apparmor: remove POLICY_MEDIATES_SAFE

[thirdparty/linux.git] / security / apparmor / apparmorfs.c

diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index d4fa04d914395393289eaea5c26b344d7668325c..701cb3e5ec3b92f4c4a595c5d7e62fc2edc96d51 100644 (file)
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -30,10 +30,9 @@
 #include "include/apparmor.h"
 #include "include/apparmorfs.h"
 #include "include/audit.h"
-#include "include/context.h"
+#include "include/cred.h"
 #include "include/crypto.h"
 #include "include/ipc.h"
-#include "include/policy_ns.h"
 #include "include/label.h"
 #include "include/policy.h"
 #include "include/policy_ns.h"
@@ -120,9 +119,7 @@ static int aafs_count;
 
 static int aafs_show_path(struct seq_file *seq, struct dentry *dentry)
 {
-       struct inode *inode = d_inode(dentry);
-
-       seq_printf(seq, "%s:[%lu]", AAFS_NAME, inode->i_ino);
+       seq_printf(seq, "%s:[%lu]", AAFS_NAME, d_inode(dentry)->i_ino);
        return 0;
 }
 
@@ -622,7 +619,7 @@ static void profile_query_cb(struct aa_profile *profile, struct aa_perms *perms,
                        tmp = aa_compute_fperms(dfa, state, &cond);
                }
        } else if (profile->policy.dfa) {
-               if (!PROFILE_MEDIATES_SAFE(profile, *match_str))
+               if (!PROFILE_MEDIATES(profile, *match_str))
                        return; /* no change to current perms */
                dfa = profile->policy.dfa;
                state = aa_dfa_match_len(dfa, profile->policy.start[0],
@@ -1189,9 +1186,7 @@ static int seq_ns_level_show(struct seq_file *seq, void *v)
 static int seq_ns_name_show(struct seq_file *seq, void *v)
 {
        struct aa_label *label = begin_current_label_crit_section();
-
-       seq_printf(seq, "%s\n", aa_ns_name(labels_ns(label),
-                                          labels_ns(label), true));
+       seq_printf(seq, "%s\n", labels_ns(label)->base.name);
        end_current_label_crit_section(label);
 
        return 0;
@@ -2152,6 +2147,10 @@ static struct aa_sfs_entry aa_sfs_entry_signal[] = {
        { }
 };
 
+static struct aa_sfs_entry aa_sfs_entry_attach[] = {
+       AA_SFS_FILE_BOOLEAN("xattr", 1),
+       { }
+};
 static struct aa_sfs_entry aa_sfs_entry_domain[] = {
        AA_SFS_FILE_BOOLEAN("change_hat",       1),
        AA_SFS_FILE_BOOLEAN("change_hatv",      1),
@@ -2159,6 +2158,9 @@ static struct aa_sfs_entry aa_sfs_entry_domain[] = {
        AA_SFS_FILE_BOOLEAN("change_profile",   1),
        AA_SFS_FILE_BOOLEAN("stack",            1),
        AA_SFS_FILE_BOOLEAN("fix_binfmt_elf_mmap",      1),
+       AA_SFS_FILE_BOOLEAN("post_nnp_subset",  1),
+       AA_SFS_FILE_BOOLEAN("computed_longest_left",    1),
+       AA_SFS_DIR("attach_conditions",         aa_sfs_entry_attach),
        AA_SFS_FILE_STRING("version", "1.2"),
        { }
 };
@@ -2167,6 +2169,7 @@ static struct aa_sfs_entry aa_sfs_entry_versions[] = {
        AA_SFS_FILE_BOOLEAN("v5",       1),
        AA_SFS_FILE_BOOLEAN("v6",       1),
        AA_SFS_FILE_BOOLEAN("v7",       1),
+       AA_SFS_FILE_BOOLEAN("v8",       1),
        { }
 };
 
@@ -2202,6 +2205,7 @@ static struct aa_sfs_entry aa_sfs_entry_features[] = {
        AA_SFS_DIR("policy",                    aa_sfs_entry_policy),
        AA_SFS_DIR("domain",                    aa_sfs_entry_domain),
        AA_SFS_DIR("file",                      aa_sfs_entry_file),
+       AA_SFS_DIR("network_v8",                aa_sfs_entry_network),
        AA_SFS_DIR("mount",                     aa_sfs_entry_mount),
        AA_SFS_DIR("namespaces",                aa_sfs_entry_ns),
        AA_SFS_FILE_U64("capability",           VFS_CAP_FLAGS_MASK),
@@ -2394,29 +2398,18 @@ static const char *policy_get_link(struct dentry *dentry,
        return NULL;
 }
 
-static int ns_get_name(char *buf, size_t size, struct aa_ns *ns,
-                      struct inode *inode)
-{
-       int res = snprintf(buf, size, "%s:[%lu]", AAFS_NAME, inode->i_ino);
-
-       if (res < 0 || res >= size)
-               res = -ENOENT;
-
-       return res;
-}
-
 static int policy_readlink(struct dentry *dentry, char __user *buffer,
                           int buflen)
 {
-       struct aa_ns *ns;
        char name[32];
        int res;
 
-       ns = aa_get_current_ns();
-       res = ns_get_name(name, sizeof(name), ns, d_inode(dentry));
-       if (res >= 0)
+       res = snprintf(name, sizeof(name), "%s:[%lu]", AAFS_NAME,
+                      d_inode(dentry)->i_ino);
+       if (res > 0 && res < sizeof(name))
                res = readlink_copy(buffer, buflen, name);
-       aa_put_ns(ns);
+       else
+               res = -ENOENT;
 
        return res;
 }
@@ -2460,34 +2453,26 @@ static int __init aa_create_aafs(void)
 
        dent = securityfs_create_file(".load", 0666, aa_sfs_entry.dentry,
                                      NULL, &aa_fs_profile_load);
-       if (IS_ERR(dent)) {
-               error = PTR_ERR(dent);
-               goto error;
-       }
+       if (IS_ERR(dent))
+               goto dent_error;
        ns_subload(root_ns) = dent;
 
        dent = securityfs_create_file(".replace", 0666, aa_sfs_entry.dentry,
                                      NULL, &aa_fs_profile_replace);
-       if (IS_ERR(dent)) {
-               error = PTR_ERR(dent);
-               goto error;
-       }
+       if (IS_ERR(dent))
+               goto dent_error;
        ns_subreplace(root_ns) = dent;
 
        dent = securityfs_create_file(".remove", 0666, aa_sfs_entry.dentry,
                                      NULL, &aa_fs_profile_remove);
-       if (IS_ERR(dent)) {
-               error = PTR_ERR(dent);
-               goto error;
-       }
+       if (IS_ERR(dent))
+               goto dent_error;
        ns_subremove(root_ns) = dent;
 
        dent = securityfs_create_file("revision", 0444, aa_sfs_entry.dentry,
                                      NULL, &aa_fs_ns_revision_fops);
-       if (IS_ERR(dent)) {
-               error = PTR_ERR(dent);
-               goto error;
-       }
+       if (IS_ERR(dent))
+               goto dent_error;
        ns_subrevision(root_ns) = dent;
 
        /* policy tree referenced by magic policy symlink */
@@ -2501,10 +2486,8 @@ static int __init aa_create_aafs(void)
        /* magic symlink similar to nsfs redirects based on task policy */
        dent = securityfs_create_symlink("policy", aa_sfs_entry.dentry,
                                         NULL, &policy_link_iops);
-       if (IS_ERR(dent)) {
-               error = PTR_ERR(dent);
-               goto error;
-       }
+       if (IS_ERR(dent))
+               goto dent_error;
 
        error = aa_mk_null_file(aa_sfs_entry.dentry);
        if (error)
@@ -2516,6 +2499,8 @@ static int __init aa_create_aafs(void)
        aa_info_message("AppArmor Filesystem Enabled");
        return 0;
 
+dent_error:
+       error = PTR_ERR(dent);
 error:
        aa_destroy_aafs();
        AA_ERROR("Error creating AppArmor securityfs\n");