summaryrefslogtreecommitdiffstats
path: root/security/apparmor/net.c
diff options
context:
space:
mode:
authorJohn Johansen <john.johansen@canonical.com>2022-05-24 02:38:12 -0700
committerJohn Johansen <john.johansen@canonical.com>2022-07-13 16:37:21 -0700
commit95c0581f9bfdfbe97126ba1c7f5650a9dd064dda (patch)
treeed4981a6a37076e2258d868a677ddcd8a976d63a /security/apparmor/net.c
parente2f76ad7d2859e333609c775fda707f205d93fd8 (diff)
downloadlinux-95c0581f9bfdfbe97126ba1c7f5650a9dd064dda.tar.gz
linux-95c0581f9bfdfbe97126ba1c7f5650a9dd064dda.tar.bz2
linux-95c0581f9bfdfbe97126ba1c7f5650a9dd064dda.zip
apparmor: add a kernel label to use on kernel objects
Separate kernel objects from unconfined. This is done so we can distinguish between the two in debugging, auditing and in preparation for being able to replace unconfined, which is not appropriate for the kernel. The kernel label will continue to behave similar to unconfined. Acked-by: Jon Tourville <jon.tourville@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor/net.c')
-rw-r--r--security/apparmor/net.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/security/apparmor/net.c b/security/apparmor/net.c
index e0c1b50d6edd..7efe4d17273d 100644
--- a/security/apparmor/net.c
+++ b/security/apparmor/net.c
@@ -145,12 +145,13 @@ int aa_af_perm(struct aa_label *label, const char *op, u32 request, u16 family,
static int aa_label_sk_perm(struct aa_label *label, const char *op, u32 request,
struct sock *sk)
{
+ struct aa_sk_ctx *ctx = SK_CTX(sk);
int error = 0;
AA_BUG(!label);
AA_BUG(!sk);
- if (!unconfined(label)) {
+ if (ctx->label != kernel_t && !unconfined(label)) {
struct aa_profile *profile;
DEFINE_AUDIT_SK(sa, op, sk);