diff options
| author |   John Johansen <john.johansen@canonical.com> | 2017-08-06 05:39:08 -0700 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2017-09-22 13:00:58 -0700 |
| commit | 26b7899510ae243e392960704ebdba52d05fbb13 (patch) | |
| tree | 1a83d9bf79e3d404f7f5a9f8d7b203396432beec /security/apparmor/label.c | |
| parent | apparmor: cleanup conditional check for label in label_print (diff) | |
| download | linux-dev-26b7899510ae243e392960704ebdba52d05fbb13.tar.xz linux-dev-26b7899510ae243e392960704ebdba52d05fbb13.zip | |
apparmor: add support for absolute root view based labels
With apparmor policy virtualization based on policy namespace View's
we don't generally want/need absolute root based views, however there
are cases like debugging and some secid based conversions where
using a root based view is important.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Diffstat (limited to '')
| -rw-r--r-- | security/apparmor/label.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/security/apparmor/label.c b/security/apparmor/label.c index 38be7a89cc31..52b4ef14840d 100644 --- a/security/apparmor/label.c +++ b/security/apparmor/label.c @@ -1607,8 +1607,13 @@ int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns, AA_BUG(!str && size != 0); AA_BUG(!label); - if (!ns) + if (flags & FLAG_ABS_ROOT) { + ns = root_ns; + len = snprintf(str, size, "="); + update_for_len(total, len, size, str); + } else if (!ns) { ns = labels_ns(label); + } label_for_each(i, label, profile) { if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) { @@ -1868,6 +1873,9 @@ struct aa_label *aa_label_parse(struct aa_label *base, const char *str, if (*str == '&') str++; } + if (*str == '=') + base = &root_ns->unconfined->label; + error = vec_setup(profile, vec, len, gfp); if (error) return ERR_PTR(error); |