kernel/security/apparmor/include/policy_ns.h, branch linux-4.16.y

apparmor: switch from profiles to using labels on contexts

2017-06-11T00:11:38Z

Begin the actual switch to using domain labels by storing them on the context and converting the label to a singular profile where possible. Signed-off-by: John Johansen

apparmor: add namespace lookup fns()

2017-06-11T00:11:32Z

Currently lookups are restricted to a single ns component in the path. However when namespaces are allowed to have separate views, and scopes this will not be sufficient, as it will be possible to have a multiple component ns path in scope. Add some ns lookup fns() to allow this and use them. Signed-off-by: John Johansen

apparmor: add policy revision file interface

2017-06-11T00:11:27Z

Add a policy revision file to find the current revision of a ns's policy. There is a revision file per ns, as well as a virtualized global revision file in the base apparmor fs directory. The global revision file when opened will provide the revision of the opening task namespace. The revision file can be waited on via select/poll to detect apparmor policy changes from the last read revision of the opened file. This means that the revision file must be read after the select/poll other wise update data will remain ready for reading. Signed-off-by: John Johansen

apparmor: move to per loaddata files, instead of replicating in profiles

2017-06-08T19:51:49Z

The loaddata sets cover more than just a single profile and should be tracked at the ns level. Move the load data files under the namespace and reference the files from the profiles via a symlink. Signed-off-by: John Johansen Reviewed-by: Seth Arnold Reviewed-by: Kees Cook

apparmor: add special .null file used to "close" fds at exec

2017-01-16T09:18:35Z

Borrow the special null device file from selinux to "close" fds that don't have sufficient permissions at exec time. Signed-off-by: John Johansen

apparmor: refactor prepare_ns() and make usable from different views

2017-01-16T09:18:28Z

prepare_ns() will need to be called from alternate views, and namespaces will need to be created via different interfaces. So refactor and allow specifying the view ns. Signed-off-by: John Johansen

apparmor: allow ns visibility question to consider subnses

2017-01-16T09:18:22Z

Signed-off-by: John Johansen

apparmor: add fn to lookup profiles by fqname

2017-01-16T09:18:22Z

Signed-off-by: John Johansen

apparmor: add strn version of aa_find_ns

2017-01-16T09:18:20Z

Signed-off-by: John Johansen

apparmor: rename namespace to ns to improve code line lengths

2017-01-16T08:42:16Z

Signed-off-by: John Johansen