From dc764045908b18bf773a872ede3e0957f9132f2a Mon Sep 17 00:00:00 2001 From: John Johansen Date: Fri, 27 Sep 2013 16:15:00 -0700 Subject: [PATCH] remove support for change_hat 1.4 change_hat 1.4 was an experiement is more directly controlling change_hat by adding hat rulles to the profile. It has not been used since the original experiment (4 years). So remove it Signed-off-by: John Johansen Acked-by: Seth Arnold Acked-by: Steve Beattie --- parser/parser.h | 4 --- parser/parser_common.c | 1 - parser/parser_main.c | 7 ----- parser/parser_policy.c | 68 ------------------------------------------ 4 files changed, 80 deletions(-) diff --git a/parser/parser.h b/parser/parser.h index d78e39085..e60ba55f7 100644 --- a/parser/parser.h +++ b/parser/parser.h @@ -217,9 +217,6 @@ struct var_string { #define BOOL int -#define FLAG_CHANGEHAT_1_4 2 -#define FLAG_CHANGEHAT_1_5 3 - extern int preprocess_only; #define PATH_CHROOT_REL 0x1 @@ -283,7 +280,6 @@ extern int net_af_max_override; extern int kernel_load; extern int kernel_supports_network; extern int kernel_supports_mount; -extern int flag_changehat_version; extern int conf_verbose; extern int conf_quiet; extern int names_only; diff --git a/parser/parser_common.c b/parser/parser_common.c index e8b20f0bf..39a295ff3 100644 --- a/parser/parser_common.c +++ b/parser/parser_common.c @@ -27,7 +27,6 @@ int net_af_max_override = -1; /* use kernel to determine af_max */ int kernel_load = 1; int kernel_supports_network = 1; /* kernel supports network rules */ int kernel_supports_mount = 0; /* kernel supports mount rules */ -int flag_changehat_version = FLAG_CHANGEHAT_1_5; int conf_verbose = 0; int conf_quiet = 0; int names_only = 0; diff --git a/parser/parser_main.c b/parser/parser_main.c index ab2aea9b3..4b0887e45 100644 --- a/parser/parser_main.c +++ b/parser/parser_main.c @@ -854,13 +854,6 @@ static void get_flags_string(char **flags, char *flags_file) { (*flags)[size] = 0; fclose(f); - pos = strstr(*flags, "change_hat="); - if (pos) { - if (strncmp(pos, "change_hat=1.4", 14) == 0) - flag_changehat_version = FLAG_CHANGEHAT_1_4; -//fprintf(stderr, "flags string: %s\n", flags_string); -//fprintf(stderr, "changehat %d\n", flag_changehat_version); - } return; fail: diff --git a/parser/parser_policy.c b/parser/parser_policy.c index 8ca165489..22bd2688c 100644 --- a/parser/parser_policy.c +++ b/parser/parser_policy.c @@ -397,28 +397,6 @@ static void __add_hat_rules_parent(const void *nodep, const VISIT value, if ((*t)->local) return; - /* add rule to grant permission to change_hat - * An opensuse 11.0, AA 2.3 requirement, - * rules are added to the parent of the hat - */ - if ((flag_changehat_version == FLAG_CHANGEHAT_1_4) && - (*t)->parent) { - char *buffer = (char *) malloc(strlen((*t)->name) + 1); - if (!buffer) { - PERROR("Memory allocation error\n"); - exit(1); - } - - strcpy(buffer, (*t)->name); - - entry = new_entry(NULL, buffer, AA_CHANGE_HAT, NULL); - if (!entry) { - PERROR("Memory allocation error\n"); - exit(1); - } - add_entry_to_policy((*t)->parent, entry); - } - entry = new_entry(NULL, strdup(CHANGEHAT_PATH), AA_MAY_WRITE, NULL); if (!entry) { PERROR(_("ERROR adding hat access rule for profile %s\n"), @@ -430,56 +408,10 @@ static void __add_hat_rules_parent(const void *nodep, const VISIT value, twalk((*t)->hat_table, __add_hat_rules_parent); } -/* Deprecated: used to support changehat rules of AppArmor 2.3 - * add the same hat rules to the hats as the parent so that hats can - * change to sibling hats - */ -static void __add_hat_rules_hats(const void *nodep, const VISIT value, - const int __unused depth) -{ - struct codomain **t = (struct codomain **) nodep; - - if (value == preorder || value == endorder) - return; - - /* don't add hat rules if a parent profile with no hats */ - if (!(*t)->hat_table && !(*t)->parent) - return; - - /* don't add hat rules for local_profiles */ - if ((*t)->local) - return; - - /* hat */ - if ((*t)->parent) { - struct cod_entry *entry, *new_ent; - list_for_each((*t)->parent->entries, entry) { - if (entry->mode & AA_CHANGE_HAT) { - char *buffer = strdup(entry->name); - if (!buffer) { - PERROR("Memory allocation error\n"); - exit(1); - } - new_ent = new_entry(NULL, buffer, - AA_CHANGE_HAT, NULL); - if (!entry) { - PERROR("Memory allocation error\n"); - exit(1); - } - add_entry_to_policy((*t), new_ent); - } - } - } - twalk((*t)->hat_table, __add_hat_rules_hats); -} - static int add_hat_rules(void) { twalk(policy_list, __add_hat_rules_parent); - /* support hat rules of AppArmor 2.3 in opensuse 11.0 */ - if (flag_changehat_version == FLAG_CHANGEHAT_1_4) - twalk(policy_list, __add_hat_rules_hats); return 0; }