security/apparmor/policy.c

Source file repositories/reference/linux-study-clean/security/apparmor/policy.c

File Facts

System
Linux kernel
Corpus path
security/apparmor/policy.c
Extension
.c
Size
40608 bytes
Lines
1493
Domain
Core OS
Bucket
Security And Isolation
Inferred role
Core OS: implementation source
Status
source implementation candidate

Why This File Exists

Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.

Dependency Surface

Detected Declarations

Annotated Snippet

while (curr != profile) {

			while (!list_empty(&curr->base.profiles))
				curr = list_first_entry(&curr->base.profiles,
							struct aa_profile, base.list);

			to_remove = curr;
			if (!list_is_last(&to_remove->base.list,
					  &aa_deref_parent(curr)->base.profiles))
				curr = list_next_entry(to_remove, base.list);
			else
				curr = aa_deref_parent(curr);

			/* released by free_profile */
			aa_label_remove(&to_remove->label);
			__aafs_profile_rmdir(to_remove);
			__list_remove_profile(to_remove);
		}
	}

	/* released by free_profile */
	aa_label_remove(&profile->label);
	__aafs_profile_rmdir(profile);
	__list_remove_profile(profile);
}

/**
 * __aa_profile_list_release - remove all profiles on the list and put refs
 * @head: list of profiles  (NOT NULL)
 *
 * Requires: namespace lock be held
 */
void __aa_profile_list_release(struct list_head *head)
{
	struct aa_profile *profile, *tmp;
	list_for_each_entry_safe(profile, tmp, head, base.list)
		__remove_profile(profile);
}

/**
 * aa_free_data - free a data blob
 * @ptr: data to free
 * @arg: unused
 */
static void aa_free_data(void *ptr, void *arg)
{
	struct aa_data *data = ptr;

	if (!ptr)
		return;

	kvfree_sensitive(data->data, data->size);
	kfree_sensitive(data->key);
	kfree_sensitive(data);
}

static void free_attachment(struct aa_attachment *attach)
{
	int i;

	if (!attach)
		return;

	for (i = 0; i < attach->xattr_count; i++)
		kfree_sensitive(attach->xattrs[i]);
	kfree_sensitive(attach->xattrs);
	aa_put_pdb(attach->xmatch);
}

static void free_ruleset(struct aa_ruleset *rules)
{
	int i;

	if (!rules)
	  return;

	aa_put_pdb(rules->file);
	aa_put_pdb(rules->policy);
	aa_free_cap_rules(&rules->caps);
	aa_free_rlimit_rules(&rules->rlimits);

	for (i = 0; i < rules->secmark_count; i++)
		kfree_sensitive(rules->secmark[i].label);
	kfree_sensitive(rules->secmark);
	kfree_sensitive(rules);
}

struct aa_ruleset *aa_alloc_ruleset(gfp_t gfp)
{
	struct aa_ruleset *rules;

Annotation

Implementation Notes