Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c0929212 authored by John Johansen's avatar John Johansen
Browse files

apparmor: add support for mapping secids and using secctxes 



Use a radix tree to provide a map between the secid and the label,
and along with it a basic ability to provide secctx conversion.

Shared/cached secctx will be added later.

Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
parent 552c69b3

security/apparmor/include/label.h

+1 −1
Original line number Diff line number Diff line
@@ -281,7 +281,7 @@ void __aa_labelset_update_subtree(struct aa_ns *ns); 


void aa_label_free(struct aa_label *label);

void aa_label_kref(struct kref *kref);

bool aa_label_init(struct aa_label *label, int size);

bool aa_label_init(struct aa_label *label, int size, gfp_t gfp);

struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp);



bool aa_label_is_subset(struct aa_label *set, struct aa_label *sub);

security/apparmor/include/secid.h

+12 −3
Original line number Diff line number Diff line
@@ -3,7 +3,7 @@ 
 *

 * This file contains AppArmor security identifier (secid) definitions

 *

 * Copyright 2009-2010 Canonical Ltd.

 * Copyright 2009-2018 Canonical Ltd.

 *

 * This program is free software; you can redistribute it and/or

 * modify it under the terms of the GNU General Public License as
@@ -14,13 +14,22 @@ 
#ifndef __AA_SECID_H

#define __AA_SECID_H



#include <linux/slab.h>

#include <linux/types.h>



struct aa_label;



/* secid value that will not be allocated */

#define AA_SECID_INVALID 0

#define AA_SECID_ALLOC AA_SECID_INVALID



u32 aa_alloc_secid(void);

struct aa_label *aa_secid_to_label(u32 secid);

int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);

int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);

void apparmor_release_secctx(char *secdata, u32 seclen);





u32 aa_alloc_secid(struct aa_label *label, gfp_t gfp);

void aa_free_secid(u32 secid);

void aa_secid_update(u32 secid, struct aa_label *label);



#endif /* __AA_SECID_H */

security/apparmor/label.c

+3 −3
Original line number Diff line number Diff line
@@ -402,12 +402,12 @@ static void label_free_or_put_new(struct aa_label *label, struct aa_label *new) 
		aa_put_label(new);

}



bool aa_label_init(struct aa_label *label, int size)

bool aa_label_init(struct aa_label *label, int size, gfp_t gfp)

{

	AA_BUG(!label);

	AA_BUG(size < 1);



	label->secid = aa_alloc_secid();

	label->secid = aa_alloc_secid(label, gfp);

	if (label->secid == AA_SECID_INVALID)

		return false;
@@ -441,7 +441,7 @@ struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp) 
	if (!new)

		goto fail;



	if (!aa_label_init(new, size))

	if (!aa_label_init(new, size, gfp))

		goto fail;



	if (!proxy) {

security/apparmor/lsm.c

+5 −0
Original line number Diff line number Diff line
@@ -39,6 +39,7 @@ 
#include "include/policy_ns.h"

#include "include/procattr.h"

#include "include/mount.h"

#include "include/secid.h"



/* Flag indicating whether initialization completed */

int apparmor_initialized;
@@ -1188,6 +1189,10 @@ static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = { 
	LSM_HOOK_INIT(task_alloc, apparmor_task_alloc),

	LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit),

	LSM_HOOK_INIT(task_kill, apparmor_task_kill),



	LSM_HOOK_INIT(secid_to_secctx, apparmor_secid_to_secctx),

	LSM_HOOK_INIT(secctx_to_secid, apparmor_secctx_to_secid),

	LSM_HOOK_INIT(release_secctx, apparmor_release_secctx),

};



/*

security/apparmor/policy.c

+1 −1
Original line number Diff line number Diff line
@@ -268,7 +268,7 @@ struct aa_profile *aa_alloc_profile(const char *hname, struct aa_proxy *proxy, 


	if (!aa_policy_init(&profile->base, NULL, hname, gfp))

		goto fail;

	if (!aa_label_init(&profile->label, 1))

	if (!aa_label_init(&profile->label, 1, gfp))

		goto fail;



	/* update being set needed by fs interface */