apparmor: remove sid from profiles

The sid is not going to be a direct property of a profile anymore, instead
it will be directly related to the label, and the profile will pickup
a label back reference.

For null-profiles replace the use of sid with a per namespace unique
id.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>

diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
index 95979c431e264c6934b16e5188eb86798973a610..b25491a3046a2a1dd14f16b31828c52d19d5df7e 100644 (file)
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -105,6 +105,7 @@ struct aa_ns_acct {
  * @acct: accounting for the namespace
  * @unconfined: special unconfined profile for the namespace
  * @sub_ns: list of namespaces under the current namespace.
+ * @uniq_null: uniq value used for null learning profiles
  *
  * An aa_namespace defines the set profiles that are searched to determine
  * which profile to attach to a task.  Profiles can not be shared between
@@ -127,6 +128,7 @@ struct aa_namespace {
        struct aa_ns_acct acct;
        struct aa_profile *unconfined;
        struct list_head sub_ns;
+       atomic_t uniq_null;
 };
 
 /* struct aa_policydb - match engine for a policy
@@ -148,7 +150,6 @@ struct aa_policydb {
  * @rename: optional profile name that this profile renamed
  * @xmatch: optional extended matching for unconfined executables names
  * @xmatch_len: xmatch prefix len, used to determine xmatch priority
- * @sid: the unique security id number of this profile
  * @audit: the auditing mode of the profile
  * @mode: the enforcement mode of the profile
  * @flags: flags controlling profile behavior
@@ -184,7 +185,6 @@ struct aa_profile {
 
        struct aa_dfa *xmatch;
        int xmatch_len;
-       u32 sid;
        enum audit_mode audit;
        enum profile_mode mode;
        u32 flags;

diff --git a/security/apparmor/include/sid.h b/security/apparmor/include/sid.h
index 020db35c301026cd9b2e80c7cb934b3039ee1019..513ca0e48965a8a78bf4e6322794b528534fe500 100644 (file)
--- a/security/apparmor/include/sid.h
+++ b/security/apparmor/include/sid.h
@@ -16,7 +16,9 @@
 
 #include <linux/types.h>
 
-struct aa_profile;
+/* sid value that will not be allocated */
+#define AA_SID_INVALID 0
+#define AA_SID_ALLOC AA_SID_INVALID
 
 u32 aa_alloc_sid(void);
 void aa_free_sid(u32 sid);

diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index 813200384d97cfc7f06a76e9b2f6286be7dfa7ab..13fc9efddd5d0d5a827295839cd28990b42059c1 100644 (file)
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -87,7 +87,6 @@
 #include "include/policy.h"
 #include "include/policy_unpack.h"
 #include "include/resource.h"
-#include "include/sid.h"
 
 
 /* root profile namespace */
@@ -292,7 +291,6 @@ static struct aa_namespace *alloc_namespace(const char *prefix,
        if (!ns->unconfined)
                goto fail_unconfined;
 
-       ns->unconfined->sid = aa_alloc_sid();
        ns->unconfined->flags = PFLAG_UNCONFINED | PFLAG_IX_ON_NAME_ERROR |
            PFLAG_IMMUTABLE;
 
@@ -303,6 +301,8 @@ static struct aa_namespace *alloc_namespace(const char *prefix,
         */
        ns->unconfined->ns = aa_get_namespace(ns);
 
+       atomic_set(&ns->uniq_null, 0);
+
        return ns;
 
 fail_unconfined:
@@ -497,7 +497,6 @@ static void __replace_profile(struct aa_profile *old, struct aa_profile *new)
        /* released when @new is freed */
        new->parent = aa_get_profile(old->parent);
        new->ns = aa_get_namespace(old->ns);
-       new->sid = old->sid;
        __list_add_profile(&policy->profiles, new);
        /* inherit children */
        list_for_each_entry_safe(child, tmp, &old->base.profiles, base.list) {
@@ -665,7 +664,7 @@ struct aa_profile *aa_alloc_profile(const char *hname)
  * @hat: true if the null- learning profile is a hat
  *
  * Create a null- complain mode profile used in learning mode.  The name of
- * the profile is unique and follows the format of parent//null-sid.
+ * the profile is unique and follows the format of parent//null-<uniq>.
  *
  * null profiles are added to the profile list but the list does not
  * hold a count on them so that they are automatically released when
@@ -677,20 +676,19 @@ struct aa_profile *aa_new_null_profile(struct aa_profile *parent, int hat)
 {
        struct aa_profile *profile = NULL;
        char *name;
-       u32 sid = aa_alloc_sid();
+       int uniq = atomic_inc_return(&parent->ns->uniq_null);
 
        /* freed below */
        name = kmalloc(strlen(parent->base.hname) + 2 + 7 + 8, GFP_KERNEL);
        if (!name)
                goto fail;
-       sprintf(name, "%s//null-%x", parent->base.hname, sid);
+       sprintf(name, "%s//null-%x", parent->base.hname, uniq);
 
        profile = aa_alloc_profile(name);
        kfree(name);
        if (!profile)
                goto fail;
 
-       profile->sid = sid;
        profile->mode = APPARMOR_COMPLAIN;
        profile->flags = PFLAG_NULL;
        if (hat)
@@ -708,7 +706,6 @@ struct aa_profile *aa_new_null_profile(struct aa_profile *parent, int hat)
        return profile;
 
 fail:
-       aa_free_sid(sid);
        return NULL;
 }
 
@@ -749,7 +746,6 @@ static void free_profile(struct aa_profile *profile)
        aa_free_cap_rules(&profile->caps);
        aa_free_rlimit_rules(&profile->rlimits);
 
-       aa_free_sid(profile->sid);
        aa_put_dfa(profile->xmatch);
        aa_put_dfa(profile->policy.dfa);
 
@@ -972,7 +968,6 @@ static void __add_new_profile(struct aa_namespace *ns, struct aa_policy *policy,
                profile->parent = aa_get_profile((struct aa_profile *) policy);
        __list_add_profile(&policy->profiles, profile);
        /* released on free_profile */
-       profile->sid = aa_alloc_sid();
        profile->ns = aa_get_namespace(ns);
 }
 
@@ -1110,14 +1105,8 @@ audit:
        if (!error) {
                if (rename_profile)
                        __replace_profile(rename_profile, new_profile);
-               if (old_profile) {
-                       /* when there are both rename and old profiles
-                        * inherit old profiles sid
-                        */
-                       if (rename_profile)
-                               aa_free_sid(new_profile->sid);
+               if (old_profile)
                        __replace_profile(old_profile, new_profile);
-               }
                if (!(old_profile || rename_profile))
                        __add_new_profile(ns, policy, new_profile);
        }

diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index ca48a7d8d5b3835d58f3f7c2e3c55803594de05b..6dac7d77cb4d53c1241402d7a267466c31dbb613 100644 (file)
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -27,7 +27,6 @@
 #include "include/match.h"
 #include "include/policy.h"
 #include "include/policy_unpack.h"
-#include "include/sid.h"
 
 /*
  * The AppArmor interface treats data as a type byte followed by the