diff options
| author | Konstantin Meskhidze <konstantin.meskhidze@huawei.com> | 2023-10-26 09:47:40 +0800 |
|---|---|---|
| committer | Mickaël Salaün <mic@digikod.net> | 2023-10-26 21:07:09 +0200 |
| commit | 13fc6455fa19b0859e1b9640bf09903bec8df4f4 (patch) | |
| tree | 1e8feb1150c35a56c8c1249b1fdf8201181283af /security/landlock/fs.c | |
| parent | 05d3ef8bba77c1b5f98d941d8b2d4aeab8118ef1 (diff) | |
| download | lwn-13fc6455fa19b0859e1b9640bf09903bec8df4f4.tar.gz lwn-13fc6455fa19b0859e1b9640bf09903bec8df4f4.zip | |
landlock: Make ruleset's access masks more generic
Rename ruleset's access masks and modify it's type to access_masks_t
to support network type rules in following commits. Add filesystem
helper functions to add and get filesystem mask.
Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
Link: https://lore.kernel.org/r/20231026014751.414649-2-konstantin.meskhidze@huawei.com
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Diffstat (limited to 'security/landlock/fs.c')
| -rw-r--r-- | security/landlock/fs.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/security/landlock/fs.c b/security/landlock/fs.c index 1c0c198f6fdb..6953801619ac 100644 --- a/security/landlock/fs.c +++ b/security/landlock/fs.c @@ -178,9 +178,9 @@ int landlock_append_fs_rule(struct landlock_ruleset *const ruleset, return -EINVAL; /* Transforms relative access rights to absolute ones. */ - access_rights |= - LANDLOCK_MASK_ACCESS_FS & - ~(ruleset->fs_access_masks[0] | ACCESS_INITIALLY_DENIED); + access_rights |= LANDLOCK_MASK_ACCESS_FS & + ~(landlock_get_fs_access_mask(ruleset, 0) | + ACCESS_INITIALLY_DENIED); object = get_inode_object(d_backing_inode(path->dentry)); if (IS_ERR(object)) return PTR_ERR(object); @@ -294,7 +294,7 @@ get_handled_accesses(const struct landlock_ruleset *const domain) size_t layer_level; for (layer_level = 0; layer_level < domain->num_layers; layer_level++) - access_dom |= domain->fs_access_masks[layer_level]; + access_dom |= landlock_get_fs_access_mask(domain, layer_level); return access_dom & LANDLOCK_MASK_ACCESS_FS; } @@ -336,7 +336,7 @@ init_layer_masks(const struct landlock_ruleset *const domain, * access rights. */ if (BIT_ULL(access_bit) & - (domain->fs_access_masks[layer_level] | + (landlock_get_fs_access_mask(domain, layer_level) | ACCESS_INITIALLY_DENIED)) { (*layer_masks)[access_bit] |= BIT_ULL(layer_level); |