linux-stable.git/security/apparmor/context.c, branch linux-4.15.y

apparmor: switch from profiles to using labels on contexts

2017-06-11T00:11:38+00:00

Begin the actual switch to using domain labels by storing them on
the context and converting the label to a singular profile where
possible.

Signed-off-by: John Johansen

apparmor: convert to profile block critical sections

2017-06-11T00:11:34+00:00

There are still a few places where profile replacement fails to update
and a stale profile is used for mediation. Fix this by moving to
accessing the current label through a critical section that will
always ensure mediation is using the current label regardless of
whether the tasks cred has been updated or not.

Signed-off-by: John Johansen

apparmor: replace remaining BUG_ON() asserts with AA_BUG()

2017-01-16T09:18:56+00:00

AA_BUG() uses WARN and won't break the kernel like BUG_ON().

Signed-off-by: John Johansen

apparmor: rename context abreviation cxt to the more standard ctx

2017-01-16T09:18:45+00:00

Signed-off-by: John Johansen

apparmor: fail task profile update if current_cred isn't real_cred

2017-01-16T09:18:45+00:00

Trying to update the task cred while the task current cred is not the
real cred will result in an error at the cred layer. Avoid this by
failing early and delaying the update.

Signed-off-by: John Johansen

apparmor: rename replacedby to proxy

2017-01-16T09:18:19+00:00

Proxy is shorter and a better fit than replaceby, so rename it.

Signed-off-by: John Johansen

apparmor: change how profile replacement update is done

2013-08-14T18:42:06+00:00

remove the use of replaced by chaining and move to profile invalidation
and lookup to handle task replacement.

Replacement chaining can result in large chains of profiles being pinned
in memory when one profile in the chain is use. With implicit labeling
this will be even more of a problem, so move to a direct lookup method.

Signed-off-by: John Johansen

apparmor: localize getting the security context to a few macros

2013-04-28T07:39:35+00:00

Signed-off-by: John Johansen 
Acked-by: Seth Arnold

apparmor: use common fn to clear task_context for domain transitions

2013-04-28T07:36:20+00:00

Signed-off-by: John Johansen 
Acked-by: Steve Beattie

apparmor: add utility function to get an arbitrary tasks profile.

2013-04-28T07:35:53+00:00

Signed-off-by: John Johansen 
Acked-by: Steve Beattie