diff options
| author | John Johansen <john.johansen@canonical.com> | 2022-09-05 23:53:29 -0700 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2022-10-03 14:49:04 -0700 |
| commit | 0bece4fa97a2bd397da66d4fced78f76eb214a3e (patch) | |
| tree | 7a5e0d42965a373f3e7e5e058e94d99d079e00f0 /security/apparmor | |
| parent | 670f31774ab6bf8e2d756f27444b035b9be8a0c9 (diff) | |
| download | linux-0bece4fa97a2bd397da66d4fced78f76eb214a3e.tar.bz2 | |
apparmor: make sure perm indexes are accumulated
accumulate permission indexes on a first encountered basis. This
favors original rulesets so that new ones can not override without
profile replacement.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor')
| -rw-r--r-- | security/apparmor/include/file.h | 4 | ||||
| -rw-r--r-- | security/apparmor/include/perms.h | 9 | ||||
| -rw-r--r-- | security/apparmor/lib.c | 14 |
3 files changed, 25 insertions, 2 deletions
diff --git a/security/apparmor/include/file.h b/security/apparmor/include/file.h index 521c8568f6d4..1a1c0f0c5071 100644 --- a/security/apparmor/include/file.h +++ b/security/apparmor/include/file.h @@ -88,10 +88,10 @@ static inline struct aa_label *aa_get_file_label(struct aa_file_ctx *ctx) * - exec type - which determines how the executable name and index are used * - flags - which modify how the destination name is applied */ -#define AA_X_INDEX_MASK 0x00ffffff +#define AA_X_INDEX_MASK AA_INDEX_MASK #define AA_X_TYPE_MASK 0x0c000000 -#define AA_X_NONE 0x00000000 +#define AA_X_NONE AA_INDEX_NONE #define AA_X_NAME 0x04000000 /* use executable name px */ #define AA_X_TABLE 0x08000000 /* use a specified name ->n# */ diff --git a/security/apparmor/include/perms.h b/security/apparmor/include/perms.h index d66059fcebb4..0de8c3fb090d 100644 --- a/security/apparmor/include/perms.h +++ b/security/apparmor/include/perms.h @@ -78,11 +78,20 @@ struct aa_perms { u32 quiet; /* set only when ~allow | deny */ u32 hide; /* set only when ~allow | deny */ + u32 xindex; u32 tag; /* tag string index, if present */ u32 label; /* label string index, if present */ }; +/* + * Indexes are broken into a 24 bit index and 8 bit flag. + * For the index to be valid there must be a value in the flag + */ +#define AA_INDEX_MASK 0x00ffffff +#define AA_INDEX_FLAG_MASK 0xff000000 +#define AA_INDEX_NONE 0 + #define ALL_PERMS_MASK 0xffffffff extern struct aa_perms nullperms; extern struct aa_perms allperms; diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c index b0fcec893274..d6a8c361025b 100644 --- a/security/apparmor/lib.c +++ b/security/apparmor/lib.c @@ -348,6 +348,13 @@ void aa_perms_accum_raw(struct aa_perms *accum, struct aa_perms *addend) accum->hide &= addend->hide & ~addend->allow; accum->prompt |= addend->prompt & ~addend->allow & ~addend->deny; accum->subtree |= addend->subtree & ~addend->deny; + + if (!accum->xindex) + accum->xindex = addend->xindex; + if (!accum->tag) + accum->tag = addend->tag; + if (!accum->label) + accum->label = addend->label; } /** @@ -367,6 +374,13 @@ void aa_perms_accum(struct aa_perms *accum, struct aa_perms *addend) accum->hide &= addend->hide & ~accum->allow; accum->prompt |= addend->prompt & ~accum->allow & ~accum->deny; accum->subtree &= addend->subtree & ~accum->deny; + + if (!accum->xindex) + accum->xindex = addend->xindex; + if (!accum->tag) + accum->tag = addend->tag; + if (!accum->label) + accum->label = addend->label; } void aa_profile_match_label(struct aa_profile *profile, struct aa_label *label, |