kernel/security/apparmor/include/apparmorfs.h, branch linux-4.16.y

apparmor: add policy revision file interface

2017-06-11T00:11:27Z

Add a policy revision file to find the current revision of a ns's policy. There is a revision file per ns, as well as a virtualized global revision file in the base apparmor fs directory. The global revision file when opened will provide the revision of the opening task namespace. The revision file can be waited on via select/poll to detect apparmor policy changes from the last read revision of the opened file. This means that the revision file must be read after the select/poll other wise update data will remain ready for reading. Signed-off-by: John Johansen

apparmor: allow specifying an already created dir to create ns entries in

2017-06-08T19:51:52Z

Signed-off-by: John Johansen Reviewed-by: Seth Arnold Reviewed-by: Kees Cook

apparmor: rename apparmor file fns and data to indicate use

2017-06-08T19:51:52Z

prefixes are used for fns/data that are not static to apparmorfs.c with the prefixes being aafs - special magic apparmorfs for policy namespace data aa_sfs - for fns/data that go into securityfs aa_fs - for fns/data that may be used in the either of aafs or securityfs Signed-off-by: John Johansen Reviewed-by: Seth Arnold Reviewed-by: Kees Cook

apparmor: move to per loaddata files, instead of replicating in profiles

2017-06-08T19:51:49Z

The loaddata sets cover more than just a single profile and should be tracked at the ns level. Move the load data files under the namespace and reference the files from the profiles via a symlink. Signed-off-by: John Johansen Reviewed-by: Seth Arnold Reviewed-by: Kees Cook

apparmor: add per policy ns .load, .replace, .remove interface files

2017-01-16T09:18:44Z

Having per policy ns interface files helps with containers restoring policy. Signed-off-by: John Johansen

apparmor: allow introspecting the loaded policy pre internal transform

2017-01-16T09:18:42Z

Store loaded policy and allow introspecting it through apparmorfs. This has several uses from debugging, policy validation, and policy checkpoint and restore for containers. Signed-off-by: John Johansen

apparmor: add special .null file used to "close" fds at exec

2017-01-16T09:18:35Z

Borrow the special null device file from selinux to "close" fds that don't have sufficient permissions at exec time. Signed-off-by: John Johansen

apparmor: rename namespace to ns to improve code line lengths

2017-01-16T08:42:16Z

Signed-off-by: John Johansen

apparmor: add the ability to report a sha1 hash of loaded policy

2013-08-14T18:42:08Z

Provide userspace the ability to introspect a sha1 hash value for each profile currently loaded. Signed-off-by: John Johansen Acked-by: Seth Arnold

apparmor: add an optional profile attachment string for profiles

2013-08-14T18:42:07Z

Add the ability to take in and report a human readable profile attachment string for profiles so that attachment specifications can be easily inspected. Signed-off-by: John Johansen Acked-by: Seth Arnold