linux.git/security/apparmor/include/perms.h, branch v4.14

Revert "apparmor: add base infastructure for socket mediation"

2017-10-26T17:35:35+00:00

This reverts commit 651e28c5537abb39076d3949fb7618536f1d242e.

This caused a regression:
 "The specific problem is that dnsmasq refuses to start on openSUSE Leap
  42.2.  The specific cause is that and attempt to open a PF_LOCAL socket
  gets EACCES.  This means that networking doesn't function on a system
  with a 4.14-rc2 system."

Sadly, the developers involved seemed to be in denial for several weeks
about this, delaying the revert.  This has not been a good release for
the security subsystem, and this area needs to change development
practices.

Reported-and-bisected-by: James Bottomley 
Tracked-by: Thorsten Leemhuis 
Cc: John Johansen 
Cc: Vlastimil Babka 
Cc: Seth Arnold 
Signed-off-by: Linus Torvalds

apparmor: add base infastructure for socket mediation

2017-09-22T20:00:58+00:00

Provide a basic mediation of sockets. This is not a full net mediation
but just whether a spcific family of socket can be used by an
application, along with setting up some basic infrastructure for
network mediation to follow.

the user space rule hav the basic form of
  NETWORK RULE = [ QUALIFIERS ] 'network' [ DOMAIN ]
                 [ TYPE | PROTOCOL ]

  DOMAIN = ( 'inet' | 'ax25' | 'ipx' | 'appletalk' | 'netrom' |
             'bridge' | 'atmpvc' | 'x25' | 'inet6' | 'rose' |
	     'netbeui' | 'security' | 'key' | 'packet' | 'ash' |
	     'econet' | 'atmsvc' | 'sna' | 'irda' | 'pppox' |
	     'wanpipe' | 'bluetooth' | 'netlink' | 'unix' | 'rds' |
	     'llc' | 'can' | 'tipc' | 'iucv' | 'rxrpc' | 'isdn' |
	     'phonet' | 'ieee802154' | 'caif' | 'alg' | 'nfc' |
	     'vsock' | 'mpls' | 'ib' | 'kcm' ) ','

  TYPE = ( 'stream' | 'dgram' | 'seqpacket' |  'rdm' | 'raw' |
           'packet' )

  PROTOCOL = ( 'tcp' | 'udp' | 'icmp' )

eg.
  network,
  network inet,

Signed-off-by: John Johansen 
Acked-by: Seth Arnold

apparmor: add cross check permission helper macros

2017-06-11T00:11:41+00:00

The cross check permission helper macros will help simplify code
that does cross task permission checks like ptrace.

Signed-off-by: John Johansen

apparmor: switch from profiles to using labels on contexts

2017-06-11T00:11:38+00:00

Begin the actual switch to using domain labels by storing them on
the context and converting the label to a singular profile where
possible.

Signed-off-by: John Johansen

apparmor: switch from file_perms to aa_perms

2017-06-11T00:11:30+00:00

Signed-off-by: John Johansen

apparmor: add gerneric permissions struct and support fns

2017-06-11T00:11:30+00:00

Signed-off-by: John Johansen

apparmor: rework perm mapping to a slightly broader set

2017-06-09T12:59:22+00:00

Signed-off-by: John Johansen

apparmor: move permissions into their own file to be more easily shared

2017-06-08T19:51:53+00:00

Signed-off-by: John Johansen