linux - Linux Kernel (branches are rebased on master from time to time)

Age	Commit message (Collapse)	Author	Files	Lines
2017-06-10	apparmor: switch from profiles to using labels on contexts	John Johansen	1	-80/+78
	Begin the actual switch to using domain labels by storing them on the context and converting the label to a singular profile where possible. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-10	apparmor: convert to profile block critical sections	John Johansen	1	-23/+100
	There are still a few places where profile replacement fails to update and a stale profile is used for mediation. Fix this by moving to accessing the current label through a critical section that will always ensure mediation is using the current label regardless of whether the tasks cred has been updated or not. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-08	apparmor: move file context into file.h	John Johansen	1	-32/+0
	Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16	apparmor: rename context abreviation cxt to the more standard ctx	John Johansen	1	-38/+40
	Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16	apparmor: add ns being viewed as a param to policy_view_capable()	John Johansen	1	-0/+6
	Prepare for a tighter pairing of user namespaces and apparmor policy namespaces, by making the ns to be viewed available and checking that the user namespace level is the same as the policy ns level. This strict pairing will be relaxed once true support of user namespaces lands. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-01-16	apparmor: rename PFLAG_INVALID to PFLAG_STALE	John Johansen	1	-1/+1
	Invalid does not convey the meaning of the flag anymore so rename it. Signed-off-by: John Johansen <john.johansen@canonical.com>
2013-08-14	apparmor: change how profile replacement update is done	John Johansen	1	-8/+7
	remove the use of replaced by chaining and move to profile invalidation and lookup to handle task replacement. Replacement chaining can result in large chains of profiles being pinned in memory when one profile in the chain is use. With implicit labeling this will be even more of a problem, so move to a direct lookup method. Signed-off-by: John Johansen <john.johansen@canonical.com>
2013-04-28	apparmor: localize getting the security context to a few macros	John Johansen	1	-2/+5
	Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-04-28	apparmor: use common fn to clear task_context for domain transitions	John Johansen	1	-0/+13
	Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-04-28	apparmor: add utility function to get an arbitrary tasks profile.	John Johansen	1	-16/+25
	Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2010-08-02	AppArmor: contexts used in attaching policy to system objects	John Johansen	1	-0/+154
	AppArmor contexts attach profiles and state to tasks, files, etc. when a direct profile reference is not sufficient. Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: James Morris <jmorris@namei.org>