Unverified Commit 8376226e authored by Mickaël Salaün's avatar Mickaël Salaün
Browse files

landlock: Refactor network access mask management 



Replace get_raw_handled_net_accesses() and get_current_net_domain() with
a call to landlock_get_applicable_domain().

Cc: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
Cc: Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com>
Reviewed-by: default avatarGünther Noack <gnoack@google.com>
Link: https://lore.kernel.org/r/20241109110856.222842-3-mic@digikod.net


Signed-off-by: default avatarMickaël Salaün <mic@digikod.net>
parent 0c0effb0

security/landlock/net.c

+6 −22
Original line number Diff line number Diff line
@@ -39,27 +39,9 @@ int landlock_append_net_rule(struct landlock_ruleset *const ruleset, 
	return err;

}



static access_mask_t

get_raw_handled_net_accesses(const struct landlock_ruleset *const domain)

{

	access_mask_t access_dom = 0;

	size_t layer_level;



	for (layer_level = 0; layer_level < domain->num_layers; layer_level++)

		access_dom |= landlock_get_net_access_mask(domain, layer_level);

	return access_dom;

}



static const struct landlock_ruleset *get_current_net_domain(void)

{

	const struct landlock_ruleset *const dom =

		landlock_get_current_domain();



	if (!dom || !get_raw_handled_net_accesses(dom))

		return NULL;



	return dom;

}

static const struct access_masks any_net = {

	.net = ~0,

};



static int current_check_access_socket(struct socket *const sock,

				       struct sockaddr *const address,
@@ -72,7 +54,9 @@ static int current_check_access_socket(struct socket *const sock, 
	struct landlock_id id = {

		.type = LANDLOCK_KEY_NET_PORT,

	};

	const struct landlock_ruleset *const dom = get_current_net_domain();

	const struct landlock_ruleset *const dom =

		landlock_get_applicable_domain(landlock_get_current_domain(),

					       any_net);



	if (!dom)

		return 0;