]> git.baikalelectronics.ru Git - kernel.git/commit
apparmor: add base infastructure for socket mediation
authorJohn Johansen <john.johansen@canonical.com>
Wed, 19 Jul 2017 06:18:33 +0000 (23:18 -0700)
committerJohn Johansen <john.johansen@canonical.com>
Fri, 22 Sep 2017 20:00:58 +0000 (13:00 -0700)
commit9e6f3dea5748e21e4cef3a84af64720102c44bc9
tree376539d1a5b97339f9123809707fe5c442afc193
parent479186c91fb3b6854fa5219fa69da7e816c2ab1e
apparmor: add base infastructure for socket mediation

Provide a basic mediation of sockets. This is not a full net mediation
but just whether a spcific family of socket can be used by an
application, along with setting up some basic infrastructure for
network mediation to follow.

the user space rule hav the basic form of
  NETWORK RULE = [ QUALIFIERS ] 'network' [ DOMAIN ]
                 [ TYPE | PROTOCOL ]

  DOMAIN = ( 'inet' | 'ax25' | 'ipx' | 'appletalk' | 'netrom' |
             'bridge' | 'atmpvc' | 'x25' | 'inet6' | 'rose' |
     'netbeui' | 'security' | 'key' | 'packet' | 'ash' |
     'econet' | 'atmsvc' | 'sna' | 'irda' | 'pppox' |
     'wanpipe' | 'bluetooth' | 'netlink' | 'unix' | 'rds' |
     'llc' | 'can' | 'tipc' | 'iucv' | 'rxrpc' | 'isdn' |
     'phonet' | 'ieee802154' | 'caif' | 'alg' | 'nfc' |
     'vsock' | 'mpls' | 'ib' | 'kcm' ) ','

  TYPE = ( 'stream' | 'dgram' | 'seqpacket' |  'rdm' | 'raw' |
           'packet' )

  PROTOCOL = ( 'tcp' | 'udp' | 'icmp' )

eg.
  network,
  network inet,

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
12 files changed:
security/apparmor/.gitignore
security/apparmor/Makefile
security/apparmor/apparmorfs.c
security/apparmor/file.c
security/apparmor/include/audit.h
security/apparmor/include/net.h [new file with mode: 0644]
security/apparmor/include/perms.h
security/apparmor/include/policy.h
security/apparmor/lib.c
security/apparmor/lsm.c
security/apparmor/net.c [new file with mode: 0644]
security/apparmor/policy_unpack.c