Signed-off-by: John Johansen <[email protected]>
---
security/apparmor/audit.c | 1 +
security/apparmor/include/audit.h | 1 +
security/apparmor/lsm.c | 13 +++++++++++++
3 files changed, 15 insertions(+)
diff --git a/security/apparmor/audit.c b/security/apparmor/audit.c
index 6ebebd5..cc7d6c6 100644
--- a/security/apparmor/audit.c
+++ b/security/apparmor/audit.c
@@ -39,6 +39,7 @@ const char *const op_table[] = {
"chdir",
"getattr",
"open",
+ "access",
"file_perm",
"file_lock",
diff --git a/security/apparmor/include/audit.h
b/security/apparmor/include/audit.h
index 57f5ce8..190cc8b 100644
--- a/security/apparmor/include/audit.h
+++ b/security/apparmor/include/audit.h
@@ -67,6 +67,7 @@ enum aa_ops {
OP_CHDIR,
OP_GETATTR,
OP_OPEN,
+ OP_ACCESS,
OP_FPERM,
OP_FLOCK,
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 794aa1a..1f5e370 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -376,6 +376,18 @@ static int apparmor_path_chdir(struct path *path)
return common_perm(OP_CHDIR, path, MAY_READ, &cond);
}
+static int apparmor_path_access(struct path *path, umode_t mode)
+{
+ struct path_cond cond = { path->dentry->d_inode->i_uid,
+ path->dentry->d_inode->i_mode
+ };
+
+ if (!mediated_filesystem(path->dentry->d_inode))
+ return 0;
+
+ return common_perm(OP_ACCESS, path, mode & ~MAY_ACCESS, &cond);
+}
+
static int apparmor_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
{
if (!mediated_filesystem(dentry->d_inode))
@@ -645,6 +657,7 @@ static struct security_operations apparmor_ops = {
.path_chmod = apparmor_path_chmod,
.path_chown = apparmor_path_chown,
.path_chdir = apparmor_path_chdir,
+ .path_access = apparmor_path_access,
.path_truncate = apparmor_path_truncate,
.inode_getattr = apparmor_inode_getattr,
--
1.8.3.2
--
AppArmor mailing list
[email protected]
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/apparmor
