]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
apparmor: add base infastructure for socket mediation
authorJohn Johansen <john.johansen@canonical.com>
Wed, 19 Jul 2017 06:18:33 +0000 (23:18 -0700)
committerJohn Johansen <john.johansen@canonical.com>
Fri, 22 Sep 2017 20:00:58 +0000 (13:00 -0700)
commit651e28c5537abb39076d3949fb7618536f1d242e
tree376539d1a5b97339f9123809707fe5c442afc193
parentcbf2d0e1a9e4876046a628e0e036a7545a3a4c40
apparmor: add base infastructure for socket mediation

Provide a basic mediation of sockets. This is not a full net mediation
but just whether a spcific family of socket can be used by an
application, along with setting up some basic infrastructure for
network mediation to follow.

the user space rule hav the basic form of
  NETWORK RULE = [ QUALIFIERS ] 'network' [ DOMAIN ]
                 [ TYPE | PROTOCOL ]

  DOMAIN = ( 'inet' | 'ax25' | 'ipx' | 'appletalk' | 'netrom' |
             'bridge' | 'atmpvc' | 'x25' | 'inet6' | 'rose' |
     'netbeui' | 'security' | 'key' | 'packet' | 'ash' |
     'econet' | 'atmsvc' | 'sna' | 'irda' | 'pppox' |
     'wanpipe' | 'bluetooth' | 'netlink' | 'unix' | 'rds' |
     'llc' | 'can' | 'tipc' | 'iucv' | 'rxrpc' | 'isdn' |
     'phonet' | 'ieee802154' | 'caif' | 'alg' | 'nfc' |
     'vsock' | 'mpls' | 'ib' | 'kcm' ) ','

  TYPE = ( 'stream' | 'dgram' | 'seqpacket' |  'rdm' | 'raw' |
           'packet' )

  PROTOCOL = ( 'tcp' | 'udp' | 'icmp' )

eg.
  network,
  network inet,

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
12 files changed:
security/apparmor/.gitignore
security/apparmor/Makefile
security/apparmor/apparmorfs.c
security/apparmor/file.c
security/apparmor/include/audit.h
security/apparmor/include/net.h [new file with mode: 0644]
security/apparmor/include/perms.h
security/apparmor/include/policy.h
security/apparmor/lib.c
security/apparmor/lsm.c
security/apparmor/net.c [new file with mode: 0644]
security/apparmor/policy_unpack.c