summaryrefslogtreecommitdiffstats
path: root/security/apparmor/include/policy_ns.h
Commit message (Collapse)AuthorAgeFilesLines
* apparmor: switch from profiles to using labels on contextsJohn Johansen2017-06-111-0/+4
| | | | | | | | Begin the actual switch to using domain labels by storing them on the context and converting the label to a singular profile where possible. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add namespace lookup fns()John Johansen2017-06-111-0/+13
| | | | | | | | | | | Currently lookups are restricted to a single ns component in the path. However when namespaces are allowed to have separate views, and scopes this will not be sufficient, as it will be possible to have a multiple component ns path in scope. Add some ns lookup fns() to allow this and use them. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add policy revision file interfaceJohn Johansen2017-06-111-0/+1
| | | | | | | | | | | | | | Add a policy revision file to find the current revision of a ns's policy. There is a revision file per ns, as well as a virtualized global revision file in the base apparmor fs directory. The global revision file when opened will provide the revision of the opening task namespace. The revision file can be waited on via select/poll to detect apparmor policy changes from the last read revision of the opened file. This means that the revision file must be read after the select/poll other wise update data will remain ready for reading. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: move to per loaddata files, instead of replicating in profilesJohn Johansen2017-06-081-0/+3
| | | | | | | | | | The loaddata sets cover more than just a single profile and should be tracked at the ns level. Move the load data files under the namespace and reference the files from the profiles via a symlink. Signed-off-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Seth Arnold <seth.arnold@canonical.com> Reviewed-by: Kees Cook <keescook@chromium.org>
* apparmor: add special .null file used to "close" fds at execJohn Johansen2017-01-161-0/+2
| | | | | | | Borrow the special null device file from selinux to "close" fds that don't have sufficient permissions at exec time. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: refactor prepare_ns() and make usable from different viewsJohn Johansen2017-01-161-1/+3
| | | | | | | | prepare_ns() will need to be called from alternate views, and namespaces will need to be created via different interfaces. So refactor and allow specifying the view ns. Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: allow ns visibility question to consider subnsesJohn Johansen2017-01-161-2/+2
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add fn to lookup profiles by fqnameJohn Johansen2017-01-161-5/+5
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: add strn version of aa_find_nsJohn Johansen2017-01-161-3/+10
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: rename namespace to ns to improve code line lengthsJohn Johansen2017-01-161-22/+21Star
| | | | Signed-off-by: John Johansen <john.johansen@canonical.com>
* apparmor: split apparmor policy namespaces code into its own fileJohn Johansen2017-01-161-0/+137
Policy namespaces will be diverging from profile management and expanding so put it in its own file. Signed-off-by: John Johansen <john.johansen@canonical.com>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2024-07-15 12:31:44 +0200