From: "Eric W. Biederman" <ebiederm@xmission.com>
To: <linux-security-module@vger.kernel.org>
Cc: <linux-kernel@vger.kernel.org>, Serge Hallyn <serge@hallyn.com>,
Linux Containers <containers@lists.linux-foundation.org>,
"Eric W. Biederman" <ebiederm@xmission.com>,
John Johansen <john.johansen@canonical.com>
Subject: [PATCH 02/14] userns: Convert apparmor to use kuid and kgid where appropriate
Date: Thu, 20 Sep 2012 17:28:38 -0700 [thread overview]
Message-ID: <1348187330-6616-2-git-send-email-ebiederm@xmission.com> (raw)
In-Reply-To: <1348187330-6616-1-git-send-email-ebiederm@xmission.com>
From: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: John Johansen <john.johansen@canonical.com>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
---
init/Kconfig | 1 -
security/apparmor/domain.c | 4 ++--
security/apparmor/file.c | 12 +++++++-----
security/apparmor/include/audit.h | 2 +-
security/apparmor/include/file.h | 4 ++--
5 files changed, 12 insertions(+), 11 deletions(-)
diff --git a/init/Kconfig b/init/Kconfig
index f315997..637faf8 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -964,7 +964,6 @@ config UIDGID_CONVERTED
# Security modules
depends on SECURITY_TOMOYO = n
- depends on SECURITY_APPARMOR = n
config UIDGID_STRICT_TYPE_CHECKS
bool "Require conversions between uid/gids and their internal representation"
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index b81ea10..60f0c76 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -721,7 +721,7 @@ audit:
if (!permtest)
error = aa_audit_file(profile, &perms, GFP_KERNEL,
OP_CHANGE_HAT, AA_MAY_CHANGEHAT, NULL,
- target, 0, info, error);
+ target, GLOBAL_ROOT_UID, info, error);
out:
aa_put_profile(hat);
@@ -848,7 +848,7 @@ int aa_change_profile(const char *ns_name, const char *hname, bool onexec,
audit:
if (!permtest)
error = aa_audit_file(profile, &perms, GFP_KERNEL, op, request,
- name, hname, 0, info, error);
+ name, hname, GLOBAL_ROOT_UID, info, error);
aa_put_namespace(ns);
aa_put_profile(target);
diff --git a/security/apparmor/file.c b/security/apparmor/file.c
index cf19d40..cd21ec5 100644
--- a/security/apparmor/file.c
+++ b/security/apparmor/file.c
@@ -65,7 +65,7 @@ static void audit_file_mask(struct audit_buffer *ab, u32 mask)
static void file_audit_cb(struct audit_buffer *ab, void *va)
{
struct common_audit_data *sa = va;
- uid_t fsuid = current_fsuid();
+ kuid_t fsuid = current_fsuid();
if (sa->aad->fs.request & AA_AUDIT_FILE_MASK) {
audit_log_format(ab, " requested_mask=");
@@ -76,8 +76,10 @@ static void file_audit_cb(struct audit_buffer *ab, void *va)
audit_file_mask(ab, sa->aad->fs.denied);
}
if (sa->aad->fs.request & AA_AUDIT_FILE_MASK) {
- audit_log_format(ab, " fsuid=%d", fsuid);
- audit_log_format(ab, " ouid=%d", sa->aad->fs.ouid);
+ audit_log_format(ab, " fsuid=%d",
+ from_kuid(&init_user_ns, fsuid));
+ audit_log_format(ab, " ouid=%d",
+ from_kuid(&init_user_ns, sa->aad->fs.ouid));
}
if (sa->aad->fs.target) {
@@ -103,7 +105,7 @@ static void file_audit_cb(struct audit_buffer *ab, void *va)
*/
int aa_audit_file(struct aa_profile *profile, struct file_perms *perms,
gfp_t gfp, int op, u32 request, const char *name,
- const char *target, uid_t ouid, const char *info, int error)
+ const char *target, kuid_t ouid, const char *info, int error)
{
int type = AUDIT_APPARMOR_AUTO;
struct common_audit_data sa;
@@ -201,7 +203,7 @@ static struct file_perms compute_perms(struct aa_dfa *dfa, unsigned int state,
*/
perms.kill = 0;
- if (current_fsuid() == cond->uid) {
+ if (uid_eq(current_fsuid(), cond->uid)) {
perms.allow = map_old_perms(dfa_user_allow(dfa, state));
perms.audit = map_old_perms(dfa_user_audit(dfa, state));
perms.quiet = map_old_perms(dfa_user_quiet(dfa, state));
diff --git a/security/apparmor/include/audit.h b/security/apparmor/include/audit.h
index 4b7e189..69d8cae 100644
--- a/security/apparmor/include/audit.h
+++ b/security/apparmor/include/audit.h
@@ -125,7 +125,7 @@ struct apparmor_audit_data {
const char *target;
u32 request;
u32 denied;
- uid_t ouid;
+ kuid_t ouid;
} fs;
};
};
diff --git a/security/apparmor/include/file.h b/security/apparmor/include/file.h
index f98fd47..967b2de 100644
--- a/security/apparmor/include/file.h
+++ b/security/apparmor/include/file.h
@@ -71,7 +71,7 @@ struct path;
/* need to make conditional which ones are being set */
struct path_cond {
- uid_t uid;
+ kuid_t uid;
umode_t mode;
};
@@ -146,7 +146,7 @@ static inline u16 dfa_map_xindex(u16 mask)
int aa_audit_file(struct aa_profile *profile, struct file_perms *perms,
gfp_t gfp, int op, u32 request, const char *name,
- const char *target, uid_t ouid, const char *info, int error);
+ const char *target, kuid_t ouid, const char *info, int error);
/**
* struct aa_file_rules - components used for file rule permissions
--
1.7.5.4
next prev parent reply other threads:[~2012-09-21 0:29 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-09-21 0:26 [REVIEW][PATCH 00/14] userns: Miscelanous conversions Eric W. Biederman
2012-09-21 0:28 ` [PATCH 01/14] userns: Convert loop to use kuid_t instead of uid_t Eric W. Biederman
2012-09-21 0:28 ` Eric W. Biederman [this message]
2012-09-21 0:28 ` [PATCH 03/14] userns: Convert tomoyo to use kuid and kgid where appropriate Eric W. Biederman
2012-09-21 0:28 ` [PATCH 04/14] userns: Convert selinux " Eric W. Biederman
2012-09-26 17:51 ` Serge Hallyn
2012-09-21 0:28 ` [PATCH 05/14] userns: Convert hostfs " Eric W. Biederman
2012-09-23 21:59 ` Richard Weinberger
2012-09-24 2:39 ` Eric W. Biederman
2012-09-24 14:55 ` Serge Hallyn
2012-09-21 0:28 ` [PATCH 06/14] userns: Convert EVM to deal with kuids and kgids in it's hmac computation Eric W. Biederman
2012-09-21 0:28 ` [PATCH 07/14] userns: Add user namespace support to IMA Eric W. Biederman
2012-09-21 0:28 ` [PATCH 08/14] userns: Teach security_path_chown to take kuids and kgids Eric W. Biederman
2012-09-21 0:28 ` [PATCH 09/14] userns: Convert binder ipc to use kuids Eric W. Biederman
2012-09-21 6:44 ` Greg Kroah-Hartman
2012-09-21 0:28 ` [PATCH 10/14] userns: Convert s390 hypfs to use kuid and kgid where appropriate Eric W. Biederman
2012-09-26 17:52 ` Serge Hallyn
2012-09-21 0:28 ` [PATCH 11/14] userns: Convert s390 getting uid and gid system calls to use kuid and kgid Eric W. Biederman
2012-09-26 17:59 ` Serge Hallyn
2012-09-21 0:28 ` [PATCH 12/14] userns: On ppc convert current_uid from a kuid before printing Eric W. Biederman
2012-09-26 17:56 ` Serge Hallyn
2012-09-21 0:28 ` [PATCH 13/14] userns: On ia64 deal with current_uid and current_gid being kuid and kgid Eric W. Biederman
2012-09-26 17:55 ` Serge Hallyn
2012-09-21 0:28 ` [PATCH 14/14] userns: On alpha modify linux_to_osf_stat to use convert from kuids and kgids Eric W. Biederman
2012-09-21 6:07 ` [PATCH 01/14] userns: Convert loop to use kuid_t instead of uid_t Jens Axboe
2012-09-21 7:07 ` Eric W. Biederman
2012-09-21 7:11 ` Jens Axboe
2012-09-21 7:19 ` Eric W. Biederman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1348187330-6616-2-git-send-email-ebiederm@xmission.com \
--to=ebiederm@xmission.com \
--cc=containers@lists.linux-foundation.org \
--cc=john.johansen@canonical.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=serge@hallyn.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).