linux - Mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/

Age	Commit message (Collapse)	Author	Lines
2018-02-09	apparmor: move task related defines and fns to task.X files	John Johansen	-221/+0
	Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-02-09	apparmor: rename tctx to ctx	John Johansen	-13/+12
	now that cred_ctx has been removed we can rename task_ctxs from tctx without causing confusion. Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-02-09	apparmor: drop cred_ctx and reference the label directly	John Johansen	-60/+23
	With the task domain change information now stored in the task->security context, the cred->security context only stores the label. We can get rid of the cred_ctx and directly reference the label, removing a layer of indirection, and unneeded extra allocations. Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-02-09	apparmor: move task domain change info to task security	John Johansen	-30/+61
	The task domain change info is task specific and its and abuse of the cred to store the information in there. Now that a task->security field exists store it in the proper place. Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-02-09	apparmor: rename task_ctx to the more accurate cred_ctx	John Johansen	-19/+19
	Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-10	apparmor: switch from profiles to using labels on contexts	John Johansen	-43/+44
	Begin the actual switch to using domain labels by storing them on the context and converting the label to a singular profile where possible. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-10	apparmor: convert to profile block critical sections	John Johansen	-1/+1
	There are still a few places where profile replacement fails to update and a stale profile is used for mediation. Fix this by moving to accessing the current label through a critical section that will always ensure mediation is using the current label regardless of whether the tasks cred has been updated or not. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16	apparmor: replace remaining BUG_ON() asserts with AA_BUG()	John Johansen	-2/+2
	AA_BUG() uses WARN and won't break the kernel like BUG_ON(). Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16	apparmor: rename context abreviation cxt to the more standard ctx	John Johansen	-49/+51
	Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16	apparmor: fail task profile update if current_cred isn't real_cred	John Johansen	-0/+3
	Trying to update the task cred while the task current cred is not the real cred will result in an error at the cred layer. Avoid this by failing early and delaying the update. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16	apparmor: rename replacedby to proxy	John Johansen	-1/+1
	Proxy is shorter and a better fit than replaceby, so rename it. Signed-off-by: John Johansen <john.johansen@canonical.com>
2013-08-14	apparmor: change how profile replacement update is done	John Johansen	-11/+5
	remove the use of replaced by chaining and move to profile invalidation and lookup to handle task replacement. Replacement chaining can result in large chains of profiles being pinned in memory when one profile in the chain is use. With implicit labeling this will be even more of a problem, so move to a direct lookup method. Signed-off-by: John Johansen <john.johansen@canonical.com>
2013-04-28	apparmor: localize getting the security context to a few macros	John Johansen	-5/+5
	Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-04-28	apparmor: use common fn to clear task_context for domain transitions	John Johansen	-11/+6
	Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-04-28	apparmor: add utility function to get an arbitrary tasks profile.	John Johansen	-0/+17
	Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2010-08-02	AppArmor: contexts used in attaching policy to system objects	John Johansen	-0/+216
	AppArmor contexts attach profiles and state to tasks, files, etc. when a direct profile reference is not sufficient. Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: James Morris <jmorris@namei.org>