diff options
| author | John Johansen <john.johansen@canonical.com> | 2022-07-16 11:53:46 +0300 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2022-10-04 00:49:03 +0300 |
| commit | e844fe9b51c984472ea98be3b2d1201ba9ee3213 (patch) | |
| tree | 167bf6c3beeec74821dd3f2d54b77b3c37b3a361 /security/apparmor/mount.c | |
| parent | bf690f59d0429c62de4db1234f16557eedcb39bf (diff) | |
| download | linux-e844fe9b51c984472ea98be3b2d1201ba9ee3213.tar.xz | |
apparmor: convert policy lookup to use accept as an index
Remap polidydb dfa accept table from embedded perms to an index, and
then move the perm lookup to use the accept entry as an index into the
perm table. This is done so that the perm table can be separated from
the dfa, allowing dfa accept to index to share expanded permission
sets.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor/mount.c')
| -rw-r--r-- | security/apparmor/mount.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c index 1e978c2b1ee4..7594f3a3441e 100644 --- a/security/apparmor/mount.c +++ b/security/apparmor/mount.c @@ -249,7 +249,7 @@ static int do_match_mnt(struct aa_policydb *policy, unsigned int start, state = match_mnt_flags(policy->dfa, state, flags); if (!state) return 4; - *perms = *aa_lookup_perms(policy->perms, state); + *perms = *aa_lookup_perms(policy, state); if (perms->allow & AA_MAY_MOUNT) return 0; @@ -262,7 +262,7 @@ static int do_match_mnt(struct aa_policydb *policy, unsigned int start, state = aa_dfa_match(policy->dfa, state, data); if (!state) return 5; - *perms = *aa_lookup_perms(policy->perms, state); + *perms = *aa_lookup_perms(policy, state); if (perms->allow & AA_MAY_MOUNT) return 0; } @@ -584,7 +584,7 @@ static int profile_umount(struct aa_profile *profile, const struct path *path, state = aa_dfa_match(profile->policy.dfa, profile->policy.start[AA_CLASS_MOUNT], name); - perms = *aa_lookup_perms(profile->policy.perms, state); + perms = *aa_lookup_perms(&profile->policy, state); if (AA_MAY_UMOUNT & ~perms.allow) error = -EACCES; @@ -655,7 +655,7 @@ static struct aa_label *build_pivotroot(struct aa_profile *profile, new_name); state = aa_dfa_null_transition(profile->policy.dfa, state); state = aa_dfa_match(profile->policy.dfa, state, old_name); - perms = *aa_lookup_perms(profile->policy.perms, state); + perms = *aa_lookup_perms(&profile->policy, state); if (AA_MAY_PIVOTROOT & perms.allow) error = 0; |