[v29,28/28] AppArmor: Remove the exclusive flag

Message ID	20210924175441.7943-29-casey@schaufler-ca.com (mailing list archive)
State	Superseded
Delegated to:	Paul Moore
Headers	show Return-Path: <selinux-owner@kernel.org> From: Casey Schaufler <casey@schaufler-ca.com> To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: casey@schaufler-ca.com, linux-audit@redhat.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com, sds@tycho.nsa.gov, linux-kernel@vger.kernel.org, Stephen Smalley <stephen.smalley.work@gmail.com> Subject: [PATCH v29 28/28] AppArmor: Remove the exclusive flag Date: Fri, 24 Sep 2021 10:54:41 -0700 Message-Id: <20210924175441.7943-29-casey@schaufler-ca.com> In-Reply-To: <20210924175441.7943-1-casey@schaufler-ca.com> References: <20210924175441.7943-1-casey@schaufler-ca.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	[v29,01/28] LSM: Infrastructure management of the sock security \| expand [v29,01/28] LSM: Infrastructure management of the sock security [v29,02/28] LSM: Add the lsmblob data structure. [v29,03/28] LSM: provide lsm name and id slot mappings [v29,04/28] IMA: avoid label collisions with stacked LSMs [v29,05/28] LSM: Use lsmblob in security_audit_rule_match [v29,06/28] LSM: Use lsmblob in security_kernel_act_as [v29,07/28] LSM: Use lsmblob in security_secctx_to_secid [v29,08/28] LSM: Use lsmblob in security_secid_to_secctx [v29,09/28] LSM: Use lsmblob in security_ipc_getsecid [v29,10/28] LSM: Use lsmblob in security_task_getsecid [v29,11/28] LSM: Use lsmblob in security_inode_getsecid [v29,12/28] LSM: Use lsmblob in security_cred_getsecid [v29,13/28] IMA: Change internal interfaces to use lsmblobs [v29,14/28] LSM: Specify which LSM to display [v29,15/28] LSM: Ensure the correct LSM context releaser [v29,16/28] LSM: Use lsmcontext in security_secid_to_secctx [v29,17/28] LSM: Use lsmcontext in security_inode_getsecctx [v29,18/28] LSM: security_secid_to_secctx in netlink netfilter [v29,19/28] NET: Store LSM netlabel data in a lsmblob [v29,20/28] LSM: Verify LSM display sanity in binder [v29,21/28] LSM: Extend security_secid_to_secctx to include module selection [v29,22/28] Audit: Keep multiple LSM data in audit_names [v29,23/28] Audit: Create audit_stamp structure [v29,24/28] Audit: Add framework for auxiliary records [v29,25/28] Audit: Add record for multiple task security contexts [v29,26/28] Audit: Add record for multiple object security contexts [v29,27/28] LSM: Add /proc attr entry for full LSM context [v29,28/28] AppArmor: Remove the exclusive flag

Message ID

20210924175441.7943-29-casey@schaufler-ca.com (mailing list archive)

State

Superseded

Delegated to:

Paul Moore

Headers

From: Casey Schaufler <casey@schaufler-ca.com>
To: casey.schaufler@intel.com, jmorris@namei.org,
        linux-security-module@vger.kernel.org, selinux@vger.kernel.org
Cc: casey@schaufler-ca.com, linux-audit@redhat.com,
        keescook@chromium.org, john.johansen@canonical.com,
        penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com,
        sds@tycho.nsa.gov, linux-kernel@vger.kernel.org,
        Stephen Smalley <stephen.smalley.work@gmail.com>
Subject: [PATCH v29 28/28] AppArmor: Remove the exclusive flag
Date: Fri, 24 Sep 2021 10:54:41 -0700
Message-Id: <20210924175441.7943-29-casey@schaufler-ca.com>
In-Reply-To: <20210924175441.7943-1-casey@schaufler-ca.com>
References: <20210924175441.7943-1-casey@schaufler-ca.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

Series

[v29,01/28] LSM: Infrastructure management of the sock security | expand

Commit Message

Casey Schaufler Sept. 24, 2021, 5:54 p.m. UTC

With the inclusion of the interface LSM process attribute
mechanism AppArmor no longer needs to be treated as an
"exclusive" security module. Remove the flag that indicates
it is exclusive. Remove the stub getpeersec_dgram AppArmor
hook as it has no effect in the single LSM case and
interferes in the multiple LSM case.

Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
---
 security/apparmor/lsm.c | 20 +-------------------
 1 file changed, 1 insertion(+), 19 deletions(-)

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 65a004597e53..15af5a5cb0c0 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -1138,22 +1138,6 @@  static int apparmor_socket_getpeersec_stream(struct socket *sock,
 	return error;
 }
 
-/**
- * apparmor_socket_getpeersec_dgram - get security label of packet
- * @sock: the peer socket
- * @skb: packet data
- * @secid: pointer to where to put the secid of the packet
- *
- * Sets the netlabel socket state on sk from parent
- */
-static int apparmor_socket_getpeersec_dgram(struct socket *sock,
-					    struct sk_buff *skb, u32 *secid)
-
-{
-	/* TODO: requires secid support */
-	return -ENOPROTOOPT;
-}
-
 /**
  * apparmor_sock_graft - Initialize newly created socket
  * @sk: child sock
@@ -1257,8 +1241,6 @@  static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
 #endif
 	LSM_HOOK_INIT(socket_getpeersec_stream,
 		      apparmor_socket_getpeersec_stream),
-	LSM_HOOK_INIT(socket_getpeersec_dgram,
-		      apparmor_socket_getpeersec_dgram),
 	LSM_HOOK_INIT(sock_graft, apparmor_sock_graft),
 #ifdef CONFIG_NETWORK_SECMARK
 	LSM_HOOK_INIT(inet_conn_request, apparmor_inet_conn_request),
@@ -1928,7 +1910,7 @@  static int __init apparmor_init(void)
 
 DEFINE_LSM(apparmor) = {
 	.name = "apparmor",
-	.flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
+	.flags = LSM_FLAG_LEGACY_MAJOR,
 	.enabled = &apparmor_enabled,
 	.blobs = &apparmor_blob_sizes,
 	.init = apparmor_init,

[v29,28/28] AppArmor: Remove the exclusive flag

Commit Message

Patch