apparmor: preparse for state being more than just an integer

Convert from an unsigned int to a state_t for state position. This is
a step in prepping for the state position carrying some additional
flags, and a limited form of backtracking to support variables.

Signed-off-by: John Johansen <john.johansen@canonical.com>

diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index f2b78108bae81976f9fc26c940ccb555a700f3f8..fb9d2ccb34d6078aa307c50c4934bb949ae60334 100644 (file)
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -613,7 +613,7 @@ static void profile_query_cb(struct aa_profile *profile, struct aa_perms *perms,
 {
        struct aa_perms tmp = { };
        struct aa_dfa *dfa;
-       unsigned int state = 0;
+       aa_state_t state = DFA_NOMATCH;
 
        if (profile_unconfined(profile))
                return;

diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 45a8887021f10acb4830e9a329842d6c25d0d95c..5883f0fc02d3d6fa2da616820ac6395f75d0299d 100644 (file)
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -95,9 +95,9 @@ out:
  * If a subns profile is not to be matched should be prescreened with
  * visibility test.
  */
-static inline unsigned int match_component(struct aa_profile *profile,
-                                          struct aa_profile *tp,
-                                          bool stack, unsigned int state)
+static inline aa_state_t match_component(struct aa_profile *profile,
+                                        struct aa_profile *tp,
+                                        bool stack, aa_state_t state)
 {
        const char *ns_name;
 
@@ -132,7 +132,7 @@ static inline unsigned int match_component(struct aa_profile *profile,
  */
 static int label_compound_match(struct aa_profile *profile,
                                struct aa_label *label, bool stack,
-                               unsigned int state, bool subns, u32 request,
+                               aa_state_t state, bool subns, u32 request,
                                struct aa_perms *perms)
 {
        struct aa_profile *tp;
@@ -192,14 +192,14 @@ fail:
  */
 static int label_components_match(struct aa_profile *profile,
                                  struct aa_label *label, bool stack,
-                                 unsigned int start, bool subns, u32 request,
+                                 aa_state_t start, bool subns, u32 request,
                                  struct aa_perms *perms)
 {
        struct aa_profile *tp;
        struct label_it i;
        struct aa_perms tmp;
        struct path_cond cond = { };
-       unsigned int state = 0;
+       aa_state_t state = 0;
 
        /* find first subcomponent to test */
        label_for_each(i, label, tp) {
@@ -252,7 +252,7 @@ fail:
  * Returns: the state the match finished in, may be the none matching state
  */
 static int label_match(struct aa_profile *profile, struct aa_label *label,
-                      bool stack, unsigned int state, bool subns, u32 request,
+                      bool stack, aa_state_t state, bool subns, u32 request,
                       struct aa_perms *perms)
 {
        int error;
@@ -286,7 +286,7 @@ static int label_match(struct aa_profile *profile, struct aa_label *label,
  */
 static int change_profile_perms(struct aa_profile *profile,
                                struct aa_label *target, bool stack,
-                               u32 request, unsigned int start,
+                               u32 request, aa_state_t start,
                                struct aa_perms *perms)
 {
        if (profile_unconfined(profile)) {
@@ -308,7 +308,7 @@ static int change_profile_perms(struct aa_profile *profile,
  * Returns: number of extended attributes that matched, or < 0 on error
  */
 static int aa_xattrs_match(const struct linux_binprm *bprm,
-                          struct aa_profile *profile, unsigned int state)
+                          struct aa_profile *profile, aa_state_t state)
 {
        int i;
        ssize_t size;
@@ -416,7 +416,8 @@ restart:
                 * match.
                 */
                if (profile->xmatch.dfa) {
-                       unsigned int state, count;
+                       unsigned int count;
+                       aa_state_t state;
                        u32 index, perm;
 
                        state = aa_dfa_leftmatch(profile->xmatch.dfa,
@@ -631,7 +632,7 @@ static struct aa_label *profile_transition(struct aa_profile *profile,
 {
        struct aa_label *new = NULL;
        const char *info = NULL, *name = NULL, *target = NULL;
-       unsigned int state = profile->file.start[AA_CLASS_FILE];
+       aa_state_t state = profile->file.start[AA_CLASS_FILE];
        struct aa_perms perms = {};
        bool nonewprivs = false;
        int error = 0;
@@ -727,7 +728,7 @@ static int profile_onexec(struct aa_profile *profile, struct aa_label *onexec,
                          char *buffer, struct path_cond *cond,
                          bool *secure_exec)
 {
-       unsigned int state = profile->file.start[AA_CLASS_FILE];
+       aa_state_t state = profile->file.start[AA_CLASS_FILE];
        struct aa_perms perms = {};
        const char *xname = NULL, *info = "change_profile onexec";
        int error = -EACCES;

diff --git a/security/apparmor/file.c b/security/apparmor/file.c
index 7bddec3df75f7b3e3ad7b5113c7ea8b999bdd6d0..636efcade3f58b1727e63a46686bb43c94af2abe 100644 (file)
--- a/security/apparmor/file.c
+++ b/security/apparmor/file.c
@@ -186,7 +186,7 @@ static int path_name(const char *op, struct aa_label *label,
  */
 struct aa_perms default_perms = {};
 struct aa_perms *aa_lookup_fperms(struct aa_policydb *file_rules,
-                                unsigned int state, struct path_cond *cond)
+                                aa_state_t state, struct path_cond *cond)
 {
        unsigned int index = ACCEPT_TABLE(file_rules->dfa)[state];
 
@@ -209,11 +209,11 @@ struct aa_perms *aa_lookup_fperms(struct aa_policydb *file_rules,
  *
  * Returns: the final state in @dfa when beginning @start and walking @name
  */
-unsigned int aa_str_perms(struct aa_policydb *file_rules, unsigned int start,
-                         const char *name, struct path_cond *cond,
-                         struct aa_perms *perms)
+aa_state_t aa_str_perms(struct aa_policydb *file_rules, aa_state_t start,
+                       const char *name, struct path_cond *cond,
+                       struct aa_perms *perms)
 {
-       unsigned int state;
+       aa_state_t state;
        state = aa_dfa_match(file_rules->dfa, start, name);
        *perms = *(aa_lookup_fperms(file_rules, state, cond));
 
@@ -320,7 +320,7 @@ static int profile_path_link(struct aa_profile *profile,
        struct aa_perms lperms = {}, perms;
        const char *info = NULL;
        u32 request = AA_MAY_LINK;
-       unsigned int state;
+       aa_state_t state;
        int error;
 
        error = path_name(OP_LINK, &profile->label, link, profile->path_flags,

diff --git a/security/apparmor/include/file.h b/security/apparmor/include/file.h
index 736b8f6554044950438d9f129af25b8549a951cc..8c82cf279dc2a10d47acdc234c56e09aa8efe518 100644 (file)
--- a/security/apparmor/include/file.h
+++ b/security/apparmor/include/file.h
@@ -166,10 +166,10 @@ int aa_audit_file(struct aa_profile *profile, struct aa_perms *perms,
                  const char *info, int error);
 
 struct aa_perms *aa_lookup_fperms(struct aa_policydb *file_rules,
-                                 unsigned int state, struct path_cond *cond);
-unsigned int aa_str_perms(struct aa_policydb *file_rules, unsigned int start,
-                         const char *name, struct path_cond *cond,
-                         struct aa_perms *perms);
+                                 aa_state_t state, struct path_cond *cond);
+aa_state_t aa_str_perms(struct aa_policydb *file_rules, aa_state_t start,
+                       const char *name, struct path_cond *cond,
+                       struct aa_perms *perms);
 
 int __aa_path_perm(const char *op, struct aa_profile *profile,
                   const char *name, u32 request, struct path_cond *cond,

diff --git a/security/apparmor/include/label.h b/security/apparmor/include/label.h
index 860484c6f99a63aec8750ff4c7205ae0cb05b084..1130ba10a1526add55a0ce97cc208d86d99dfac7 100644 (file)
--- a/security/apparmor/include/label.h
+++ b/security/apparmor/include/label.h
@@ -333,7 +333,7 @@ struct aa_label *aa_label_parse(struct aa_label *base, const char *str,
 static inline const char *aa_label_strn_split(const char *str, int n)
 {
        const char *pos;
-       unsigned int state;
+       aa_state_t state;
 
        state = aa_dfa_matchn_until(stacksplitdfa, DFA_START, str, n, &pos);
        if (!ACCEPT_TABLE(stacksplitdfa)[state])
@@ -345,7 +345,7 @@ static inline const char *aa_label_strn_split(const char *str, int n)
 static inline const char *aa_label_str_split(const char *str)
 {
        const char *pos;
-       unsigned int state;
+       aa_state_t state;
 
        state = aa_dfa_match_until(stacksplitdfa, DFA_START, str, &pos);
        if (!ACCEPT_TABLE(stacksplitdfa)[state])
@@ -358,7 +358,7 @@ static inline const char *aa_label_str_split(const char *str)
 
 struct aa_perms;
 int aa_label_match(struct aa_profile *profile, struct aa_label *label,
-                  unsigned int state, bool subns, u32 request,
+                  aa_state_t state, bool subns, u32 request,
                   struct aa_perms *perms);
 
 

diff --git a/security/apparmor/include/lib.h b/security/apparmor/include/lib.h
index f42359f58eb5878bf3241405b4d2845d3c61dca5..f176f3ced2a3614a66fe9c975a728e1ce5e519db 100644 (file)
--- a/security/apparmor/include/lib.h
+++ b/security/apparmor/include/lib.h
@@ -87,8 +87,8 @@ static inline bool aa_strneq(const char *str, const char *sub, int len)
  * character which is not used in standard matching and is only
  * used to separate pairs.
  */
-static inline unsigned int aa_dfa_null_transition(struct aa_dfa *dfa,
-                                                 unsigned int start)
+static inline aa_state_t aa_dfa_null_transition(struct aa_dfa *dfa,
+                                               aa_state_t start)
 {
        /* the null transition only needs the string's null terminator byte */
        return aa_dfa_next(dfa, start, 0);

diff --git a/security/apparmor/include/match.h b/security/apparmor/include/match.h
index 8844895905881bad81dbce5e8336df6a3cf05d38..58fbf67139b9c7b43af9ec3709f278822d447537 100644 (file)
--- a/security/apparmor/include/match.h
+++ b/security/apparmor/include/match.h
@@ -125,19 +125,19 @@ static inline size_t table_size(size_t len, size_t el_size)
 int aa_setup_dfa_engine(void);
 void aa_teardown_dfa_engine(void);
 
+#define aa_state_t unsigned int
+
 struct aa_dfa *aa_dfa_unpack(void *blob, size_t size, int flags);
-unsigned int aa_dfa_match_len(struct aa_dfa *dfa, unsigned int start,
-                             const char *str, int len);
-unsigned int aa_dfa_match(struct aa_dfa *dfa, unsigned int start,
-                         const char *str);
-unsigned int aa_dfa_next(struct aa_dfa *dfa, unsigned int state,
-                        const char c);
-unsigned int aa_dfa_outofband_transition(struct aa_dfa *dfa,
-                                        unsigned int state);
-unsigned int aa_dfa_match_until(struct aa_dfa *dfa, unsigned int start,
-                               const char *str, const char **retpos);
-unsigned int aa_dfa_matchn_until(struct aa_dfa *dfa, unsigned int start,
-                                const char *str, int n, const char **retpos);
+aa_state_t aa_dfa_match_len(struct aa_dfa *dfa, aa_state_t start,
+                           const char *str, int len);
+aa_state_t aa_dfa_match(struct aa_dfa *dfa, aa_state_t start,
+                       const char *str);
+aa_state_t aa_dfa_next(struct aa_dfa *dfa, aa_state_t state, const char c);
+aa_state_t aa_dfa_outofband_transition(struct aa_dfa *dfa, aa_state_t state);
+aa_state_t aa_dfa_match_until(struct aa_dfa *dfa, aa_state_t start,
+                             const char *str, const char **retpos);
+aa_state_t aa_dfa_matchn_until(struct aa_dfa *dfa, aa_state_t start,
+                              const char *str, int n, const char **retpos);
 
 void aa_dfa_free_kref(struct kref *kref);
 
@@ -156,8 +156,8 @@ struct match_workbuf N = {          \
        .len = 0,                       \
 }
 
-unsigned int aa_dfa_leftmatch(struct aa_dfa *dfa, unsigned int start,
-                             const char *str, unsigned int *count);
+aa_state_t aa_dfa_leftmatch(struct aa_dfa *dfa, aa_state_t start,
+                           const char *str, unsigned int *count);
 
 /**
  * aa_get_dfa - increment refcount on dfa @p

diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
index 31c0af87625056c549248c14d84c7a6860d31280..3a7d165e8fcc11f5acf64c8946925a3563e311de 100644 (file)
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -78,7 +78,7 @@ struct aa_policydb {
        struct aa_dfa *dfa;
        struct aa_perms *perms;
        struct aa_domain trans;
-       unsigned int start[AA_CLASS_LAST + 1];
+       aa_state_t start[AA_CLASS_LAST + 1];
 };
 
 static inline void aa_destroy_policydb(struct aa_policydb *policy)
@@ -91,7 +91,7 @@ static inline void aa_destroy_policydb(struct aa_policydb *policy)
 }
 
 static inline struct aa_perms *aa_lookup_perms(struct aa_policydb *policy,
-                                              unsigned int state)
+                                              aa_state_t state)
 {
        unsigned int index = ACCEPT_TABLE(policy->dfa)[state];
 
@@ -239,7 +239,7 @@ static inline struct aa_profile *aa_get_newest_profile(struct aa_profile *p)
        return labels_profile(aa_get_newest_label(&p->label));
 }
 
-static inline unsigned int PROFILE_MEDIATES(struct aa_profile *profile,
+static inline aa_state_t PROFILE_MEDIATES(struct aa_profile *profile,
                                            unsigned char class)
 {
        if (class <= AA_CLASS_LAST)
@@ -249,13 +249,13 @@ static inline unsigned int PROFILE_MEDIATES(struct aa_profile *profile,
                                        profile->policy.start[0], &class, 1);
 }
 
-static inline unsigned int PROFILE_MEDIATES_AF(struct aa_profile *profile,
-                                              u16 AF) {
-       unsigned int state = PROFILE_MEDIATES(profile, AA_CLASS_NET);
+static inline aa_state_t PROFILE_MEDIATES_AF(struct aa_profile *profile,
+                                            u16 AF) {
+       aa_state_t state = PROFILE_MEDIATES(profile, AA_CLASS_NET);
        __be16 be_af = cpu_to_be16(AF);
 
        if (!state)
-               return 0;
+               return DFA_NOMATCH;
        return aa_dfa_match_len(profile->policy.dfa, state, (char *) &be_af, 2);
 }
 

diff --git a/security/apparmor/ipc.c b/security/apparmor/ipc.c
index 3dbbc59d440dae5708e503c2bda506a50b8bcb88..7255a9d52372880e1e8a942c6d2b1b9c92642f0c 100644 (file)
--- a/security/apparmor/ipc.c
+++ b/security/apparmor/ipc.c
@@ -79,7 +79,7 @@ static int profile_signal_perm(struct aa_profile *profile,
                               struct common_audit_data *sa)
 {
        struct aa_perms perms;
-       unsigned int state;
+       aa_state_t state;
 
        if (profile_unconfined(profile) ||
            !PROFILE_MEDIATES(profile, AA_CLASS_SIGNAL))

diff --git a/security/apparmor/label.c b/security/apparmor/label.c
index 30cb68641c0f505ba5398e2fffe0ded143e51c0f..3a967003fa7c70c6af30e1e876e86d94971757ec 100644 (file)
--- a/security/apparmor/label.c
+++ b/security/apparmor/label.c
@@ -1265,9 +1265,9 @@ static inline bool label_is_visible(struct aa_profile *profile,
  * If a subns profile is not to be matched should be prescreened with
  * visibility test.
  */
-static inline unsigned int match_component(struct aa_profile *profile,
-                                          struct aa_profile *tp,
-                                          unsigned int state)
+static inline aa_state_t match_component(struct aa_profile *profile,
+                                        struct aa_profile *tp,
+                                        aa_state_t state)
 {
        const char *ns_name;
 
@@ -1299,7 +1299,7 @@ static inline unsigned int match_component(struct aa_profile *profile,
  */
 static int label_compound_match(struct aa_profile *profile,
                                struct aa_label *label,
-                               unsigned int state, bool subns, u32 request,
+                               aa_state_t state, bool subns, u32 request,
                                struct aa_perms *perms)
 {
        struct aa_profile *tp;
@@ -1356,14 +1356,14 @@ fail:
  *        check to be stacked.
  */
 static int label_components_match(struct aa_profile *profile,
-                                 struct aa_label *label, unsigned int start,
+                                 struct aa_label *label, aa_state_t start,
                                  bool subns, u32 request,
                                  struct aa_perms *perms)
 {
        struct aa_profile *tp;
        struct label_it i;
        struct aa_perms tmp;
-       unsigned int state = 0;
+       aa_state_t state = 0;
 
        /* find first subcomponent to test */
        label_for_each(i, label, tp) {
@@ -1415,7 +1415,7 @@ fail:
  * Returns: the state the match finished in, may be the none matching state
  */
 int aa_label_match(struct aa_profile *profile, struct aa_label *label,
-                  unsigned int state, bool subns, u32 request,
+                  aa_state_t state, bool subns, u32 request,
                   struct aa_perms *perms)
 {
        int error = label_compound_match(profile, label, state, subns, request,

diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c
index 974a217218a6efa8c72e710a3bd3c02014313682..60deb4dc30c7f2e1a1b617b061521986a3005f12 100644 (file)
--- a/security/apparmor/lib.c
+++ b/security/apparmor/lib.c
@@ -357,7 +357,7 @@ void aa_profile_match_label(struct aa_profile *profile, struct aa_label *label,
                            int type, u32 request, struct aa_perms *perms)
 {
        /* TODO: doesn't yet handle extended types */
-       unsigned int state;
+       aa_state_t state;
 
        state = aa_dfa_next(profile->policy.dfa,
                            profile->policy.start[AA_CLASS_LABEL],

diff --git a/security/apparmor/match.c b/security/apparmor/match.c
index 3e9e1eaf990ed7a953da87505e76c1123c9a5a11..5095c26ca6836574718c5605e47951c573ab23dc 100644 (file)
--- a/security/apparmor/match.c
+++ b/security/apparmor/match.c
@@ -436,17 +436,17 @@ do {                                                      \
  *
  * Returns: final state reached after input is consumed
  */
-unsigned int aa_dfa_match_len(struct aa_dfa *dfa, unsigned int start,
-                             const char *str, int len)
+aa_state_t aa_dfa_match_len(struct aa_dfa *dfa, aa_state_t start,
+                           const char *str, int len)
 {
        u16 *def = DEFAULT_TABLE(dfa);
        u32 *base = BASE_TABLE(dfa);
        u16 *next = NEXT_TABLE(dfa);
        u16 *check = CHECK_TABLE(dfa);
-       unsigned int state = start;
+       aa_state_t state = start;
 
-       if (state == 0)
-               return 0;
+       if (state == DFA_NOMATCH)
+               return DFA_NOMATCH;
 
        /* current state is <state>, matching character *str */
        if (dfa->tables[YYTD_ID_EC]) {
@@ -476,17 +476,16 @@ unsigned int aa_dfa_match_len(struct aa_dfa *dfa, unsigned int start,
  *
  * Returns: final state reached after input is consumed
  */
-unsigned int aa_dfa_match(struct aa_dfa *dfa, unsigned int start,
-                         const char *str)
+aa_state_t aa_dfa_match(struct aa_dfa *dfa, aa_state_t start, const char *str)
 {
        u16 *def = DEFAULT_TABLE(dfa);
        u32 *base = BASE_TABLE(dfa);
        u16 *next = NEXT_TABLE(dfa);
        u16 *check = CHECK_TABLE(dfa);
-       unsigned int state = start;
+       aa_state_t state = start;
 
-       if (state == 0)
-               return 0;
+       if (state == DFA_NOMATCH)
+               return DFA_NOMATCH;
 
        /* current state is <state>, matching character *str */
        if (dfa->tables[YYTD_ID_EC]) {
@@ -515,8 +514,7 @@ unsigned int aa_dfa_match(struct aa_dfa *dfa, unsigned int start,
  *
  * Returns: state reach after input @c
  */
-unsigned int aa_dfa_next(struct aa_dfa *dfa, unsigned int state,
-                         const char c)
+aa_state_t aa_dfa_next(struct aa_dfa *dfa, aa_state_t state, const char c)
 {
        u16 *def = DEFAULT_TABLE(dfa);
        u32 *base = BASE_TABLE(dfa);
@@ -534,7 +532,7 @@ unsigned int aa_dfa_next(struct aa_dfa *dfa, unsigned int state,
        return state;
 }
 
-unsigned int aa_dfa_outofband_transition(struct aa_dfa *dfa, unsigned int state)
+aa_state_t aa_dfa_outofband_transition(struct aa_dfa *dfa, aa_state_t state)
 {
        u16 *def = DEFAULT_TABLE(dfa);
        u32 *base = BASE_TABLE(dfa);
@@ -564,7 +562,7 @@ unsigned int aa_dfa_outofband_transition(struct aa_dfa *dfa, unsigned int state)
  *
  * Returns: final state reached after input is consumed
  */
-unsigned int aa_dfa_match_until(struct aa_dfa *dfa, unsigned int start,
+aa_state_t aa_dfa_match_until(struct aa_dfa *dfa, aa_state_t start,
                                const char *str, const char **retpos)
 {
        u16 *def = DEFAULT_TABLE(dfa);
@@ -572,10 +570,10 @@ unsigned int aa_dfa_match_until(struct aa_dfa *dfa, unsigned int start,
        u16 *next = NEXT_TABLE(dfa);
        u16 *check = CHECK_TABLE(dfa);
        u32 *accept = ACCEPT_TABLE(dfa);
-       unsigned int state = start, pos;
+       aa_state_t state = start, pos;
 
-       if (state == 0)
-               return 0;
+       if (state == DFA_NOMATCH)
+               return DFA_NOMATCH;
 
        /* current state is <state>, matching character *str */
        if (dfa->tables[YYTD_ID_EC]) {
@@ -625,7 +623,7 @@ unsigned int aa_dfa_match_until(struct aa_dfa *dfa, unsigned int start,
  *
  * Returns: final state reached after input is consumed
  */
-unsigned int aa_dfa_matchn_until(struct aa_dfa *dfa, unsigned int start,
+aa_state_t aa_dfa_matchn_until(struct aa_dfa *dfa, aa_state_t start,
                                 const char *str, int n, const char **retpos)
 {
        u16 *def = DEFAULT_TABLE(dfa);
@@ -633,11 +631,11 @@ unsigned int aa_dfa_matchn_until(struct aa_dfa *dfa, unsigned int start,
        u16 *next = NEXT_TABLE(dfa);
        u16 *check = CHECK_TABLE(dfa);
        u32 *accept = ACCEPT_TABLE(dfa);
-       unsigned int state = start, pos;
+       aa_state_t state = start, pos;
 
        *retpos = NULL;
-       if (state == 0)
-               return 0;
+       if (state == DFA_NOMATCH)
+               return DFA_NOMATCH;
 
        /* current state is <state>, matching character *str */
        if (dfa->tables[YYTD_ID_EC]) {
@@ -677,11 +675,11 @@ do {                                                              \
 } while (0)
 
 /* For DFAs that don't support extended tagging of states */
-static bool is_loop(struct match_workbuf *wb, unsigned int state,
+static bool is_loop(struct match_workbuf *wb, aa_state_t state,
                    unsigned int *adjust)
 {
-       unsigned int pos = wb->pos;
-       unsigned int i;
+       aa_state_t pos = wb->pos;
+       aa_state_t i;
 
        if (wb->history[pos] < state)
                return false;
@@ -700,7 +698,7 @@ static bool is_loop(struct match_workbuf *wb, unsigned int state,
        return true;
 }
 
-static unsigned int leftmatch_fb(struct aa_dfa *dfa, unsigned int start,
+static aa_state_t leftmatch_fb(struct aa_dfa *dfa, aa_state_t start,
                                 const char *str, struct match_workbuf *wb,
                                 unsigned int *count)
 {
@@ -708,7 +706,7 @@ static unsigned int leftmatch_fb(struct aa_dfa *dfa, unsigned int start,
        u32 *base = BASE_TABLE(dfa);
        u16 *next = NEXT_TABLE(dfa);
        u16 *check = CHECK_TABLE(dfa);
-       unsigned int state = start, pos;
+       aa_state_t state = start, pos;
 
        AA_BUG(!dfa);
        AA_BUG(!str);
@@ -716,8 +714,8 @@ static unsigned int leftmatch_fb(struct aa_dfa *dfa, unsigned int start,
        AA_BUG(!count);
 
        *count = 0;
-       if (state == 0)
-               return 0;
+       if (state == DFA_NOMATCH)
+               return DFA_NOMATCH;
 
        /* current state is <state>, matching character *str */
        if (dfa->tables[YYTD_ID_EC]) {
@@ -781,8 +779,8 @@ out:
  *
  * Returns: final state reached after input is consumed
  */
-unsigned int aa_dfa_leftmatch(struct aa_dfa *dfa, unsigned int start,
-                             const char *str, unsigned int *count)
+aa_state_t aa_dfa_leftmatch(struct aa_dfa *dfa, aa_state_t start,
+                           const char *str, unsigned int *count)
 {
        DEFINE_MATCH_WB(wb);
 

diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c
index 7594f3a3441e5b6698ced55737240602a98bca94..84aaf25e5deef115171d904efcaa19589b6afb46 100644 (file)
--- a/security/apparmor/mount.c
+++ b/security/apparmor/mount.c
@@ -190,7 +190,7 @@ static int audit_mount(struct aa_profile *profile, const char *op,
  *
  * Returns: next state after flags match
  */
-static unsigned int match_mnt_flags(struct aa_dfa *dfa, unsigned int state,
+static aa_state_t match_mnt_flags(struct aa_dfa *dfa, aa_state_t state,
                                    unsigned long flags)
 {
        unsigned int i;
@@ -217,12 +217,12 @@ static const char * const mnt_info_table[] = {
  * Returns 0 on success else element that match failed in, this is the
  * index into the mnt_info_table above
  */
-static int do_match_mnt(struct aa_policydb *policy, unsigned int start,
+static int do_match_mnt(struct aa_policydb *policy, aa_state_t start,
                        const char *mntpnt, const char *devname,
                        const char *type, unsigned long flags,
                        void *data, bool binary, struct aa_perms *perms)
 {
-       unsigned int state;
+       aa_state_t state;
 
        AA_BUG(!policy);
        AA_BUG(!policy->dfa);
@@ -567,7 +567,7 @@ static int profile_umount(struct aa_profile *profile, const struct path *path,
 {
        struct aa_perms perms = { };
        const char *name = NULL, *info = NULL;
-       unsigned int state;
+       aa_state_t state;
        int error;
 
        AA_BUG(!profile);
@@ -627,7 +627,7 @@ static struct aa_label *build_pivotroot(struct aa_profile *profile,
        const char *old_name, *new_name = NULL, *info = NULL;
        const char *trans_name = NULL;
        struct aa_perms perms = { };
-       unsigned int state;
+       aa_state_t state;
        int error;
 
        AA_BUG(!profile);

diff --git a/security/apparmor/net.c b/security/apparmor/net.c
index fcfb97079e1beea460ef5085097aef53a4126aef..d420d3aec3b859b1b315950e1e2533aec9a3ec5c 100644 (file)
--- a/security/apparmor/net.c
+++ b/security/apparmor/net.c
@@ -109,7 +109,7 @@ int aa_profile_af_perm(struct aa_profile *profile, struct common_audit_data *sa,
                       u32 request, u16 family, int type)
 {
        struct aa_perms perms = { };
-       unsigned int state;
+       aa_state_t state;
        __be16 buffer[2];
 
        AA_BUG(family >= AF_MAX);

diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 0917412ba48f4230de616d7e138e54c735d3b253..3ea591d31be7e0f28c1b82f471577aebe34d3b49 100644 (file)
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -698,7 +698,7 @@ static u32 map_old_perms(u32 old)
 }
 
 static void compute_fperms_allow(struct aa_perms *perms, struct aa_dfa *dfa,
-                                unsigned int state)
+                                aa_state_t state)
 {
        perms->allow |= AA_MAY_GETATTR;
 
@@ -710,7 +710,7 @@ static void compute_fperms_allow(struct aa_perms *perms, struct aa_dfa *dfa,
 }
 
 static struct aa_perms compute_fperms_user(struct aa_dfa *dfa,
-                                          unsigned int state)
+                                          aa_state_t state)
 {
        struct aa_perms perms = { };
 
@@ -725,7 +725,7 @@ static struct aa_perms compute_fperms_user(struct aa_dfa *dfa,
 }
 
 static struct aa_perms compute_fperms_other(struct aa_dfa *dfa,
-                                           unsigned int state)
+                                           aa_state_t state)
 {
        struct aa_perms perms = { };
 
@@ -748,8 +748,8 @@ static struct aa_perms compute_fperms_other(struct aa_dfa *dfa,
  */
 static struct aa_perms *compute_fperms(struct aa_dfa *dfa)
 {
-       int state;
-       int state_count;
+       aa_state_t state;
+       unsigned int state_count;
        struct aa_perms *table;
 
        AA_BUG(!dfa);
@@ -796,7 +796,7 @@ static u32 map_other(u32 x)
 }
 
 static struct aa_perms compute_perms_entry(struct aa_dfa *dfa,
-                                          unsigned int state)
+                                          aa_state_t state)
 {
        struct aa_perms perms = { };
 
@@ -817,8 +817,8 @@ static struct aa_perms compute_perms_entry(struct aa_dfa *dfa,
 
 static struct aa_perms *compute_perms(struct aa_dfa *dfa)
 {
-       int state;
-       int state_count;
+       unsigned int state;
+       unsigned int state_count;
        struct aa_perms *table;
 
        AA_BUG(!dfa);