kernel/linux.git/security/apparmor/ipc.c, branch linux-4.13.y

apparmor: allow ptrace checks to be finer grained than just capability

2017-06-11T00:11:42+00:00

Signed-off-by: John Johansen

apparmor: move ptrace checks to using labels

2017-06-11T00:11:41+00:00

Signed-off-by: John Johansen

apparmor: move capability checks to using labels

2017-06-11T00:11:40+00:00

Signed-off-by: John Johansen

apparmor: switch from profiles to using labels on contexts

2017-06-11T00:11:38+00:00

Begin the actual switch to using domain labels by storing them on the context and converting the label to a singular profile where possible. Signed-off-by: John Johansen

apparmor: change aad apparmor_audit_data macro to a fn macro

2017-01-16T09:18:47+00:00

The aad macro can replace aad strings when it is not intended to. Switch to a fn macro so it is only applied when intended. Also at the same time cleanup audit_data initialization by putting common boiler plate behind a macro, and dropping the gfp_t parameter which will become useless. Signed-off-by: John Johansen

apparmor: fix capability to not use the current task, during reporting

2013-10-30T04:33:37+00:00

Mediation is based off of the cred but auditing includes the current task which may not be related to the actual request. Signed-off-by: John Johansen

apparmor: add utility function to get an arbitrary tasks profile.

2013-04-28T07:35:53+00:00

Signed-off-by: John Johansen Acked-by: Steve Beattie

LSM: do not initialize common_audit_data to 0

2012-04-09T16:23:04+00:00

It isn't needed. If you don't set the type of the data associated with that type it is a pretty obvious programming bug. So why waste the cycles? Signed-off-by: Eric Paris

LSM: remove the COMMON_AUDIT_DATA_INIT type expansion

2012-04-09T16:23:01+00:00

Just open code it so grep on the source code works better. Signed-off-by: Eric Paris

LSM: shrink sizeof LSM specific portion of common_audit_data

2012-04-03T16:48:40+00:00

Linus found that the gigantic size of the common audit data caused a big perf hit on something as simple as running stat() in a loop. This patch requires LSMs to declare the LSM specific portion separately rather than doing it in a union. Thus each LSM can be responsible for shrinking their portion and don't have to pay a penalty just because other LSMs have a bigger space requirement. Signed-off-by: Eric Paris Signed-off-by: Linus Torvalds