kernel/linux.git/security/apparmor/include/match.h, branch v4.20.9

apparmor: improve overlapping domain attachment resolution

2018-02-09T19:30:02+00:00

Overlapping domain attachments using the current longest left exact match fail in some simple cases, and with the fix to ensure consistent behavior by failing unresolvable attachments it becomes important to do a better job. eg. under the current match the following are unresolvable where the alternation is clearly a better match under the most specific left match rule. /** /{bin/,}usr/ Use a counting match that detects when a loop in the state machine is enter, and return the match count to provide a better specific left match resolution. Signed-off-by: John Johansen

apparmor: dfa add support for state differential encoding

2018-02-09T19:30:01+00:00

State differential encoding can provide better compression for apparmor policy, without having significant impact on match time. Signed-off-by: John Johansen

apparmor: use the dfa to do label parse string splitting

2018-02-09T19:30:01+00:00

The current split scheme is actually wrong in that it splits ///& where that is invalid and should fail. Use the dfa to do a proper bounded split without having to worry about getting the string processing right in code. Signed-off-by: John Johansen Acked-by: Seth Arnold

apparmor: add first substr match to dfa

2018-02-09T19:30:01+00:00

Signed-off-by: John Johansen Acked-by: Seth Arnold

apparmor: fix restricted endian type warnings for dfa unpack

2017-01-16T09:18:54+00:00

Signed-off-by: John Johansen

apparmor: add a default null dfa

2017-01-16T09:18:34+00:00

Instead of testing whether a given dfa exists in every code path, have a default null dfa that is used when loaded policy doesn't provide a dfa. This will let us get rid of special casing and avoid dereference bugs when special casing is missed. Signed-off-by: John Johansen

apparmor: add get_dfa() fn

2017-01-16T09:18:32+00:00

The dfa is currently setup to be shared (has the basis of refcounting) but currently can't be because the count can't be increased. Signed-off-by: John Johansen

apparmor: add missing id bounds check on dfa verification

2016-07-12T15:43:10+00:00

Signed-off-by: John Johansen

apparmor: move perm defines into policy_unpack

2013-04-28T07:37:04+00:00

Signed-off-by: John Johansen Acked-by: Steve Beattie

apparmor: misc cleanup of match

2013-04-28T07:36:55+00:00

tidying up comments, includes and defines Signed-off-by: John Johansen Acked-by: Kees Cook