Changes in apparmorfs.h

d61c57fd - apparmor: make export of raw binary profile to userspace optional

Mon, 01 Feb 2021 11:43:18 +0000

apparmor: make export of raw binary profile to userspace optionalEmbedded systems have limited space and don't need the introspectionor checkpoint restore capability provided by exporting the rawprofile binary data so make it so make it a config option.This will reduce run time memory use and also speed up policy loads.Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/include/apparmorfs.h

b886d83c - treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441

Sat, 01 Jun 2019 08:08:55 +0000

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441Based on 1 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation version 2 of the licenseextracted by the scancode license scanner the SPDX license identifier GPL-2.0-onlyhas been chosen to replace the boilerplate/reference in 315 file(s).Signed-off-by: Thomas Gleixner Reviewed-by: Allison Randal Reviewed-by: Armijn Hemel Cc: linux-spdx@vger.kernel.orgLink: https://lkml.kernel.org/r/20190531190115.503150771@linutronix.deSigned-off-by: Greg Kroah-Hartman List of files: /linux-6.15/security/apparmor/include/apparmorfs.h

d9bf2c26 - apparmor: add policy revision file interface

Fri, 26 May 2017 23:27:58 +0000

apparmor: add policy revision file interfaceAdd a policy revision file to find the current revision of a ns's policy.There is a revision file per ns, as well as a virtualized global revisionfile in the base apparmor fs directory. The global revision file whenopened will provide the revision of the opening task namespace.The revision file can be waited on via select/poll to detect apparmorpolicy changes from the last read revision of the opened file. Thismeans that the revision file must be read after the select/poll otherwise update data will remain ready for reading.Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/include/apparmorfs.h

98407f0a - apparmor: allow specifying an already created dir to create ns entries in

Thu, 25 May 2017 13:31:46 +0000

apparmor: allow specifying an already created dir to create ns entries inSigned-off-by: John Johansen Reviewed-by: Seth Arnold Reviewed-by: Kees Cook List of files: /linux-6.15/security/apparmor/include/apparmorfs.h

c97204ba - apparmor: rename apparmor file fns and data to indicate use

Thu, 25 May 2017 13:23:42 +0000

apparmor: rename apparmor file fns and data to indicate useprefixes are used for fns/data that are not static to apparmorfs.cwith the prefixes being aafs - special magic apparmorfs for policy namespace data aa_sfs - for fns/data that go into securityfs aa_fs - for fns/data that may be used in the either of aafs or securityfsSigned-off-by: John Johansen Reviewed-by: Seth Arnold Reviewed-by: Kees Cook List of files: /linux-6.15/security/apparmor/include/apparmorfs.h

5d5182ca - apparmor: move to per loaddata files, instead of replicating in profiles

Tue, 09 May 2017 07:08:41 +0000

apparmor: move to per loaddata files, instead of replicating in profilesThe loaddata sets cover more than just a single profile and shouldbe tracked at the ns level. Move the load data files under the namespaceand reference the files from the profiles via a symlink.Signed-off-by: John Johansen Reviewed-by: Seth Arnold Reviewed-by: Kees Cook List of files: /linux-6.15/security/apparmor/include/apparmorfs.h

b7fd2c03 - apparmor: add per policy ns .load, .replace, .remove interface files

Mon, 16 Jan 2017 08:42:58 +0000

apparmor: add per policy ns .load, .replace, .remove interface filesHaving per policy ns interface files helps with containers restoringpolicy.Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/include/apparmorfs.h

5ac8c355 - apparmor: allow introspecting the loaded policy pre internal transform

Mon, 16 Jan 2017 08:42:55 +0000

apparmor: allow introspecting the loaded policy pre internal transformStore loaded policy and allow introspecting it through apparmorfs. Thishas several uses from debugging, policy validation, and policy checkpointand restore for containers.Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/include/apparmorfs.h

a71ada30 - apparmor: add special .null file used to "close" fds at exec

Mon, 16 Jan 2017 08:42:45 +0000

apparmor: add special .null file used to "close" fds at execBorrow the special null device file from selinux to "close" fds thatdon't have sufficient permissions at exec time.Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/include/apparmorfs.h

98849dff - apparmor: rename namespace to ns to improve code line lengths

Mon, 16 Jan 2017 08:42:16 +0000

apparmor: rename namespace to ns to improve code line lengthsSigned-off-by: John Johansen List of files: /linux-6.15/security/apparmor/include/apparmorfs.h

f8eb8a13 - apparmor: add the ability to report a sha1 hash of loaded policy

Wed, 14 Aug 2013 18:27:36 +0000

apparmor: add the ability to report a sha1 hash of loaded policyProvide userspace the ability to introspect a sha1 hash value for eachprofile currently loaded.Signed-off-by: John Johansen Acked-by: Seth Arnold List of files: /linux-6.15/security/apparmor/include/apparmorfs.h

556d0be7 - apparmor: add an optional profile attachment string for profiles

Thu, 11 Jul 2013 04:17:43 +0000

apparmor: add an optional profile attachment string for profilesAdd the ability to take in and report a human readable profile attachmentstring for profiles so that attachment specifications can be easilyinspected.Signed-off-by: John Johansen Acked-by: Seth Arnold List of files: /linux-6.15/security/apparmor/include/apparmorfs.h

0d259f04 - apparmor: add interface files for profiles and namespaces

Thu, 11 Jul 2013 04:13:43 +0000

apparmor: add interface files for profiles and namespacesAdd basic interface files to access namespace and profile information.The interface files are created when a profile is loaded and removedwhen the profile or namespace is removed.Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/include/apparmorfs.h

a9bf8e9f - AppArmor: add "file" details to securityfs

Fri, 27 Jan 2012 00:29:22 +0000

AppArmor: add "file" details to securityfsCreate the "file" directory in the securityfs for tracking featuresrelated to files.Signed-off-by: Kees Cook Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/include/apparmorfs.h

e74abcf3 - AppArmor: add initial "features" directory to securityfs

Fri, 27 Jan 2012 00:29:21 +0000

AppArmor: add initial "features" directory to securityfsThis adds the "features" subdirectory to the AppArmor securityfsto display boolean features flags and the known capability mask.Signed-off-by: Kees Cook Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/include/apparmorfs.h

9acd494b - AppArmor: refactor securityfs to use structures

Fri, 27 Jan 2012 00:29:20 +0000

AppArmor: refactor securityfs to use structuresUse a file tree structure to represent the AppArmor securityfs.Signed-off-by: Kees Cook Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/include/apparmorfs.h

63e2b423 - AppArmor: userspace interfaces

Thu, 29 Jul 2010 21:48:03 +0000

AppArmor: userspace interfacesThe /proc//attr/* interface is used for process introspection andcommands. While the apparmorfs interface is used for global introspectionand loading and removing policy.The interface currently only contains the files necessary for loadingpolicy, and will be extended in the future to include sysfs stylesingle per file introspection inteface.The old AppArmor 2.4 interface files have been removed into a compatibilitypatch, that distros can use to maintain backwards compatibility.Signed-off-by: John Johansen Signed-off-by: James Morris List of files: /linux-6.15/security/apparmor/include/apparmorfs.h