kernel/linux.git/security/apparmor/include/perms.h, branch v6.12.80

apparmor: add io_uring mediation

2023-10-18T22:58:49+00:00

For now, the io_uring mediation is limited to sqpoll and override_creds. Signed-off-by: Georgia Garcia Signed-off-by: John Johansen

apparmor: combine common_audit_data and apparmor_audit_data

2023-10-18T22:30:29+00:00

Everywhere where common_audit_data is used apparmor audit_data is also used. We can simplify the code and drop the use of the aad macro everywhere by combining the two structures. Reviewed-by: Georgia Garcia Signed-off-by: John Johansen

apparmor: refactor profile rules and attachments

2022-10-03T21:49:04+00:00

In preparation for moving from a single set of rules and a single attachment to multiple rulesets and attachments separate from the profile refactor attachment information and ruleset info into their own structures. Signed-off-by: John Johansen

apparmor: cleanup: move perm accumulation into perms.h

2022-10-03T21:49:04+00:00

Perm accumulation is going to be used much more frequently so let the compiler figure out if it can be optimized when used. Signed-off-by: John Johansen

apparmor: make sure perm indexes are accumulated

2022-10-03T21:49:04+00:00

accumulate permission indexes on a first encountered basis. This favors original rulesets so that new ones can not override without profile replacement. Signed-off-by: John Johansen

apparmor: extend permissions to support a label and tag string

2022-10-03T21:49:03+00:00

add indexes for label and tag entries. Rename the domain table to the str_table as its a shared string table with label and tags. Signed-off-by: John Johansen

apparmor: extend xindex size

2022-10-03T21:49:03+00:00

Allow the xindex to have 2^24 entries. Signed-off-by: John Johansen

apparmor: convert policy lookup to use accept as an index

2022-10-03T21:49:03+00:00

Remap polidydb dfa accept table from embedded perms to an index, and then move the perm lookup to use the accept entry as an index into the perm table. This is done so that the perm table can be separated from the dfa, allowing dfa accept to index to share expanded permission sets. Signed-off-by: John Johansen

apparmor: cleanup shared permission struct

2022-10-03T21:49:03+00:00

The shared permissions struct has the stop field which is unneeded and the "reserved" subtree field commented which is needed. Also reorganize so that the entries are logically grouped. Signed-off-by: John Johansen

apparmor: compute policydb permission on profile load

2022-10-03T21:49:03+00:00

Rather than computing policydb permissions for each access permissions can be computed once on profile load and stored for lookup. Signed-off-by: John Johansen