summaryrefslogtreecommitdiff
path: root/security/apparmor/domain.c
diff options
context:
space:
mode:
authorKees Cook <keescook@chromium.org>2017-07-18 15:25:24 -0700
committerKees Cook <keescook@chromium.org>2017-08-01 12:03:06 -0700
commit993b3ab0642e57da5de6bef11dd50db7e2fc3b7e (patch)
tree0406425b33f4d3c513d9cf773ddcfe25500a5d5e /security/apparmor/domain.c
parentc425e189ffd7720c881fe9ccd7143cea577f6d03 (diff)
apparmor: Refactor to remove bprm_secureexec hook
The AppArmor bprm_secureexec hook can be merged with the bprm_set_creds hook since it's dealing with the same information, and all of the details are finalized during the first call to the bprm_set_creds hook via prepare_binprm() (subsequent calls due to binfmt_script, etc, are ignored via bprm->called_set_creds). Here, all the comments describe how secureexec is actually calculated during bprm_set_creds, so this actually does it, drops the bprm flag that was being used internally by AppArmor, and drops the bprm_secureexec hook. Signed-off-by: Kees Cook <keescook@chromium.org> Acked-by: John Johansen <john.johansen@canonical.com> Reviewed-by: James Morris <james.l.morris@oracle.com> Acked-by: Serge Hallyn <serge@hallyn.com>
Diffstat (limited to 'security/apparmor/domain.c')
-rw-r--r--security/apparmor/domain.c19
1 files changed, 1 insertions, 18 deletions
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 67ec52cfc523..17a601c67b62 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -807,7 +807,7 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
aa_label_printk(new, GFP_ATOMIC);
dbg_printk("\n");
}
- bprm->unsafe |= AA_SECURE_X_NEEDED;
+ bprm->secureexec = 1;
}
if (label->proxy != new->proxy) {
@@ -843,23 +843,6 @@ audit:
goto done;
}
-/**
- * apparmor_bprm_secureexec - determine if secureexec is needed
- * @bprm: binprm for exec (NOT NULL)
- *
- * Returns: %1 if secureexec is needed else %0
- */
-int apparmor_bprm_secureexec(struct linux_binprm *bprm)
-{
- /* the decision to use secure exec is computed in set_creds
- * and stored in bprm->unsafe.
- */
- if (bprm->unsafe & AA_SECURE_X_NEEDED)
- return 1;
-
- return 0;
-}
-
/*
* Functions for self directed profile change
*/