apparmor: switch from file_perms to aa_perms

Signed-off-by: John Johansen <john.johansen@canonical.com>

diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index ab8f23cdccff9881bcc2da5a51f687f440fc1cd0..a0ba33454b8c55d08f7f0de36d5202b1d5d4d886 100644 (file)
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -93,12 +93,12 @@ out:
  *
  * Returns: permission set
  */
-static struct file_perms change_profile_perms(struct aa_profile *profile,
-                                             struct aa_ns *ns,
-                                             const char *name, u32 request,
-                                             unsigned int start)
+static struct aa_perms change_profile_perms(struct aa_profile *profile,
+                                           struct aa_ns *ns,
+                                           const char *name, u32 request,
+                                           unsigned int start)
 {
-       struct file_perms perms;
+       struct aa_perms perms;
        struct path_cond cond = { };
        unsigned int state;
 
@@ -342,7 +342,7 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
        struct aa_ns *ns;
        char *buffer = NULL;
        unsigned int state;
-       struct file_perms perms = {};
+       struct aa_perms perms = {};
        struct path_cond cond = {
                file_inode(bprm->file)->i_uid,
                file_inode(bprm->file)->i_mode
@@ -400,7 +400,7 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
        /* find exec permissions for name */
        state = aa_str_perms(profile->file.dfa, state, name, &cond, &perms);
        if (ctx->onexec) {
-               struct file_perms cp;
+               struct aa_perms cp;
                info = "change_profile onexec";
                new_profile = aa_get_newest_profile(ctx->onexec);
                if (!(perms.allow & AA_MAY_ONEXEC))
@@ -609,7 +609,7 @@ int aa_change_hat(const char *hats[], int count, u64 token, bool permtest)
        struct aa_profile *profile, *previous_profile, *hat = NULL;
        char *name = NULL;
        int i;
-       struct file_perms perms = {};
+       struct aa_perms perms = {};
        const char *target = NULL, *info = NULL;
        int error = 0;
 
@@ -748,7 +748,7 @@ int aa_change_profile(const char *fqname, bool onexec,
 {
        const struct cred *cred;
        struct aa_profile *profile, *target = NULL;
-       struct file_perms perms = {};
+       struct aa_perms perms = {};
        const char *info = NULL, *op;
        int error = 0;
        u32 request;

diff --git a/security/apparmor/file.c b/security/apparmor/file.c
index 1ee656f66aa43b8c3380c2b4783e9d82aed755ee..2e128c2aa4dc8c0364a81d2446da4567fa5c2e94 100644 (file)
--- a/security/apparmor/file.c
+++ b/security/apparmor/file.c
@@ -19,8 +19,6 @@
 #include "include/path.h"
 #include "include/policy.h"
 
-struct file_perms nullperms;
-
 static u32 map_mask_to_chr_mask(u32 mask)
 {
        u32 m = mask & PERMS_CHRS_MASK;
@@ -92,7 +90,7 @@ static void file_audit_cb(struct audit_buffer *ab, void *va)
  *
  * Returns: %0 or error on failure
  */
-int aa_audit_file(struct aa_profile *profile, struct file_perms *perms,
+int aa_audit_file(struct aa_profile *profile, struct aa_perms *perms,
                  const char *op, u32 request, const char *name,
                  const char *target, kuid_t ouid, const char *info, int error)
 {
@@ -170,7 +168,7 @@ static u32 map_old_perms(u32 old)
 }
 
 /**
- * compute_perms - convert dfa compressed perms to internal perms
+ * aa_compute_fperms - convert dfa compressed perms to internal perms
  * @dfa: dfa to compute perms for   (NOT NULL)
  * @state: state in dfa
  * @cond:  conditions to consider  (NOT NULL)
@@ -180,17 +178,21 @@ static u32 map_old_perms(u32 old)
  *
  * Returns: computed permission set
  */
-static struct file_perms compute_perms(struct aa_dfa *dfa, unsigned int state,
-                                      struct path_cond *cond)
+struct aa_perms aa_compute_fperms(struct aa_dfa *dfa, unsigned int state,
+                                 struct path_cond *cond)
 {
-       struct file_perms perms;
+       struct aa_perms perms;
 
        /* FIXME: change over to new dfa format
         * currently file perms are encoded in the dfa, new format
         * splits the permissions from the dfa.  This mapping can be
         * done at profile load
         */
-       perms.kill = 0;
+       perms.deny = 0;
+       perms.kill = perms.stop = 0;
+       perms.complain = perms.cond = 0;
+       perms.hide = 0;
+       perms.prompt = 0;
 
        if (uid_eq(current_fsuid(), cond->uid)) {
                perms.allow = map_old_perms(dfa_user_allow(dfa, state));
@@ -226,16 +228,11 @@ static struct file_perms compute_perms(struct aa_dfa *dfa, unsigned int state,
  */
 unsigned int aa_str_perms(struct aa_dfa *dfa, unsigned int start,
                          const char *name, struct path_cond *cond,
-                         struct file_perms *perms)
+                         struct aa_perms *perms)
 {
        unsigned int state;
-       if (!dfa) {
-               *perms = nullperms;
-               return DFA_NOMATCH;
-       }
-
        state = aa_dfa_match(dfa, start, name);
-       *perms = compute_perms(dfa, state, cond);
+       *perms = aa_compute_fperms(dfa, state, cond);
 
        return state;
 }
@@ -269,7 +266,7 @@ int aa_path_perm(const char *op, struct aa_profile *profile,
                 struct path_cond *cond)
 {
        char *buffer = NULL;
-       struct file_perms perms = {};
+       struct aa_perms perms = {};
        const char *name, *info = NULL;
        int error;
 
@@ -348,7 +345,7 @@ int aa_path_link(struct aa_profile *profile, struct dentry *old_dentry,
        };
        char *buffer = NULL, *buffer2 = NULL;
        const char *lname, *tname = NULL, *info = NULL;
-       struct file_perms lperms, perms;
+       struct aa_perms lperms, perms;
        u32 request = AA_MAY_LINK;
        unsigned int state;
        int error;

diff --git a/security/apparmor/include/file.h b/security/apparmor/include/file.h
index fb3642a94e3d6d571d0a29c9f9899974ddc2cb3c..365ca7ead133605fbd091a8c2c35cc58ae3154b0 100644 (file)
--- a/security/apparmor/include/file.h
+++ b/security/apparmor/include/file.h
@@ -90,25 +90,6 @@ struct path_cond {
        umode_t mode;
 };
 
-/* struct file_perms - file permission
- * @allow: mask of permissions that are allowed
- * @audit: mask of permissions to force an audit message for
- * @quiet: mask of permissions to quiet audit messages for
- * @kill: mask of permissions that when matched will kill the task
- * @xindex: exec transition index if @allow contains MAY_EXEC
- *
- * The @audit and @queit mask should be mutually exclusive.
- */
-struct file_perms {
-       u32 allow;
-       u32 audit;
-       u32 quiet;
-       u32 kill;
-       u16 xindex;
-};
-
-extern struct file_perms nullperms;
-
 #define COMBINED_PERM_MASK(X) ((X).allow | (X).audit | (X).quiet | (X).kill)
 
 /* FIXME: split perms from dfa and match this to description
@@ -159,7 +140,7 @@ static inline u16 dfa_map_xindex(u16 mask)
 #define dfa_other_xindex(dfa, state) \
        dfa_map_xindex((ACCEPT_TABLE(dfa)[state] >> 14) & 0x3fff)
 
-int aa_audit_file(struct aa_profile *profile, struct file_perms *perms,
+int aa_audit_file(struct aa_profile *profile, struct aa_perms *perms,
                  const char *op, u32 request, const char *name,
                  const char *target, kuid_t ouid, const char *info, int error);
 
@@ -182,9 +163,11 @@ struct aa_file_rules {
        /* TODO: add delegate table */
 };
 
+struct aa_perms aa_compute_fperms(struct aa_dfa *dfa, unsigned int state,
+                                   struct path_cond *cond);
 unsigned int aa_str_perms(struct aa_dfa *dfa, unsigned int start,
                          const char *name, struct path_cond *cond,
-                         struct file_perms *perms);
+                         struct aa_perms *perms);
 
 int aa_path_perm(const char *op, struct aa_profile *profile,
                 const struct path *path, int flags, u32 request,

diff --git a/security/apparmor/include/perms.h b/security/apparmor/include/perms.h
index 6ef23212bd664ba0adbdddb2a8c664efd7596ed1..82946fb81f91520690345277b075d6ba2d592340 100644 (file)
--- a/security/apparmor/include/perms.h
+++ b/security/apparmor/include/perms.h
@@ -88,7 +88,7 @@ struct aa_perms {
 };
 
 #define ALL_PERMS_MASK 0xffffffff
-
+extern struct aa_perms nullperms;
 extern struct aa_perms allperms;
 
 struct aa_profile;

diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c
index a509137448236f6132f2c7b44a2413c6224848a4..3e9146e68c4a862a31317862fc82146cce696e50 100644 (file)
--- a/security/apparmor/lib.c
+++ b/security/apparmor/lib.c
@@ -24,6 +24,7 @@
 #include "include/perms.h"
 #include "include/policy.h"
 
+struct aa_perms nullperms;
 struct aa_perms allperms = { .allow = ALL_PERMS_MASK,
                             .quiet = ALL_PERMS_MASK,
                             .hide = ALL_PERMS_MASK };