aboutsummaryrefslogtreecommitdiff
path: root/security/apparmor/include/context.h
AgeCommit message (Collapse)AuthorFilesLines
2018-02-09apparmor: move context.h to cred.hJohn Johansen1-176/+0
Now that file contexts have been moved into file, and task context fns() and data have been split from the context, only the cred context remains in context.h so rename to cred.h to better reflect what it deals with. Signed-off-by: John Johansen <[email protected]>
2018-02-09apparmor: move task related defines and fns to task.X filesJohn Johansen1-39/+1
Signed-off-by: John Johansen <[email protected]>
2018-02-09apparmor: cleanup, drop unused fn __aa_task_is_confined()John Johansen1-11/+0
Signed-off-by: John Johansen <[email protected]>
2018-02-09apparmor: drop cred_ctx and reference the label directlyJohn Johansen1-19/+5
With the task domain change information now stored in the task->security context, the cred->security context only stores the label. We can get rid of the cred_ctx and directly reference the label, removing a layer of indirection, and unneeded extra allocations. Signed-off-by: John Johansen <[email protected]>
2018-02-09apparmor: move task domain change info to task securityJohn Johansen1-10/+21
The task domain change info is task specific and its and abuse of the cred to store the information in there. Now that a task->security field exists store it in the proper place. Signed-off-by: John Johansen <[email protected]>
2018-02-09apparmor: rename task_ctx to the more accurate cred_ctxJohn Johansen1-10/+9
Signed-off-by: John Johansen <[email protected]>
2017-06-10apparmor: switch from profiles to using labels on contextsJohn Johansen1-80/+78
Begin the actual switch to using domain labels by storing them on the context and converting the label to a singular profile where possible. Signed-off-by: John Johansen <[email protected]>
2017-06-10apparmor: convert to profile block critical sectionsJohn Johansen1-23/+100
There are still a few places where profile replacement fails to update and a stale profile is used for mediation. Fix this by moving to accessing the current label through a critical section that will always ensure mediation is using the current label regardless of whether the tasks cred has been updated or not. Signed-off-by: John Johansen <[email protected]>
2017-06-08apparmor: move file context into file.hJohn Johansen1-32/+0
Signed-off-by: John Johansen <[email protected]>
2017-01-16apparmor: rename context abreviation cxt to the more standard ctxJohn Johansen1-38/+40
Signed-off-by: John Johansen <[email protected]>
2017-01-16apparmor: add ns being viewed as a param to policy_view_capable()John Johansen1-0/+6
Prepare for a tighter pairing of user namespaces and apparmor policy namespaces, by making the ns to be viewed available and checking that the user namespace level is the same as the policy ns level. This strict pairing will be relaxed once true support of user namespaces lands. Signed-off-by: John Johansen <[email protected]>
2017-01-16apparmor: rename PFLAG_INVALID to PFLAG_STALEJohn Johansen1-1/+1
Invalid does not convey the meaning of the flag anymore so rename it. Signed-off-by: John Johansen <[email protected]>
2013-08-14apparmor: change how profile replacement update is doneJohn Johansen1-8/+7
remove the use of replaced by chaining and move to profile invalidation and lookup to handle task replacement. Replacement chaining can result in large chains of profiles being pinned in memory when one profile in the chain is use. With implicit labeling this will be even more of a problem, so move to a direct lookup method. Signed-off-by: John Johansen <[email protected]>
2013-04-28apparmor: localize getting the security context to a few macrosJohn Johansen1-2/+5
Signed-off-by: John Johansen <[email protected]> Acked-by: Seth Arnold <[email protected]>
2013-04-28apparmor: use common fn to clear task_context for domain transitionsJohn Johansen1-0/+13
Signed-off-by: John Johansen <[email protected]> Acked-by: Steve Beattie <[email protected]>
2013-04-28apparmor: add utility function to get an arbitrary tasks profile.John Johansen1-16/+25
Signed-off-by: John Johansen <[email protected]> Acked-by: Steve Beattie <[email protected]>
2010-08-02AppArmor: contexts used in attaching policy to system objectsJohn Johansen1-0/+154
AppArmor contexts attach profiles and state to tasks, files, etc. when a direct profile reference is not sufficient. Signed-off-by: John Johansen <[email protected]> Signed-off-by: James Morris <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.