提交 9acd494b 编写于 作者: K Kees Cook 提交者: John Johansen

AppArmor: refactor securityfs to use structures

Use a file tree structure to represent the AppArmor securityfs.
Signed-off-by: NKees Cook <kees@ubuntu.com>
Signed-off-by: NJohn Johansen <john.johansen@canonical.com>
上级 b0d5de4d
...@@ -144,36 +144,103 @@ static const struct file_operations aa_fs_profile_remove = { ...@@ -144,36 +144,103 @@ static const struct file_operations aa_fs_profile_remove = {
/** Base file system setup **/ /** Base file system setup **/
static struct dentry *aa_fs_dentry __initdata; static struct aa_fs_entry aa_fs_entry_apparmor[] = {
AA_FS_FILE_FOPS(".load", 0640, &aa_fs_profile_load),
AA_FS_FILE_FOPS(".replace", 0640, &aa_fs_profile_replace),
AA_FS_FILE_FOPS(".remove", 0640, &aa_fs_profile_remove),
{ }
};
static void __init aafs_remove(const char *name) static struct aa_fs_entry aa_fs_entry =
{ AA_FS_DIR("apparmor", aa_fs_entry_apparmor);
struct dentry *dentry;
dentry = lookup_one_len(name, aa_fs_dentry, strlen(name)); /**
if (!IS_ERR(dentry)) { * aafs_create_file - create a file entry in the apparmor securityfs
securityfs_remove(dentry); * @fs_file: aa_fs_entry to build an entry for (NOT NULL)
dput(dentry); * @parent: the parent dentry in the securityfs
*
* Use aafs_remove_file to remove entries created with this fn.
*/
static int __init aafs_create_file(struct aa_fs_entry *fs_file,
struct dentry *parent)
{
int error = 0;
fs_file->dentry = securityfs_create_file(fs_file->name,
S_IFREG | fs_file->mode,
parent, fs_file,
fs_file->file_ops);
if (IS_ERR(fs_file->dentry)) {
error = PTR_ERR(fs_file->dentry);
fs_file->dentry = NULL;
} }
return error;
} }
/** /**
* aafs_create - create an entry in the apparmor filesystem * aafs_create_dir - recursively create a directory entry in the securityfs
* @name: name of the entry (NOT NULL) * @fs_dir: aa_fs_entry (and all child entries) to build (NOT NULL)
* @mask: file permission mask of the file * @parent: the parent dentry in the securityfs
* @fops: file operations for the file (NOT NULL)
* *
* Used aafs_remove to remove entries created with this fn. * Use aafs_remove_dir to remove entries created with this fn.
*/ */
static int __init aafs_create(const char *name, umode_t mask, static int __init aafs_create_dir(struct aa_fs_entry *fs_dir,
const struct file_operations *fops) struct dentry *parent)
{ {
struct dentry *dentry; int error;
struct aa_fs_entry *fs_file;
dentry = securityfs_create_file(name, S_IFREG | mask, aa_fs_dentry, fs_dir->dentry = securityfs_create_dir(fs_dir->name, parent);
NULL, fops); if (IS_ERR(fs_dir->dentry)) {
error = PTR_ERR(fs_dir->dentry);
fs_dir->dentry = NULL;
goto failed;
}
return IS_ERR(dentry) ? PTR_ERR(dentry) : 0; for (fs_file = fs_dir->v.files; fs_file->name; ++fs_file) {
if (fs_file->v_type == AA_FS_TYPE_DIR)
error = aafs_create_dir(fs_file, fs_dir->dentry);
else
error = aafs_create_file(fs_file, fs_dir->dentry);
if (error)
goto failed;
}
return 0;
failed:
return error;
}
/**
* aafs_remove_file - drop a single file entry in the apparmor securityfs
* @fs_file: aa_fs_entry to detach from the securityfs (NOT NULL)
*/
static void __init aafs_remove_file(struct aa_fs_entry *fs_file)
{
if (!fs_file->dentry)
return;
securityfs_remove(fs_file->dentry);
fs_file->dentry = NULL;
}
/**
* aafs_remove_dir - recursively drop a directory entry from the securityfs
* @fs_dir: aa_fs_entry (and all child entries) to detach (NOT NULL)
*/
static void __init aafs_remove_dir(struct aa_fs_entry *fs_dir)
{
struct aa_fs_entry *fs_file;
for (fs_file = fs_dir->v.files; fs_file->name; ++fs_file) {
if (fs_file->v_type == AA_FS_TYPE_DIR)
aafs_remove_dir(fs_file);
else
aafs_remove_file(fs_file);
}
aafs_remove_file(fs_dir);
} }
/** /**
...@@ -183,14 +250,7 @@ static int __init aafs_create(const char *name, umode_t mask, ...@@ -183,14 +250,7 @@ static int __init aafs_create(const char *name, umode_t mask,
*/ */
void __init aa_destroy_aafs(void) void __init aa_destroy_aafs(void)
{ {
if (aa_fs_dentry) { aafs_remove_dir(&aa_fs_entry);
aafs_remove(".remove");
aafs_remove(".replace");
aafs_remove(".load");
securityfs_remove(aa_fs_dentry);
aa_fs_dentry = NULL;
}
} }
/** /**
...@@ -207,25 +267,13 @@ static int __init aa_create_aafs(void) ...@@ -207,25 +267,13 @@ static int __init aa_create_aafs(void)
if (!apparmor_initialized) if (!apparmor_initialized)
return 0; return 0;
if (aa_fs_dentry) { if (aa_fs_entry.dentry) {
AA_ERROR("%s: AppArmor securityfs already exists\n", __func__); AA_ERROR("%s: AppArmor securityfs already exists\n", __func__);
return -EEXIST; return -EEXIST;
} }
aa_fs_dentry = securityfs_create_dir("apparmor", NULL); /* Populate fs tree. */
if (IS_ERR(aa_fs_dentry)) { error = aafs_create_dir(&aa_fs_entry, NULL);
error = PTR_ERR(aa_fs_dentry);
aa_fs_dentry = NULL;
goto error;
}
error = aafs_create(".load", 0640, &aa_fs_profile_load);
if (error)
goto error;
error = aafs_create(".replace", 0640, &aa_fs_profile_replace);
if (error)
goto error;
error = aafs_create(".remove", 0640, &aa_fs_profile_remove);
if (error) if (error)
goto error; goto error;
......
...@@ -15,6 +15,30 @@ ...@@ -15,6 +15,30 @@
#ifndef __AA_APPARMORFS_H #ifndef __AA_APPARMORFS_H
#define __AA_APPARMORFS_H #define __AA_APPARMORFS_H
enum aa_fs_type {
AA_FS_TYPE_FOPS,
AA_FS_TYPE_DIR,
};
struct aa_fs_entry;
struct aa_fs_entry {
const char *name;
struct dentry *dentry;
umode_t mode;
enum aa_fs_type v_type;
union {
struct aa_fs_entry *files;
} v;
const struct file_operations *file_ops;
};
#define AA_FS_FILE_FOPS(_name, _mode, _fops) \
{ .name = (_name), .v_type = AA_FS_TYPE_FOPS, \
.mode = (_mode), .file_ops = (_fops) }
#define AA_FS_DIR(_name, _value) \
{ .name = (_name), .v_type = AA_FS_TYPE_DIR, .v.files = (_value) }
extern void __init aa_destroy_aafs(void); extern void __init aa_destroy_aafs(void);
#endif /* __AA_APPARMORFS_H */ #endif /* __AA_APPARMORFS_H */
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册