summaryrefslogtreecommitdiffstats
path: root/security/apparmor/include/policy.h
diff options
context:
space:
mode:
authorJohn Johansen <john.johansen@canonical.com>2013-02-18 16:10:34 -0800
committerJohn Johansen <john.johansen@canonical.com>2013-04-28 00:37:13 -0700
commita4987857d2c958b93b2faafe0811eea1a63ff59a (patch)
treeaa140446d01ddecc209415720ef77dc9c7777ca2 /security/apparmor/include/policy.h
parent180a6f5965a49535a7704c07691a6d1209904971 (diff)
downloadlinux-a4987857d2c958b93b2faafe0811eea1a63ff59a.tar.bz2
apparmor: remove sid from profiles
The sid is not going to be a direct property of a profile anymore, instead it will be directly related to the label, and the profile will pickup a label back reference. For null-profiles replace the use of sid with a per namespace unique id. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Kees Cook <kees@ubuntu.com>
Diffstat (limited to 'security/apparmor/include/policy.h')
-rw-r--r--security/apparmor/include/policy.h4
1 files changed, 2 insertions, 2 deletions
diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
index 95979c431e26..b25491a3046a 100644
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -105,6 +105,7 @@ struct aa_ns_acct {
* @acct: accounting for the namespace
* @unconfined: special unconfined profile for the namespace
* @sub_ns: list of namespaces under the current namespace.
+ * @uniq_null: uniq value used for null learning profiles
*
* An aa_namespace defines the set profiles that are searched to determine
* which profile to attach to a task. Profiles can not be shared between
@@ -127,6 +128,7 @@ struct aa_namespace {
struct aa_ns_acct acct;
struct aa_profile *unconfined;
struct list_head sub_ns;
+ atomic_t uniq_null;
};
/* struct aa_policydb - match engine for a policy
@@ -148,7 +150,6 @@ struct aa_policydb {
* @rename: optional profile name that this profile renamed
* @xmatch: optional extended matching for unconfined executables names
* @xmatch_len: xmatch prefix len, used to determine xmatch priority
- * @sid: the unique security id number of this profile
* @audit: the auditing mode of the profile
* @mode: the enforcement mode of the profile
* @flags: flags controlling profile behavior
@@ -184,7 +185,6 @@ struct aa_profile {
struct aa_dfa *xmatch;
int xmatch_len;
- u32 sid;
enum audit_mode audit;
enum profile_mode mode;
u32 flags;