kernel/linux.git/security/apparmor/include/file.h, branch v6.12.80

apparmor: pass cred through to audit info.

2023-10-18T22:30:38+00:00

The cred is needed to properly audit some messages, and will be needed in the future for uid conditional mediation. So pass it through to where the apparmor_audit_data struct gets defined. Reviewed-by: Georgia Garcia Signed-off-by: John Johansen

apparmor: cleanup unused functions in file.h

2023-08-08T20:16:13+00:00

After changes in commit 33bf60cabcc7 ("LSM: Infrastructure management of the file security"), aa_alloc_file_ctx() and aa_free_file_ctx() are no longer used, so remove them, and also remove aa_get_file_label() because it seems that it's never been used before. Signed-off-by: Xiu Jianfeng Signed-off-by: John Johansen

apparmor: make __aa_path_perm() static

2022-10-03T21:49:04+00:00

Make __aa_path_perm() static as it's only used inside apparmor/file.c. Signed-off-by: Xiu Jianfeng Signed-off-by: John Johansen

apparmor: make sure perm indexes are accumulated

2022-10-03T21:49:04+00:00

accumulate permission indexes on a first encountered basis. This favors original rulesets so that new ones can not override without profile replacement. Signed-off-by: John Johansen

apparmor: extend xindex size

2022-10-03T21:49:03+00:00

Allow the xindex to have 2^24 entries. Signed-off-by: John Johansen

apparmor: move dfa perm macros into policy_unpack

2022-10-03T21:49:03+00:00

Now that the permission remapping macros aren't needed anywhere except during profile unpack, move them. Signed-off-by: John Johansen

apparmor: preparse for state being more than just an integer

2022-10-03T21:49:03+00:00

Convert from an unsigned int to a state_t for state position. This is a step in prepping for the state position carrying some additional flags, and a limited form of backtracking to support variables. Signed-off-by: John Johansen

apparmor: combine file_rules and aa_policydb into a single shared struct

2022-10-03T21:49:03+00:00

file_rules and policydb are almost the same and will need the same features in the future so combine them. Signed-off-by: John Johansen

apparmor: move fperm computation into policy_unpack

2022-10-03T21:49:02+00:00

fperm computation is only needed during policy_unpack so move the code there to isolate it fromt the run time code. Signed-off-by: John Johansen

apparmor: compute file permissions on profile load

2022-10-03T21:49:02+00:00

Rather than computing file permissions for each file access, file permissions can be computed once on profile load and stored for lookup. Signed-off-by: Mike Salvatore Signed-off-by: John Johansen