Rename IMA's internal filter rule functions from security_filter_rule_*() to ima_filter_rule_*(). This avoids polluting the security_* namespace, which is typically reserved for general security subsystem infrastructure.
Unified · Split
| @@ -413,24 +413,24 @@ static inline void ima_free_modsig(struct modsig *modsig) · 412 unmodified lines | |||
| 413 | /* LSM based policy rules require audit */ | 413 | /* LSM based policy rules require audit */ |
| 414 | #ifdef CONFIG_IMA_LSM_RULES | 414 | #ifdef CONFIG_IMA_LSM_RULES |
| 415 | 415 | ||
| 416 | #define security_filter_rule_init security_audit_rule_init | 416 | #define ima_filter_rule_init security_audit_rule_init |
| 417 | #define security_filter_rule_free security_audit_rule_free | 417 | #define ima_filter_rule_free security_audit_rule_free |
| 418 | #define security_filter_rule_match security_audit_rule_match | 418 | #define ima_filter_rule_match security_audit_rule_match |
| 419 | 419 | ||
| 420 | #else | 420 | #else |
| 421 | 421 | ||
| 422 | static inline int security_filter_rule_init(u32 field, u32 op, char *rulestr, | 422 | static inline int ima_filter_rule_init(u32 field, u32 op, char *rulestr, |
| 423 | void **lsmrule) | 423 | void **lsmrule) |
| 424 | { | 424 | { |
| 425 | return -EINVAL; | 425 | return -EINVAL; |
| 426 | } | 426 | } |
| 427 | 427 | ||
| 428 | static inline void security_filter_rule_free(void *lsmrule) | 428 | static inline void ima_filter_rule_free(void *lsmrule) |
| 429 | { | 429 | { |
| 430 | } | 430 | } |
| 431 | 431 | ||
| 432 | static inline int security_filter_rule_match(u32 secid, u32 field, u32 op, | 432 | static inline int ima_filter_rule_match(u32 secid, u32 field, u32 op, |
| 433 | void *lsmrule) | 433 | void *lsmrule) |
| 434 | { | 434 | { |
| 435 | return -EINVAL; | 435 | return -EINVAL; |
| 436 | } | 436 | } |
| @@ -258,7 +258,7 @@ static void ima_lsm_free_rule(struct ima_rule_entry *entry) · 257 unmodified lines | |||
| 258 | int i; | 258 | int i; |
| 259 | 259 | ||
| 260 | for (i = 0; i < MAX_LSM_RULES; i++) { | 260 | for (i = 0; i < MAX_LSM_RULES; i++) { |
| 261 | security_filter_rule_free(entry->lsm[i].rule); | 261 | ima_filter_rule_free(entry->lsm[i].rule); |
| 262 | kfree(entry->lsm[i].args_p); | 262 | kfree(entry->lsm[i].args_p); |
| 263 | } | 263 | } |
| 264 | } | 264 | } |
| @@ -308,10 +308,9 @@ static struct ima_rule_entry *ima_lsm_copy_rule(struct ima_rule_entry *entry) · 43 unmodified lines | |||
| 308 | */ | 308 | */ |
| 309 | entry->lsm[i].args_p = NULL; | 309 | entry->lsm[i].args_p = NULL; |
| 310 | 310 | ||
| 311 | security_filter_rule_init(nentry->lsm[i].type, | 311 | ima_filter_rule_init(nentry->lsm[i].type, Audit_equal, |
| 312 | Audit_equal, | 312 | nentry->lsm[i].args_p, |
| 313 | nentry->lsm[i].args_p, | 313 | &nentry->lsm[i].rule); |
| 314 | &nentry->lsm[i].rule); | ||
| 315 | if (!nentry->lsm[i].rule) | 314 | if (!nentry->lsm[i].rule) |
| 316 | pr_warn("rule for LSM \'%s\' is undefined\n", | 315 | pr_warn("rule for LSM \'%s\' is undefined\n", |
| 317 | nentry->lsm[i].args_p); | 316 | nentry->lsm[i].args_p); |
| @@ -495,18 +494,16 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, · 177 unmodified lines | |||
| 495 | case LSM_OBJ_ROLE: | 494 | case LSM_OBJ_ROLE: |
| 496 | case LSM_OBJ_TYPE: | 495 | case LSM_OBJ_TYPE: |
| 497 | security_inode_getsecid(inode, &osid); | 496 | security_inode_getsecid(inode, &osid); |
| 498 | rc = security_filter_rule_match(osid, | 497 | rc = ima_filter_rule_match(osid, rule->lsm[i].type, |
| 499 | rule->lsm[i].type, | 498 | Audit_equal, |
| 500 | Audit_equal, | 499 | rule->lsm[i].rule); |
| 501 | rule->lsm[i].rule); | ||
| 502 | break; | 500 | break; |
| 503 | case LSM_SUBJ_USER: | 501 | case LSM_SUBJ_USER: |
| 504 | case LSM_SUBJ_ROLE: | 502 | case LSM_SUBJ_ROLE: |
| 505 | case LSM_SUBJ_TYPE: | 503 | case LSM_SUBJ_TYPE: |
| 506 | rc = security_filter_rule_match(secid, | 504 | rc = ima_filter_rule_match(secid, rule->lsm[i].type, |
| 507 | rule->lsm[i].type, | 505 | Audit_equal, |
| 508 | Audit_equal, | 506 | rule->lsm[i].rule); |
| 509 | rule->lsm[i].rule); | ||
| 510 | default: | 507 | default: |
| 511 | break; | 508 | break; |
| 512 | } | 509 | } |
| @@ -901,10 +898,9 @@ static int ima_lsm_rule_init(struct ima_rule_entry *entry, · 388 unmodified lines | |||
| 901 | return -ENOMEM; | 898 | return -ENOMEM; |
| 902 | 899 | ||
| 903 | entry->lsm[lsm_rule].type = audit_type; | 900 | entry->lsm[lsm_rule].type = audit_type; |
| 904 | result = security_filter_rule_init(entry->lsm[lsm_rule].type, | 901 | result = ima_filter_rule_init(entry->lsm[lsm_rule].type, Audit_equal, |
| 905 | Audit_equal, | 902 | entry->lsm[lsm_rule].args_p, |
| 906 | entry->lsm[lsm_rule].args_p, | 903 | &entry->lsm[lsm_rule].rule); |
| 907 | &entry->lsm[lsm_rule].rule); | ||
| 908 | if (!entry->lsm[lsm_rule].rule) { | 904 | if (!entry->lsm[lsm_rule].rule) { |
| 909 | pr_warn("rule for LSM \'%s\' is undefined\n", | 905 | pr_warn("rule for LSM \'%s\' is undefined\n", |
| 910 | entry->lsm[lsm_rule].args_p); | 906 | entry->lsm[lsm_rule].args_p); |