AppArmor: export known rlimit names/value mappings in securityfs (d384b0a1) · Commits · 戴 / test

security/apparmor/Makefile

+18 −6

Original line number	Diff line number	Diff line
		@@ -28,25 +28,37 @@ cmd_make-caps = echo "static const char *capability_names[] = {" > $@ ;\
		# [RLIMIT_STACK] = "stack",
		#
		# and build a second integer table (with the second sed cmd), that maps
		# RLIMIT defines to the order defined in asm-generic/resource.h Thi is
		# RLIMIT defines to the order defined in asm-generic/resource.h This is
		# required by policy load to map policy ordering of RLIMITs to internal
		# ordering for architectures that redefine an RLIMIT.
		# Transforms lines from
		# #define RLIMIT_STACK 3 /* max stack size */
		# to
		# RLIMIT_STACK,
		#
		# and build the securityfs entries for the mapping.
		# Transforms lines from
		# #define RLIMIT_FSIZE 1 /* Maximum filesize */
		# #define RLIMIT_STACK 3 /* max stack size */
		# to
		# #define AA_FS_RLIMIT_MASK "fsize stack"
		quiet_cmd_make-rlim = GEN $@
		cmd_make-rlim = echo "static const char *rlim_names[] = {" > $@ ;\
		cmd_make-rlim = echo "static const char *rlim_names[RLIM_NLIMITS] = {" > $@ ;\
		sed $< >> $@ -r -n \
		-e 's/^\# ?define[ \t]+(RLIMIT_([A-Z0-9_]+)).*/[\1] = "\L\2",/p';\
		echo "};" >> $@ ;\
		echo "static const int rlim_map[] = {" >> $@ ;\
		echo "static const int rlim_map[RLIM_NLIMITS] = {" >> $@ ;\
		sed -r -n "s/^\# ?define[ \t]+(RLIMIT_[A-Z0-9_]+).*/\1,/p" $< >> $@ ;\
		echo "};" >> $@
		echo "};" >> $@ ; \
		echo -n '\#define AA_FS_RLIMIT_MASK "' >> $@ ;\
		sed -r -n 's/^\# ?define[ \t]+RLIMIT_([A-Z0-9_]+).*/\L\1/p' $< \| \
		tr '\n' ' ' \| sed -e 's/ $$/"\n/' >> $@

		$(obj)/capability.o : $(obj)/capability_names.h
		$(obj)/resource.o : $(obj)/rlim_names.h
		$(obj)/capability_names.h : $(srctree)/include/linux/capability.h
		$(obj)/capability_names.h : $(srctree)/include/linux/capability.h \
		$(src)/Makefile
		$(call cmd,make-caps)
		$(obj)/rlim_names.h : $(srctree)/include/asm-generic/resource.h
		$(obj)/rlim_names.h : $(srctree)/include/asm-generic/resource.h \
		$(src)/Makefile
		$(call cmd,make-rlim)

security/apparmor/apparmorfs.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -25,6 +25,7 @@
		#include "include/audit.h"
		#include "include/context.h"
		#include "include/policy.h"
		#include "include/resource.h"

		/**
		* aa_simple_write_to_buffer - common routine for getting policy from user
		@@ -201,6 +202,7 @@ static struct aa_fs_entry aa_fs_entry_features[] = {
		AA_FS_DIR("domain", aa_fs_entry_domain),
		AA_FS_DIR("file", aa_fs_entry_file),
		AA_FS_FILE_U64("capability", VFS_CAP_FLAGS_MASK),
		AA_FS_DIR("rlimit", aa_fs_entry_rlimit),
		{ }
		};

security/apparmor/include/resource.h

+4 −0

Original line number	Diff line number	Diff line
		@@ -18,6 +18,8 @@
		#include <linux/resource.h>
		#include <linux/sched.h>

		#include "apparmorfs.h"

		struct aa_profile;

		/* struct aa_rlimit - rlimit settings for the profile
		@@ -32,6 +34,8 @@ struct aa_rlimit {
		struct rlimit limits[RLIM_NLIMITS];
		};

		extern struct aa_fs_entry aa_fs_entry_rlimit[];

		int aa_map_resource(int resource);
		int aa_task_setrlimit(struct aa_profile profile, struct task_struct ,
		unsigned int resource, struct rlimit *new_rlim);

security/apparmor/resource.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -23,6 +23,11 @@
		*/
		#include "rlim_names.h"

		struct aa_fs_entry aa_fs_entry_rlimit[] = {
		AA_FS_FILE_STRING("mask", AA_FS_RLIMIT_MASK),
		{ }
		};

		/* audit callback for resource specific fields */
		static void audit_cb(struct audit_buffer ab, void va)
		{

Admin message