[lxc-devel] [PATCH 2/3] add lsm op for checking if an lsm is present/enabled
Dwight Engen
dwight.engen at oracle.com
Tue Oct 15 17:51:20 UTC 2013
Signed-off-by: Dwight Engen <dwight.engen at oracle.com>
---
src/lxc/lsm/apparmor.c | 1 +
src/lxc/lsm/lsm.c | 7 +++++++
src/lxc/lsm/lsm.h | 3 +++
src/lxc/lsm/nop.c | 6 ++++++
src/lxc/lsm/selinux.c | 1 +
5 files changed, 18 insertions(+)
diff --git a/src/lxc/lsm/apparmor.c b/src/lxc/lsm/apparmor.c
index c13613a..146564f 100644
--- a/src/lxc/lsm/apparmor.c
+++ b/src/lxc/lsm/apparmor.c
@@ -167,6 +167,7 @@ static int apparmor_process_label_set(const char *label, int use_default)
static struct lsm_drv apparmor_drv = {
.name = "AppArmor",
+ .enabled = apparmor_enabled,
.process_label_get = apparmor_process_label_get,
.process_label_set = apparmor_process_label_set,
};
diff --git a/src/lxc/lsm/lsm.c b/src/lxc/lsm/lsm.c
index 3974f11..f022de9 100644
--- a/src/lxc/lsm/lsm.c
+++ b/src/lxc/lsm/lsm.c
@@ -62,6 +62,13 @@ void lsm_init(void)
INFO("Initialized LSM security driver %s", drv->name);
}
+int lsm_enabled()
+{
+ if (drv)
+ return drv->enabled();
+ return 0;
+}
+
char *lsm_process_label_get(pid_t pid)
{
if (!drv) {
diff --git a/src/lxc/lsm/lsm.h b/src/lxc/lsm/lsm.h
index 2a82c66..ee093da 100644
--- a/src/lxc/lsm/lsm.h
+++ b/src/lxc/lsm/lsm.h
@@ -31,18 +31,21 @@ struct lxc_conf;
struct lsm_drv {
const char *name;
+ int (*enabled)(void);
char *(*process_label_get)(pid_t pid);
int (*process_label_set)(const char *label, int use_default);
};
#if HAVE_APPARMOR || HAVE_SELINUX
void lsm_init(void);
+int lsm_enabled(void);
char *lsm_process_label_get(pid_t pid);
int lsm_process_label_set(const char *label, int use_default);
int lsm_proc_mount(struct lxc_conf *lxc_conf);
void lsm_proc_unmount(struct lxc_conf *lxc_conf);
#else
static inline void lsm_init(void) { }
+static inline int lsm_enabled(void) { return 0; }
static inline char *lsm_process_label_get(pid_t pid) { return NULL; }
static inline int lsm_process_label_set(char *label, int use_default) { return 0; }
static inline int lsm_proc_mount(struct lxc_conf *lxc_conf) { return 0; }
diff --git a/src/lxc/lsm/nop.c b/src/lxc/lsm/nop.c
index 9184e6b..e39b0f5 100644
--- a/src/lxc/lsm/nop.c
+++ b/src/lxc/lsm/nop.c
@@ -34,8 +34,14 @@ static int nop_process_label_set(const char *label, int use_default)
return 0;
}
+static int nop_enabled(void)
+{
+ return 0;
+}
+
static struct lsm_drv nop_drv = {
.name = "nop",
+ .enabled = nop_enabled,
.process_label_get = nop_process_label_get,
.process_label_set = nop_process_label_set,
};
diff --git a/src/lxc/lsm/selinux.c b/src/lxc/lsm/selinux.c
index 6e44e8b..ef5beb0 100644
--- a/src/lxc/lsm/selinux.c
+++ b/src/lxc/lsm/selinux.c
@@ -89,6 +89,7 @@ static int selinux_process_label_set(const char *label, int use_default)
static struct lsm_drv selinux_drv = {
.name = "SELinux",
+ .enabled = is_selinux_enabled,
.process_label_get = selinux_process_label_get,
.process_label_set = selinux_process_label_set,
};
--
1.8.3.1
More information about the lxc-devel
mailing list