linux-stable.git/security/apparmor/include/apparmorfs.h, branch linux-rolling-stable

apparmor: remove or add symlinks to rawdata according to export_binary

2026-07-24T14:20:13+00:00

[ Upstream commit 59fe6fbc4cd45582bc8893de0a382a36562317b3 ]

When the export_binary parameter is set, then rawdata is available and
there should be a symbolic link for the rawdata in the profile
directory in apparmorfs. If the parameter is unset, then the symlinks
should not exist.

The issue arises when changing the value of export_binary on runtime
and replacing profiles. If export_binary was set when the profile was
originally loaded, then changed to 0 and the profile was reloaded,
then the symbolic links would still exist but would return ENOENT
because the rawdata no longer exists.

On the opposite side, if export_binary was unset when the profile was
originally loaded, then changed to 1 and the profile was reloaded,
then the symbolic links would not exist, even though the rawdata does.

Fixes: d61c57fde8191 ("apparmor: make export of raw binary profile to userspace optional")
Signed-off-by: Georgia Garcia 
Signed-off-by: John Johansen 
Signed-off-by: Sasha Levin

apparmor: move initcalls to the LSM framework

2025-10-22T23:24:27+00:00

Reviewed-by: Kees Cook 
Acked-by: John Johansen 
Signed-off-by: Paul Moore

apparmor: make export of raw binary profile to userspace optional

2022-07-09T22:13:59+00:00

Embedded systems have limited space and don't need the introspection
or checkpoint restore capability provided by exporting the raw
profile binary data so make it so make it a config option.

This will reduce run time memory use and also speed up policy loads.

Signed-off-by: John Johansen

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441

2019-06-05T15:37:17+00:00

Based on 1 normalized pattern(s):

  this program is free software you can redistribute it and or modify
  it under the terms of the gnu general public license as published by
  the free software foundation version 2 of the license

extracted by the scancode license scanner the SPDX license identifier

  GPL-2.0-only

has been chosen to replace the boilerplate/reference in 315 file(s).

Signed-off-by: Thomas Gleixner 
Reviewed-by: Allison Randal 
Reviewed-by: Armijn Hemel 
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190531190115.503150771@linutronix.de
Signed-off-by: Greg Kroah-Hartman

apparmor: add policy revision file interface

2017-06-11T00:11:27+00:00

Add a policy revision file to find the current revision of a ns's policy.
There is a revision file per ns, as well as a virtualized global revision
file in the base apparmor fs directory. The global revision file when
opened will provide the revision of the opening task namespace.

The revision file can be waited on via select/poll to detect apparmor
policy changes from the last read revision of the opened file. This
means that the revision file must be read after the select/poll other
wise update data will remain ready for reading.

Signed-off-by: John Johansen

apparmor: allow specifying an already created dir to create ns entries in

2017-06-08T19:51:52+00:00

Signed-off-by: John Johansen 
Reviewed-by: Seth Arnold 
Reviewed-by: Kees Cook

apparmor: rename apparmor file fns and data to indicate use

2017-06-08T19:51:52+00:00

prefixes are used for fns/data that are not static to apparmorfs.c
with the prefixes being
  aafs   - special magic apparmorfs for policy namespace data
  aa_sfs - for fns/data that go into securityfs
  aa_fs  - for fns/data that may be used in the either of aafs or
           securityfs

Signed-off-by: John Johansen 
Reviewed-by: Seth Arnold 
Reviewed-by: Kees Cook

apparmor: move to per loaddata files, instead of replicating in profiles

2017-06-08T19:51:49+00:00

The loaddata sets cover more than just a single profile and should
be tracked at the ns level. Move the load data files under the namespace
and reference the files from the profiles via a symlink.

Signed-off-by: John Johansen 
Reviewed-by: Seth Arnold 
Reviewed-by: Kees Cook

apparmor: add per policy ns .load, .replace, .remove interface files

2017-01-16T09:18:44+00:00

Having per policy ns interface files helps with containers restoring
policy.

Signed-off-by: John Johansen

apparmor: allow introspecting the loaded policy pre internal transform

2017-01-16T09:18:42+00:00

Store loaded policy and allow introspecting it through apparmorfs. This
has several uses from debugging, policy validation, and policy checkpoint
and restore for containers.

Signed-off-by: John Johansen