[27/27] AppArmor: Remove the exclusive flag

Message ID	20190726233923.2570-28-casey@schaufler-ca.com (mailing list archive)
State	Superseded
Headers	show Return-Path: <selinux-owner@kernel.org> From: Casey Schaufler <casey@schaufler-ca.com> To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: casey@schaufler-ca.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com, sds@tycho.nsa.gov Subject: [PATCH 27/27] AppArmor: Remove the exclusive flag Date: Fri, 26 Jul 2019 16:39:23 -0700 Message-Id: <20190726233923.2570-28-casey@schaufler-ca.com> In-Reply-To: <20190726233923.2570-1-casey@schaufler-ca.com> References: <20190726233923.2570-1-casey@schaufler-ca.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: selinux-owner@vger.kernel.org Precedence: bulk
Series	LSM: Module stacking for AppArmor \| expand [v5,00/27] LSM: Module stacking for AppArmor [01/27] LSM: Infrastructure management of the sock security [02/27] LSM: Infrastructure management of the key blob [03/27] LSM: Create and manage the lsmblob data structure. [04/27] LSM: Use lsmblob in security_audit_rule_match [05/27] LSM: Use lsmblob in security_kernel_act_as [06/27] net: Prepare UDS for security module stacking [07/27] LSM: Use lsmblob in security_secctx_to_secid [08/27] LSM: Use lsmblob in security_secid_to_secctx [09/27] LSM: Use lsmblob in security_ipc_getsecid [10/27] LSM: Use lsmblob in security_task_getsecid [11/27] LSM: Use lsmblob in security_inode_getsecid [12/27] LSM: Use lsmblob in security_cred_getsecid [13/27] IMA: Change internal interfaces to use lsmblobs [14/27] LSM: Specify which LSM to display [15/27] LSM: Ensure the correct LSM context releaser [16/27] LSM: Use lsmcontext in security_secid_to_secctx [17/27] LSM: Use lsmcontext in security_dentry_init_security [18/27] LSM: Use lsmcontext in security_inode_getsecctx [19/27] LSM: security_secid_to_secctx in netlink netfilter [20/27] NET: Store LSM netlabel data in a lsmblob [21/27] SELinux: Verify LSM display sanity in binder [22/27] Audit: Add subj_LSM fields when necessary [23/27] Audit: Include object data for all security modules [24/27] LSM: Provide an user space interface for the default display [25/27] NET: Add SO_PEERCONTEXT for multiple LSMs [26/27] LSM: Add /proc attr entry for full LSM context [27/27] AppArmor: Remove the exclusive flag

Message ID

20190726233923.2570-28-casey@schaufler-ca.com (mailing list archive)

State

Superseded

Headers

From: Casey Schaufler <casey@schaufler-ca.com>
To: casey.schaufler@intel.com, jmorris@namei.org,
        linux-security-module@vger.kernel.org, selinux@vger.kernel.org
Cc: casey@schaufler-ca.com, keescook@chromium.org,
        john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp,
        paul@paul-moore.com, sds@tycho.nsa.gov
Subject: [PATCH 27/27] AppArmor: Remove the exclusive flag
Date: Fri, 26 Jul 2019 16:39:23 -0700
Message-Id: <20190726233923.2570-28-casey@schaufler-ca.com>
In-Reply-To: <20190726233923.2570-1-casey@schaufler-ca.com>
References: <20190726233923.2570-1-casey@schaufler-ca.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: selinux-owner@vger.kernel.org
Precedence: bulk

Series

LSM: Module stacking for AppArmor | expand

Commit Message

Casey Schaufler July 26, 2019, 11:39 p.m. UTC

With the inclusion of the "display" process attribute
mechanism AppArmor no longer needs to be treated as an
"exclusive" security module. Remove the flag that indicates
it is exclusive. Remove the stub getpeersec_dgram AppArmor
hook as it has no effect in the single LSM case and
interferes in the multiple LSM case.

Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
---
 security/apparmor/lsm.c | 20 +-------------------
 1 file changed, 1 insertion(+), 19 deletions(-)

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 5d25959610f9..fb5d5af426c6 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -1071,22 +1071,6 @@  static int apparmor_socket_getpeersec_stream(struct socket *sock, char **optval,
 	return error;
 }
 
-/**
- * apparmor_socket_getpeersec_dgram - get security label of packet
- * @sock: the peer socket
- * @skb: packet data
- * @secid: pointer to where to put the secid of the packet
- *
- * Sets the netlabel socket state on sk from parent
- */
-static int apparmor_socket_getpeersec_dgram(struct socket *sock,
-					    struct sk_buff *skb, u32 *secid)
-
-{
-	/* TODO: requires secid support */
-	return -ENOPROTOOPT;
-}
-
 /**
  * apparmor_sock_graft - Initialize newly created socket
  * @sk: child sock
@@ -1190,8 +1174,6 @@  static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
 #endif
 	LSM_HOOK_INIT(socket_getpeersec_stream,
 		      apparmor_socket_getpeersec_stream),
-	LSM_HOOK_INIT(socket_getpeersec_dgram,
-		      apparmor_socket_getpeersec_dgram),
 	LSM_HOOK_INIT(sock_graft, apparmor_sock_graft),
 #ifdef CONFIG_NETWORK_SECMARK
 	LSM_HOOK_INIT(inet_conn_request, apparmor_inet_conn_request),
@@ -1702,7 +1684,7 @@  static int __init apparmor_init(void)
 
 DEFINE_LSM(apparmor) = {
 	.name = "apparmor",
-	.flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
+	.flags = LSM_FLAG_LEGACY_MAJOR,
 	.enabled = &apparmor_enabled,
 	.blobs = &apparmor_blob_sizes,
 	.init = apparmor_init,

[27/27] AppArmor: Remove the exclusive flag

Commit Message

Patch