linux-toradex.git/security/apparmor/include/file.h, branch v6.3-rc3

apparmor: make __aa_path_perm() static

2022-10-03T21:49:04+00:00

Make __aa_path_perm() static as it's only used inside apparmor/file.c.

Signed-off-by: Xiu Jianfeng 
Signed-off-by: John Johansen

apparmor: make sure perm indexes are accumulated

2022-10-03T21:49:04+00:00

accumulate permission indexes on a first encountered basis. This
favors original rulesets so that new ones can not override without
profile replacement.

Signed-off-by: John Johansen

apparmor: extend xindex size

2022-10-03T21:49:03+00:00

Allow the xindex to have 2^24 entries.

Signed-off-by: John Johansen

apparmor: move dfa perm macros into policy_unpack

2022-10-03T21:49:03+00:00

Now that the permission remapping macros aren't needed anywhere except
during profile unpack, move them.

Signed-off-by: John Johansen

apparmor: preparse for state being more than just an integer

2022-10-03T21:49:03+00:00

Convert from an unsigned int to a state_t for state position. This is
a step in prepping for the state position carrying some additional
flags, and a limited form of backtracking to support variables.

Signed-off-by: John Johansen

apparmor: combine file_rules and aa_policydb into a single shared struct

2022-10-03T21:49:03+00:00

file_rules and policydb are almost the same and will need the same
features in the future so combine them.

Signed-off-by: John Johansen

apparmor: move fperm computation into policy_unpack

2022-10-03T21:49:02+00:00

fperm computation is only needed during policy_unpack so move the
code there to isolate it fromt the run time code.

Signed-off-by: John Johansen

apparmor: compute file permissions on profile load

2022-10-03T21:49:02+00:00

Rather than computing file permissions for each file access, file
permissions can be computed once on profile load and stored for lookup.

Signed-off-by: Mike Salvatore 
Signed-off-by: John Johansen

apparmor: extend policydb permission set by making use of the xbits

2022-07-19T09:57:15+00:00

The policydb permission set has left the xbits unused. Make them available
for mediation.

Signed-off-by: John Johansen

Merge tag 'apparmor-pr-2021-11-10' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor

2021-11-11T22:47:32+00:00

Pull apparmor updates from John Johansen:
 "Features
   - use per file locks for transactional queries
   - update policy management capability checks to work with LSM stacking

  Bug Fixes:
   - check/put label on apparmor_sk_clone_security()
   - fix error check on update of label hname
   - fix introspection of of task mode for unconfined tasks

  Cleanups:
   - avoid -Wempty-body warning
   - remove duplicated 'Returns:' comments
   - fix doc warning
   - remove unneeded one-line hook wrappers
   - use struct_size() helper in kzalloc()
   - fix zero-length compiler warning in AA_BUG()
   - file.h: delete duplicated word
   - delete repeated words in comments
   - remove repeated declaration"

* tag 'apparmor-pr-2021-11-10' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor:
  apparmor: remove duplicated 'Returns:' comments
  apparmor: remove unneeded one-line hook wrappers
  apparmor: Use struct_size() helper in kzalloc()
  apparmor: fix zero-length compiler warning in AA_BUG()
  apparmor: use per file locks for transactional queries
  apparmor: fix doc warning
  apparmor: Remove the repeated declaration
  apparmor: avoid -Wempty-body warning
  apparmor: Fix internal policy capable check for policy management
  apparmor: fix error check
  security: apparmor: delete repeated words in comments
  security: apparmor: file.h: delete duplicated word
  apparmor: switch to apparmor to internal capable check for policy management
  apparmor: update policy capable checks to use a label
  apparmor: fix introspection of of task mode for unconfined tasks
  apparmor: check/put label on apparmor_sk_clone_security()