mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-04 08:24:42 +01:00
64 lines
2.2 KiB
Diff
64 lines
2.2 KiB
Diff
|
From 6b092bbbf9e17b10f709d11b3bc2d7e493617934 Mon Sep 17 00:00:00 2001
|
||
|
|
From: John Johansen <john.johansen@canonical.com>
|
||
|
|
Date: Sun, 6 Aug 2017 05:39:08 -0700
|
||
|
|
Subject: [PATCH 09/17] apparmor: add support for absolute root view based
|
||
|
|
labels
|
||
|
|
|
||
|
|
With apparmor policy virtualization based on policy namespace View's
|
||
|
|
we don't generally want/need absolute root based views, however there
|
||
|
|
are cases like debugging and some secid based conversions where
|
||
|
|
using a root based view is important.
|
||
|
|
|
||
|
|
Signed-off-by: John Johansen <john.johansen@canonical.com>
|
||
|
|
Acked-by: Seth Arnold <seth.arnold@canonical.com>
|
||
|
|
(cherry picked from commit eadfbf0898eda94cee0d982626aa24a3146db48b)
|
||
|
|
---
|
||
|
|
security/apparmor/include/label.h | 1 +
|
||
|
|
security/apparmor/label.c | 10 +++++++++-
|
||
|
|
2 files changed, 10 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/security/apparmor/include/label.h b/security/apparmor/include/label.h
|
||
|
|
index 9a283b722755..af22dcbbcb8a 100644
|
||
|
|
--- a/security/apparmor/include/label.h
|
||
|
|
+++ b/security/apparmor/include/label.h
|
||
|
|
@@ -310,6 +310,7 @@ bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp);
|
||
|
|
#define FLAG_SHOW_MODE 1
|
||
|
|
#define FLAG_VIEW_SUBNS 2
|
||
|
|
#define FLAG_HIDDEN_UNCONFINED 4
|
||
|
|
+#define FLAG_ABS_ROOT 8
|
||
|
|
int aa_label_snxprint(char *str, size_t size, struct aa_ns *view,
|
||
|
|
struct aa_label *label, int flags);
|
||
|
|
int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,
|
||
|
|
diff --git a/security/apparmor/label.c b/security/apparmor/label.c
|
||
|
|
index 38be7a89cc31..52b4ef14840d 100644
|
||
|
|
--- a/security/apparmor/label.c
|
||
|
|
+++ b/security/apparmor/label.c
|
||
|
|
@@ -1607,8 +1607,13 @@ int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns,
|
||
|
|
AA_BUG(!str && size != 0);
|
||
|
|
AA_BUG(!label);
|
||
|
|
|
||
|
|
- if (!ns)
|
||
|
|
+ if (flags & FLAG_ABS_ROOT) {
|
||
|
|
+ ns = root_ns;
|
||
|
|
+ len = snprintf(str, size, "=");
|
||
|
|
+ update_for_len(total, len, size, str);
|
||
|
|
+ } else if (!ns) {
|
||
|
|
ns = labels_ns(label);
|
||
|
|
+ }
|
||
|
|
|
||
|
|
label_for_each(i, label, profile) {
|
||
|
|
if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
|
||
|
|
@@ -1868,6 +1873,9 @@ struct aa_label *aa_label_parse(struct aa_label *base, const char *str,
|
||
|
|
if (*str == '&')
|
||
|
|
str++;
|
||
|
|
}
|
||
|
|
+ if (*str == '=')
|
||
|
|
+ base = &root_ns->unconfined->label;
|
||
|
|
+
|
||
|
|
error = vec_setup(profile, vec, len, gfp);
|
||
|
|
if (error)
|
||
|
|
return ERR_PTR(error);
|
||
|
|
--
|
||
|
|
2.11.0
|
||
|
|
|