Messages in this thread | | | Date | Fri, 27 Jan 2012 11:34:30 -0800 | From | John Johansen <> | Subject | Re: [PATCH 2/4] AppArmor: add initial "features" directory to securityfs |
| |
On 01/26/2012 04:29 PM, Kees Cook wrote: > From: Kees Cook <kees@outflux.net> > > This adds the "features" subdirectory to the AppArmor securityfs > to display boolean features flags and the known capability mask. > > Signed-off-by: Kees Cook <kees@ubuntu.com> Acked-by: John Johansen <john.johansen@canonical.com>
> --- > security/apparmor/apparmorfs.c | 52 ++++++++++++++++++++++++++++++++ > security/apparmor/include/apparmorfs.h | 14 ++++++++ > 2 files changed, 66 insertions(+), 0 deletions(-) > > diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c > index 1e22bb3..36efe64 100644 > --- a/security/apparmor/apparmorfs.c > +++ b/security/apparmor/apparmorfs.c > @@ -18,6 +18,7 @@ > #include <linux/seq_file.h> > #include <linux/uaccess.h> > #include <linux/namei.h> > +#include <linux/capability.h> > > #include "include/apparmor.h" > #include "include/apparmorfs.h" > @@ -142,12 +143,63 @@ static const struct file_operations aa_fs_profile_remove = { > .llseek = default_llseek, > }; > > +static int aa_fs_seq_show(struct seq_file *seq, void *v) > +{ > + struct aa_fs_entry *fs_file = seq->private; > + > + if (!fs_file) > + return 0; > + > + switch (fs_file->v_type) { > + case AA_FS_TYPE_BOOLEAN: > + seq_printf(seq, "%s\n", fs_file->v.boolean ? "yes" : "no"); > + break; > + case AA_FS_TYPE_U64: > + seq_printf(seq, "%#08lx\n", fs_file->v.u64); > + break; > + default: > + /* Ignore unpritable entry types. */ > + break; > + } > + > + return 0; > +} > + > +static int aa_fs_seq_open(struct inode *inode, struct file *file) > +{ > + return single_open(file, aa_fs_seq_show, inode->i_private); > +} > + > +const struct file_operations aa_fs_seq_file_ops = { > + .owner = THIS_MODULE, > + .open = aa_fs_seq_open, > + .read = seq_read, > + .llseek = seq_lseek, > + .release = single_release, > +}; > + > /** Base file system setup **/ > > +static struct aa_fs_entry aa_fs_entry_domain[] = { > + AA_FS_FILE_BOOLEAN("change_hat", 1), > + AA_FS_FILE_BOOLEAN("change_hatv", 1), > + AA_FS_FILE_BOOLEAN("change_onexec", 1), > + AA_FS_FILE_BOOLEAN("change_profile", 1), > + { } > +}; > + > +static struct aa_fs_entry aa_fs_entry_features[] = { > + AA_FS_DIR("domain", aa_fs_entry_domain), > + AA_FS_FILE_BOOLEAN("namespaces", 1), > + AA_FS_FILE_U64("capability", VFS_CAP_FLAGS_MASK), > + { } > +}; > + > static struct aa_fs_entry aa_fs_entry_apparmor[] = { > AA_FS_FILE_FOPS(".load", 0640, &aa_fs_profile_load), > AA_FS_FILE_FOPS(".replace", 0640, &aa_fs_profile_replace), > AA_FS_FILE_FOPS(".remove", 0640, &aa_fs_profile_remove), > + AA_FS_DIR("features", aa_fs_entry_features), > { } > }; > > diff --git a/security/apparmor/include/apparmorfs.h b/security/apparmor/include/apparmorfs.h > index 4fdf02f..16e6545 100644 > --- a/security/apparmor/include/apparmorfs.h > +++ b/security/apparmor/include/apparmorfs.h > @@ -16,6 +16,8 @@ > #define __AA_APPARMORFS_H > > enum aa_fs_type { > + AA_FS_TYPE_BOOLEAN, > + AA_FS_TYPE_U64, > AA_FS_TYPE_FOPS, > AA_FS_TYPE_DIR, > }; > @@ -28,11 +30,23 @@ struct aa_fs_entry { > umode_t mode; > enum aa_fs_type v_type; > union { > + bool boolean; > + unsigned long u64; > struct aa_fs_entry *files; > } v; > const struct file_operations *file_ops; > }; > > +extern const struct file_operations aa_fs_seq_file_ops; > + > +#define AA_FS_FILE_BOOLEAN(_name, _value) \ > + { .name = (_name), .mode = 0444, \ > + .v_type = AA_FS_TYPE_BOOLEAN, .v.boolean = (_value), \ > + .file_ops = &aa_fs_seq_file_ops } > +#define AA_FS_FILE_U64(_name, _value) \ > + { .name = (_name), .mode = 0444, \ > + .v_type = AA_FS_TYPE_U64, .v.u64 = (_value), \ > + .file_ops = &aa_fs_seq_file_ops } > #define AA_FS_FILE_FOPS(_name, _mode, _fops) \ > { .name = (_name), .v_type = AA_FS_TYPE_FOPS, \ > .mode = (_mode), .file_ops = (_fops) }
| |