diff options
author | John Johansen <john.johansen@canonical.com> | 2017-01-16 00:42:24 -0800 |
---|---|---|
committer | John Johansen <john.johansen@canonical.com> | 2017-01-16 01:18:22 -0800 |
commit | 31617ddfdd7764a5046f076247208aa324458069 (patch) | |
tree | c7338161d7d5fae07b830e5f24c4bae0604b30b4 | |
parent | 3b0aaf5866bf92a3e47627a02ed5e1be6d7cc110 (diff) | |
download | op-kernel-dev-31617ddfdd7764a5046f076247208aa324458069.zip op-kernel-dev-31617ddfdd7764a5046f076247208aa324458069.tar.gz |
apparmor: add fn to lookup profiles by fqname
Signed-off-by: John Johansen <john.johansen@canonical.com>
-rw-r--r-- | security/apparmor/include/policy.h | 2 | ||||
-rw-r--r-- | security/apparmor/include/policy_ns.h | 10 | ||||
-rw-r--r-- | security/apparmor/policy.c | 29 | ||||
-rw-r--r-- | security/apparmor/policy_ns.c | 4 |
4 files changed, 38 insertions, 7 deletions
diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h index c90f4a2..da62d29 100644 --- a/security/apparmor/include/policy.h +++ b/security/apparmor/include/policy.h @@ -180,6 +180,8 @@ struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name); struct aa_profile *aa_lookupn_profile(struct aa_ns *ns, const char *hname, size_t n); struct aa_profile *aa_lookup_profile(struct aa_ns *ns, const char *name); +struct aa_profile *aa_fqlookupn_profile(struct aa_profile *base, + const char *fqname, size_t n); struct aa_profile *aa_match_profile(struct aa_ns *ns, const char *name); ssize_t aa_replace_profiles(void *udata, size_t size, bool noreplace); diff --git a/security/apparmor/include/policy_ns.h b/security/apparmor/include/policy_ns.h index 381f8b0..ebf9b40 100644 --- a/security/apparmor/include/policy_ns.h +++ b/security/apparmor/include/policy_ns.h @@ -46,11 +46,11 @@ struct aa_ns_acct { * @uniq_id: a unique id count for the profiles in the namespace * @dents: dentries for the namespaces file entries in apparmorfs * - * An aa_ns defines the set profiles that are searched to determine - * which profile to attach to a task. Profiles can not be shared between - * aa_nss and profile names within a namespace are guaranteed to be - * unique. When profiles in separate namespaces have the same name they - * are NOT considered to be equivalent. + * An aa_ns defines the set profiles that are searched to determine which + * profile to attach to a task. Profiles can not be shared between aa_ns + * and profile names within a namespace are guaranteed to be unique. When + * profiles in separate namespaces have the same name they are NOT considered + * to be equivalent. * * Namespaces are hierarchical and only namespaces and profiles below the * current namespace are visible. diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c index 2918104..7fde578 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c @@ -498,6 +498,35 @@ struct aa_profile *aa_lookup_profile(struct aa_ns *ns, const char *hname) { return aa_lookupn_profile(ns, hname, strlen(hname)); } + +struct aa_profile *aa_fqlookupn_profile(struct aa_profile *base, + const char *fqname, size_t n) +{ + struct aa_profile *profile; + struct aa_ns *ns; + const char *name, *ns_name; + size_t ns_len; + + name = aa_splitn_fqname(fqname, n, &ns_name, &ns_len); + if (ns_name) { + ns = aa_findn_ns(base->ns, ns_name, ns_len); + if (!ns) + return NULL; + } else + ns = aa_get_ns(base->ns); + + if (name) + profile = aa_lookupn_profile(ns, name, n - (name - fqname)); + else if (ns) + /* default profile for ns, currently unconfined */ + profile = aa_get_newest_profile(ns->unconfined); + else + profile = NULL; + aa_put_ns(ns); + + return profile; +} + /** * replacement_allowed - test to see if replacement is allowed * @profile: profile to test if it can be replaced (MAYBE NULL) diff --git a/security/apparmor/policy_ns.c b/security/apparmor/policy_ns.c index 9746643..bab23cc 100644 --- a/security/apparmor/policy_ns.c +++ b/security/apparmor/policy_ns.c @@ -226,7 +226,7 @@ static void __ns_list_release(struct list_head *head); /** * destroy_ns - remove everything contained by @ns - * @ns: ns to have it contents removed (NOT NULL) + * @ns: namespace to have it contents removed (NOT NULL) */ static void destroy_ns(struct aa_ns *ns) { @@ -276,7 +276,7 @@ static void __ns_list_release(struct list_head *head) } /** - * aa_alloc_root_ns - allocate the root profile namespcae + * aa_alloc_root_ns - allocate the root profile namespace * * Returns: %0 on success else error * |