[v11-ima,25/25] AppArmor: Remove the exclusive flag

Message ID	20191127213718.18267-26-casey@schaufler-ca.com (mailing list archive)
State	New, archived
Headers	show Return-Path: <SRS0=jDa8=ZT=vger.kernel.org=linux-integrity-owner@kernel.org> From: Casey Schaufler <casey@schaufler-ca.com> To: linux-integrity@vger.kernel.org, zohar@linux.ibm.com Subject: [v11-ima PATCH 25/25] AppArmor: Remove the exclusive flag Date: Wed, 27 Nov 2019 13:37:18 -0800 Message-Id: <20191127213718.18267-26-casey@schaufler-ca.com> In-Reply-To: <20191127213718.18267-1-casey@schaufler-ca.com> References: <20191127213718.18267-1-casey@schaufler-ca.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk
Series	LSM: Module stacking for AppArmor \| expand [v11-ima,00/25] LSM: Module stacking for AppArmor [v11-ima,01/25] LSM: Infrastructure management of the sock security [v11-ima,02/25] LSM: Create and manage the lsmblob data structure. [v11-ima,03/25] LSM: Use lsmblob in security_audit_rule_match [v11-ima,04/25] LSM: Use lsmblob in security_kernel_act_as [v11-ima,05/25] net: Prepare UDS for security module stacking [v11-ima,06/25] LSM: Use lsmblob in security_secctx_to_secid [v11-ima,07/25] LSM: Use lsmblob in security_secid_to_secctx [v11-ima,08/25] LSM: Use lsmblob in security_ipc_getsecid [v11-ima,09/25] LSM: Use lsmblob in security_task_getsecid [v11-ima,10/25] LSM: Use lsmblob in security_inode_getsecid [v11-ima,11/25] LSM: Use lsmblob in security_cred_getsecid [v11-ima,12/25] IMA: Change internal interfaces to use lsmblobs [v11-ima,13/25] LSM: Specify which LSM to display [v11-ima,14/25] LSM: Ensure the correct LSM context releaser [v11-ima,15/25] LSM: Use lsmcontext in security_secid_to_secctx [v11-ima,16/25] LSM: Use lsmcontext in security_dentry_init_security [v11-ima,17/25] LSM: Use lsmcontext in security_inode_getsecctx [v11-ima,18/25] LSM: security_secid_to_secctx in netlink netfilter [v11-ima,19/25] NET: Store LSM netlabel data in a lsmblob [v11-ima,20/25] LSM: Verify LSM display sanity in binder [v11-ima,21/25] Audit: Add subj_LSM fields when necessary [v11-ima,22/25] Audit: Include object data for all security modules [v11-ima,23/25] NET: Add SO_PEERCONTEXT for multiple LSMs [v11-ima,24/25] LSM: Add /proc attr entry for full LSM context [v11-ima,25/25] AppArmor: Remove the exclusive flag

Message ID

20191127213718.18267-26-casey@schaufler-ca.com (mailing list archive)

State

New, archived

Headers

From: Casey Schaufler <casey@schaufler-ca.com>
To: linux-integrity@vger.kernel.org, zohar@linux.ibm.com
Subject: [v11-ima PATCH 25/25] AppArmor: Remove the exclusive flag
Date: Wed, 27 Nov 2019 13:37:18 -0800
Message-Id: <20191127213718.18267-26-casey@schaufler-ca.com>
In-Reply-To: <20191127213718.18267-1-casey@schaufler-ca.com>
References: <20191127213718.18267-1-casey@schaufler-ca.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: linux-integrity-owner@vger.kernel.org
Precedence: bulk

Series

LSM: Module stacking for AppArmor | expand

Commit Message

Casey Schaufler Nov. 27, 2019, 9:37 p.m. UTC

With the inclusion of the "display" process attribute
mechanism AppArmor no longer needs to be treated as an
"exclusive" security module. Remove the flag that indicates
it is exclusive. Remove the stub getpeersec_dgram AppArmor
hook as it has no effect in the single LSM case and
interferes in the multiple LSM case.

Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
---
 security/apparmor/lsm.c | 20 +-------------------
 1 file changed, 1 insertion(+), 19 deletions(-)

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index b4c964fdc2f9..81bc4f773429 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -1099,22 +1099,6 @@  static int apparmor_socket_getpeersec_stream(struct socket *sock, char **optval,
 	return error;
 }
 
-/**
- * apparmor_socket_getpeersec_dgram - get security label of packet
- * @sock: the peer socket
- * @skb: packet data
- * @secid: pointer to where to put the secid of the packet
- *
- * Sets the netlabel socket state on sk from parent
- */
-static int apparmor_socket_getpeersec_dgram(struct socket *sock,
-					    struct sk_buff *skb, u32 *secid)
-
-{
-	/* TODO: requires secid support */
-	return -ENOPROTOOPT;
-}
-
 /**
  * apparmor_sock_graft - Initialize newly created socket
  * @sk: child sock
@@ -1218,8 +1202,6 @@  static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
 #endif
 	LSM_HOOK_INIT(socket_getpeersec_stream,
 		      apparmor_socket_getpeersec_stream),
-	LSM_HOOK_INIT(socket_getpeersec_dgram,
-		      apparmor_socket_getpeersec_dgram),
 	LSM_HOOK_INIT(sock_graft, apparmor_sock_graft),
 #ifdef CONFIG_NETWORK_SECMARK
 	LSM_HOOK_INIT(inet_conn_request, apparmor_inet_conn_request),
@@ -1777,7 +1759,7 @@  static int __init apparmor_init(void)
 
 DEFINE_LSM(apparmor) = {
 	.name = "apparmor",
-	.flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
+	.flags = LSM_FLAG_LEGACY_MAJOR,
 	.enabled = &apparmor_enabled,
 	.blobs = &apparmor_blob_sizes,
 	.init = apparmor_init,

[v11-ima,25/25] AppArmor: Remove the exclusive flag

Commit Message

Patch