diff options
| author |   John Johansen <john.johansen@canonical.com> | 2022-03-25 05:20:02 -0700 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2022-07-19 02:57:15 -0700 |
| commit | f567e7fada03d4c9c5f646a439ad2356371c4147 (patch) | |
| tree | 27a41e6ad633e02cfe8b32c3f13c20d03458c9e1 /security/apparmor/lib.c | |
| parent | apparmor: allow label to carry debug flags (diff) | |
| download | linux-dev-f567e7fada03d4c9c5f646a439ad2356371c4147.tar.xz linux-dev-f567e7fada03d4c9c5f646a439ad2356371c4147.zip | |
apparmor: extend policydb permission set by making use of the xbits
The policydb permission set has left the xbits unused. Make them available
for mediation.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor/lib.c')
| -rw-r--r-- | security/apparmor/lib.c | 25 |
1 files changed, 21 insertions, 4 deletions
diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c index 5eda003c0d45..1c72a61108d3 100644 --- a/security/apparmor/lib.c +++ b/security/apparmor/lib.c @@ -322,22 +322,39 @@ static u32 map_other(u32 x) ((x & 0x60) << 19); /* SETOPT/GETOPT */ } +static u32 map_xbits(u32 x) +{ + return ((x & 0x1) << 7) | + ((x & 0x7e) << 9); +} + void aa_compute_perms(struct aa_dfa *dfa, unsigned int state, struct aa_perms *perms) { + /* This mapping is convulated due to history. + * v1-v4: only file perms + * v5: added policydb which dropped in perm user conditional to + * gain new perm bits, but had to map around the xbits because + * the userspace compiler was still munging them. + * v9: adds using the xbits in policydb because the compiler now + * supports treating policydb permission bits different. + * Unfortunately there is not way to force auditing on the + * perms represented by the xbits + */ *perms = (struct aa_perms) { - .allow = dfa_user_allow(dfa, state), + .allow = dfa_user_allow(dfa, state) | + map_xbits(dfa_user_xbits(dfa, state)), .audit = dfa_user_audit(dfa, state), - .quiet = dfa_user_quiet(dfa, state), + .quiet = dfa_user_quiet(dfa, state) | + map_xbits(dfa_other_xbits(dfa, state)), }; - /* for v5 perm mapping in the policydb, the other set is used + /* for v5-v9 perm mapping in the policydb, the other set is used * to extend the general perm set */ perms->allow |= map_other(dfa_other_allow(dfa, state)); perms->audit |= map_other(dfa_other_audit(dfa, state)); perms->quiet |= map_other(dfa_other_quiet(dfa, state)); -// perms->xindex = dfa_user_xindex(dfa, state); } /** |