summaryrefslogtreecommitdiff
path: root/security/apparmor
diff options
context:
space:
mode:
authorMatthew Garrett <mjg59@google.com>2018-05-24 13:27:45 -0700
committerJohn Johansen <john.johansen@canonical.com>2018-10-03 06:18:17 -0700
commit617a629c08bfffb05249131079d9a38322902e5b (patch)
treed2db7e4567b47d10a6e9e981dc834645108d5216 /security/apparmor
parent1f8266ff58840d698a1e96d2274189de1bdf7969 (diff)
apparmor: Add a wildcard secid
Reserve a secid value that we can use as a wildcard, allowing us to define policy that's expected to match against all secids. Signed-off-by: Matthew Garrett <mjg59@google.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor')
-rw-r--r--security/apparmor/include/secid.h3
-rw-r--r--security/apparmor/secid.c3
2 files changed, 4 insertions, 2 deletions
diff --git a/security/apparmor/include/secid.h b/security/apparmor/include/secid.h
index dee6fa3b6081..fa2062711b63 100644
--- a/security/apparmor/include/secid.h
+++ b/security/apparmor/include/secid.h
@@ -22,6 +22,9 @@ struct aa_label;
/* secid value that will not be allocated */
#define AA_SECID_INVALID 0
+/* secid value that matches any other secid */
+#define AA_SECID_WILDCARD 1
+
struct aa_label *aa_secid_to_label(u32 secid);
int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);
int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
diff --git a/security/apparmor/secid.c b/security/apparmor/secid.c
index f2f22d00db18..8c951c493beb 100644
--- a/security/apparmor/secid.c
+++ b/security/apparmor/secid.c
@@ -32,8 +32,7 @@
* secids - do not pin labels with a refcount. They rely on the label
* properly updating/freeing them
*/
-
-#define AA_FIRST_SECID 1
+#define AA_FIRST_SECID 2
static DEFINE_IDR(aa_secids);
static DEFINE_SPINLOCK(secid_lock);