apparmor: Add Basic ns cross check condition for ipc

Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Leann Ogasawara <leann.ogasawara@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

diff --git a/security/apparmor/include/perms.h b/security/apparmor/include/perms.h
index 175fe134216373ef3a873c988554386eacfb6660..b7cd839eea9a40af30ab2dc75ba18529c6321b01 100644 (file)
--- a/security/apparmor/include/perms.h
+++ b/security/apparmor/include/perms.h
@@ -104,14 +104,24 @@ extern struct aa_perms allperms;
 })
 
 
-/* TODO: update for labels pointing to labels instead of profiles
-*  Note: this only works for profiles from a single namespace
-*/
+/*
+ * TODO: update for labels pointing to labels instead of profiles
+ * TODO: optimize the walk, currently does subwalk of L2 for each P in L1
+ * gah this doesn't allow for label compound check!!!!
+ */
+#define xcheck_ns_profile_profile(P1, P2, FN, args...)         \
+({                                                             \
+       int ____e = 0;                                          \
+       if (P1->ns == P2->ns)                                   \
+               ____e = FN((P1), (P2), args);                   \
+       (____e);                                                \
+})
 
-#define xcheck_profile_label(P, L, FN, args...)                        \
+#define xcheck_ns_profile_label(P, L, FN, args...)             \
 ({                                                             \
        struct aa_profile *__p2;                                \
-       fn_for_each((L), __p2, FN((P), __p2, args));            \
+       fn_for_each((L), __p2,                                  \
+                   xcheck_ns_profile_profile((P), __p2, (FN), args));  \
 })
 
 #define xcheck_ns_labels(L1, L2, FN, args...)                  \
@@ -120,13 +130,9 @@ extern struct aa_perms allperms;
        fn_for_each((L1), __p1, FN(__p1, (L2), args));          \
 })
 
-/* todo: fix to handle multiple namespaces */
-#define xcheck_labels(L1, L2, FN, args...)                     \
-       xcheck_ns_labels((L1), (L2), FN, args)
-
 /* Do the cross check but applying FN at the profiles level */
 #define xcheck_labels_profiles(L1, L2, FN, args...)            \
-       xcheck_ns_labels((L1), (L2), xcheck_profile_label, (FN), args)
+       xcheck_ns_labels((L1), (L2), xcheck_ns_profile_label, (FN), args)
 
 
 #define FINAL_CHECK true