UBUNTU: SAUCE: Revert "apparmor: Add support for audit rule filtering"

Revert currently unused by Ubuntu apparmor features that require secid
support, to enable apparmor LSM stacking with the 5.1 LSM stacking
patchset.

This reverts commit e79c26d04043b15de64f082d4da52e9fff7ca607.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>

diff --git a/security/apparmor/audit.c b/security/apparmor/audit.c
index 060fe1691feaa17af63847c0494e32f9b127b917..ee8f3d35de23153922b2fe5370fcd9726ba52121 100644 (file)
--- a/security/apparmor/audit.c
+++ b/security/apparmor/audit.c
@@ -15,7 +15,7 @@
 #include "include/audit.h"
 #include "include/policy.h"
 #include "include/policy_ns.h"
-#include "include/secid.h"
+
 
 const char *const audit_mode_names[] = {
        "normal",
@@ -159,95 +159,3 @@ int aa_audit(int type, struct aa_profile *profile, struct common_audit_data *sa,
 
        return aad(sa)->error;
 }
-
-struct aa_audit_rule {
-       char *profile;
-};
-
-void aa_audit_rule_free(void *vrule)
-{
-       struct aa_audit_rule *rule = vrule;
-
-       if (rule) {
-               kfree(rule->profile);
-               kfree(rule);
-       }
-}
-
-int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
-{
-       struct aa_audit_rule *rule;
-
-       switch (field) {
-       case AUDIT_SUBJ_ROLE:
-               if (op != Audit_equal && op != Audit_not_equal)
-                       return -EINVAL;
-               break;
-       default:
-               return -EINVAL;
-       }
-
-       rule = kzalloc(sizeof(struct aa_audit_rule), GFP_KERNEL);
-
-       if (!rule)
-               return -ENOMEM;
-
-       rule->profile = kstrdup(rulestr, GFP_KERNEL);
-
-       if (!rule->profile) {
-               kfree(rule);
-               return -ENOMEM;
-       }
-
-       *vrule = rule;
-
-       return 0;
-}
-
-int aa_audit_rule_known(struct audit_krule *rule)
-{
-       int i;
-
-       for (i = 0; i < rule->field_count; i++) {
-               struct audit_field *f = &rule->fields[i];
-
-               switch (f->type) {
-               case AUDIT_SUBJ_ROLE:
-                       return 1;
-               }
-       }
-
-       return 0;
-}
-
-int aa_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule)
-{
-       struct aa_audit_rule *rule = vrule;
-       struct aa_label *label;
-       struct label_it i;
-       struct aa_profile *profile;
-       int found = 0;
-
-       label = aa_secid_to_label(sid);
-
-       if (!label)
-               return -ENOENT;
-
-       label_for_each(i, label, profile) {
-               if (strcmp(rule->profile, profile->base.hname) == 0) {
-                       found = 1;
-                       break;
-               }
-       }
-
-       switch (field) {
-       case AUDIT_SUBJ_ROLE:
-               switch (op) {
-               case Audit_equal:
-                       return found;
-               case Audit_not_equal:
-                       return !found;
-               }
-       }
-       return 0;
-}

diff --git a/security/apparmor/include/audit.h b/security/apparmor/include/audit.h
index 18519a4eb67e3cc46c729dd4baba2571fac42cba..f17e167690c0ae5d261fe39164f5703615c385aa 100644 (file)
--- a/security/apparmor/include/audit.h
+++ b/security/apparmor/include/audit.h
@@ -185,9 +185,4 @@ static inline int complain_error(int error)
        return error;
 }
 
-void aa_audit_rule_free(void *vrule);
-int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule);
-int aa_audit_rule_known(struct audit_krule *rule);
-int aa_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule);
-
 #endif /* __AA_AUDIT_H */

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index c47aea7b5a0b1b3bac81f3dcae9a45b1c5c5fbab..b738568ebdbed0fe653d117cad94f601bd4f1415 100644 (file)
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -1299,13 +1299,6 @@ static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
        LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit),
        LSM_HOOK_INIT(task_kill, apparmor_task_kill),
 
-#ifdef CONFIG_AUDIT
-       LSM_HOOK_INIT(audit_rule_init, aa_audit_rule_init),
-       LSM_HOOK_INIT(audit_rule_known, aa_audit_rule_known),
-       LSM_HOOK_INIT(audit_rule_match, aa_audit_rule_match),
-       LSM_HOOK_INIT(audit_rule_free, aa_audit_rule_free),
-#endif
-
        LSM_HOOK_INIT(secid_to_secctx, apparmor_secid_to_secctx),
        LSM_HOOK_INIT(secctx_to_secid, apparmor_secctx_to_secid),
        LSM_HOOK_INIT(release_secctx, apparmor_release_secctx),