On Wed, Apr 20, 2016 at 11:52:52PM -0700, John Johansen wrote: > currently only the profile that is causing the failure is logged. This > makes it more confusing than necessary about which profiles loaded > and which didn't. So make sure to log success and failure messages for > all profiles in the set being loaded. > > Signed-off-by: John Johansen <[email protected]>
Very neat. Acked-by: Seth Arnold <[email protected]> Thanks > --- > security/apparmor/policy.c | 29 +++++++++++++++++++---------- > 1 file changed, 19 insertions(+), 10 deletions(-) > > diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c > index 455c9f8..db31bc5 100644 > --- a/security/apparmor/policy.c > +++ b/security/apparmor/policy.c > @@ -1067,7 +1067,7 @@ static int __lookup_replace(struct aa_namespace *ns, > const char *hname, > */ > ssize_t aa_replace_profiles(void *udata, size_t size, bool noreplace) > { > - const char *ns_name, *name = NULL, *info = NULL; > + const char *ns_name, *info = NULL; > struct aa_namespace *ns = NULL; > struct aa_load_ent *ent, *tmp; > int op = OP_PROF_REPL; > @@ -1082,18 +1082,15 @@ ssize_t aa_replace_profiles(void *udata, size_t size, > bool noreplace) > /* released below */ > ns = aa_prepare_namespace(ns_name); > if (!ns) { > - info = "failed to prepare namespace"; > - error = -ENOMEM; > - name = ns_name; > - goto fail; > + error = audit_policy(op, GFP_KERNEL, ns_name, > + "failed to prepare namespace", -ENOMEM); > + goto free; > } > > mutex_lock(&ns->lock); > /* setup parent and ns info */ > list_for_each_entry(ent, &lh, list) { > struct aa_policy *policy; > - > - name = ent->new->base.hname; > error = __lookup_replace(ns, ent->new->base.hname, noreplace, > &ent->old, &info); > if (error) > @@ -1121,7 +1118,6 @@ ssize_t aa_replace_profiles(void *udata, size_t size, > bool noreplace) > if (!p) { > error = -ENOENT; > info = "parent does not exist"; > - name = ent->new->base.hname; > goto fail_lock; > } > rcu_assign_pointer(ent->new->parent, aa_get_profile(p)); > @@ -1214,9 +1210,22 @@ out: > > fail_lock: > mutex_unlock(&ns->lock); > -fail: > - error = audit_policy(op, GFP_KERNEL, name, info, error); > > + /* audit cause of failure */ > + op = (!ent->old) ? OP_PROF_LOAD : OP_PROF_REPL; > + audit_policy(op, GFP_KERNEL, ent->new->base.hname, info, error); > + /* audit status that rest of profiles in the atomic set failed too */ > + info = "valid profile in failed atomic policy load"; > + list_for_each_entry(tmp, &lh, list) { > + if (tmp == ent) { > + info = "unchecked profile in failed atomic policy load"; > + /* skip entry that caused failure */ > + continue; > + } > + op = (!ent->old) ? OP_PROF_LOAD : OP_PROF_REPL; > + audit_policy(op, GFP_KERNEL, tmp->new->base.hname, info, error); > + } > +free: > list_for_each_entry_safe(ent, tmp, &lh, list) { > list_del_init(&ent->list); > aa_load_ent_free(ent);
signature.asc
Description: Digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
