#define K_ABI_MASK 0x3ff
#define FORCE_COMPLAIN_FLAG 0x800
#define VERSION_LT(X, Y) (((X) & K_ABI_MASK) < ((Y) & K_ABI_MASK))
+#define VERSION_LE(X, Y) (((X) & K_ABI_MASK) <= ((Y) & K_ABI_MASK))
#define VERSION_GT(X, Y) (((X) & K_ABI_MASK) > ((Y) & K_ABI_MASK))
#define v5 5 /* base version */
}
static struct aa_perms compute_perms_entry(struct aa_dfa *dfa,
- aa_state_t state)
+ aa_state_t state,
+ u32 version)
{
struct aa_perms perms = { };
*/
perms.allow |= map_other(dfa_other_allow(dfa, state));
+ if (VERSION_LE(version, v8))
+ perms.allow |= AA_MAY_LOCK;
perms.audit |= map_other(dfa_other_audit(dfa, state));
perms.quiet |= map_other(dfa_other_quiet(dfa, state));
return perms;
}
-static struct aa_perms *compute_perms(struct aa_dfa *dfa)
+static struct aa_perms *compute_perms(struct aa_dfa *dfa, u32 version)
{
unsigned int state;
unsigned int state_count;
/* zero init so skip the trap state (state == 0) */
for (state = 1; state < state_count; state++)
- table[state] = compute_perms_entry(dfa, state);
+ table[state] = compute_perms_entry(dfa, state, version);
return table;
}
}
if (!unpack_nameX(e, AA_STRUCTEND, NULL))
goto fail;
- profile->policy.perms = compute_perms(profile->policy.dfa);
+ profile->policy.perms = compute_perms(profile->policy.dfa,
+ e->version);
if (!profile->policy.perms) {
info = "failed to remap policydb permission table";
goto fail;