linux-toradex.git/security/apparmor/policy.c, branch v5.0

apparmor: fix checkpatch error in Parse secmark policy

2018-11-02T05:28:17+00:00

Fix missed spacing error reported by checkpatch for
9caafbe2b4cf ("Parse secmark policy")

Signed-off-by: John Johansen

apparmor: Parse secmark policy

2018-10-03T13:18:38+00:00

Add support for parsing secmark policy provided by userspace, and
store that in the overall policy.

Signed-off-by: Matthew Garrett 
Signed-off-by: John Johansen

apparmor: fix memory leak when deduping profile load

2018-06-07T08:51:01+00:00

AppArmor is leaking the newly loaded profile and its proxy when
the profile is an exact match to the currently loaded version.

In this case the dedup check results in the profile being skipped and
put without dealing with the proxy ref thus not breaking a circular
refcount and causing a leak.

BugLink: http://bugs.launchpad.net/bugs/1750594
Fixes: 5d5182cae401 ("apparmor: move to per loaddata files, instead of replicating in profiles")
Signed-off-by: John Johansen

apparmor: fix typo "preconfinement"

2018-05-03T07:50:46+00:00

Signed-off-by: Zygmunt Krynicki 
Acked-by: Christian Boltz 
Signed-off-by: John Johansen

apparmor: add support for mapping secids and using secctxes

2018-05-02T07:48:55+00:00

Use a radix tree to provide a map between the secid and the label,
and along with it a basic ability to provide secctx conversion.

Shared/cached secctx will be added later.

Signed-off-by: John Johansen

apparmor: convert attaching profiles via xattrs to use dfa matching

2018-02-09T19:30:02+00:00

This converts profile attachment based on xattrs to a fixed extended
conditional using dfa matching.

This has a couple of advantages
- pattern matching can be used for the xattr match

- xattrs can be optional for an attachment or marked as required

- the xattr attachment conditional will be able to be combined with
  other extended conditionals when the flexible extended conditional
  work lands.

The xattr fixed extended conditional is appended to the xmatch
conditional. If an xattr attachment is specified the profile xmatch
will be generated regardless of whether there is a pattern match on
the executable name.

Signed-off-by: John Johansen 
Acked-by: Seth Arnold

apparmor: Add support for attaching profiles via xattr, presence and value

2018-02-09T19:30:02+00:00

Make it possible to tie Apparmor profiles to the presence of one or more
extended attributes, and optionally their values. An example usecase for
this is to automatically transition to a more privileged Apparmor profile
if an executable has a valid IMA signature, which can then be appraised
by the IMA subsystem.

Signed-off-by: Matthew Garrett 
Signed-off-by: John Johansen

apparmor: move context.h to cred.h

2018-02-09T19:30:01+00:00

Now that file contexts have been moved into file, and task context
fns() and data have been split from the context, only the cred context
remains in context.h so rename to cred.h to better reflect what it
deals with.

Signed-off-by: John Johansen

apparmor: cleanup fixup description of aa_replace_profiles

2018-02-09T19:30:01+00:00

Signed-off-by: John Johansen

apparmor: rename task_ctx to the more accurate cred_ctx

2018-02-09T19:30:01+00:00

Signed-off-by: John Johansen