[v27,25/25] AppArmor: Remove the exclusive flag

Message ID	20210611000435.36398-26-casey@schaufler-ca.com (mailing list archive)
State	New, archived
Headers	show Return-Path: <linux-security-module-owner@kernel.org> From: Casey Schaufler <casey@schaufler-ca.com> To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: casey@schaufler-ca.com, linux-audit@redhat.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com, sds@tycho.nsa.gov, linux-kernel@vger.kernel.org Subject: [PATCH v27 25/25] AppArmor: Remove the exclusive flag Date: Thu, 10 Jun 2021 17:04:35 -0700 Message-Id: <20210611000435.36398-26-casey@schaufler-ca.com> In-Reply-To: <20210611000435.36398-1-casey@schaufler-ca.com> References: <20210611000435.36398-1-casey@schaufler-ca.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	LSM: Module stacking for AppArmor \| expand [v27,00/25] LSM: Module stacking for AppArmor [v27,01/25] LSM: Infrastructure management of the sock security [v27,02/25] LSM: Add the lsmblob data structure. [v27,03/25] LSM: provide lsm name and id slot mappings [v27,04/25] IMA: avoid label collisions with stacked LSMs [v27,05/25] LSM: Use lsmblob in security_audit_rule_match [v27,06/25] LSM: Use lsmblob in security_kernel_act_as [v27,07/25] LSM: Use lsmblob in security_secctx_to_secid [v27,08/25] LSM: Use lsmblob in security_secid_to_secctx [v27,09/25] LSM: Use lsmblob in security_ipc_getsecid [v27,10/25] LSM: Use lsmblob in security_task_getsecid [v27,11/25] LSM: Use lsmblob in security_inode_getsecid [v27,12/25] LSM: Use lsmblob in security_cred_getsecid [v27,13/25] IMA: Change internal interfaces to use lsmblobs [v27,14/25] LSM: Specify which LSM to display [v27,15/25] LSM: Ensure the correct LSM context releaser [v27,16/25] LSM: Use lsmcontext in security_secid_to_secctx [v27,17/25] LSM: Use lsmcontext in security_inode_getsecctx [v27,18/25] LSM: security_secid_to_secctx in netlink netfilter [v27,19/25] NET: Store LSM netlabel data in a lsmblob [v27,20/25] LSM: Verify LSM display sanity in binder [v27,21/25] audit: add support for non-syscall auxiliary records [v27,22/25] Audit: Add record for multiple process LSM attributes [v27,23/25] Audit: Add record for multiple object LSM attributes [v27,24/25] LSM: Add /proc attr entry for full LSM context [v27,25/25] AppArmor: Remove the exclusive flag

Message ID

20210611000435.36398-26-casey@schaufler-ca.com (mailing list archive)

State

New, archived

Headers

From: Casey Schaufler <casey@schaufler-ca.com>
To: casey.schaufler@intel.com, jmorris@namei.org,
        linux-security-module@vger.kernel.org, selinux@vger.kernel.org
Cc: casey@schaufler-ca.com, linux-audit@redhat.com,
        keescook@chromium.org, john.johansen@canonical.com,
        penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com,
        sds@tycho.nsa.gov, linux-kernel@vger.kernel.org
Subject: [PATCH v27 25/25] AppArmor: Remove the exclusive flag
Date: Thu, 10 Jun 2021 17:04:35 -0700
Message-Id: <20210611000435.36398-26-casey@schaufler-ca.com>
In-Reply-To: <20210611000435.36398-1-casey@schaufler-ca.com>
References: <20210611000435.36398-1-casey@schaufler-ca.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

Series

LSM: Module stacking for AppArmor | expand

Commit Message

Casey Schaufler June 11, 2021, 12:04 a.m. UTC

With the inclusion of the interface LSM process attribute
mechanism AppArmor no longer needs to be treated as an
"exclusive" security module. Remove the flag that indicates
it is exclusive. Remove the stub getpeersec_dgram AppArmor
hook as it has no effect in the single LSM case and
interferes in the multiple LSM case.

Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: John Johansen <john.johansen@canonical.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
---
 security/apparmor/lsm.c | 20 +-------------------
 1 file changed, 1 insertion(+), 19 deletions(-)

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 65a004597e53..15af5a5cb0c0 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -1138,22 +1138,6 @@  static int apparmor_socket_getpeersec_stream(struct socket *sock,
 	return error;
 }
 
-/**
- * apparmor_socket_getpeersec_dgram - get security label of packet
- * @sock: the peer socket
- * @skb: packet data
- * @secid: pointer to where to put the secid of the packet
- *
- * Sets the netlabel socket state on sk from parent
- */
-static int apparmor_socket_getpeersec_dgram(struct socket *sock,
-					    struct sk_buff *skb, u32 *secid)
-
-{
-	/* TODO: requires secid support */
-	return -ENOPROTOOPT;
-}
-
 /**
  * apparmor_sock_graft - Initialize newly created socket
  * @sk: child sock
@@ -1257,8 +1241,6 @@  static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
 #endif
 	LSM_HOOK_INIT(socket_getpeersec_stream,
 		      apparmor_socket_getpeersec_stream),
-	LSM_HOOK_INIT(socket_getpeersec_dgram,
-		      apparmor_socket_getpeersec_dgram),
 	LSM_HOOK_INIT(sock_graft, apparmor_sock_graft),
 #ifdef CONFIG_NETWORK_SECMARK
 	LSM_HOOK_INIT(inet_conn_request, apparmor_inet_conn_request),
@@ -1928,7 +1910,7 @@  static int __init apparmor_init(void)
 
 DEFINE_LSM(apparmor) = {
 	.name = "apparmor",
-	.flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
+	.flags = LSM_FLAG_LEGACY_MAJOR,
 	.enabled = &apparmor_enabled,
 	.blobs = &apparmor_blob_sizes,
 	.init = apparmor_init,

[v27,25/25] AppArmor: Remove the exclusive flag

Commit Message

Patch