diff options
| author | John Johansen <john.johansen@canonical.com> | 2018-06-17 03:56:25 -0700 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2026-08-10 22:49:41 -0700 |
| commit | 7965b1f3940ae21209ad095fcf2df46c0a99df2d (patch) | |
| tree | df5ef347cb35aa23c9d3b8192f21da6b958069f3 /security/apparmor | |
| parent | 1bc94d09e1a94fe3f94cce025e0799dea24f2888 (diff) | |
| download | linux-stable-7965b1f3940ae21209ad095fcf2df46c0a99df2d.tar.gz linux-stable-7965b1f3940ae21209ad095fcf2df46c0a99df2d.zip | |
apparmor: make MEDIATES_AF_UNIX its own fn
Hide the functionality of determinig unix mediation behind its own fn
so it is easier to adjust the test in the future as it has different
requirements than the other socket mediation.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor')
| -rw-r--r-- | security/apparmor/af_unix.c | 14 | ||||
| -rw-r--r-- | security/apparmor/file.c | 2 | ||||
| -rw-r--r-- | security/apparmor/include/policy.h | 6 |
3 files changed, 13 insertions, 9 deletions
diff --git a/security/apparmor/af_unix.c b/security/apparmor/af_unix.c index 395aede487ec..84250c0b9c78 100644 --- a/security/apparmor/af_unix.c +++ b/security/apparmor/af_unix.c @@ -209,7 +209,7 @@ static int profile_create_perm(struct aa_profile *profile, int family, AA_BUG(!profile); AA_BUG(profile_unconfined(profile)); - state = RULE_MEDIATES_v9NET(rules); + state = RULE_MEDIATES_UNIX(rules); if (state) { state = aa_match_to_prot(rules->policy, state, AA_MAY_CREATE, PF_UNIX, type, protocol, NULL, @@ -235,7 +235,7 @@ static int profile_sk_perm(struct aa_profile *profile, AA_BUG(!sk); AA_BUG(profile_unconfined(profile)); - state = RULE_MEDIATES_v9NET(rules); + state = RULE_MEDIATES_UNIX(rules); if (state) { if (is_unix_fs(sk)) return unix_fs_perm(ad->op, request, ad->subj_cred, @@ -264,7 +264,7 @@ static int profile_bind_perm(struct aa_profile *profile, struct sock *sk, AA_BUG(!ad); AA_BUG(profile_unconfined(profile)); - state = RULE_MEDIATES_v9NET(rules); + state = RULE_MEDIATES_UNIX(rules); if (state) { if (is_unix_addr_fs(ad->net.addr, ad->net.addrlen)) /* under v7-9 fs hook handles bind */ @@ -295,7 +295,7 @@ static int profile_listen_perm(struct aa_profile *profile, struct sock *sk, AA_BUG(!ad); AA_BUG(profile_unconfined(profile)); - state = RULE_MEDIATES_v9NET(rules); + state = RULE_MEDIATES_UNIX(rules); if (state) { __be16 b = cpu_to_be16(backlog); @@ -332,7 +332,7 @@ static int profile_accept_perm(struct aa_profile *profile, AA_BUG(!ad); AA_BUG(profile_unconfined(profile)); - state = RULE_MEDIATES_v9NET(rules); + state = RULE_MEDIATES_UNIX(rules); if (state) { if (is_unix_fs(sk)) return unix_fs_perm(ad->op, AA_MAY_ACCEPT, @@ -362,7 +362,7 @@ static int profile_opt_perm(struct aa_profile *profile, u32 request, AA_BUG(!ad); AA_BUG(profile_unconfined(profile)); - state = RULE_MEDIATES_v9NET(rules); + state = RULE_MEDIATES_UNIX(rules); if (state) { __be16 b = cpu_to_be16(optname); if (is_unix_fs(sk)) @@ -403,7 +403,7 @@ static int profile_peer_perm(struct aa_profile *profile, u32 request, AA_BUG(!peer_label); AA_BUG(!ad); - state = RULE_MEDIATES_v9NET(rules); + state = RULE_MEDIATES_UNIX(rules); if (state) { struct aa_profile *peerp; diff --git a/security/apparmor/file.c b/security/apparmor/file.c index c9d55fe1086f..e67ca65b7bd9 100644 --- a/security/apparmor/file.c +++ b/security/apparmor/file.c @@ -232,7 +232,7 @@ int __aa_path_perm(const char *op, const struct cred *subj_cred, int e = 0; if (profile_unconfined(profile) || - ((flags & PATH_SOCK_COND) && !RULE_MEDIATES_v9NET(rules))) + ((flags & PATH_SOCK_COND) && !RULE_MEDIATES_UNIX(rules))) return 0; aa_str_perms(rules->file, rules->file->start[AA_CLASS_FILE], name, cond, perms); diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h index 240b2eba7687..f530436e2b9d 100644 --- a/security/apparmor/include/policy.h +++ b/security/apparmor/include/policy.h @@ -351,10 +351,14 @@ static inline aa_state_t RULE_MEDIATES_NET(struct aa_ruleset *rules) /* fallback and check v7/8 if v9 is NOT mediated */ if (!state) state = RULE_MEDIATES(rules, AA_CLASS_NET); - return state; } +static inline aa_state_t RULE_MEDIATES_UNIX(struct aa_ruleset *rules) +{ + return RULE_MEDIATES_v9NET(rules); +} + void aa_compute_profile_mediates(struct aa_profile *profile); static inline bool profile_mediates(struct aa_profile *profile, |