Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a9bf8e9f authored by Kees Cook's avatar Kees Cook Committed by John Johansen
Browse files

AppArmor: add "file" details to securityfs 



Create the "file" directory in the securityfs for tracking features
related to files.

Signed-off-by: default avatarKees Cook <kees@ubuntu.com>
Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
parent e74abcf3

security/apparmor/apparmorfs.c

+10 −0
Original line number Diff line number Diff line
@@ -154,6 +154,9 @@ static int aa_fs_seq_show(struct seq_file *seq, void *v) 
	case AA_FS_TYPE_BOOLEAN:

		seq_printf(seq, "%s\n", fs_file->v.boolean ? "yes" : "no");

		break;

	case AA_FS_TYPE_STRING:

		seq_printf(seq, "%s\n", fs_file->v.string);

		break;

	case AA_FS_TYPE_U64:

		seq_printf(seq, "%#08lx\n", fs_file->v.u64);

		break;
@@ -180,6 +183,12 @@ const struct file_operations aa_fs_seq_file_ops = { 


/** Base file system setup **/



static struct aa_fs_entry aa_fs_entry_file[] = {

	AA_FS_FILE_STRING("mask", "create read write exec append mmap_exec " \

				  "link lock"),

	{ }

};



static struct aa_fs_entry aa_fs_entry_domain[] = {

	AA_FS_FILE_BOOLEAN("change_hat",	1),

	AA_FS_FILE_BOOLEAN("change_hatv",	1),
@@ -190,6 +199,7 @@ static struct aa_fs_entry aa_fs_entry_domain[] = { 


static struct aa_fs_entry aa_fs_entry_features[] = {

	AA_FS_DIR("domain",			aa_fs_entry_domain),

	AA_FS_DIR("file",			aa_fs_entry_file),

	AA_FS_FILE_U64("capability",		VFS_CAP_FLAGS_MASK),

	{ }

};

security/apparmor/include/apparmorfs.h

+6 −0
Original line number Diff line number Diff line
@@ -17,6 +17,7 @@ 


enum aa_fs_type {

	AA_FS_TYPE_BOOLEAN,

	AA_FS_TYPE_STRING,

	AA_FS_TYPE_U64,

	AA_FS_TYPE_FOPS,

	AA_FS_TYPE_DIR,
@@ -31,6 +32,7 @@ struct aa_fs_entry { 
	enum aa_fs_type v_type;

	union {

		bool boolean;

		char *string;

		unsigned long u64;

		struct aa_fs_entry *files;

	} v;
@@ -43,6 +45,10 @@ extern const struct file_operations aa_fs_seq_file_ops; 
	{ .name = (_name), .mode = 0444, \

	  .v_type = AA_FS_TYPE_BOOLEAN, .v.boolean = (_value), \

	  .file_ops = &aa_fs_seq_file_ops }

#define AA_FS_FILE_STRING(_name, _value) \

	{ .name = (_name), .mode = 0444, \

	  .v_type = AA_FS_TYPE_STRING, .v.string = (_value), \

	  .file_ops = &aa_fs_seq_file_ops }

#define AA_FS_FILE_U64(_name, _value) \

	{ .name = (_name), .mode = 0444, \

	  .v_type = AA_FS_TYPE_U64, .v.u64 = (_value), \