diff options
Diffstat (limited to 'security/apparmor')
-rw-r--r-- | security/apparmor/include/apparmor.h | 13 | ||||
-rw-r--r-- | security/apparmor/include/policy.h | 13 | ||||
-rw-r--r-- | security/apparmor/policy.c | 1 | ||||
-rw-r--r-- | security/apparmor/policy_unpack.c | 24 |
4 files changed, 50 insertions, 1 deletions
diff --git a/security/apparmor/include/apparmor.h b/security/apparmor/include/apparmor.h index 248c408ddc1b..40aedd9f73ea 100644 --- a/security/apparmor/include/apparmor.h +++ b/security/apparmor/include/apparmor.h | |||
@@ -19,6 +19,19 @@ | |||
19 | 19 | ||
20 | #include "match.h" | 20 | #include "match.h" |
21 | 21 | ||
22 | /* | ||
23 | * Class of mediation types in the AppArmor policy db | ||
24 | */ | ||
25 | #define AA_CLASS_ENTRY 0 | ||
26 | #define AA_CLASS_UNKNOWN 1 | ||
27 | #define AA_CLASS_FILE 2 | ||
28 | #define AA_CLASS_CAP 3 | ||
29 | #define AA_CLASS_NET 4 | ||
30 | #define AA_CLASS_RLIMITS 5 | ||
31 | #define AA_CLASS_DOMAIN 6 | ||
32 | |||
33 | #define AA_CLASS_LAST AA_CLASS_DOMAIN | ||
34 | |||
22 | /* Control parameters settable through module/boot flags */ | 35 | /* Control parameters settable through module/boot flags */ |
23 | extern enum audit_mode aa_g_audit; | 36 | extern enum audit_mode aa_g_audit; |
24 | extern bool aa_g_audit_header; | 37 | extern bool aa_g_audit_header; |
diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h index aeda5cf56904..9e18e9609e24 100644 --- a/security/apparmor/include/policy.h +++ b/security/apparmor/include/policy.h | |||
@@ -129,6 +129,17 @@ struct aa_namespace { | |||
129 | struct list_head sub_ns; | 129 | struct list_head sub_ns; |
130 | }; | 130 | }; |
131 | 131 | ||
132 | /* struct aa_policydb - match engine for a policy | ||
133 | * dfa: dfa pattern match | ||
134 | * start: set of start states for the different classes of data | ||
135 | */ | ||
136 | struct aa_policydb { | ||
137 | /* Generic policy DFA specific rule types will be subsections of it */ | ||
138 | struct aa_dfa *dfa; | ||
139 | unsigned int start[AA_CLASS_LAST + 1]; | ||
140 | |||
141 | }; | ||
142 | |||
132 | /* struct aa_profile - basic confinement data | 143 | /* struct aa_profile - basic confinement data |
133 | * @base - base components of the profile (name, refcount, lists, lock ...) | 144 | * @base - base components of the profile (name, refcount, lists, lock ...) |
134 | * @parent: parent of profile | 145 | * @parent: parent of profile |
@@ -143,6 +154,7 @@ struct aa_namespace { | |||
143 | * @flags: flags controlling profile behavior | 154 | * @flags: flags controlling profile behavior |
144 | * @path_flags: flags controlling path generation behavior | 155 | * @path_flags: flags controlling path generation behavior |
145 | * @size: the memory consumed by this profiles rules | 156 | * @size: the memory consumed by this profiles rules |
157 | * @policy: general match rules governing policy | ||
146 | * @file: The set of rules governing basic file access and domain transitions | 158 | * @file: The set of rules governing basic file access and domain transitions |
147 | * @caps: capabilities for the profile | 159 | * @caps: capabilities for the profile |
148 | * @rlimits: rlimits for the profile | 160 | * @rlimits: rlimits for the profile |
@@ -179,6 +191,7 @@ struct aa_profile { | |||
179 | u32 path_flags; | 191 | u32 path_flags; |
180 | int size; | 192 | int size; |
181 | 193 | ||
194 | struct aa_policydb policy; | ||
182 | struct aa_file_rules file; | 195 | struct aa_file_rules file; |
183 | struct aa_caps caps; | 196 | struct aa_caps caps; |
184 | struct aa_rlimit rlimits; | 197 | struct aa_rlimit rlimits; |
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c index 4f0eadee78b8..73288d0b541f 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c | |||
@@ -749,6 +749,7 @@ static void free_profile(struct aa_profile *profile) | |||
749 | 749 | ||
750 | aa_free_sid(profile->sid); | 750 | aa_free_sid(profile->sid); |
751 | aa_put_dfa(profile->xmatch); | 751 | aa_put_dfa(profile->xmatch); |
752 | aa_put_dfa(profile->policy.dfa); | ||
752 | 753 | ||
753 | aa_put_profile(profile->replacedby); | 754 | aa_put_profile(profile->replacedby); |
754 | 755 | ||
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c index c50634b724b5..25fd51edc8da 100644 --- a/security/apparmor/policy_unpack.c +++ b/security/apparmor/policy_unpack.c | |||
@@ -469,7 +469,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e) | |||
469 | { | 469 | { |
470 | struct aa_profile *profile = NULL; | 470 | struct aa_profile *profile = NULL; |
471 | const char *name = NULL; | 471 | const char *name = NULL; |
472 | int error = -EPROTO; | 472 | int i, error = -EPROTO; |
473 | kernel_cap_t tmpcap; | 473 | kernel_cap_t tmpcap; |
474 | u32 tmp; | 474 | u32 tmp; |
475 | 475 | ||
@@ -562,6 +562,28 @@ static struct aa_profile *unpack_profile(struct aa_ext *e) | |||
562 | if (!unpack_rlimits(e, profile)) | 562 | if (!unpack_rlimits(e, profile)) |
563 | goto fail; | 563 | goto fail; |
564 | 564 | ||
565 | if (unpack_nameX(e, AA_STRUCT, "policydb")) { | ||
566 | /* generic policy dfa - optional and may be NULL */ | ||
567 | profile->policy.dfa = unpack_dfa(e); | ||
568 | if (IS_ERR(profile->policy.dfa)) { | ||
569 | error = PTR_ERR(profile->policy.dfa); | ||
570 | profile->policy.dfa = NULL; | ||
571 | goto fail; | ||
572 | } | ||
573 | if (!unpack_u32(e, &profile->policy.start[0], "start")) | ||
574 | /* default start state */ | ||
575 | profile->policy.start[0] = DFA_START; | ||
576 | /* setup class index */ | ||
577 | for (i = AA_CLASS_FILE; i <= AA_CLASS_LAST; i++) { | ||
578 | profile->policy.start[i] = | ||
579 | aa_dfa_next(profile->policy.dfa, | ||
580 | profile->policy.start[0], | ||
581 | i); | ||
582 | } | ||
583 | if (!unpack_nameX(e, AA_STRUCTEND, NULL)) | ||
584 | goto fail; | ||
585 | } | ||
586 | |||
565 | /* get file rules */ | 587 | /* get file rules */ |
566 | profile->file.dfa = unpack_dfa(e); | 588 | profile->file.dfa = unpack_dfa(e); |
567 | if (IS_ERR(profile->file.dfa)) { | 589 | if (IS_ERR(profile->file.dfa)) { |