apparmor: change aad apparmor_audit_data macro to a fn macro

The aad macro can replace aad strings when it is not intended to. Switch
to a fn macro so it is only applied when intended.

Also at the same time cleanup audit_data initialization by putting
common boiler plate behind a macro, and dropping the gfp_t parameter
which will become useless.

Signed-off-by: John Johansen <john.johansen@canonical.com>

diff --git a/security/apparmor/audit.c b/security/apparmor/audit.c
index bcd28d8..0c81ff6 100644 (file)
--- a/security/apparmor/audit.c
+++ b/security/apparmor/audit.c
@@ -62,23 +62,23 @@ static void audit_pre(struct audit_buffer *ab, void *ca)
 
        if (aa_g_audit_header) {
                audit_log_format(ab, "apparmor=");
-               audit_log_string(ab, aa_audit_type[sa->aad->type]);
+               audit_log_string(ab, aa_audit_type[aad(sa)->type]);
        }
 
-       if (sa->aad->op) {
+       if (aad(sa)->op) {
                audit_log_format(ab, " operation=");
-               audit_log_string(ab, sa->aad->op);
+               audit_log_string(ab, aad(sa)->op);
        }
 
-       if (sa->aad->info) {
+       if (aad(sa)->info) {
                audit_log_format(ab, " info=");
-               audit_log_string(ab, sa->aad->info);
-               if (sa->aad->error)
-                       audit_log_format(ab, " error=%d", sa->aad->error);
+               audit_log_string(ab, aad(sa)->info);
+               if (aad(sa)->error)
+                       audit_log_format(ab, " error=%d", aad(sa)->error);
        }
 
-       if (sa->aad->profile) {
-               struct aa_profile *profile = sa->aad->profile;
+       if (aad(sa)->profile) {
+               struct aa_profile *profile = aad(sa)->profile;
                if (profile->ns != root_ns) {
                        audit_log_format(ab, " namespace=");
                        audit_log_untrustedstring(ab, profile->ns->base.hname);
@@ -87,9 +87,9 @@ static void audit_pre(struct audit_buffer *ab, void *ca)
                audit_log_untrustedstring(ab, profile->base.hname);
        }
 
-       if (sa->aad->name) {
+       if (aad(sa)->name) {
                audit_log_format(ab, " name=");
-               audit_log_untrustedstring(ab, sa->aad->name);
+               audit_log_untrustedstring(ab, aad(sa)->name);
        }
 }
 
@@ -101,7 +101,7 @@ static void audit_pre(struct audit_buffer *ab, void *ca)
 void aa_audit_msg(int type, struct common_audit_data *sa,
                  void (*cb) (struct audit_buffer *, void *))
 {
-       sa->aad->type = type;
+       aad(sa)->type = type;
        common_lsm_audit(sa, audit_pre, cb);
 }
 
@@ -109,7 +109,6 @@ void aa_audit_msg(int type, struct common_audit_data *sa,
  * aa_audit - Log a profile based audit event to the audit subsystem
  * @type: audit type for the message
  * @profile: profile to check against (NOT NULL)
- * @gfp: allocation flags to use
  * @sa: audit event (NOT NULL)
  * @cb: optional callback fn for type specific fields (MAYBE NULL)
  *
@@ -117,14 +116,13 @@ void aa_audit_msg(int type, struct common_audit_data *sa,
  *
  * Returns: error on failure
  */
-int aa_audit(int type, struct aa_profile *profile, gfp_t gfp,
-            struct common_audit_data *sa,
+int aa_audit(int type, struct aa_profile *profile, struct common_audit_data *sa,
             void (*cb) (struct audit_buffer *, void *))
 {
        BUG_ON(!profile);
 
        if (type == AUDIT_APPARMOR_AUTO) {
-               if (likely(!sa->aad->error)) {
+               if (likely(!aad(sa)->error)) {
                        if (AUDIT_MODE(profile) != AUDIT_ALL)
                                return 0;
                        type = AUDIT_APPARMOR_AUDIT;
@@ -136,23 +134,23 @@ int aa_audit(int type, struct aa_profile *profile, gfp_t gfp,
        if (AUDIT_MODE(profile) == AUDIT_QUIET ||
            (type == AUDIT_APPARMOR_DENIED &&
             AUDIT_MODE(profile) == AUDIT_QUIET))
-               return sa->aad->error;
+               return aad(sa)->error;
 
        if (KILL_MODE(profile) && type == AUDIT_APPARMOR_DENIED)
                type = AUDIT_APPARMOR_KILL;
 
        if (!unconfined(profile))
-               sa->aad->profile = profile;
+               aad(sa)->profile = profile;
 
        aa_audit_msg(type, sa, cb);
 
-       if (sa->aad->type == AUDIT_APPARMOR_KILL)
+       if (aad(sa)->type == AUDIT_APPARMOR_KILL)
                (void)send_sig_info(SIGKILL, NULL,
                        sa->type == LSM_AUDIT_DATA_TASK && sa->u.tsk ?
                                    sa->u.tsk : current);
 
-       if (sa->aad->type == AUDIT_APPARMOR_ALLOWED)
-               return complain_error(sa->aad->error);
+       if (aad(sa)->type == AUDIT_APPARMOR_ALLOWED)
+               return complain_error(aad(sa)->error);
 
-       return sa->aad->error;
+       return aad(sa)->error;
 }

diff --git a/security/apparmor/capability.c b/security/apparmor/capability.c
index 1101c6f..1d2e2de 100644 (file)
--- a/security/apparmor/capability.c
+++ b/security/apparmor/capability.c
@@ -66,13 +66,9 @@ static int audit_caps(struct aa_profile *profile, int cap, int error)
 {
        struct audit_cache *ent;
        int type = AUDIT_APPARMOR_AUTO;
-       struct common_audit_data sa;
-       struct apparmor_audit_data aad = {0,};
-       sa.type = LSM_AUDIT_DATA_CAP;
-       sa.aad = &aad;
+       DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_CAP, OP_CAPABLE);
        sa.u.cap = cap;
-       sa.aad->op = OP_CAPABLE;
-       sa.aad->error = error;
+       aad(&sa)->error = error;
 
        if (likely(!error)) {
                /* test if auditing is being forced */
@@ -104,7 +100,7 @@ static int audit_caps(struct aa_profile *profile, int cap, int error)
        }
        put_cpu_var(audit_cache);
 
-       return aa_audit(type, profile, GFP_ATOMIC, &sa, audit_cb);
+       return aa_audit(type, profile, &sa, audit_cb);
 }
 
 /**

diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index c2f1d65..d18b3f0 100644 (file)
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -508,8 +508,7 @@ x_clear:
        aa_clear_task_ctx_trans(ctx);
 
 audit:
-       error = aa_audit_file(profile, &perms, GFP_KERNEL, OP_EXEC, MAY_EXEC,
-                             name,
+       error = aa_audit_file(profile, &perms, OP_EXEC, MAY_EXEC, name,
                              new_profile ? new_profile->base.hname : NULL,
                              cond.uid, info, error);
 
@@ -714,9 +713,9 @@ int aa_change_hat(const char *hats[], int count, u64 token, bool permtest)
 
 audit:
        if (!permtest)
-               error = aa_audit_file(profile, &perms, GFP_KERNEL,
-                                     OP_CHANGE_HAT, AA_MAY_CHANGEHAT, NULL,
-                                     target, GLOBAL_ROOT_UID, info, error);
+               error = aa_audit_file(profile, &perms, OP_CHANGE_HAT,
+                                     AA_MAY_CHANGEHAT, NULL, target,
+                                     GLOBAL_ROOT_UID, info, error);
 
 out:
        aa_put_profile(hat);
@@ -842,8 +841,8 @@ int aa_change_profile(const char *ns_name, const char *hname, bool onexec,
 
 audit:
        if (!permtest)
-               error = aa_audit_file(profile, &perms, GFP_KERNEL, op, request,
-                                     name, hname, GLOBAL_ROOT_UID, info, error);
+               error = aa_audit_file(profile, &perms, op, request, name,
+                                     hname, GLOBAL_ROOT_UID, info, error);
 
        aa_put_ns(ns);
        aa_put_profile(target);

diff --git a/security/apparmor/file.c b/security/apparmor/file.c
index e04f044..750564c 100644 (file)
--- a/security/apparmor/file.c
+++ b/security/apparmor/file.c
@@ -67,24 +67,24 @@ static void file_audit_cb(struct audit_buffer *ab, void *va)
        struct common_audit_data *sa = va;
        kuid_t fsuid = current_fsuid();
 
-       if (sa->aad->fs.request & AA_AUDIT_FILE_MASK) {
+       if (aad(sa)->fs.request & AA_AUDIT_FILE_MASK) {
                audit_log_format(ab, " requested_mask=");
-               audit_file_mask(ab, sa->aad->fs.request);
+               audit_file_mask(ab, aad(sa)->fs.request);
        }
-       if (sa->aad->fs.denied & AA_AUDIT_FILE_MASK) {
+       if (aad(sa)->fs.denied & AA_AUDIT_FILE_MASK) {
                audit_log_format(ab, " denied_mask=");
-               audit_file_mask(ab, sa->aad->fs.denied);
+               audit_file_mask(ab, aad(sa)->fs.denied);
        }
-       if (sa->aad->fs.request & AA_AUDIT_FILE_MASK) {
+       if (aad(sa)->fs.request & AA_AUDIT_FILE_MASK) {
                audit_log_format(ab, " fsuid=%d",
                                 from_kuid(&init_user_ns, fsuid));
                audit_log_format(ab, " ouid=%d",
-                                from_kuid(&init_user_ns, sa->aad->fs.ouid));
+                                from_kuid(&init_user_ns, aad(sa)->fs.ouid));
        }
 
-       if (sa->aad->fs.target) {
+       if (aad(sa)->fs.target) {
                audit_log_format(ab, " target=");
-               audit_log_untrustedstring(ab, sa->aad->fs.target);
+               audit_log_untrustedstring(ab, aad(sa)->fs.target);
        }
 }
 
@@ -104,54 +104,53 @@ static void file_audit_cb(struct audit_buffer *ab, void *va)
  * Returns: %0 or error on failure
  */
 int aa_audit_file(struct aa_profile *profile, struct file_perms *perms,
-                 gfp_t gfp, const char *op, u32 request, const char *name,
+                 const char *op, u32 request, const char *name,
                  const char *target, kuid_t ouid, const char *info, int error)
 {
        int type = AUDIT_APPARMOR_AUTO;
-       struct common_audit_data sa;
-       struct apparmor_audit_data aad = {0,};
-       sa.type = LSM_AUDIT_DATA_TASK;
+       DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_TASK, op);
+
+       sa.u.tsk = NULL;
+       aad(&sa)->fs.request = request;
+       aad(&sa)->name = name;
+       aad(&sa)->fs.target = target;
+       aad(&sa)->fs.ouid = ouid;
+       aad(&sa)->info = info;
+       aad(&sa)->error = error;
        sa.u.tsk = NULL;
-       sa.aad = &aad;
-       aad.op = op,
-       aad.fs.request = request;
-       aad.name = name;
-       aad.fs.target = target;
-       aad.fs.ouid = ouid;
-       aad.info = info;
-       aad.error = error;
-
-       if (likely(!sa.aad->error)) {
+
+       if (likely(!aad(&sa)->error)) {
                u32 mask = perms->audit;
 
                if (unlikely(AUDIT_MODE(profile) == AUDIT_ALL))
                        mask = 0xffff;
 
                /* mask off perms that are not being force audited */
-               sa.aad->fs.request &= mask;
+               aad(&sa)->fs.request &= mask;
 
-               if (likely(!sa.aad->fs.request))
+               if (likely(!aad(&sa)->fs.request))
                        return 0;
                type = AUDIT_APPARMOR_AUDIT;
        } else {
                /* only report permissions that were denied */
-               sa.aad->fs.request = sa.aad->fs.request & ~perms->allow;
+               aad(&sa)->fs.request = aad(&sa)->fs.request & ~perms->allow;
+               AA_BUG(!aad(&sa)->fs.request);
 
-               if (sa.aad->fs.request & perms->kill)
+               if (aad(&sa)->fs.request & perms->kill)
                        type = AUDIT_APPARMOR_KILL;
 
                /* quiet known rejects, assumes quiet and kill do not overlap */
-               if ((sa.aad->fs.request & perms->quiet) &&
+               if ((aad(&sa)->fs.request & perms->quiet) &&
                    AUDIT_MODE(profile) != AUDIT_NOQUIET &&
                    AUDIT_MODE(profile) != AUDIT_ALL)
-                       sa.aad->fs.request &= ~perms->quiet;
+                       aad(&sa)->fs.request &= ~perms->quiet;
 
-               if (!sa.aad->fs.request)
-                       return COMPLAIN_MODE(profile) ? 0 : sa.aad->error;
+               if (!aad(&sa)->fs.request)
+                       return COMPLAIN_MODE(profile) ? 0 : aad(&sa)->error;
        }
 
-       sa.aad->fs.denied = sa.aad->fs.request & ~perms->allow;
-       return aa_audit(type, profile, gfp, &sa, file_audit_cb);
+       aad(&sa)->fs.denied = aad(&sa)->fs.request & ~perms->allow;
+       return aa_audit(type, profile, &sa, file_audit_cb);
 }
 
 /**
@@ -302,8 +301,8 @@ int aa_path_perm(const char *op, struct aa_profile *profile,
                if (request & ~perms.allow)
                        error = -EACCES;
        }
-       error = aa_audit_file(profile, &perms, GFP_KERNEL, op, request, name,
-                             NULL, cond->uid, info, error);
+       error = aa_audit_file(profile, &perms, op, request, name, NULL,
+                             cond->uid, info, error);
        kfree(buffer);
 
        return error;
@@ -430,7 +429,7 @@ done_tests:
        error = 0;
 
 audit:
-       error = aa_audit_file(profile, &lperms, GFP_KERNEL, OP_LINK, request,
+       error = aa_audit_file(profile, &lperms, OP_LINK, request,
                              lname, tname, cond.uid, info, error);
        kfree(buffer);
        kfree(buffer2);

diff --git a/security/apparmor/include/audit.h b/security/apparmor/include/audit.h
index 956c0b1..fdc4774 100644 (file)
--- a/security/apparmor/include/audit.h
+++ b/security/apparmor/include/audit.h
@@ -108,34 +108,53 @@ struct apparmor_audit_data {
        const char *name;
        const char *info;
        union {
-               void *target;
+               /* these entries require a custom callback fn */
                struct {
+                       struct aa_profile *peer;
+                       struct {
+                               const char *target;
+                               u32 request;
+                               u32 denied;
+                               kuid_t ouid;
+                       } fs;
+               };
+               struct {
+                       const char *name;
                        long pos;
                        const char *ns;
-                       void *target;
                } iface;
                struct {
                        int rlim;
                        unsigned long max;
                } rlim;
-               struct {
-                       const char *target;
-                       u32 request;
-                       u32 denied;
-                       kuid_t ouid;
-               } fs;
        };
 };
 
-/* define a short hand for apparmor_audit_data structure */
-#define aad apparmor_audit_data
+/* macros for dealing with  apparmor_audit_data structure */
+#define aad(SA) ((SA)->apparmor_audit_data)
+#define DEFINE_AUDIT_DATA(NAME, T, X)                                  \
+       /* TODO: cleanup audit init so we don't need _aad = {0,} */     \
+       struct apparmor_audit_data NAME ## _aad = { .op = (X), };       \
+       struct common_audit_data NAME =                                 \
+       {                                                               \
+       .type = (T),                                                    \
+       .u.tsk = NULL,                                                  \
+       };                                                              \
+       NAME.apparmor_audit_data = &(NAME ## _aad)
 
 void aa_audit_msg(int type, struct common_audit_data *sa,
                  void (*cb) (struct audit_buffer *, void *));
-int aa_audit(int type, struct aa_profile *profile, gfp_t gfp,
-            struct common_audit_data *sa,
+int aa_audit(int type, struct aa_profile *profile, struct common_audit_data *sa,
             void (*cb) (struct audit_buffer *, void *));
 
+#define aa_audit_error(ERROR, SA, CB)                          \
+({                                                             \
+       aad((SA))->error = (ERROR);                             \
+       aa_audit_msg(AUDIT_APPARMOR_ERROR, (SA), (CB));         \
+       aad((SA))->error;                                       \
+})
+
+
 static inline int complain_error(int error)
 {
        if (error == -EPERM || error == -EACCES)

diff --git a/security/apparmor/include/file.h b/security/apparmor/include/file.h
index 0eb5436..38f821b 100644 (file)
--- a/security/apparmor/include/file.h
+++ b/security/apparmor/include/file.h
@@ -145,7 +145,7 @@ static inline u16 dfa_map_xindex(u16 mask)
        dfa_map_xindex((ACCEPT_TABLE(dfa)[state] >> 14) & 0x3fff)
 
 int aa_audit_file(struct aa_profile *profile, struct file_perms *perms,
-                 gfp_t gfp, const char *op, u32 request, const char *name,
+                 const char *op, u32 request, const char *name,
                  const char *target, kuid_t ouid, const char *info, int error);
 
 /**

diff --git a/security/apparmor/ipc.c b/security/apparmor/ipc.c
index 777ac1c..edac790 100644 (file)
--- a/security/apparmor/ipc.c
+++ b/security/apparmor/ipc.c
@@ -25,8 +25,8 @@
 static void audit_cb(struct audit_buffer *ab, void *va)
 {
        struct common_audit_data *sa = va;
-       audit_log_format(ab, " target=");
-       audit_log_untrustedstring(ab, sa->aad->target);
+       audit_log_format(ab, " peer=");
+       audit_log_untrustedstring(ab, aad(sa)->peer->base.hname);
 }
 
 /**
@@ -40,16 +40,12 @@ static void audit_cb(struct audit_buffer *ab, void *va)
 static int aa_audit_ptrace(struct aa_profile *profile,
                           struct aa_profile *target, int error)
 {
-       struct common_audit_data sa;
-       struct apparmor_audit_data aad = {0,};
-       sa.type = LSM_AUDIT_DATA_NONE;
-       sa.aad = &aad;
-       aad.op = OP_PTRACE;
-       aad.target = target;
-       aad.error = error;
+       DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_PTRACE);
 
-       return aa_audit(AUDIT_APPARMOR_AUTO, profile, GFP_ATOMIC, &sa,
-                       audit_cb);
+       aad(&sa)->peer = target;
+       aad(&sa)->error = error;
+
+       return aa_audit(AUDIT_APPARMOR_AUTO, profile, &sa, audit_cb);
 }
 
 /**

diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c
index 5d8ef31..66475bd 100644 (file)
--- a/security/apparmor/lib.c
+++ b/security/apparmor/lib.c
@@ -120,11 +120,9 @@ const char *aa_splitn_fqname(const char *fqname, size_t n, const char **ns_name,
 void aa_info_message(const char *str)
 {
        if (audit_enabled) {
-               struct common_audit_data sa;
-               struct apparmor_audit_data aad = {0,};
-               sa.type = LSM_AUDIT_DATA_NONE;
-               sa.aad = &aad;
-               aad.info = str;
+               DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, NULL);
+
+               aad(&sa)->info = str;
                aa_audit_msg(AUDIT_APPARMOR_STATUS, &sa, NULL);
        }
        printk(KERN_INFO "AppArmor: %s\n", str);

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index c751b03..c4bae8a 100644 (file)
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -504,11 +504,10 @@ static int apparmor_getprocattr(struct task_struct *task, char *name,
 static int apparmor_setprocattr(struct task_struct *task, char *name,
                                void *value, size_t size)
 {
-       struct common_audit_data sa;
-       struct apparmor_audit_data aad = {0,};
        char *command, *largs = NULL, *args = value;
        size_t arg_size;
        int error;
+       DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_SETPROCATTR);
 
        if (size == 0)
                return -EINVAL;
@@ -568,12 +567,9 @@ out:
        return error;
 
 fail:
-       sa.type = LSM_AUDIT_DATA_NONE;
-       sa.aad = &aad;
-       aad.profile = aa_current_profile();
-       aad.op = OP_SETPROCATTR;
-       aad.info = name;
-       aad.error = error = -EINVAL;
+       aad(&sa)->profile = aa_current_profile();
+       aad(&sa)->info = name;
+       aad(&sa)->error = error = -EINVAL;
        aa_audit_msg(AUDIT_APPARMOR_DENIED, &sa, NULL);
        goto out;
 }

diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index 17754ee..bc63cf7 100644 (file)
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -588,9 +588,9 @@ static void audit_cb(struct audit_buffer *ab, void *va)
 {
        struct common_audit_data *sa = va;
 
-       if (sa->aad->iface.ns) {
+       if (aad(sa)->iface.ns) {
                audit_log_format(ab, " ns=");
-               audit_log_untrustedstring(ab, sa->aad->iface.ns);
+               audit_log_untrustedstring(ab, aad(sa)->iface.ns);
        }
 }
 
@@ -606,22 +606,18 @@ static void audit_cb(struct audit_buffer *ab, void *va)
  *
  * Returns: the error to be returned after audit is done
  */
-static int audit_policy(struct aa_profile *profile, const char *op, gfp_t gfp,
+static int audit_policy(struct aa_profile *profile, const char *op,
                        const char *nsname, const char *name,
                        const char *info, int error)
 {
-       struct common_audit_data sa;
-       struct apparmor_audit_data aad = {0,};
-       sa.type = LSM_AUDIT_DATA_NONE;
-       sa.aad = &aad;
-       aad.op = op;
-       aad.iface.ns = nsname;
-       aad.name = name;
-       aad.info = info;
-       aad.error = error;
-
-       return aa_audit(AUDIT_APPARMOR_STATUS, profile, gfp,
-                       &sa, audit_cb);
+       DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, op);
+
+       aad(&sa)->iface.ns = nsname;
+       aad(&sa)->name = name;
+       aad(&sa)->info = info;
+       aad(&sa)->error = error;
+
+       return aa_audit(AUDIT_APPARMOR_STATUS, profile, &sa, audit_cb);
 }
 
 /**
@@ -675,11 +671,11 @@ int aa_may_manage_policy(struct aa_profile *profile, struct aa_ns *ns,
 {
        /* check if loading policy is locked out */
        if (aa_g_lock_policy)
-               return audit_policy(profile, op, GFP_KERNEL, NULL, NULL,
+               return audit_policy(profile, op, NULL, NULL,
                             "policy_locked", -EACCES);
 
        if (!policy_admin_capable(ns))
-               return audit_policy(profile, op, GFP_KERNEL, NULL, NULL,
+               return audit_policy(profile, op, NULL, NULL,
                                    "not policy admin", -EACCES);
 
        /* TODO: add fine grained mediation of policy loads */
@@ -937,8 +933,8 @@ ssize_t aa_replace_profiles(struct aa_ns *view, struct aa_profile *profile,
                list_del_init(&ent->list);
                op = (!ent->old && !ent->rename) ? OP_PROF_LOAD : OP_PROF_REPL;
 
-               audit_policy(profile, op, GFP_ATOMIC, NULL,
-                            ent->new->base.hname, NULL, error);
+               audit_policy(profile, op, NULL, ent->new->base.hname,
+                            NULL, error);
 
                if (ent->old) {
                        __replace_profile(ent->old, ent->new, 1);
@@ -993,7 +989,7 @@ fail_lock:
        /* audit cause of failure */
        op = (!ent->old) ? OP_PROF_LOAD : OP_PROF_REPL;
 fail:
-       audit_policy(profile, op, GFP_KERNEL, ns_name, ent->new->base.hname,
+       audit_policy(profile, op, ns_name, ent->new->base.hname,
                     info, error);
        /* audit status that rest of profiles in the atomic set failed too */
        info = "valid profile in failed atomic policy load";
@@ -1004,7 +1000,7 @@ fail:
                        continue;
                }
                op = (!ent->old) ? OP_PROF_LOAD : OP_PROF_REPL;
-               audit_policy(profile, op, GFP_KERNEL, ns_name,
+               audit_policy(profile, op, ns_name,
                             tmp->new->base.hname, info, error);
        }
        list_for_each_entry_safe(ent, tmp, &lh, list) {
@@ -1079,7 +1075,7 @@ ssize_t aa_remove_profiles(struct aa_ns *view, struct aa_profile *subj,
        }
 
        /* don't fail removal if audit fails */
-       (void) audit_policy(subj, OP_PROF_RM, GFP_KERNEL, ns_name, name, info,
+       (void) audit_policy(subj, OP_PROF_RM, ns_name, name, info,
                            error);
        aa_put_ns(ns);
        aa_put_profile(profile);
@@ -1090,7 +1086,7 @@ fail_ns_lock:
        aa_put_ns(ns);
 
 fail:
-       (void) audit_policy(subj, OP_PROF_RM, GFP_KERNEL, ns_name, name, info,
+       (void) audit_policy(subj, OP_PROF_RM, ns_name, name, info,
                            error);
        return error;
 }

diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 38c148f..441efc9 100644 (file)
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -79,13 +79,17 @@ struct aa_ext {
 static void audit_cb(struct audit_buffer *ab, void *va)
 {
        struct common_audit_data *sa = va;
-       if (sa->aad->iface.target) {
-               struct aa_profile *name = sa->aad->iface.target;
+
+       if (aad(sa)->iface.ns) {
+               audit_log_format(ab, " ns=");
+               audit_log_untrustedstring(ab, aad(sa)->iface.ns);
+       }
+       if (aad(sa)->iface.name) {
                audit_log_format(ab, " name=");
-               audit_log_untrustedstring(ab, name->base.hname);
+               audit_log_untrustedstring(ab, aad(sa)->iface.name);
        }
-       if (sa->aad->iface.pos)
-               audit_log_format(ab, " offset=%ld", sa->aad->iface.pos);
+       if (aad(sa)->iface.pos)
+               audit_log_format(ab, " offset=%ld", aad(sa)->iface.pos);
 }
 
 /**
@@ -104,20 +108,18 @@ static int audit_iface(struct aa_profile *new, const char *ns_name,
                       int error)
 {
        struct aa_profile *profile = __aa_current_profile();
-       struct common_audit_data sa;
-       struct apparmor_audit_data aad = {0,};
-       sa.type = LSM_AUDIT_DATA_NONE;
-       sa.aad = &aad;
-       aad.iface.ns = ns_name;
+       DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, NULL);
        if (e)
-               aad.iface.pos = e->pos - e->start;
-       aad.iface.target = new;
-       aad.name = name;
-       aad.info = info;
-       aad.error = error;
-
-       return aa_audit(AUDIT_APPARMOR_STATUS, profile, GFP_KERNEL, &sa,
-                       audit_cb);
+               aad(&sa)->iface.pos = e->pos - e->start;
+       aad(&sa)->iface.ns = ns_name;
+       if (new)
+               aad(&sa)->iface.name = new->base.hname;
+       else
+               aad(&sa)->iface.name = name;
+       aad(&sa)->info = info;
+       aad(&sa)->error = error;
+
+       return aa_audit(AUDIT_APPARMOR_STATUS, profile, &sa, audit_cb);
 }
 
 void aa_loaddata_kref(struct kref *kref)

diff --git a/security/apparmor/resource.c b/security/apparmor/resource.c
index 67a6072..86a941a 100644 (file)
--- a/security/apparmor/resource.c
+++ b/security/apparmor/resource.c
@@ -35,7 +35,7 @@ static void audit_cb(struct audit_buffer *ab, void *va)
        struct common_audit_data *sa = va;
 
        audit_log_format(ab, " rlimit=%s value=%lu",
-                        rlim_names[sa->aad->rlim.rlim], sa->aad->rlim.max);
+                        rlim_names[aad(sa)->rlim.rlim], aad(sa)->rlim.max);
 }
 
 /**
@@ -50,17 +50,12 @@ static void audit_cb(struct audit_buffer *ab, void *va)
 static int audit_resource(struct aa_profile *profile, unsigned int resource,
                          unsigned long value, int error)
 {
-       struct common_audit_data sa;
-       struct apparmor_audit_data aad = {0,};
-
-       sa.type = LSM_AUDIT_DATA_NONE;
-       sa.aad = &aad;
-       aad.op = OP_SETRLIMIT,
-       aad.rlim.rlim = resource;
-       aad.rlim.max = value;
-       aad.error = error;
-       return aa_audit(AUDIT_APPARMOR_AUTO, profile, GFP_KERNEL, &sa,
-                       audit_cb);
+       DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_SETRLIMIT);
+
+       aad(&sa)->rlim.rlim = resource;
+       aad(&sa)->rlim.max = value;
+       aad(&sa)->error = error;
+       return aa_audit(AUDIT_APPARMOR_AUTO, profile, &sa, audit_cb);
 }
 
 /**