diff options
| author | John Johansen <john.johansen@canonical.com> | 2022-03-26 01:46:18 -0700 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2022-07-19 02:55:45 -0700 |
| commit | c1ed5da197652318341fd36333d45e8e6d5c3359 (patch) | |
| tree | 683644f81fe3f38082ddc519a8d7d798e183ab70 /security/apparmor/label.c | |
| parent | 2504db207146543736e877241f3b3de005cbe056 (diff) | |
apparmor: allow label to carry debug flags
Allow labels to have debug flags that can be used to trigger debug output
only from profiles/labels that are marked. This can help reduce debug
output by allowing debug to be target to a specific confinement condition.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor/label.c')
| -rw-r--r-- | security/apparmor/label.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/security/apparmor/label.c b/security/apparmor/label.c index a658b67c784c..0f36ee907438 100644 --- a/security/apparmor/label.c +++ b/security/apparmor/label.c @@ -197,18 +197,18 @@ static bool vec_is_stale(struct aa_profile **vec, int n) return false; } -static bool vec_unconfined(struct aa_profile **vec, int n) +static long union_vec_flags(struct aa_profile **vec, int n, long mask) { + long u = 0; int i; AA_BUG(!vec); for (i = 0; i < n; i++) { - if (!profile_unconfined(vec[i])) - return false; + u |= vec[i]->label.flags & mask; } - return true; + return u; } static int sort_cmp(const void *a, const void *b) @@ -1097,8 +1097,8 @@ static struct aa_label *label_merge_insert(struct aa_label *new, else if (k == b->size) return aa_get_label(b); } - if (vec_unconfined(new->vec, new->size)) - new->flags |= FLAG_UNCONFINED; + new->flags |= union_vec_flags(new->vec, new->size, FLAG_UNCONFINED | + FLAG_DEBUG1 | FLAG_DEBUG2); ls = labels_set(new); write_lock_irqsave(&ls->lock, flags); label = __label_insert(labels_set(new), new, false); |