mirror of
https://github.com/torvalds/linux
synced 2024-07-21 10:41:44 +00:00
524d8e1425
Displaying the mode as part of the seectx takes up unnecessary memory, makes it so we can't use refcounted secctx so we need to alloc/free on every conversion from secid to secctx and introduces a space that could be potentially mishandled by tooling. Eg. In an audit record we get subj_type=firefix (enforce) Having the mode reported is not necessary, and might even be confusing eg. when writing an audit rule to match the above record field you would use -F subj_type=firefox ie. the mode is not included. AppArmor provides ways to find the mode without reporting as part of the secctx. So disable this by default before its use is wide spread and we can't. For now we add a sysctl to control the behavior as we can't guarantee no one is using this. Acked-by: Andrea Righi <andrea.righi@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
38 lines
988 B
C
38 lines
988 B
C
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
/*
|
|
* AppArmor security module
|
|
*
|
|
* This file contains AppArmor security identifier (secid) definitions
|
|
*
|
|
* Copyright 2009-2018 Canonical Ltd.
|
|
*/
|
|
|
|
#ifndef __AA_SECID_H
|
|
#define __AA_SECID_H
|
|
|
|
#include <linux/slab.h>
|
|
#include <linux/types.h>
|
|
|
|
struct aa_label;
|
|
|
|
/* secid value that will not be allocated */
|
|
#define AA_SECID_INVALID 0
|
|
|
|
/* secid value that matches any other secid */
|
|
#define AA_SECID_WILDCARD 1
|
|
|
|
/* sysctl to enable displaying mode when converting secid to secctx */
|
|
extern int apparmor_display_secid_mode;
|
|
|
|
struct aa_label *aa_secid_to_label(u32 secid);
|
|
int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);
|
|
int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
|
|
void apparmor_release_secctx(char *secdata, u32 seclen);
|
|
|
|
|
|
int aa_alloc_secid(struct aa_label *label, gfp_t gfp);
|
|
void aa_free_secid(u32 secid);
|
|
void aa_secid_update(u32 secid, struct aa_label *label);
|
|
|
|
#endif /* __AA_SECID_H */
|