Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 617a629c authored by Matthew Garrett's avatar Matthew Garrett Committed by John Johansen
Browse files

apparmor: Add a wildcard secid 



Reserve a secid value that we can use as a wildcard, allowing us to
define policy that's expected to match against all secids.

Signed-off-by: default avatarMatthew Garrett <mjg59@google.com>
Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
parent 1f8266ff

security/apparmor/include/secid.h

+3 −0
Original line number Diff line number Diff line
@@ -22,6 +22,9 @@ struct aa_label; 
/* secid value that will not be allocated */

#define AA_SECID_INVALID 0



/* secid value that matches any other secid */

#define AA_SECID_WILDCARD 1



struct aa_label *aa_secid_to_label(u32 secid);

int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);

int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);

security/apparmor/secid.c

+1 −2
Original line number Diff line number Diff line
@@ -32,8 +32,7 @@ 
 * secids - do not pin labels with a refcount. They rely on the label

 * properly updating/freeing them

 */



#define AA_FIRST_SECID 1

#define AA_FIRST_SECID 2



static DEFINE_IDR(aa_secids);

static DEFINE_SPINLOCK(secid_lock);