	/* inherit children */

	list_for_each_entry_safe(child, tmp, &old->base.profiles, base.list) {
@@ -665,7 +664,7 @@ struct aa_profile *aa_alloc_profile(const char *hname) 
 * @hat: true if the null- learning profile is a hat

 *

 * Create a null- complain mode profile used in learning mode.  The name of

 * the profile is unique and follows the format of parent//null-sid.

 * the profile is unique and follows the format of parent//null-<uniq>.

 *

 * null profiles are added to the profile list but the list does not

 * hold a count on them so that they are automatically released when
@@ -677,20 +676,19 @@ struct aa_profile *aa_new_null_profile(struct aa_profile *parent, int hat) 
{

	struct aa_profile *profile = NULL;

	char *name;

	u32 sid = aa_alloc_sid();

	int uniq = atomic_inc_return(&parent->ns->uniq_null);



	/* freed below */

	name = kmalloc(strlen(parent->base.hname) + 2 + 7 + 8, GFP_KERNEL);

	if (!name)

		goto fail;

	sprintf(name, "%s//null-%x", parent->base.hname, sid);

	sprintf(name, "%s//null-%x", parent->base.hname, uniq);



	profile = aa_alloc_profile(name);

	kfree(name);

	if (!profile)

		goto fail;



	profile->sid = sid;

	profile->mode = APPARMOR_COMPLAIN;

	profile->flags = PFLAG_NULL;

	if (hat)
@@ -708,7 +706,6 @@ struct aa_profile *aa_new_null_profile(struct aa_profile *parent, int hat) 
	return profile;



fail:

	aa_free_sid(sid);

	return NULL;

}
@@ -749,7 +746,6 @@ static void free_profile(struct aa_profile *profile) 
	aa_free_cap_rules(&profile->caps);

	aa_free_rlimit_rules(&profile->rlimits);



	aa_free_sid(profile->sid);

	aa_put_dfa(profile->xmatch);

	aa_put_dfa(profile->policy.dfa);
@@ -972,7 +968,6 @@ static void __add_new_profile(struct aa_namespace *ns, struct aa_policy *policy, 
		profile->parent = aa_get_profile((struct aa_profile *) policy);

	__list_add_profile(&policy->profiles, profile);

	/* released on free_profile */

	profile->sid = aa_alloc_sid();

	profile->ns = aa_get_namespace(ns);

}
@@ -1110,14 +1105,8 @@ ssize_t aa_replace_profiles(void *udata, size_t size, bool noreplace) 
	if (!error) {

		if (rename_profile)

			__replace_profile(rename_profile, new_profile);

		if (old_profile) {

			/* when there are both rename and old profiles

			 * inherit old profiles sid

			 */

			if (rename_profile)

				aa_free_sid(new_profile->sid);

		if (old_profile)

			__replace_profile(old_profile, new_profile);

		}

		if (!(old_profile || rename_profile))

			__add_new_profile(ns, policy, new_profile);

	}

security/apparmor/policy_unpack.c

+0 −1
Original line number Diff line number Diff line
@@ -27,7 +27,6 @@ 
#include "include/match.h"

#include "include/policy.h"

#include "include/policy_unpack.h"

#include "include/sid.h"



/*

 * The AppArmor interface treats data as a type byte followed by the