diff options
| author | John Johansen <john.johansen@canonical.com> | 2026-06-29 16:58:57 -0700 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2026-08-10 22:49:41 -0700 |
| commit | 1af45bf33b3c11fcc0ea0813ebfd68d0df342e48 (patch) | |
| tree | ad3d4ba20df3eec57a6439d88b3a0176af9ebbc3 /security | |
| parent | 89ac6aa752ec8b7b43d8d88a3e7719d1868d582a (diff) | |
| download | linux-1af45bf33b3c11fcc0ea0813ebfd68d0df342e48.tar.gz linux-1af45bf33b3c11fcc0ea0813ebfd68d0df342e48.zip | |
apparmor: refactor network socket mediation to support compatibility
Make it easier for distros to support the network backwards compat
patch by refactoring the code to minimize the changes needed.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security')
| -rw-r--r-- | security/apparmor/net.c | 18 |
1 files changed, 10 insertions, 8 deletions
diff --git a/security/apparmor/net.c b/security/apparmor/net.c index 678d1417efd6..4d4e9e389080 100644 --- a/security/apparmor/net.c +++ b/security/apparmor/net.c @@ -262,14 +262,15 @@ int aa_profile_af_perm(struct aa_profile *profile, AA_BUG(type < 0 || type >= SOCK_MAX); AA_BUG(profile_unconfined(profile)); - if (profile_unconfined(profile)) - return 0; state = RULE_MEDIATES_NET(rules); - if (!state) - return 0; - state = aa_match_to_prot(rules->policy, state, request, family, type, - protocol, &p, &ad->info); - return aa_do_perms(profile, rules->policy, state, request, p, ad); + if (state) { + state = aa_match_to_prot(rules->policy, state, request, family, + type, protocol, &p, &ad->info); + return aa_do_perms(profile, rules->policy, state, request, p, + ad); + } /* else */ + + return 0; } int aa_af_perm(const struct cred *subj_cred, struct aa_label *label, @@ -298,7 +299,8 @@ int aa_label_sk_perm(const struct cred *subj_cred, struct aa_label *label, ad.subj_cred = subj_cred; error = fn_for_each_confined(label, profile, - aa_profile_af_sk_perm(profile, &ad, request, sk)); + aa_profile_af_perm(profile, &ad, request, sk->sk_family, + sk->sk_type, sk->sk_protocol)); } return error; |