linux-stable.git/security/apparmor/file.c, branch v4.7

apparmor: constify aa_path_link()

2016-03-28T04:47:26+00:00

Signed-off-by: Al Viro

[apparmor] constify struct path * in a bunch of helpers

2016-03-28T03:48:14+00:00

Signed-off-by: Al Viro

VFS: security/: d_backing_inode() annotations

2015-04-15T19:06:56+00:00

most of the ->d_inode uses there refer to the same inode IO would
go to, i.e. d_backing_inode()

Signed-off-by: David Howells 
Signed-off-by: Al Viro

new helper: file_inode(file)

2013-02-23T04:31:31+00:00

Signed-off-by: Al Viro

userns: Convert apparmor to use kuid and kgid where appropriate

2012-09-21T10:13:21+00:00

Cc: John Johansen 
Acked-by: Serge Hallyn 
Signed-off-by: Eric W. Biederman

LSM: do not initialize common_audit_data to 0

2012-04-09T16:23:04+00:00

It isn't needed.  If you don't set the type of the data associated with
that type it is a pretty obvious programming bug.  So why waste the cycles?

Signed-off-by: Eric Paris

LSM: remove the COMMON_AUDIT_DATA_INIT type expansion

2012-04-09T16:23:01+00:00

Just open code it so grep on the source code works better.

Signed-off-by: Eric Paris

LSM: shrink sizeof LSM specific portion of common_audit_data

2012-04-03T16:48:40+00:00

Linus found that the gigantic size of the common audit data caused a big
perf hit on something as simple as running stat() in a loop.  This patch
requires LSMs to declare the LSM specific portion separately rather than
doing it in a union.  Thus each LSM can be responsible for shrinking their
portion and don't have to pay a penalty just because other LSMs have a
bigger space requirement.

Signed-off-by: Eric Paris 
Signed-off-by: Linus Torvalds

apparmor: Fix change_onexec when called from a confined task

2012-03-27T14:00:05+00:00

Fix failure in aa_change_onexec api when the request is made from a confined
task.  This failure was caused by two problems

 The AA_MAY_ONEXEC perm was not being mapped correctly for this case.

 The executable name was being checked as second time instead of using the
 requested onexec profile name, which may not be the same as the exec
 profile name. This mistake can not be exploited to grant extra permission
 because of the above flaw where the ONEXEC permission was not being mapped
 so it will not be granted.

BugLink: http://bugs.launchpad.net/bugs/963756

Signed-off-by: John Johansen 
Signed-off-by: James Morris

AppArmor: Move path failure information into aa_get_name and rename

2012-03-14T13:15:25+00:00

Move the path name lookup failure messages into the main path name lookup
routine, as the information is useful in more than just aa_path_perm.

Also rename aa_get_name to aa_path_name as it is not getting a reference
counted object with a corresponding put fn.

Signed-off-by: John Johansen 
Acked-by: Kees Cook