Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d384b0a1 authored by Kees Cook's avatar Kees Cook Committed by John Johansen
Browse files

AppArmor: export known rlimit names/value mappings in securityfs 



Since the parser needs to know which rlimits are known to the kernel,
export the list via a mask file in the "rlimit" subdirectory in the
securityfs "features" directory.

Signed-off-by: default avatarKees Cook <kees@ubuntu.com>
Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
parent a9bf8e9f

security/apparmor/Makefile

+18 −6
Original line number Diff line number Diff line
@@ -28,25 +28,37 @@ cmd_make-caps = echo "static const char *capability_names[] = {" > $@ ;\ 
#    [RLIMIT_STACK] = "stack",

#

# and build a second integer table (with the second sed cmd), that maps

# RLIMIT defines to the order defined in asm-generic/resource.h  Thi is

# RLIMIT defines to the order defined in asm-generic/resource.h  This is

# required by policy load to map policy ordering of RLIMITs to internal

# ordering for architectures that redefine an RLIMIT.

# Transforms lines from

#    #define RLIMIT_STACK		3	/* max stack size */

# to

# RLIMIT_STACK, 

#

# and build the securityfs entries for the mapping.

# Transforms lines from

#    #define RLIMIT_FSIZE        1   /* Maximum filesize */

#    #define RLIMIT_STACK		3	/* max stack size */

# to

# #define AA_FS_RLIMIT_MASK "fsize stack"

quiet_cmd_make-rlim = GEN     $@

cmd_make-rlim = echo "static const char *rlim_names[] = {" > $@ ;\

cmd_make-rlim = echo "static const char *rlim_names[RLIM_NLIMITS] = {" > $@ ;\

	sed $< >> $@ -r -n \

	    -e 's/^\# ?define[ \t]+(RLIMIT_([A-Z0-9_]+)).*/[\1] = "\L\2",/p';\

	echo "};" >> $@ ;\

	echo "static const int rlim_map[] = {" >> $@ ;\

	echo "static const int rlim_map[RLIM_NLIMITS] = {" >> $@ ;\

	sed -r -n "s/^\# ?define[ \t]+(RLIMIT_[A-Z0-9_]+).*/\1,/p" $< >> $@ ;\

	echo "};" >> $@

	echo "};" >> $@ ; \

	echo -n '\#define AA_FS_RLIMIT_MASK "' >> $@ ;\

	sed -r -n 's/^\# ?define[ \t]+RLIMIT_([A-Z0-9_]+).*/\L\1/p' $< | \

	    tr '\n' ' ' | sed -e 's/ $$/"\n/' >> $@



$(obj)/capability.o : $(obj)/capability_names.h

$(obj)/resource.o : $(obj)/rlim_names.h

$(obj)/capability_names.h : $(srctree)/include/linux/capability.h

$(obj)/capability_names.h : $(srctree)/include/linux/capability.h \

			    $(src)/Makefile

	$(call cmd,make-caps)

$(obj)/rlim_names.h : $(srctree)/include/asm-generic/resource.h

$(obj)/rlim_names.h : $(srctree)/include/asm-generic/resource.h \

		      $(src)/Makefile

	$(call cmd,make-rlim)

security/apparmor/apparmorfs.c

+2 −0
Original line number Diff line number Diff line
@@ -25,6 +25,7 @@ 
#include "include/audit.h"

#include "include/context.h"

#include "include/policy.h"

#include "include/resource.h"



/**

 * aa_simple_write_to_buffer - common routine for getting policy from user
@@ -201,6 +202,7 @@ static struct aa_fs_entry aa_fs_entry_features[] = { 
	AA_FS_DIR("domain",			aa_fs_entry_domain),

	AA_FS_DIR("file",			aa_fs_entry_file),

	AA_FS_FILE_U64("capability",		VFS_CAP_FLAGS_MASK),

	AA_FS_DIR("rlimit",			aa_fs_entry_rlimit),

	{ }

};

security/apparmor/include/resource.h

+4 −0
Original line number Diff line number Diff line
@@ -18,6 +18,8 @@ 
#include <linux/resource.h>

#include <linux/sched.h>



#include "apparmorfs.h"



struct aa_profile;



/* struct aa_rlimit - rlimit settings for the profile
@@ -32,6 +34,8 @@ struct aa_rlimit { 
	struct rlimit limits[RLIM_NLIMITS];

};



extern struct aa_fs_entry aa_fs_entry_rlimit[];



int aa_map_resource(int resource);

int aa_task_setrlimit(struct aa_profile *profile, struct task_struct *,

		      unsigned int resource, struct rlimit *new_rlim);

security/apparmor/resource.c

+5 −0
Original line number Diff line number Diff line
@@ -23,6 +23,11 @@ 
 */

#include "rlim_names.h"



struct aa_fs_entry aa_fs_entry_rlimit[] = {

	AA_FS_FILE_STRING("mask", AA_FS_RLIMIT_MASK),

	{ }

};



/* audit callback for resource specific fields */

static void audit_cb(struct audit_buffer *ab, void *va)

{