summaryrefslogtreecommitdiff
path: root/security
diff options
context:
space:
mode:
authorJohn Johansen <john.johansen@canonical.com>2017-01-16 00:42:24 -0800
committerJohn Johansen <john.johansen@canonical.com>2017-01-16 01:18:22 -0800
commit31617ddfdd7764a5046f076247208aa324458069 (patch)
treec7338161d7d5fae07b830e5f24c4bae0604b30b4 /security
parent3b0aaf5866bf92a3e47627a02ed5e1be6d7cc110 (diff)
apparmor: add fn to lookup profiles by fqname
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security')
-rw-r--r--security/apparmor/include/policy.h2
-rw-r--r--security/apparmor/include/policy_ns.h10
-rw-r--r--security/apparmor/policy.c29
-rw-r--r--security/apparmor/policy_ns.c4
4 files changed, 38 insertions, 7 deletions
diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
index c90f4a2ffe57..da62d29d3992 100644
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -180,6 +180,8 @@ struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name);
struct aa_profile *aa_lookupn_profile(struct aa_ns *ns, const char *hname,
size_t n);
struct aa_profile *aa_lookup_profile(struct aa_ns *ns, const char *name);
+struct aa_profile *aa_fqlookupn_profile(struct aa_profile *base,
+ const char *fqname, size_t n);
struct aa_profile *aa_match_profile(struct aa_ns *ns, const char *name);
ssize_t aa_replace_profiles(void *udata, size_t size, bool noreplace);
diff --git a/security/apparmor/include/policy_ns.h b/security/apparmor/include/policy_ns.h
index 381f8b078548..ebf9b40f84ed 100644
--- a/security/apparmor/include/policy_ns.h
+++ b/security/apparmor/include/policy_ns.h
@@ -46,11 +46,11 @@ struct aa_ns_acct {
* @uniq_id: a unique id count for the profiles in the namespace
* @dents: dentries for the namespaces file entries in apparmorfs
*
- * An aa_ns defines the set profiles that are searched to determine
- * which profile to attach to a task. Profiles can not be shared between
- * aa_nss and profile names within a namespace are guaranteed to be
- * unique. When profiles in separate namespaces have the same name they
- * are NOT considered to be equivalent.
+ * An aa_ns defines the set profiles that are searched to determine which
+ * profile to attach to a task. Profiles can not be shared between aa_ns
+ * and profile names within a namespace are guaranteed to be unique. When
+ * profiles in separate namespaces have the same name they are NOT considered
+ * to be equivalent.
*
* Namespaces are hierarchical and only namespaces and profiles below the
* current namespace are visible.
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index 291810490eaf..7fde5785005d 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -498,6 +498,35 @@ struct aa_profile *aa_lookup_profile(struct aa_ns *ns, const char *hname)
{
return aa_lookupn_profile(ns, hname, strlen(hname));
}
+
+struct aa_profile *aa_fqlookupn_profile(struct aa_profile *base,
+ const char *fqname, size_t n)
+{
+ struct aa_profile *profile;
+ struct aa_ns *ns;
+ const char *name, *ns_name;
+ size_t ns_len;
+
+ name = aa_splitn_fqname(fqname, n, &ns_name, &ns_len);
+ if (ns_name) {
+ ns = aa_findn_ns(base->ns, ns_name, ns_len);
+ if (!ns)
+ return NULL;
+ } else
+ ns = aa_get_ns(base->ns);
+
+ if (name)
+ profile = aa_lookupn_profile(ns, name, n - (name - fqname));
+ else if (ns)
+ /* default profile for ns, currently unconfined */
+ profile = aa_get_newest_profile(ns->unconfined);
+ else
+ profile = NULL;
+ aa_put_ns(ns);
+
+ return profile;
+}
+
/**
* replacement_allowed - test to see if replacement is allowed
* @profile: profile to test if it can be replaced (MAYBE NULL)
diff --git a/security/apparmor/policy_ns.c b/security/apparmor/policy_ns.c
index 9746643cbab2..bab23cce197c 100644
--- a/security/apparmor/policy_ns.c
+++ b/security/apparmor/policy_ns.c
@@ -226,7 +226,7 @@ static void __ns_list_release(struct list_head *head);
/**
* destroy_ns - remove everything contained by @ns
- * @ns: ns to have it contents removed (NOT NULL)
+ * @ns: namespace to have it contents removed (NOT NULL)
*/
static void destroy_ns(struct aa_ns *ns)
{
@@ -276,7 +276,7 @@ static void __ns_list_release(struct list_head *head)
}
/**
- * aa_alloc_root_ns - allocate the root profile namespcae
+ * aa_alloc_root_ns - allocate the root profile namespace
*
* Returns: %0 on success else error
*