[v37,33/33] AppArmor: Remove the exclusive flag

Message ID	20220628005611.13106-34-casey@schaufler-ca.com (mailing list archive)
State	Handled Elsewhere
Delegated to:	Paul Moore
Headers	show Return-Path: <selinux-owner@kernel.org> From: Casey Schaufler <casey@schaufler-ca.com> To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: casey@schaufler-ca.com, linux-audit@redhat.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com, stephen.smalley.work@gmail.com, linux-kernel@vger.kernel.org Subject: [PATCH v37 33/33] AppArmor: Remove the exclusive flag Date: Mon, 27 Jun 2022 17:56:11 -0700 Message-Id: <20220628005611.13106-34-casey@schaufler-ca.com> In-Reply-To: <20220628005611.13106-1-casey@schaufler-ca.com> References: <20220628005611.13106-1-casey@schaufler-ca.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	[v37,01/33] integrity: disassociate ima_filter_rule from security_audit_rule \| expand [v37,01/33] integrity: disassociate ima_filter_rule from security_audit_rule [v37,02/33] LSM: Infrastructure management of the sock security [v37,03/33] LSM: Add the lsmblob data structure. [v37,04/33] LSM: provide lsm name and id slot mappings [v37,05/33] IMA: avoid label collisions with stacked LSMs [v37,06/33] LSM: Use lsmblob in security_audit_rule_match [v37,07/33] LSM: Use lsmblob in security_kernel_act_as [v37,08/33] LSM: Use lsmblob in security_secctx_to_secid [v37,09/33] LSM: Use lsmblob in security_secid_to_secctx [v37,10/33] LSM: Use lsmblob in security_ipc_getsecid [v37,11/33] LSM: Use lsmblob in security_current_getsecid [v37,12/33] LSM: Use lsmblob in security_inode_getsecid [v37,13/33] LSM: Use lsmblob in security_cred_getsecid [v37,14/33] LSM: Specify which LSM to display [v37,15/33] LSM: Ensure the correct LSM context releaser [v37,16/33] LSM: Use lsmcontext in security_secid_to_secctx [v37,17/33] LSM: Use lsmcontext in security_inode_getsecctx [v37,18/33] LSM: Use lsmcontext in security_dentry_init_security [v37,19/33] LSM: security_secid_to_secctx in netlink netfilter [v37,20/33] NET: Store LSM netlabel data in a lsmblob [v37,21/33] binder: Pass LSM identifier for confirmation [v37,22/33] LSM: security_secid_to_secctx module selection [v37,23/33] Audit: Keep multiple LSM data in audit_names [v37,24/33] Audit: Create audit_stamp structure [v37,25/33] LSM: Add a function to report multiple LSMs [v37,26/33] Audit: Allow multiple records in an audit_buffer [v37,27/33] Audit: Add record for multiple task security contexts [v37,28/33] audit: multiple subject lsm values for netlabel [v37,29/33] Audit: Add record for multiple object contexts [v37,30/33] netlabel: Use a struct lsmblob in audit data [v37,31/33] LSM: Removed scaffolding function lsmcontext_init [v37,32/33] LSM: Add /proc attr entry for full LSM context [v37,33/33] AppArmor: Remove the exclusive flag

Message ID

20220628005611.13106-34-casey@schaufler-ca.com (mailing list archive)

State

Handled Elsewhere

Delegated to:

Paul Moore

Headers

From: Casey Schaufler <casey@schaufler-ca.com>
To: casey.schaufler@intel.com, jmorris@namei.org,
        linux-security-module@vger.kernel.org, selinux@vger.kernel.org
Cc: casey@schaufler-ca.com, linux-audit@redhat.com,
        keescook@chromium.org, john.johansen@canonical.com,
        penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com,
        stephen.smalley.work@gmail.com, linux-kernel@vger.kernel.org
Subject: [PATCH v37 33/33] AppArmor: Remove the exclusive flag
Date: Mon, 27 Jun 2022 17:56:11 -0700
Message-Id: <20220628005611.13106-34-casey@schaufler-ca.com>
In-Reply-To: <20220628005611.13106-1-casey@schaufler-ca.com>
References: <20220628005611.13106-1-casey@schaufler-ca.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

Series

[v37,01/33] integrity: disassociate ima_filter_rule from security_audit_rule | expand

Commit Message

Casey Schaufler June 28, 2022, 12:56 a.m. UTC

With the inclusion of the interface LSM process attribute
mechanism AppArmor no longer needs to be treated as an
"exclusive" security module. Remove the flag that indicates
it is exclusive. Remove the stub getpeersec_dgram AppArmor
hook as it has no effect in the single LSM case and
interferes in the multiple LSM case.

Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
---
 security/apparmor/lsm.c | 20 +-------------------
 1 file changed, 1 insertion(+), 19 deletions(-)

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 1fdb885facbb..1d742d864e0b 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -1165,22 +1165,6 @@  static int apparmor_socket_getpeersec_stream(struct socket *sock,
 	return error;
 }
 
-/**
- * apparmor_socket_getpeersec_dgram - get security label of packet
- * @sock: the peer socket
- * @skb: packet data
- * @secid: pointer to where to put the secid of the packet
- *
- * Sets the netlabel socket state on sk from parent
- */
-static int apparmor_socket_getpeersec_dgram(struct socket *sock,
-					    struct sk_buff *skb, u32 *secid)
-
-{
-	/* TODO: requires secid support */
-	return -ENOPROTOOPT;
-}
-
 /**
  * apparmor_sock_graft - Initialize newly created socket
  * @sk: child sock
@@ -1284,8 +1268,6 @@  static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
 #endif
 	LSM_HOOK_INIT(socket_getpeersec_stream,
 		      apparmor_socket_getpeersec_stream),
-	LSM_HOOK_INIT(socket_getpeersec_dgram,
-		      apparmor_socket_getpeersec_dgram),
 	LSM_HOOK_INIT(sock_graft, apparmor_sock_graft),
 #ifdef CONFIG_NETWORK_SECMARK
 	LSM_HOOK_INIT(inet_conn_request, apparmor_inet_conn_request),
@@ -1939,7 +1921,7 @@  static int __init apparmor_init(void)
 
 DEFINE_LSM(apparmor) = {
 	.name = "apparmor",
-	.flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
+	.flags = LSM_FLAG_LEGACY_MAJOR,
 	.enabled = &apparmor_enabled,
 	.blobs = &apparmor_blob_sizes,
 	.init = apparmor_init,

[v37,33/33] AppArmor: Remove the exclusive flag

Commit Message

Patch