mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-31 06:16:03 +00:00
Code Issues Releases Wiki Activity

Add the ability to separate policy_version from kernel and parser abi

Browse Source 
This will allow for the parser to invalidate its caches separate of whether
the kernel policy version has changed. This can be desirable if a parser
bug is discovered, a new version the parser is shipped and we need to
force cache files to be regenerated.

Policy current stores a 32 bit version number in the header binary policy.
For newer policy (> v5 kernel abi) split this number into 3 separate
fields policy_version, parser_abi, kernel_abi.

If binary policy with a split version number is loaded to an older
kernel it will be correctly rejected as unsupported as those kernels
will see it as a none v5 version. For kernels that only support v5
policy on the kernel abi version is written.

The rules for policy versioning should be
policy_version:
  Set by text policy language version. Parsers that don't understand
  a specified version may fail, or drop rules they are unaware of.

parser_abi_version:
  gets bumped when a userspace bug is discovered that requires policy be
  recompiled. The policy version could be reset for each new kernel version
  but since the parser needs to support multiple kernel versions tracking
  this is extra work and should be avoided.

kernel_abi_version:
  gets bumped when semantic changes need to be applied. Eg unix domain
  sockets being mediated at connect.

  the kernel abi version does not encapsulate all supported features.
  As kernels could have different sets of patches supplied. Basic feature
  support is determined by the policy_mediates() encoding in the policydb.

  As such comparing cache features to kernel features is still needed
  to determine if cached policy is best matched to the kernel.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
This commit is contained in:
John Johansen
2014-04-23 11:00:32 -07:00
parent b9b99508e8
commit d05313f555
6 changed files with 125 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
parser/parser.h
View File

@@ -253,11 +253,49 @@ do { \
goto fail_target; \
} while (0)
#define u8 unsigned char
#define u16 uint16_t
#define u32 uint32_t
#define u64 uint64_t
#if __BYTE_ORDER == __BIG_ENDIAN
# define cpu_to_le16(x) ((u16)(bswap_16 ((u16) x)))
# define cpu_to_le32(x) ((u32)(bswap_32 ((u32) x)))
# define cpu_to_le64(x) ((u64)(bswap_64 ((u64) x)))
#else
# define cpu_to_le16(x) ((u16)(x))
# define cpu_to_le32(x) ((u32)(x))
# define cpu_to_le64(x) ((u64)(x))
#endif
/* The encoding for kernal abi > 5 is
* 28-31: reserved
* 20-27: policy version
* 12-19: policy abi version
* 11: force complain flag
* 10: reserved
* 0-9: kernel abi version
*/
#define ENCODE_VERSION(C, P, PABI, KABI) \
({ \
u32 version = (KABI) & 0x3ff; \
if ((KABI) > 5) { \
version |= (C) ? 1 << 11 : 0; \
version |= ((PABI) & 0xff) << 12; \
version |= ((P) & 0xff) << 20; \
} \
version; \
})
/* from parser_common.c */
extern uint32_t policy_version;
extern uint32_t parser_abi_version;
extern uint32_t kernel_abi_version;
extern int force_complain;
extern int perms_create;
extern int net_af_max_override;
extern int kernel_load;
extern int kernel_policy_version;
extern int kernel_supports_network;
extern int kernel_supports_policydb;
extern int kernel_supports_mount;