Commit 47f6e5cc authored by John Johansen's avatar John Johansen
Browse files

apparmor: change op from int to const char * 



Having ops be an integer that is an index into an op name table is
awkward and brittle. Every op change requires an edit for both the
op constant and a string in the table. Instead switch to using const
strings directly, eliminating the need for the table that needs to
be kept in sync.

Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
parent 55a26ebf

security/apparmor/apparmorfs.c

+2 −2
Original line number Diff line number Diff line
@@ -85,7 +85,7 @@ static int mangle_name(const char *name, char *target) 
 * Returns: kernel buffer containing copy of user buffer data or an

 *          ERR_PTR on failure.

 */

static struct aa_loaddata *aa_simple_write_to_buffer(int op,

static struct aa_loaddata *aa_simple_write_to_buffer(const char *op,

						     const char __user *userbuf,

						     size_t alloc_size,

						     size_t copy_size,
@@ -122,7 +122,7 @@ static ssize_t policy_update(int binop, const char __user *buf, size_t size, 
	ssize_t error;

	struct aa_loaddata *data;

	struct aa_profile *profile = aa_current_profile();

	int op = binop == PROF_ADD ? OP_PROF_LOAD : OP_PROF_REPL;

	const char *op = binop == PROF_ADD ? OP_PROF_LOAD : OP_PROF_REPL;

	/* high level check about policy management - fine grained in

	 * below after unpack

	 */

security/apparmor/audit.c

+1 −54
Original line number Diff line number Diff line
@@ -20,59 +20,6 @@ 
#include "include/policy.h"

#include "include/policy_ns.h"



const char *const op_table[] = {

	"null",



	"sysctl",

	"capable",



	"unlink",

	"mkdir",

	"rmdir",

	"mknod",

	"truncate",

	"link",

	"symlink",

	"rename_src",

	"rename_dest",

	"chmod",

	"chown",

	"getattr",

	"open",



	"file_perm",

	"file_lock",

	"file_mmap",

	"file_mprotect",



	"create",

	"post_create",

	"bind",

	"connect",

	"listen",

	"accept",

	"sendmsg",

	"recvmsg",

	"getsockname",

	"getpeername",

	"getsockopt",

	"setsockopt",

	"socket_shutdown",



	"ptrace",



	"exec",

	"change_hat",

	"change_profile",

	"change_onexec",



	"setprocattr",

	"setrlimit",



	"profile_replace",

	"profile_load",

	"profile_remove"

};



const char *const audit_mode_names[] = {

	"normal",
@@ -120,7 +67,7 @@ static void audit_pre(struct audit_buffer *ab, void *ca) 


	if (sa->aad->op) {

		audit_log_format(ab, " operation=");

		audit_log_string(ab, op_table[sa->aad->op]);

		audit_log_string(ab, sa->aad->op);

	}



	if (sa->aad->info) {

security/apparmor/domain.c

+2 −2
Original line number Diff line number Diff line
@@ -750,8 +750,8 @@ int aa_change_profile(const char *ns_name, const char *hname, bool onexec, 
	struct aa_profile *profile, *target = NULL;

	struct aa_ns *ns = NULL;

	struct file_perms perms = {};

	const char *name = NULL, *info = NULL;

	int op, error = 0;

	const char *name = NULL, *info = NULL, *op;

	int error = 0;

	u32 request;



	if (!hname && !ns_name)

security/apparmor/file.c

+5 −4
Original line number Diff line number Diff line
@@ -104,7 +104,7 @@ static void file_audit_cb(struct audit_buffer *ab, void *va) 
 * Returns: %0 or error on failure

 */

int aa_audit_file(struct aa_profile *profile, struct file_perms *perms,

		  gfp_t gfp, int op, u32 request, const char *name,

		  gfp_t gfp, const char *op, u32 request, const char *name,

		  const char *target, kuid_t ouid, const char *info, int error)

{

	int type = AUDIT_APPARMOR_AUTO;
@@ -276,8 +276,9 @@ static inline bool is_deleted(struct dentry *dentry) 
 *

 * Returns: %0 else error if access denied or other error

 */

int aa_path_perm(int op, struct aa_profile *profile, const struct path *path,

		 int flags, u32 request, struct path_cond *cond)

int aa_path_perm(const char *op, struct aa_profile *profile,

		 const struct path *path, int flags, u32 request,

		 struct path_cond *cond)

{

	char *buffer = NULL;

	struct file_perms perms = {};
@@ -446,7 +447,7 @@ audit: 
 *

 * Returns: %0 if access allowed else error

 */

int aa_file_perm(int op, struct aa_profile *profile, struct file *file,

int aa_file_perm(const char *op, struct aa_profile *profile, struct file *file,

		 u32 request)

{

	struct path_cond cond = {

security/apparmor/include/audit.h

+53 −55
Original line number Diff line number Diff line
@@ -46,65 +46,63 @@ enum audit_type { 
	AUDIT_APPARMOR_AUTO

};



extern const char *const op_table[];

enum aa_ops {

	OP_NULL,



	OP_SYSCTL,

	OP_CAPABLE,



	OP_UNLINK,

	OP_MKDIR,

	OP_RMDIR,

	OP_MKNOD,

	OP_TRUNC,

	OP_LINK,

	OP_SYMLINK,

	OP_RENAME_SRC,

	OP_RENAME_DEST,

	OP_CHMOD,

	OP_CHOWN,

	OP_GETATTR,

	OP_OPEN,



	OP_FPERM,

	OP_FLOCK,

	OP_FMMAP,

	OP_FMPROT,



	OP_CREATE,

	OP_POST_CREATE,

	OP_BIND,

	OP_CONNECT,

	OP_LISTEN,

	OP_ACCEPT,

	OP_SENDMSG,

	OP_RECVMSG,

	OP_GETSOCKNAME,

	OP_GETPEERNAME,

	OP_GETSOCKOPT,

	OP_SETSOCKOPT,

	OP_SOCK_SHUTDOWN,



	OP_PTRACE,



	OP_EXEC,

	OP_CHANGE_HAT,

	OP_CHANGE_PROFILE,

	OP_CHANGE_ONEXEC,



	OP_SETPROCATTR,

	OP_SETRLIMIT,



	OP_PROF_REPL,

	OP_PROF_LOAD,

	OP_PROF_RM,

};

#define OP_NULL NULL



#define OP_SYSCTL "sysctl"

#define OP_CAPABLE "capable"



#define OP_UNLINK "unlink"

#define OP_MKDIR "mkdir"

#define OP_RMDIR "rmdir"

#define OP_MKNOD "mknod"

#define OP_TRUNC "truncate"

#define OP_LINK "link"

#define OP_SYMLINK "symlink"

#define OP_RENAME_SRC "rename_src"

#define OP_RENAME_DEST "rename_dest"

#define OP_CHMOD "chmod"

#define OP_CHOWN "chown"

#define OP_GETATTR "getattr"

#define OP_OPEN "open"



#define OP_FPERM "file_perm"

#define OP_FLOCK "file_lock"

#define OP_FMMAP "file_mmap"

#define OP_FMPROT "file_mprotect"



#define OP_CREATE "create"

#define OP_POST_CREATE "post_create"

#define OP_BIND "bind"

#define OP_CONNECT "connect"

#define OP_LISTEN "listen"

#define OP_ACCEPT "accept"

#define OP_SENDMSG "sendmsg"

#define OP_RECVMSG "recvmsg"

#define OP_GETSOCKNAME "getsockname"

#define OP_GETPEERNAME "getpeername"

#define OP_GETSOCKOPT "getsockopt"

#define OP_SETSOCKOPT "setsockopt"

#define OP_SHUTDOWN "socket_shutdown"



#define OP_PTRACE "ptrace"



#define OP_EXEC "exec"



#define OP_CHANGE_HAT "change_hat"

#define OP_CHANGE_PROFILE "change_profile"

#define OP_CHANGE_ONEXEC "change_onexec"



#define OP_SETPROCATTR "setprocattr"

#define OP_SETRLIMIT "setrlimit"



#define OP_PROF_REPL "profile_replace"

#define OP_PROF_LOAD "profile_load"

#define OP_PROF_RM "profile_remove"





struct apparmor_audit_data {

	int error;

	int op;

	const char *op;

	int type;

	void *profile;

	const char *name;

CRA Git | Maintained and supported by SUSTech CRA and CCSE