]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit - security/apparmor/policy_unpack.c
UBUNTU: SAUCE: apparmor: add base infastructure for socket mediation
authorJohn Johansen <john.johansen@canonical.com>
Wed, 19 Jul 2017 06:18:33 +0000 (23:18 -0700)
committerSeth Forshee <seth.forshee@canonical.com>
Mon, 29 Jan 2018 13:45:00 +0000 (07:45 -0600)
commit5c3f5639f7462ba008b083b0b8bb335e929e449d
treea6076db2eaf20df81ce1d3a7d0cc0b33ef1147af
parent93f7b346e1b6a9f8609f55384ded9c90e105e100
UBUNTU: SAUCE: apparmor: add base infastructure for socket mediation

Provide a basic mediation of sockets. This is not a full net mediation
but just whether a spcific family of socket can be used by an
application, along with setting up some basic infrastructure for
network mediation to follow.

the user space rule hav the basic form of
  NETWORK RULE = [ QUALIFIERS ] 'network' [ DOMAIN ]
                 [ TYPE | PROTOCOL ]

  DOMAIN = ( 'inet' | 'ax25' | 'ipx' | 'appletalk' | 'netrom' |
             'bridge' | 'atmpvc' | 'x25' | 'inet6' | 'rose' |
     'netbeui' | 'security' | 'key' | 'packet' | 'ash' |
     'econet' | 'atmsvc' | 'sna' | 'irda' | 'pppox' |
     'wanpipe' | 'bluetooth' | 'netlink' | 'unix' | 'rds' |
     'llc' | 'can' | 'tipc' | 'iucv' | 'rxrpc' | 'isdn' |
     'phonet' | 'ieee802154' | 'caif' | 'alg' | 'nfc' |
     'vsock' | 'mpls' | 'ib' | 'kcm' ) ','

  TYPE = ( 'stream' | 'dgram' | 'seqpacket' |  'rdm' | 'raw' |
           'packet' )

  PROTOCOL = ( 'tcp' | 'udp' | 'icmp' )

eg.
  network,
  network inet,

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
[ saf: fix conflicts when rebasing to v4.15-rc2 ]
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
12 files changed:
security/apparmor/.gitignore
security/apparmor/Makefile
security/apparmor/apparmorfs.c
security/apparmor/file.c
security/apparmor/include/audit.h
security/apparmor/include/net.h [new file with mode: 0644]
security/apparmor/include/perms.h
security/apparmor/include/policy.h
security/apparmor/lib.c
security/apparmor/lsm.c
security/apparmor/net.c [new file with mode: 0644]
security/apparmor/policy_unpack.c