[PATCH v1 2/3] landlock: Refactor network access mask management
From: Mickaël Salaün <mic@digikod.net>
Date: 2024-10-01 14:12:52
Also in:
lkml
Subsystem:
landlock security module, security subsystem, the rest · Maintainers:
Mickaël Salaün, Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds
Replace the get_raw_handled_net_accesses() implementation with a call to landlock_filter_access_masks(). Cc: Günther Noack <gnoack@google.com> Cc: Konstantin Meskhidze <redacted> Cc: Mikhail Ivanov <redacted> Signed-off-by: Mickaël Salaün <mic@digikod.net> Link: https://lore.kernel.org/r/20241001141234.397649-3-mic@digikod.net (local) --- security/landlock/net.c | 22 +++++----------------- 1 file changed, 5 insertions(+), 17 deletions(-)
diff --git a/security/landlock/net.c b/security/landlock/net.c
index c8bcd29bde09..bc3d943a7118 100644
--- a/security/landlock/net.c
+++ b/security/landlock/net.c@@ -39,26 +39,14 @@ int landlock_append_net_rule(struct landlock_ruleset *const ruleset, return err; } -static access_mask_t -get_raw_handled_net_accesses(const struct landlock_ruleset *const domain) -{ - access_mask_t access_dom = 0; - size_t layer_level; - - for (layer_level = 0; layer_level < domain->num_layers; layer_level++) - access_dom |= landlock_get_net_access_mask(domain, layer_level); - return access_dom; -} - static const struct landlock_ruleset *get_current_net_domain(void) { - const struct landlock_ruleset *const dom = - landlock_get_current_domain(); - - if (!dom || !get_raw_handled_net_accesses(dom)) - return NULL; + const union access_masks all_net = { + .net = ~0, + }; - return dom; + return landlock_filter_access_masks(landlock_get_current_domain(), + all_net); } static int current_check_access_socket(struct socket *const sock,
--
2.46.1