}
struct aa_audit_rule {
- char *profile;
+ struct aa_label *label;
};
void aa_audit_rule_free(void *vrule)
struct aa_audit_rule *rule = vrule;
if (rule) {
- kfree(rule->profile);
+ if (!IS_ERR(rule->label))
+ aa_put_label(rule->label);
kfree(rule);
}
}
if (!rule)
return -ENOMEM;
- rule->profile = kstrdup(rulestr, GFP_KERNEL);
-
- if (!rule->profile) {
- kfree(rule);
- return -ENOMEM;
- }
-
+ /* Currently rules are treated as coming from the root ns */
+ rule->label = aa_label_parse(&root_ns->unconfined->label, rulestr,
+ GFP_KERNEL, true, false);
+ if (IS_ERR(rule->label))
+ return PTR_ERR(rule->label);
*vrule = rule;
return 0;
{
struct aa_audit_rule *rule = vrule;
struct aa_label *label;
- struct label_it i;
- struct aa_profile *profile;
int found = 0;
label = aa_secid_to_label(sid);
if (!label)
return -ENOENT;
- label_for_each(i, label, profile) {
- if (strcmp(rule->profile, profile->base.hname) == 0) {
- found = 1;
- break;
- }
- }
+ if (aa_label_is_subset(label, rule->label))
+ found = 1;
switch (field) {
case AUDIT_SUBJ_ROLE: