linux.git/security/apparmor/include/policy.h, branch v6.9

apparmor: allow restricting unprivileged change_profile

2023-10-18T22:48:44+00:00

unprivileged unconfined can use change_profile to alter the confinement
set by the mac admin.

Allow restricting unprivileged unconfined by still allowing change_profile
but stacking the change against unconfined. This allows unconfined to
still apply system policy but allows the task to enter the new confinement.

If unprivileged unconfined is required a sysctl is provided to switch
to the previous behavior.

Reviewed-by: Georgia Garcia 
Signed-off-by: John Johansen

apparmor: refcount the pdb

2023-10-18T22:30:47+00:00

With the move to permission tables the dfa is no longer a stand
alone entity when used, needing a minimum of a permission table.
However it still could be shared among different pdbs each using
a different permission table.

Instead of duping the permission table when sharing a pdb, add a
refcount to the pdb so it can be easily shared.

Reviewed-by: Georgia Garcia 
Signed-off-by: John Johansen

apparmor: pass cred through to audit info.

2023-10-18T22:30:38+00:00

The cred is needed to properly audit some messages, and will be needed
in the future for uid conditional mediation. So pass it through to
where the apparmor_audit_data struct gets defined.

Reviewed-by: Georgia Garcia 
Signed-off-by: John Johansen

apparmor: remove unused PROF_* macros

2023-08-08T20:24:48+00:00

The last usage of PROF_{ADD,REPLACE} were removed by commit 18e99f191a8e
("apparmor: provide finer control over policy management"). So remove
these two unused macros.

Signed-off-by: GONG, Ruiqi 
Signed-off-by: John Johansen

apparmor: cleanup unused declarations in policy.h

2023-08-08T20:15:39+00:00

The implementions of these declarations do not exist, remove them all.

Signed-off-by: Xiu Jianfeng 
Signed-off-by: John Johansen

apparmor: refactor code that alloc null profiles

2022-10-25T05:35:36+00:00

Bother unconfined and learning profiles use the null profile as their
base. Refactor so they are share a common base routine. This doesn't
save much atm but will be important when the feature set of the
parent is inherited.

Signed-off-by: John Johansen

apparmor: rework profile->rules to be a list

2022-10-03T21:49:04+00:00

Convert profile->rules to a list as the next step towards supporting
multiple rulesets in a profile. For this step only support a single
list entry item. The logic for iterating the list will come as a
separate step.

Signed-off-by: John Johansen

apparmor: refactor profile rules and attachments

2022-10-03T21:49:04+00:00

In preparation for moving from a single set of rules and a single
attachment to multiple rulesets and attachments separate from the
profile refactor attachment information and ruleset info into their
own structures.

Signed-off-by: John Johansen

apparmor: add the ability for policy to specify a permission table

2022-10-03T21:49:03+00:00

Currently permissions are encoded in the dfa accept entries that are
then mapped to an internal permission structure. This limits the
permissions that userspace can specify, so allow userspace to directly
specify the permission table.

Signed-off-by: John Johansen

apparmor: add user mode flag

2022-10-03T21:49:03+00:00

Allow the profile to contain a user mode prompt flag. This works similar
to complain mode but will try to send messages to a userspace daemon.
If the daemon is not present or timesout regular informent will occur.

Signed-off-by: John Johansen