diff options
| author | John Johansen <john.johansen@canonical.com> | 2025-02-17 01:46:37 -0800 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2025-07-20 02:31:06 -0700 |
| commit | 9afdc6abb007d5a86f54e9f10870ac1468155ca5 (patch) | |
| tree | ca4322b73a8c95da56d8e0866ef2c490791ffdd1 /security/apparmor/capability.c | |
| parent | f9c9dce01e9640d94a37304bddc97b738ee4ac35 (diff) | |
apparmor: transition from a list of rules to a vector of rules
The set of rules on a profile is not dynamically extended, instead
if a new ruleset is needed a new version of the profile is created.
This allows us to use a vector of rules instead of a list, slightly
reducing memory usage and simplifying the code.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor/capability.c')
| -rw-r--r-- | security/apparmor/capability.c | 9 |
1 files changed, 3 insertions, 6 deletions
diff --git a/security/apparmor/capability.c b/security/apparmor/capability.c index 25b6219cdeb6..b9ea6bc45c1a 100644 --- a/security/apparmor/capability.c +++ b/security/apparmor/capability.c @@ -69,8 +69,7 @@ static int audit_caps(struct apparmor_audit_data *ad, struct aa_profile *profile { const u64 AUDIT_CACHE_TIMEOUT_NS = 1000*1000*1000; /* 1 second */ - struct aa_ruleset *rules = list_first_entry(&profile->rules, - typeof(*rules), list); + struct aa_ruleset *rules = profile->label.rules[0]; struct audit_cache *ent; int type = AUDIT_APPARMOR_AUTO; @@ -122,8 +121,7 @@ static int audit_caps(struct apparmor_audit_data *ad, struct aa_profile *profile static int profile_capable(struct aa_profile *profile, int cap, unsigned int opts, struct apparmor_audit_data *ad) { - struct aa_ruleset *rules = list_first_entry(&profile->rules, - typeof(*rules), list); + struct aa_ruleset *rules = profile->label.rules[0]; aa_state_t state; int error; @@ -195,8 +193,7 @@ int aa_capable(const struct cred *subj_cred, struct aa_label *label, kernel_cap_t aa_profile_capget(struct aa_profile *profile) { - struct aa_ruleset *rules = list_first_entry(&profile->rules, - typeof(*rules), list); + struct aa_ruleset *rules = profile->label.rules[0]; aa_state_t state; state = RULE_MEDIATES(rules, AA_CLASS_CAP); |