diff options
| author | John Johansen <john.johansen@canonical.com> | 2020-11-17 10:38:16 +0100 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2022-10-03 23:49:03 +0200 |
| commit | e2967ede22978f132cd52929edff96c701bde0eb (patch) | |
| tree | be2a22d52d6bd15e44ee25a507fb589d464951ff /security/apparmor/label.c | |
| parent | apparmor: convert xmatch to use aa_perms structure (diff) | |
| download | linux-e2967ede22978f132cd52929edff96c701bde0eb.tar.xz linux-e2967ede22978f132cd52929edff96c701bde0eb.zip | |
apparmor: compute policydb permission on profile load
Rather than computing policydb permissions for each access
permissions can be computed once on profile load and stored for lookup.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor/label.c')
| -rw-r--r-- | security/apparmor/label.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/security/apparmor/label.c b/security/apparmor/label.c index 0f36ee907438..ddb04417bdab 100644 --- a/security/apparmor/label.c +++ b/security/apparmor/label.c @@ -1328,7 +1328,7 @@ next: if (!state) goto fail; } - aa_compute_perms(profile->policy.dfa, state, perms); + *perms = *aa_lookup_perms(profile->policy.perms, state); aa_apply_modes_to_perms(profile, perms); if ((perms->allow & request) != request) return -EACCES; @@ -1379,7 +1379,7 @@ static int label_components_match(struct aa_profile *profile, return 0; next: - aa_compute_perms(profile->policy.dfa, state, &tmp); + tmp = *aa_lookup_perms(profile->policy.perms, state); aa_apply_modes_to_perms(profile, &tmp); aa_perms_accum(perms, &tmp); label_for_each_cont(i, label, tp) { @@ -1388,7 +1388,7 @@ next: state = match_component(profile, tp, start); if (!state) goto fail; - aa_compute_perms(profile->policy.dfa, state, &tmp); + tmp = *aa_lookup_perms(profile->policy.perms, state); aa_apply_modes_to_perms(profile, &tmp); aa_perms_accum(perms, &tmp); } |