Commit df8073c6 authored Jun 09, 2017 by John Johansen

apparmor: convert aa_change_XXX bool parameters to flags



Instead of passing multiple booleans consolidate on a single flags
field.

Signed-off-by: John Johansen <john.johansen@canonical.com>

parent dca91402

security/apparmor/domain.c

+13 −13

Original line number	Diff line number	Diff line
		@@ -563,7 +563,7 @@ static char new_compound_name(const char n1, const char *n2)
		* @hats: vector of hat names to try changing into (MAYBE NULL if @count == 0)
		* @count: number of hat names in @hats
		* @token: magic value to validate the hat change
		* @permtest: true if this is just a permission test
		* @flags: flags affecting behavior of the change
		*
		* Change to the first profile specified in @hats that exists, and store
		* the @hat_magic in the current task context. If the count == 0 and the
		@@ -572,7 +572,7 @@ static char new_compound_name(const char n1, const char *n2)
		*
		* Returns %0 on success, error otherwise.
		*/
		int aa_change_hat(const char *hats[], int count, u64 token, bool permtest)
		int aa_change_hat(const char *hats[], int count, u64 token, int flags)
		{
		const struct cred *cred;
		struct aa_task_ctx *ctx;
		@@ -616,7 +616,7 @@ int aa_change_hat(const char *hats[], int count, u64 token, bool permtest)
		/* released below */
		hat = aa_find_child(root, hats[i]);
		if (!hat) {
		if (!COMPLAIN_MODE(root) \|\| permtest) {
		if (!COMPLAIN_MODE(root) \|\| (flags & AA_CHANGE_TEST)) {
		if (list_empty(&root->base.profiles))
		error = -ECHILD;
		else
		@@ -663,7 +663,7 @@ int aa_change_hat(const char *hats[], int count, u64 token, bool permtest)
		goto audit;
		}

		if (!permtest) {
		if (!(flags & AA_CHANGE_TEST)) {
		error = aa_set_current_hat(hat, token);
		if (error == -EACCES)
		/* kill task in case of brute force attacks */
		@@ -684,7 +684,7 @@ int aa_change_hat(const char *hats[], int count, u64 token, bool permtest)
		goto out;

		audit:
		if (!permtest)
		if (!(flags & AA_CHANGE_TEST))
		error = aa_audit_file(profile, &perms, OP_CHANGE_HAT,
		AA_MAY_CHANGEHAT, NULL, target,
		GLOBAL_ROOT_UID, info, error);
		@@ -703,7 +703,7 @@ int aa_change_hat(const char *hats[], int count, u64 token, bool permtest)
		* aa_change_profile - perform a one-way profile transition
		* @fqname: name of profile may include namespace (NOT NULL)
		* @onexec: whether this transition is to take place immediately or at exec
		* @permtest: true if this is just a permission test
		* @flags: flags affecting change behavior
		*
		* Change to new profile @name. Unlike with hats, there is no way
		* to change back. If @name isn't specified the current profile name is
		@@ -713,8 +713,7 @@ int aa_change_hat(const char *hats[], int count, u64 token, bool permtest)
		*
		* Returns %0 on success, error otherwise.
		*/
		int aa_change_profile(const char *fqname, bool onexec,
		bool permtest, bool stack)
		int aa_change_profile(const char *fqname, int flags)
		{
		const struct cred *cred;
		struct aa_profile profile, target = NULL;
		@@ -728,7 +727,7 @@ int aa_change_profile(const char *fqname, bool onexec,
		return -EINVAL;
		}

		if (onexec) {
		if (flags & AA_CHANGE_ONEXEC) {
		request = AA_MAY_ONEXEC;
		op = OP_CHANGE_ONEXEC;
		} else {
		@@ -755,7 +754,8 @@ int aa_change_profile(const char *fqname, bool onexec,
		if (!target) {
		info = "profile not found";
		error = -ENOENT;
		if (permtest \|\| !COMPLAIN_MODE(profile))
		if ((flags & AA_CHANGE_TEST) \|\|
		!COMPLAIN_MODE(profile))
		goto audit;
		/* released below */
		target = aa_new_null_profile(profile, false, fqname,
		@@ -781,16 +781,16 @@ int aa_change_profile(const char *fqname, bool onexec,
		goto audit;
		}

		if (permtest)
		if (flags & AA_CHANGE_TEST)
		goto audit;

		if (onexec)
		if (flags & AA_CHANGE_ONEXEC)
		error = aa_set_current_onexec(target);
		else
		error = aa_replace_current_profile(target);

		audit:
		if (!permtest)
		if (!(flags & AA_CHANGE_TEST))
		error = aa_audit_file(profile, &perms, op, request, NULL,
		fqname, GLOBAL_ROOT_UID, info, error);

security/apparmor/include/domain.h

+7 −3

Original line number	Diff line number	Diff line
		@@ -23,12 +23,16 @@ struct aa_domain {
		char **table;
		};

		#define AA_CHANGE_NOFLAGS 0
		#define AA_CHANGE_TEST 1
		#define AA_CHANGE_CHILD 2
		#define AA_CHANGE_ONEXEC 4

		int apparmor_bprm_set_creds(struct linux_binprm *bprm);
		int apparmor_bprm_secureexec(struct linux_binprm *bprm);

		void aa_free_domain_entries(struct aa_domain *domain);
		int aa_change_hat(const char *hats[], int count, u64 token, bool permtest);
		int aa_change_profile(const char *fqname, bool onexec, bool permtest,
		bool stack);
		int aa_change_hat(const char *hats[], int count, u64 token, int flags);
		int aa_change_profile(const char *fqname, int flags);

		#endif /* __AA_DOMAIN_H */

security/apparmor/include/procattr.h

+1 −5

Original line number	Diff line number	Diff line
		@@ -15,11 +15,7 @@
		#ifndef __AA_PROCATTR_H
		#define __AA_PROCATTR_H

		#define AA_DO_TEST 1
		#define AA_ONEXEC 1

		int aa_getprocattr(struct aa_profile profile, char *string);
		int aa_setprocattr_changehat(char *args, size_t size, int test);
		int aa_setprocattr_changeprofile(char *fqname, bool onexec, int test);
		int aa_setprocattr_changehat(char *args, size_t size, int flags);

		#endif /* __AA_PROCATTR_H */

security/apparmor/lsm.c

+5 −8

Original line number	Diff line number	Diff line
		@@ -554,22 +554,19 @@ static int apparmor_setprocattr(const char name, void value,
		if (strcmp(name, "current") == 0) {
		if (strcmp(command, "changehat") == 0) {
		error = aa_setprocattr_changehat(args, arg_size,
		!AA_DO_TEST);
		AA_CHANGE_NOFLAGS);
		} else if (strcmp(command, "permhat") == 0) {
		error = aa_setprocattr_changehat(args, arg_size,
		AA_DO_TEST);
		AA_CHANGE_TEST);
		} else if (strcmp(command, "changeprofile") == 0) {
		error = aa_change_profile(args, !AA_ONEXEC,
		!AA_DO_TEST, false);
		error = aa_change_profile(args, AA_CHANGE_NOFLAGS);
		} else if (strcmp(command, "permprofile") == 0) {
		error = aa_change_profile(args, !AA_ONEXEC, AA_DO_TEST,
		false);
		error = aa_change_profile(args, AA_CHANGE_TEST);
		} else
		goto fail;
		} else if (strcmp(name, "exec") == 0) {
		if (strcmp(command, "exec") == 0)
		error = aa_change_profile(args, AA_ONEXEC, !AA_DO_TEST,
		false);
		error = aa_change_profile(args, AA_CHANGE_ONEXEC);
		else
		goto fail;
		} else

security/apparmor/procattr.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -109,11 +109,11 @@ static char split_token_from_name(const char op, char args, u64 token)
		* aa_setprocattr_chagnehat - handle procattr interface to change_hat
		* @args: args received from writing to /proc/<pid>/attr/current (NOT NULL)
		* @size: size of the args
		* @test: true if this is a test of change_hat permissions
		* @flags: set of flags governing behavior
		*
		* Returns: %0 or error code if change_hat fails
		*/
		int aa_setprocattr_changehat(char *args, size_t size, int test)
		int aa_setprocattr_changehat(char *args, size_t size, int flags)
		{
		char *hat;
		u64 token;
		@@ -148,5 +148,5 @@ int aa_setprocattr_changehat(char *args, size_t size, int test)
		AA_DEBUG("%s: (pid %d) Magic 0x%llx count %d Hat '%s'\n",
		__func__, current->pid, token, count, "<NULL>");

		return aa_change_hat(hats, count, token, test);
		return aa_change_hat(hats, count, token, flags);
		}