Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e74abcf3 authored by Kees Cook's avatar Kees Cook Committed by John Johansen
Browse files

AppArmor: add initial "features" directory to securityfs 



This adds the "features" subdirectory to the AppArmor securityfs
to display boolean features flags and the known capability mask.

Signed-off-by: default avatarKees Cook <kees@ubuntu.com>
Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
parent 9acd494b

security/apparmor/apparmorfs.c

+51 −0
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ 
#include <linux/seq_file.h>

#include <linux/uaccess.h>

#include <linux/namei.h>

#include <linux/capability.h>



#include "include/apparmor.h"

#include "include/apparmorfs.h"
@@ -142,12 +143,62 @@ static const struct file_operations aa_fs_profile_remove = { 
	.llseek = default_llseek,

};



static int aa_fs_seq_show(struct seq_file *seq, void *v)

{

	struct aa_fs_entry *fs_file = seq->private;



	if (!fs_file)

		return 0;



	switch (fs_file->v_type) {

	case AA_FS_TYPE_BOOLEAN:

		seq_printf(seq, "%s\n", fs_file->v.boolean ? "yes" : "no");

		break;

	case AA_FS_TYPE_U64:

		seq_printf(seq, "%#08lx\n", fs_file->v.u64);

		break;

	default:

		/* Ignore unpritable entry types. */

		break;

	}



	return 0;

}



static int aa_fs_seq_open(struct inode *inode, struct file *file)

{

	return single_open(file, aa_fs_seq_show, inode->i_private);

}



const struct file_operations aa_fs_seq_file_ops = {

	.owner		= THIS_MODULE,

	.open		= aa_fs_seq_open,

	.read		= seq_read,

	.llseek		= seq_lseek,

	.release	= single_release,

};



/** Base file system setup **/



static struct aa_fs_entry aa_fs_entry_domain[] = {

	AA_FS_FILE_BOOLEAN("change_hat",	1),

	AA_FS_FILE_BOOLEAN("change_hatv",	1),

	AA_FS_FILE_BOOLEAN("change_onexec",	1),

	AA_FS_FILE_BOOLEAN("change_profile",	1),

	{ }

};



static struct aa_fs_entry aa_fs_entry_features[] = {

	AA_FS_DIR("domain",			aa_fs_entry_domain),

	AA_FS_FILE_U64("capability",		VFS_CAP_FLAGS_MASK),

	{ }

};



static struct aa_fs_entry aa_fs_entry_apparmor[] = {

	AA_FS_FILE_FOPS(".load", 0640, &aa_fs_profile_load),

	AA_FS_FILE_FOPS(".replace", 0640, &aa_fs_profile_replace),

	AA_FS_FILE_FOPS(".remove", 0640, &aa_fs_profile_remove),

	AA_FS_DIR("features", aa_fs_entry_features),

	{ }

};

security/apparmor/include/apparmorfs.h

+14 −0
Original line number Diff line number Diff line
@@ -16,6 +16,8 @@ 
#define __AA_APPARMORFS_H



enum aa_fs_type {

	AA_FS_TYPE_BOOLEAN,

	AA_FS_TYPE_U64,

	AA_FS_TYPE_FOPS,

	AA_FS_TYPE_DIR,

};
@@ -28,11 +30,23 @@ struct aa_fs_entry { 
	umode_t mode;

	enum aa_fs_type v_type;

	union {

		bool boolean;

		unsigned long u64;

		struct aa_fs_entry *files;

	} v;

	const struct file_operations *file_ops;

};



extern const struct file_operations aa_fs_seq_file_ops;



#define AA_FS_FILE_BOOLEAN(_name, _value) \

	{ .name = (_name), .mode = 0444, \

	  .v_type = AA_FS_TYPE_BOOLEAN, .v.boolean = (_value), \

	  .file_ops = &aa_fs_seq_file_ops }

#define AA_FS_FILE_U64(_name, _value) \

	{ .name = (_name), .mode = 0444, \

	  .v_type = AA_FS_TYPE_U64, .v.u64 = (_value), \

	  .file_ops = &aa_fs_seq_file_ops }

#define AA_FS_FILE_FOPS(_name, _mode, _fops) \

	{ .name = (_name), .v_type = AA_FS_TYPE_FOPS, \

	  .mode = (_mode), .file_ops = (_fops) }