Commit 9afdc6ab authored by John Johansen's avatar John Johansen
Browse files

apparmor: transition from a list of rules to a vector of rules 



The set of rules on a profile is not dynamically extended, instead
if a new ruleset is needed a new version of the profile is created.
This allows us to use a vector of rules instead of a list, slightly
reducing memory usage and simplifying the code.

Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
parent f9c9dce0

security/apparmor/af_unix.c

+7 −15
Original line number Diff line number Diff line
@@ -202,8 +202,7 @@ static int profile_create_perm(struct aa_profile *profile, int family, 
			       int type, int protocol,

			       struct apparmor_audit_data *ad)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_ruleset *rules = profile->label.rules[0];

	aa_state_t state;



	AA_BUG(!profile);
@@ -227,9 +226,7 @@ static int profile_sk_perm(struct aa_profile *profile, 
			   struct apparmor_audit_data *ad,

			   u32 request, struct sock *sk, struct path *path)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules),

						    list);

	struct aa_ruleset *rules = profile->label.rules[0];

	struct aa_perms *p = NULL;

	aa_state_t state;
@@ -257,8 +254,7 @@ static int profile_sk_perm(struct aa_profile *profile, 
static int profile_bind_perm(struct aa_profile *profile, struct sock *sk,

			     struct apparmor_audit_data *ad)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_ruleset *rules = profile->label.rules[0];

	struct aa_perms *p = NULL;

	aa_state_t state;
@@ -289,8 +285,7 @@ static int profile_bind_perm(struct aa_profile *profile, struct sock *sk, 
static int profile_listen_perm(struct aa_profile *profile, struct sock *sk,

			       int backlog, struct apparmor_audit_data *ad)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_ruleset *rules = profile->label.rules[0];

	struct aa_perms *p = NULL;

	aa_state_t state;
@@ -327,8 +322,7 @@ static int profile_accept_perm(struct aa_profile *profile, 
			       struct sock *sk,

			       struct apparmor_audit_data *ad)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_ruleset *rules = profile->label.rules[0];

	struct aa_perms *p = NULL;

	aa_state_t state;
@@ -358,8 +352,7 @@ static int profile_opt_perm(struct aa_profile *profile, u32 request, 
			    struct sock *sk, int optname,

			    struct apparmor_audit_data *ad)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_ruleset *rules = profile->label.rules[0];

	struct aa_perms *p = NULL;

	aa_state_t state;
@@ -399,8 +392,7 @@ static int profile_peer_perm(struct aa_profile *profile, u32 request, 
			     struct aa_label *peer_label,

			     struct apparmor_audit_data *ad)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_ruleset *rules = profile->label.rules[0];

	struct aa_perms *p = NULL;

	aa_state_t state;

security/apparmor/apparmorfs.c

+1 −2
Original line number Diff line number Diff line
@@ -612,8 +612,7 @@ static const struct file_operations aa_fs_ns_revision_fops = { 
static void profile_query_cb(struct aa_profile *profile, struct aa_perms *perms,

			     const char *match_str, size_t match_len)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_ruleset *rules = profile->label.rules[0];

	struct aa_perms tmp = { };

	aa_state_t state = DFA_NOMATCH;

security/apparmor/capability.c

+3 −6
Original line number Diff line number Diff line
@@ -69,8 +69,7 @@ static int audit_caps(struct apparmor_audit_data *ad, struct aa_profile *profile 
{

	const u64 AUDIT_CACHE_TIMEOUT_NS = 1000*1000*1000; /* 1 second */



	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_ruleset *rules = profile->label.rules[0];

	struct audit_cache *ent;

	int type = AUDIT_APPARMOR_AUTO;
@@ -122,8 +121,7 @@ static int audit_caps(struct apparmor_audit_data *ad, struct aa_profile *profile 
static int profile_capable(struct aa_profile *profile, int cap,

			   unsigned int opts, struct apparmor_audit_data *ad)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_ruleset *rules = profile->label.rules[0];

	aa_state_t state;

	int error;
@@ -195,8 +193,7 @@ int aa_capable(const struct cred *subj_cred, struct aa_label *label, 


kernel_cap_t aa_profile_capget(struct aa_profile *profile)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_ruleset *rules = profile->label.rules[0];

	aa_state_t state;



	state = RULE_MEDIATES(rules, AA_CLASS_CAP);

security/apparmor/domain.c

+7 −16
Original line number Diff line number Diff line
@@ -93,8 +93,7 @@ static inline aa_state_t match_component(struct aa_profile *profile, 
					 struct aa_profile *tp,

					 bool stack, aa_state_t state)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_ruleset *rules = profile->label.rules[0];

	const char *ns_name;



	if (stack)
@@ -131,8 +130,7 @@ static int label_compound_match(struct aa_profile *profile, 
				aa_state_t state, bool subns, u32 request,

				struct aa_perms *perms)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_ruleset *rules = profile->label.rules[0];

	struct aa_profile *tp;

	struct label_it i;

	struct path_cond cond = { };
@@ -194,8 +192,7 @@ static int label_components_match(struct aa_profile *profile, 
				  aa_state_t start, bool subns, u32 request,

				  struct aa_perms *perms)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_ruleset *rules = profile->label.rules[0];

	struct aa_profile *tp;

	struct label_it i;

	struct aa_perms tmp;
@@ -520,8 +517,7 @@ static const char *next_name(int xtype, const char *name) 
struct aa_label *x_table_lookup(struct aa_profile *profile, u32 xindex,

				const char **name)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_ruleset *rules = profile->label.rules[0];

	struct aa_label *label = NULL;

	u32 xtype = xindex & AA_X_TYPE_MASK;

	int index = xindex & AA_X_INDEX_MASK;
@@ -575,8 +571,6 @@ static struct aa_label *x_to_label(struct aa_profile *profile, 
				   const char **lookupname,

				   const char **info)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_label *new = NULL;

	struct aa_label *stack = NULL;

	struct aa_ns *ns = profile->ns;
@@ -668,8 +662,7 @@ static struct aa_label *profile_transition(const struct cred *subj_cred, 
					   char *buffer, struct path_cond *cond,

					   bool *secure_exec)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_ruleset *rules = profile->label.rules[0];

	struct aa_label *new = NULL;

	struct aa_profile *new_profile = NULL;

	const char *info = NULL, *name = NULL, *target = NULL;
@@ -802,8 +795,7 @@ static int profile_onexec(const struct cred *subj_cred, 
			  char *buffer, struct path_cond *cond,

			  bool *secure_exec)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_ruleset *rules = profile->label.rules[0];

	aa_state_t state = rules->file->start[AA_CLASS_FILE];

	struct aa_perms perms = {};

	const char *xname = NULL, *info = "change_profile onexec";
@@ -1361,8 +1353,7 @@ static int change_profile_perms_wrapper(const char *op, const char *name, 
					struct aa_label *target, bool stack,

					u32 request, struct aa_perms *perms)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_ruleset *rules = profile->label.rules[0];

	const char *info = NULL;

	int error = 0;

security/apparmor/file.c

+2 −4
Original line number Diff line number Diff line
@@ -223,8 +223,7 @@ int __aa_path_perm(const char *op, const struct cred *subj_cred, 
		   u32 request, struct path_cond *cond, int flags,

		   struct aa_perms *perms)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_ruleset *rules = profile->label.rules[0];

	int e = 0;



	if (profile_unconfined(profile) ||
@@ -323,8 +322,7 @@ static int profile_path_link(const struct cred *subj_cred, 
			     const struct path *target, char *buffer2,

			     struct path_cond *cond)

{

	struct aa_ruleset *rules = list_first_entry(&profile->rules,

						    typeof(*rules), list);

	struct aa_ruleset *rules = profile->label.rules[0];

	const char *lname, *tname = NULL;

	struct aa_perms lperms = {}, perms;

	const char *info = NULL;