linux-stable.git/security/apparmor/policy.c, branch linux-3.4.y

LSM: shrink sizeof LSM specific portion of common_audit_data

2012-04-03T16:48:40+00:00

Linus found that the gigantic size of the common audit data caused a big
perf hit on something as simple as running stat() in a loop.  This patch
requires LSMs to declare the LSM specific portion separately rather than
doing it in a union.  Thus each LSM can be responsible for shrinking their
portion and don't have to pay a penalty just because other LSMs have a
bigger space requirement.

Signed-off-by: Eric Paris 
Signed-off-by: Linus Torvalds

AppArmor: add const qualifiers to string arrays

2012-03-15T02:09:13+00:00

Signed-off-by: Jan Engelhardt 
Signed-off-by: John Johansen

AppArmor: Add ability to load extended policy

2012-03-15T02:09:03+00:00

Add the base support for the new policy extensions. This does not bring
any additional functionality, or change current semantics.

Signed-off-by: John Johansen 
Acked-by: Kees Cook

APPARMOR: Fix memory leak of alloc_namespace()

2010-11-10T20:36:18+00:00

policy->name is a substring of policy->hname, if prefix is not NULL, it will
allocted strlen(prefix) + strlen(name) + 3 bytes to policy->hname in policy_init().
use kzfree(ns->base.name) will casue memory leak if alloc_namespace() failed.

Signed-off-by: Zhitong Wang 
Signed-off-by: John Johansen 
Signed-off-by: James Morris

AppArmor: Fix locking from removal of profile namespace

2010-09-07T23:19:34+00:00

The locking for profile namespace removal is wrong, when removing a
profile namespace, it needs to be removed from its parent's list.
Lock the parent of namespace list instead of the namespace being removed.

Signed-off-by: John Johansen 
Signed-off-by: James Morris

AppArmor: core policy routines

2010-08-02T05:38:37+00:00

The basic routines and defines for AppArmor policy.  AppArmor policy
is defined by a few basic components.
      profiles - the basic unit of confinement contain all the information
                 to enforce policy on a task

                 Profiles tend to be named after an executable that they
                 will attach to but this is not required.
      namespaces - a container for a set of profiles that will be used
                 during attachment and transitions between profiles.
      sids - which provide a unique id for each profile

Signed-off-by: John Johansen 
Signed-off-by: James Morris