diff options
| author | John Johansen <john.johansen@canonical.com> | 2025-02-17 01:46:37 -0800 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2025-07-20 02:31:06 -0700 |
| commit | 9afdc6abb007d5a86f54e9f10870ac1468155ca5 (patch) | |
| tree | ca4322b73a8c95da56d8e0866ef2c490791ffdd1 /security/apparmor/include/policy.h | |
| parent | f9c9dce01e9640d94a37304bddc97b738ee4ac35 (diff) | |
apparmor: transition from a list of rules to a vector of rules
The set of rules on a profile is not dynamically extended, instead
if a new ruleset is needed a new version of the profile is created.
This allows us to use a vector of rules instead of a list, slightly
reducing memory usage and simplifying the code.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor/include/policy.h')
| -rw-r--r-- | security/apparmor/include/policy.h | 16 |
1 files changed, 3 insertions, 13 deletions
diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h index a4c0f76fd03d..4c50875c9d13 100644 --- a/security/apparmor/include/policy.h +++ b/security/apparmor/include/policy.h @@ -165,8 +165,6 @@ struct aa_data { * @secmark: secmark label match info */ struct aa_ruleset { - struct list_head list; - int size; /* TODO: merge policy and file */ @@ -180,6 +178,7 @@ struct aa_ruleset { struct aa_secmark *secmark; }; + /* struct aa_attachment - data and rules for a profiles attachment * @list: * @xmatch_str: human readable attachment string @@ -218,6 +217,7 @@ struct aa_attachment { * @dents: set of dentries associated with the profile * @data: hashtable for free-form policy aa_data * @label - label this profile is an extension of + * @rules - label with the rule vec on its end * * The AppArmor profile contains the basic confinement data. Each profile * has a name, and exists in a namespace. The @name and @exec_match are @@ -245,7 +245,6 @@ struct aa_profile { const char *disconnected; struct aa_attachment attach; - struct list_head rules; struct aa_loaddata *rawdata; unsigned char *hash; @@ -253,6 +252,7 @@ struct aa_profile { struct dentry *dents[AAFS_PROF_SIZEOF]; struct rhashtable *data; + int n_rules; /* special - variable length must be last entry in profile */ struct aa_label label; }; @@ -332,16 +332,6 @@ static inline aa_state_t RULE_MEDIATES_NET(struct aa_ruleset *rules) } -static inline aa_state_t ANY_RULE_MEDIATES(struct list_head *head, - unsigned char class) -{ - struct aa_ruleset *rule; - - /* TODO: change to list walk */ - rule = list_first_entry(head, typeof(*rule), list); - return RULE_MEDIATES(rule, class); -} - void aa_compute_profile_mediates(struct aa_profile *profile); static inline bool profile_mediates(struct aa_profile *profile, unsigned char class) |