apparmor: switch getprocattr to using label_print fns()

Signed-off-by: John Johansen <john.johansen@canonical.com>

diff --git a/security/apparmor/include/procattr.h b/security/apparmor/include/procattr.h
index c0055d7..c8fd99c 100644 (file)
--- a/security/apparmor/include/procattr.h
+++ b/security/apparmor/include/procattr.h
@@ -15,7 +15,7 @@
 #ifndef __AA_PROCATTR_H
 #define __AA_PROCATTR_H
 
-int aa_getprocattr(struct aa_profile *profile, char **string);
+int aa_getprocattr(struct aa_label *label, char **string);
 int aa_setprocattr_changehat(char *args, size_t size, int flags);
 
 #endif /* __AA_PROCATTR_H */

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 3ba0853..f7f82ce 100644 (file)
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -522,7 +522,7 @@ static int apparmor_getprocattr(struct task_struct *task, char *name,
                error = -EINVAL;
 
        if (label)
-               error = aa_getprocattr(labels_profile(label), value);
+               error = aa_getprocattr(label, value);
 
        aa_put_label(label);
        put_cred(cred);

diff --git a/security/apparmor/procattr.c b/security/apparmor/procattr.c
index dce970d..d816173 100644 (file)
--- a/security/apparmor/procattr.c
+++ b/security/apparmor/procattr.c
@@ -34,51 +34,41 @@
  *
  * Returns: size of string placed in @string else error code on failure
  */
-int aa_getprocattr(struct aa_profile *profile, char **string)
+int aa_getprocattr(struct aa_label *label, char **string)
 {
-       char *str;
-       int len = 0, mode_len = 0, ns_len = 0, name_len;
-       const char *mode_str = aa_profile_mode_names[profile->mode];
-       const char *ns_name = NULL;
-       struct aa_ns *ns = profile->ns;
+       struct aa_ns *ns = labels_ns(label);
        struct aa_ns *current_ns = aa_get_current_ns();
-       char *s;
+       int len;
 
-       if (!aa_ns_visible(current_ns, ns, true))
+       if (!aa_ns_visible(current_ns, ns, true)) {
+               aa_put_ns(current_ns);
                return -EACCES;
+       }
 
-       ns_name = aa_ns_name(current_ns, ns, true);
-       ns_len = strlen(ns_name);
-
-       /* if the visible ns_name is > 0 increase size for : :// seperator */
-       if (ns_len)
-               ns_len += 4;
-
-       /* unconfined profiles don't have a mode string appended */
-       if (!profile_unconfined(profile))
-               mode_len = strlen(mode_str) + 3;        /* + 3 for _() */
+       len = aa_label_snxprint(NULL, 0, current_ns, label,
+                               FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
+                               FLAG_HIDDEN_UNCONFINED);
+       AA_BUG(len < 0);
 
-       name_len = strlen(profile->base.hname);
-       len = mode_len + ns_len + name_len + 1;     /* + 1 for \n */
-       s = str = kmalloc(len + 1, GFP_KERNEL);     /* + 1 \0 */
-       if (!str)
+       *string = kmalloc(len + 2, GFP_KERNEL);
+       if (!*string) {
+               aa_put_ns(current_ns);
                return -ENOMEM;
+       }
 
-       if (ns_len) {
-               /* skip over prefix current_ns->base.hname and separating // */
-               sprintf(s, ":%s://", ns_name);
-               s += ns_len;
+       len = aa_label_snxprint(*string, len + 2, current_ns, label,
+                               FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
+                               FLAG_HIDDEN_UNCONFINED);
+       if (len < 0) {
+               aa_put_ns(current_ns);
+               return len;
        }
-       if (profile_unconfined(profile))
-               /* mode string not being appended */
-               sprintf(s, "%s\n", profile->base.hname);
-       else
-               sprintf(s, "%s (%s)\n", profile->base.hname, mode_str);
-       *string = str;
-       aa_put_ns(current_ns);
 
-       /* NOTE: len does not include \0 of string, not saved as part of file */
-       return len;
+       (*string)[len] = '\n';
+       (*string)[len + 1] = 0;
+
+       aa_put_ns(current_ns);
+       return len + 1;
 }
 
 /**