apparmor: refactor profile rules and attachments

[linux-2.6-microblaze.git] / security / apparmor / label.c

diff --git a/security/apparmor/label.c b/security/apparmor/label.c
index 3a96700..98dadd9 100644 (file)
--- a/security/apparmor/label.c
+++ b/security/apparmor/label.c
@@ -1266,20 +1266,21 @@ static inline bool label_is_visible(struct aa_profile *profile,
  * visibility test.
  */
 static inline aa_state_t match_component(struct aa_profile *profile,
+                                        struct aa_ruleset *rules,
                                         struct aa_profile *tp,
                                         aa_state_t state)
 {
        const char *ns_name;
 
        if (profile->ns == tp->ns)
-               return aa_dfa_match(profile->policy.dfa, state, tp->base.hname);
+               return aa_dfa_match(rules->policy.dfa, state, tp->base.hname);
 
        /* try matching with namespace name and then profile */
        ns_name = aa_ns_name(profile->ns, tp->ns, true);
-       state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1);
-       state = aa_dfa_match(profile->policy.dfa, state, ns_name);
-       state = aa_dfa_match_len(profile->policy.dfa, state, ":", 1);
-       return aa_dfa_match(profile->policy.dfa, state, tp->base.hname);
+       state = aa_dfa_match_len(rules->policy.dfa, state, ":", 1);
+       state = aa_dfa_match(rules->policy.dfa, state, ns_name);
+       state = aa_dfa_match_len(rules->policy.dfa, state, ":", 1);
+       return aa_dfa_match(rules->policy.dfa, state, tp->base.hname);
 }
 
 /**
@@ -1298,6 +1299,7 @@ static inline aa_state_t match_component(struct aa_profile *profile,
  *        check to be stacked.
  */
 static int label_compound_match(struct aa_profile *profile,
+                               struct aa_ruleset *rules,
                                struct aa_label *label,
                                aa_state_t state, bool subns, u32 request,
                                struct aa_perms *perms)
@@ -1309,7 +1311,7 @@ static int label_compound_match(struct aa_profile *profile,
        label_for_each(i, label, tp) {
                if (!aa_ns_visible(profile->ns, tp->ns, subns))
                        continue;
-               state = match_component(profile, tp, state);
+               state = match_component(profile, rules, tp, state);
                if (!state)
                        goto fail;
                goto next;
@@ -1323,12 +1325,12 @@ next:
        label_for_each_cont(i, label, tp) {
                if (!aa_ns_visible(profile->ns, tp->ns, subns))
                        continue;
-               state = aa_dfa_match(profile->policy.dfa, state, "//&");
-               state = match_component(profile, tp, state);
+               state = aa_dfa_match(rules->policy.dfa, state, "//&");
+               state = match_component(profile, rules, tp, state);
                if (!state)
                        goto fail;
        }
-       *perms = *aa_lookup_perms(&profile->policy, state);
+       *perms = *aa_lookup_perms(&rules->policy, state);
        aa_apply_modes_to_perms(profile, perms);
        if ((perms->allow & request) != request)
                return -EACCES;
@@ -1343,6 +1345,7 @@ fail:
 /**
  * label_components_match - find perms for all subcomponents of a label
  * @profile: profile to find perms for
+ * @rules: ruleset to search
  * @label: label to check access permissions for
  * @start: state to start match in
  * @subns: whether to do permission checks on components in a subns
@@ -1356,6 +1359,7 @@ fail:
  *        check to be stacked.
  */
 static int label_components_match(struct aa_profile *profile,
+                                 struct aa_ruleset *rules,
                                  struct aa_label *label, aa_state_t start,
                                  bool subns, u32 request,
                                  struct aa_perms *perms)
@@ -1369,7 +1373,7 @@ static int label_components_match(struct aa_profile *profile,
        label_for_each(i, label, tp) {
                if (!aa_ns_visible(profile->ns, tp->ns, subns))
                        continue;
-               state = match_component(profile, tp, start);
+               state = match_component(profile, rules, tp, start);
                if (!state)
                        goto fail;
                goto next;
@@ -1379,16 +1383,16 @@ static int label_components_match(struct aa_profile *profile,
        return 0;
 
 next:
-       tmp = *aa_lookup_perms(&profile->policy, state);
+       tmp = *aa_lookup_perms(&rules->policy, state);
        aa_apply_modes_to_perms(profile, &tmp);
        aa_perms_accum(perms, &tmp);
        label_for_each_cont(i, label, tp) {
                if (!aa_ns_visible(profile->ns, tp->ns, subns))
                        continue;
-               state = match_component(profile, tp, start);
+               state = match_component(profile, rules, tp, start);
                if (!state)
                        goto fail;
-               tmp = *aa_lookup_perms(&profile->policy, state);
+               tmp = *aa_lookup_perms(&rules->policy, state);
                aa_apply_modes_to_perms(profile, &tmp);
                aa_perms_accum(perms, &tmp);
        }
@@ -1406,6 +1410,7 @@ fail:
 /**
  * aa_label_match - do a multi-component label match
  * @profile: profile to match against (NOT NULL)
+ * @rules: ruleset to search
  * @label: label to match (NOT NULL)
  * @state: state to start in
  * @subns: whether to match subns components
@@ -1414,18 +1419,18 @@ fail:
  *
  * Returns: the state the match finished in, may be the none matching state
  */
-int aa_label_match(struct aa_profile *profile, struct aa_label *label,
-                  aa_state_t state, bool subns, u32 request,
-                  struct aa_perms *perms)
+int aa_label_match(struct aa_profile *profile, struct aa_ruleset *rules,
+                  struct aa_label *label, aa_state_t state, bool subns,
+                  u32 request, struct aa_perms *perms)
 {
-       int error = label_compound_match(profile, label, state, subns, request,
-                                        perms);
+       int error = label_compound_match(profile, rules, label, state, subns,
+                                        request, perms);
        if (!error)
                return error;
 
        *perms = allperms;
-       return label_components_match(profile, label, state, subns, request,
-                                     perms);
+       return label_components_match(profile, rules, label, state, subns,
+                                     request, perms);
 }