--- v34
+++ v26
@@ -1,146 +1,63 @@
-Replace the single skb pointer in an audit_buffer with
-a list of skb pointers. Add the audit_stamp information
-to the audit_buffer as there's no guarantee that there
-will be an audit_context containing the stamp associated
-with the event. At audit_log_end() time create auxiliary
-records (none are currently defined) as have been added
-to the list.
+With the inclusion of the interface LSM process attribute
+mechanism AppArmor no longer needs to be treated as an
+"exclusive" security module. Remove the flag that indicates
+it is exclusive. Remove the stub getpeersec_dgram AppArmor
+hook as it has no effect in the single LSM case and
+interferes in the multiple LSM case.
-Suggested-by: Paul Moore <paul@paul-moore.com>
+Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
+Acked-by: John Johansen <john.johansen@canonical.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
---
- kernel/audit.c | 62 +++++++++++++++++++++++++++++++-------------------
- 1 file changed, 39 insertions(+), 23 deletions(-)
+ security/apparmor/lsm.c | 20 +-------------------
+ 1 file changed, 1 insertion(+), 19 deletions(-)
-diff --git a/kernel/audit.c b/kernel/audit.c
-index 6b6c089512f7..4d44c05053b0 100644
---- a/kernel/audit.c
-+++ b/kernel/audit.c
-@@ -197,8 +197,10 @@ static struct audit_ctl_mutex {
- * to place it on a transmit queue. Multiple audit_buffers can be in
- * use simultaneously. */
- struct audit_buffer {
-- struct sk_buff *skb; /* formatted skb ready to send */
-+ struct sk_buff *skb; /* the skb for audit_log functions */
-+ struct sk_buff_head skb_list; /* formatted skbs, ready to send */
- struct audit_context *ctx; /* NULL or associated context */
-+ struct audit_stamp stamp; /* audit stamp for these records */
- gfp_t gfp_mask;
- };
-
-@@ -1765,10 +1767,13 @@ __setup("audit_backlog_limit=", audit_backlog_limit_set);
-
- static void audit_buffer_free(struct audit_buffer *ab)
- {
-+ struct sk_buff *skb;
-+
- if (!ab)
- return;
-
-- kfree_skb(ab->skb);
-+ while((skb = skb_dequeue(&ab->skb_list)))
-+ kfree_skb(skb);
- kmem_cache_free(audit_buffer_cache, ab);
+diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
+index 65a004597e53..15af5a5cb0c0 100644
+--- a/security/apparmor/lsm.c
++++ b/security/apparmor/lsm.c
+@@ -1138,22 +1138,6 @@ static int apparmor_socket_getpeersec_stream(struct socket *sock,
+ return error;
}
-@@ -1784,8 +1789,12 @@ static struct audit_buffer *audit_buffer_alloc(struct audit_context *ctx,
- ab->skb = nlmsg_new(AUDIT_BUFSIZ, gfp_mask);
- if (!ab->skb)
- goto err;
-+
-+ skb_queue_head_init(&ab->skb_list);
-+ skb_queue_tail(&ab->skb_list, ab->skb);
-+
- if (!nlmsg_put(ab->skb, 0, 0, type, 0, 0))
-- goto err;
-+ kfree_skb(ab->skb);
+-/**
+- * apparmor_socket_getpeersec_dgram - get security label of packet
+- * @sock: the peer socket
+- * @skb: packet data
+- * @secid: pointer to where to put the secid of the packet
+- *
+- * Sets the netlabel socket state on sk from parent
+- */
+-static int apparmor_socket_getpeersec_dgram(struct socket *sock,
+- struct sk_buff *skb, u32 *secid)
+-
+-{
+- /* TODO: requires secid support */
+- return -ENOPROTOOPT;
+-}
+-
+ /**
+ * apparmor_sock_graft - Initialize newly created socket
+ * @sk: child sock
+@@ -1257,8 +1241,6 @@ static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
+ #endif
+ LSM_HOOK_INIT(socket_getpeersec_stream,
+ apparmor_socket_getpeersec_stream),
+- LSM_HOOK_INIT(socket_getpeersec_dgram,
+- apparmor_socket_getpeersec_dgram),
+ LSM_HOOK_INIT(sock_graft, apparmor_sock_graft),
+ #ifdef CONFIG_NETWORK_SECMARK
+ LSM_HOOK_INIT(inet_conn_request, apparmor_inet_conn_request),
+@@ -1928,7 +1910,7 @@ static int __init apparmor_init(void)
- ab->ctx = ctx;
- ab->gfp_mask = gfp_mask;
-@@ -1849,7 +1858,6 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
- int type)
- {
- struct audit_buffer *ab;
-- struct audit_stamp stamp;
-
- if (audit_initialized != AUDIT_INITIALIZED)
- return NULL;
-@@ -1904,14 +1912,14 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
- return NULL;
- }
-
-- audit_get_stamp(ab->ctx, &stamp);
-+ audit_get_stamp(ab->ctx, &ab->stamp);
- /* cancel dummy context to enable supporting records */
- if (ctx)
- ctx->dummy = 0;
- audit_log_format(ab, "audit(%llu.%03lu:%u): ",
-- (unsigned long long)stamp.ctime.tv_sec,
-- stamp.ctime.tv_nsec/1000000,
-- stamp.serial);
-+ (unsigned long long)ab->stamp.ctime.tv_sec,
-+ ab->stamp.ctime.tv_nsec/1000000,
-+ ab->stamp.serial);
-
- return ab;
- }
-@@ -2402,26 +2410,14 @@ int audit_signal_info(int sig, struct task_struct *t)
- }
-
- /**
-- * audit_log_end - end one audit record
-- * @ab: the audit_buffer
-- *
-- * We can not do a netlink send inside an irq context because it blocks (last
-- * arg, flags, is not set to MSG_DONTWAIT), so the audit buffer is placed on a
-- * queue and a kthread is scheduled to remove them from the queue outside the
-- * irq context. May be called in any context.
-+ * __audit_log_end - enqueue one audit record
-+ * @skb: the buffer to send
- */
--void audit_log_end(struct audit_buffer *ab)
-+static void __audit_log_end(struct sk_buff *skb)
- {
-- struct sk_buff *skb;
- struct nlmsghdr *nlh;
-
-- if (!ab)
-- return;
--
- if (audit_rate_check()) {
-- skb = ab->skb;
-- ab->skb = NULL;
--
- /* setup the netlink header, see the comments in
- * kauditd_send_multicast_skb() for length quirks */
- nlh = nlmsg_hdr(skb);
-@@ -2432,6 +2428,26 @@ void audit_log_end(struct audit_buffer *ab)
- wake_up_interruptible(&kauditd_wait);
- } else
- audit_log_lost("rate limit exceeded");
-+}
-+
-+/**
-+ * audit_log_end - end one audit record
-+ * @ab: the audit_buffer
-+ *
-+ * We can not do a netlink send inside an irq context because it blocks (last
-+ * arg, flags, is not set to MSG_DONTWAIT), so the audit buffer is placed on a
-+ * queue and a kthread is scheduled to remove them from the queue outside the
-+ * irq context. May be called in any context.
-+ */
-+void audit_log_end(struct audit_buffer *ab)
-+{
-+ struct sk_buff *skb;
-+
-+ if (!ab)
-+ return;
-+
-+ while ((skb = skb_dequeue(&ab->skb_list)))
-+ __audit_log_end(skb);
-
- audit_buffer_free(ab);
- }
+ DEFINE_LSM(apparmor) = {
+ .name = "apparmor",
+- .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
++ .flags = LSM_FLAG_LEGACY_MAJOR,
+ .enabled = &apparmor_enabled,
+ .blobs = &apparmor_blob_sizes,
+ .init = apparmor_init,
--
-2.35.1
+2.29.2