Skip to content

Commit bd7bd20

Browse files
jrjohansenjrjohansen
committed
apparmor: combine common_audit_data and apparmor_audit_data
Everywhere where common_audit_data is used apparmor audit_data is also used. We can simplify the code and drop the use of the aad macro everywhere by combining the two structures. Reviewed-by: Georgia Garcia <[email protected]> Signed-off-by: John Johansen <[email protected]>
1 parent 79ddd4a commit bd7bd20

File tree

15 files changed

+257
-245
lines changed

15 files changed

+257
-245
lines changed

‎security/apparmor/audit.c

Lines changed: 35 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -85,37 +85,36 @@ static const char *const aa_class_names[] = {
8585
/**
8686
* audit_pre() - core AppArmor function.
8787
* @ab: audit buffer to fill (NOT NULL)
88-
* @ca: audit structure containing data to audit (NOT NULL)
88+
* @va: audit structure containing data to audit (NOT NULL)
8989
*
90-
* Record common AppArmor audit data from @sa
90+
* Record common AppArmor audit data from @va
9191
*/
92-
static void audit_pre(struct audit_buffer *ab, void *ca)
92+
static void audit_pre(struct audit_buffer *ab, void *va)
9393
{
94-
struct common_audit_data *sa = ca;
94+
struct apparmor_audit_data *ad = aad_of_va(va);
9595

9696
if (aa_g_audit_header) {
9797
audit_log_format(ab, "apparmor=\"%s\"",
98-
aa_audit_type[aad(sa)->type]);
98+
aa_audit_type[ad->type]);
9999
}
100100

101-
if (aad(sa)->op) {
102-
audit_log_format(ab, " operation=\"%s\"", aad(sa)->op);
103-
}
101+
if (ad->op)
102+
audit_log_format(ab, " operation=\"%s\"", ad->op);
104103

105-
if (aad(sa)->class)
104+
if (ad->class)
106105
audit_log_format(ab, " class=\"%s\"",
107-
aad(sa)->class <= AA_CLASS_LAST ?
108-
aa_class_names[aad(sa)->class] :
106+
ad->class <= AA_CLASS_LAST ?
107+
aa_class_names[ad->class] :
109108
"unknown");
110109

111-
if (aad(sa)->info) {
112-
audit_log_format(ab, " info=\"%s\"", aad(sa)->info);
113-
if (aad(sa)->error)
114-
audit_log_format(ab, " error=%d", aad(sa)->error);
110+
if (ad->info) {
111+
audit_log_format(ab, " info=\"%s\"", ad->info);
112+
if (ad->error)
113+
audit_log_format(ab, " error=%d", ad->error);
115114
}
116115

117-
if (aad(sa)->label) {
118-
struct aa_label *label = aad(sa)->label;
116+
if (ad->label) {
117+
struct aa_label *label = ad->label;
119118

120119
if (label_isprofile(label)) {
121120
struct aa_profile *profile = labels_profile(label);
@@ -134,43 +133,44 @@ static void audit_pre(struct audit_buffer *ab, void *ca)
134133
}
135134
}
136135

137-
if (aad(sa)->name) {
136+
if (ad->name) {
138137
audit_log_format(ab, " name=");
139-
audit_log_untrustedstring(ab, aad(sa)->name);
138+
audit_log_untrustedstring(ab, ad->name);
140139
}
141140
}
142141

143142
/**
144143
* aa_audit_msg - Log a message to the audit subsystem
145144
* @type: audit type for the message
146-
* @sa: audit event structure (NOT NULL)
145+
* @ad: audit event structure (NOT NULL)
147146
* @cb: optional callback fn for type specific fields (MAYBE NULL)
148147
*/
149-
void aa_audit_msg(int type, struct common_audit_data *sa,
148+
void aa_audit_msg(int type, struct apparmor_audit_data *ad,
150149
void (*cb) (struct audit_buffer *, void *))
151150
{
152-
aad(sa)->type = type;
153-
common_lsm_audit(sa, audit_pre, cb);
151+
ad->type = type;
152+
common_lsm_audit(&ad->common, audit_pre, cb);
154153
}
155154

156155
/**
157156
* aa_audit - Log a profile based audit event to the audit subsystem
158157
* @type: audit type for the message
159158
* @profile: profile to check against (NOT NULL)
160-
* @sa: audit event (NOT NULL)
159+
* @ad: audit event (NOT NULL)
161160
* @cb: optional callback fn for type specific fields (MAYBE NULL)
162161
*
163162
* Handle default message switching based off of audit mode flags
164163
*
165164
* Returns: error on failure
166165
*/
167-
int aa_audit(int type, struct aa_profile *profile, struct common_audit_data *sa,
166+
int aa_audit(int type, struct aa_profile *profile,
167+
struct apparmor_audit_data *ad,
168168
void (*cb) (struct audit_buffer *, void *))
169169
{
170170
AA_BUG(!profile);
171171

172172
if (type == AUDIT_APPARMOR_AUTO) {
173-
if (likely(!aad(sa)->error)) {
173+
if (likely(!ad->error)) {
174174
if (AUDIT_MODE(profile) != AUDIT_ALL)
175175
return 0;
176176
type = AUDIT_APPARMOR_AUDIT;
@@ -182,24 +182,24 @@ int aa_audit(int type, struct aa_profile *profile, struct common_audit_data *sa,
182182
if (AUDIT_MODE(profile) == AUDIT_QUIET ||
183183
(type == AUDIT_APPARMOR_DENIED &&
184184
AUDIT_MODE(profile) == AUDIT_QUIET_DENIED))
185-
return aad(sa)->error;
185+
return ad->error;
186186

187187
if (KILL_MODE(profile) && type == AUDIT_APPARMOR_DENIED)
188188
type = AUDIT_APPARMOR_KILL;
189189

190-
aad(sa)->label = &profile->label;
190+
ad->label = &profile->label;
191191

192-
aa_audit_msg(type, sa, cb);
192+
aa_audit_msg(type, ad, cb);
193193

194-
if (aad(sa)->type == AUDIT_APPARMOR_KILL)
194+
if (ad->type == AUDIT_APPARMOR_KILL)
195195
(void)send_sig_info(SIGKILL, NULL,
196-
sa->type == LSM_AUDIT_DATA_TASK && sa->u.tsk ?
197-
sa->u.tsk : current);
196+
ad->common.type == LSM_AUDIT_DATA_TASK &&
197+
ad->common.u.tsk ? ad->common.u.tsk : current);
198198

199-
if (aad(sa)->type == AUDIT_APPARMOR_ALLOWED)
200-
return complain_error(aad(sa)->error);
199+
if (ad->type == AUDIT_APPARMOR_ALLOWED)
200+
return complain_error(ad->error);
201201

202-
return aad(sa)->error;
202+
return ad->error;
203203
}
204204

205205
struct aa_audit_rule {

‎security/apparmor/capability.c

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -51,25 +51,25 @@ static void audit_cb(struct audit_buffer *ab, void *va)
5151

5252
/**
5353
* audit_caps - audit a capability
54-
* @sa: audit data
54+
* @as: audit data
5555
* @profile: profile being tested for confinement (NOT NULL)
5656
* @cap: capability tested
5757
* @error: error code returned by test
5858
*
5959
* Do auditing of capability and handle, audit/complain/kill modes switching
6060
* and duplicate message elimination.
6161
*
62-
* Returns: 0 or sa->error on success, error code on failure
62+
* Returns: 0 or ad->error on success, error code on failure
6363
*/
64-
static int audit_caps(struct common_audit_data *sa, struct aa_profile *profile,
64+
static int audit_caps(struct apparmor_audit_data *ad, struct aa_profile *profile,
6565
int cap, int error)
6666
{
6767
struct aa_ruleset *rules = list_first_entry(&profile->rules,
6868
typeof(*rules), list);
6969
struct audit_cache *ent;
7070
int type = AUDIT_APPARMOR_AUTO;
7171

72-
aad(sa)->error = error;
72+
ad->error = error;
7373

7474
if (likely(!error)) {
7575
/* test if auditing is being forced */
@@ -101,20 +101,20 @@ static int audit_caps(struct common_audit_data *sa, struct aa_profile *profile,
101101
}
102102
put_cpu_var(audit_cache);
103103

104-
return aa_audit(type, profile, sa, audit_cb);
104+
return aa_audit(type, profile, ad, audit_cb);
105105
}
106106

107107
/**
108108
* profile_capable - test if profile allows use of capability @cap
109109
* @profile: profile being enforced (NOT NULL, NOT unconfined)
110110
* @cap: capability to test if allowed
111111
* @opts: CAP_OPT_NOAUDIT bit determines whether audit record is generated
112-
* @sa: audit data (MAY BE NULL indicating no auditing)
112+
* @ad: audit data (MAY BE NULL indicating no auditing)
113113
*
114114
* Returns: 0 if allowed else -EPERM
115115
*/
116116
static int profile_capable(struct aa_profile *profile, int cap,
117-
unsigned int opts, struct common_audit_data *sa)
117+
unsigned int opts, struct apparmor_audit_data *ad)
118118
{
119119
struct aa_ruleset *rules = list_first_entry(&profile->rules,
120120
typeof(*rules), list);
@@ -132,10 +132,10 @@ static int profile_capable(struct aa_profile *profile, int cap,
132132
/* audit the cap request in complain mode but note that it
133133
* should be optional.
134134
*/
135-
aad(sa)->info = "optional: no audit";
135+
ad->info = "optional: no audit";
136136
}
137137

138-
return audit_caps(sa, profile, cap, error);
138+
return audit_caps(ad, profile, cap, error);
139139
}
140140

141141
/**
@@ -152,11 +152,11 @@ int aa_capable(struct aa_label *label, int cap, unsigned int opts)
152152
{
153153
struct aa_profile *profile;
154154
int error = 0;
155-
DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_CAP, AA_CLASS_CAP, OP_CAPABLE);
155+
DEFINE_AUDIT_DATA(ad, LSM_AUDIT_DATA_CAP, AA_CLASS_CAP, OP_CAPABLE);
156156

157-
sa.u.cap = cap;
157+
ad.common.u.cap = cap;
158158
error = fn_for_each_confined(label, profile,
159-
profile_capable(profile, cap, opts, &sa));
159+
profile_capable(profile, cap, opts, &ad));
160160

161161
return error;
162162
}

‎security/apparmor/file.c

Lines changed: 34 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -44,33 +44,34 @@ static u32 map_mask_to_chr_mask(u32 mask)
4444
static void file_audit_cb(struct audit_buffer *ab, void *va)
4545
{
4646
struct common_audit_data *sa = va;
47+
struct apparmor_audit_data *ad = aad(sa);
4748
kuid_t fsuid = current_fsuid();
4849
char str[10];
4950

50-
if (aad(sa)->request & AA_AUDIT_FILE_MASK) {
51+
if (ad->request & AA_AUDIT_FILE_MASK) {
5152
aa_perm_mask_to_str(str, sizeof(str), aa_file_perm_chrs,
52-
map_mask_to_chr_mask(aad(sa)->request));
53+
map_mask_to_chr_mask(ad->request));
5354
audit_log_format(ab, " requested_mask=\"%s\"", str);
5455
}
55-
if (aad(sa)->denied & AA_AUDIT_FILE_MASK) {
56+
if (ad->denied & AA_AUDIT_FILE_MASK) {
5657
aa_perm_mask_to_str(str, sizeof(str), aa_file_perm_chrs,
57-
map_mask_to_chr_mask(aad(sa)->denied));
58+
map_mask_to_chr_mask(ad->denied));
5859
audit_log_format(ab, " denied_mask=\"%s\"", str);
5960
}
60-
if (aad(sa)->request & AA_AUDIT_FILE_MASK) {
61+
if (ad->request & AA_AUDIT_FILE_MASK) {
6162
audit_log_format(ab, " fsuid=%d",
6263
from_kuid(&init_user_ns, fsuid));
6364
audit_log_format(ab, " ouid=%d",
64-
from_kuid(&init_user_ns, aad(sa)->fs.ouid));
65+
from_kuid(&init_user_ns, ad->fs.ouid));
6566
}
6667

67-
if (aad(sa)->peer) {
68+
if (ad->peer) {
6869
audit_log_format(ab, " target=");
69-
aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer,
70+
aa_label_xaudit(ab, labels_ns(ad->label), ad->peer,
7071
FLAG_VIEW_SUBNS, GFP_KERNEL);
71-
} else if (aad(sa)->fs.target) {
72+
} else if (ad->fs.target) {
7273
audit_log_format(ab, " target=");
73-
audit_log_untrustedstring(ab, aad(sa)->fs.target);
74+
audit_log_untrustedstring(ab, ad->fs.target);
7475
}
7576
}
7677

@@ -95,50 +96,49 @@ int aa_audit_file(struct aa_profile *profile, struct aa_perms *perms,
9596
kuid_t ouid, const char *info, int error)
9697
{
9798
int type = AUDIT_APPARMOR_AUTO;
98-
DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_TASK, AA_CLASS_FILE, op);
99-
100-
sa.u.tsk = NULL;
101-
aad(&sa)->request = request;
102-
aad(&sa)->name = name;
103-
aad(&sa)->fs.target = target;
104-
aad(&sa)->peer = tlabel;
105-
aad(&sa)->fs.ouid = ouid;
106-
aad(&sa)->info = info;
107-
aad(&sa)->error = error;
108-
sa.u.tsk = NULL;
109-
110-
if (likely(!aad(&sa)->error)) {
99+
DEFINE_AUDIT_DATA(ad, LSM_AUDIT_DATA_TASK, AA_CLASS_FILE, op);
100+
101+
ad.request = request;
102+
ad.name = name;
103+
ad.fs.target = target;
104+
ad.peer = tlabel;
105+
ad.fs.ouid = ouid;
106+
ad.info = info;
107+
ad.error = error;
108+
ad.common.u.tsk = NULL;
109+
110+
if (likely(!ad.error)) {
111111
u32 mask = perms->audit;
112112

113113
if (unlikely(AUDIT_MODE(profile) == AUDIT_ALL))
114114
mask = 0xffff;
115115

116116
/* mask off perms that are not being force audited */
117-
aad(&sa)->request &= mask;
117+
ad.request &= mask;
118118

119-
if (likely(!aad(&sa)->request))
119+
if (likely(!ad.request))
120120
return 0;
121121
type = AUDIT_APPARMOR_AUDIT;
122122
} else {
123123
/* only report permissions that were denied */
124-
aad(&sa)->request = aad(&sa)->request & ~perms->allow;
125-
AA_BUG(!aad(&sa)->request);
124+
ad.request = ad.request & ~perms->allow;
125+
AA_BUG(!ad.request);
126126

127-
if (aad(&sa)->request & perms->kill)
127+
if (ad.request & perms->kill)
128128
type = AUDIT_APPARMOR_KILL;
129129

130130
/* quiet known rejects, assumes quiet and kill do not overlap */
131-
if ((aad(&sa)->request & perms->quiet) &&
131+
if ((ad.request & perms->quiet) &&
132132
AUDIT_MODE(profile) != AUDIT_NOQUIET &&
133133
AUDIT_MODE(profile) != AUDIT_ALL)
134-
aad(&sa)->request &= ~perms->quiet;
134+
ad.request &= ~perms->quiet;
135135

136-
if (!aad(&sa)->request)
137-
return aad(&sa)->error;
136+
if (!ad.request)
137+
return ad.error;
138138
}
139139

140-
aad(&sa)->denied = aad(&sa)->request & ~perms->allow;
141-
return aa_audit(type, profile, &sa, file_audit_cb);
140+
ad.denied = ad.request & ~perms->allow;
141+
return aa_audit(type, profile, &ad, file_audit_cb);
142142
}
143143

144144
static int path_name(const char *op, struct aa_label *label,

‎security/apparmor/include/audit.h

Lines changed: 18 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -152,33 +152,35 @@ struct apparmor_audit_data {
152152
unsigned long flags;
153153
} mnt;
154154
};
155+
156+
struct common_audit_data common;
155157
};
156158

157159
/* macros for dealing with apparmor_audit_data structure */
158-
#define aad(SA) ((SA)->apparmor_audit_data)
160+
#define aad(SA) (container_of(SA, struct apparmor_audit_data, common))
161+
#define aad_of_va(VA) aad((struct common_audit_data *)(VA))
162+
159163
#define DEFINE_AUDIT_DATA(NAME, T, C, X) \
160164
/* TODO: cleanup audit init so we don't need _aad = {0,} */ \
161-
struct apparmor_audit_data NAME ## _aad = { \
165+
struct apparmor_audit_data NAME = { \
162166
.class = (C), \
163167
.op = (X), \
164-
}; \
165-
struct common_audit_data NAME = \
166-
{ \
167-
.type = (T), \
168-
.u.tsk = NULL, \
169-
}; \
170-
NAME.apparmor_audit_data = &(NAME ## _aad)
171-
172-
void aa_audit_msg(int type, struct common_audit_data *sa,
168+
.common.type = (T), \
169+
.common.u.tsk = NULL, \
170+
.common.apparmor_audit_data = &NAME, \
171+
};
172+
173+
void aa_audit_msg(int type, struct apparmor_audit_data *ad,
173174
void (*cb) (struct audit_buffer *, void *));
174-
int aa_audit(int type, struct aa_profile *profile, struct common_audit_data *sa,
175+
int aa_audit(int type, struct aa_profile *profile,
176+
struct apparmor_audit_data *ad,
175177
void (*cb) (struct audit_buffer *, void *));
176178

177-
#define aa_audit_error(ERROR, SA, CB) \
179+
#define aa_audit_error(ERROR, AD, CB) \
178180
({ \
179-
aad((SA))->error = (ERROR); \
180-
aa_audit_msg(AUDIT_APPARMOR_ERROR, (SA), (CB)); \
181-
aad((SA))->error; \
181+
(AD)->error = (ERROR); \
182+
aa_audit_msg(AUDIT_APPARMOR_ERROR, (AD), (CB)); \
183+
(AD)->error; \
182184
})
183185

184186

0 commit comments

Comments
 (0)