lkml.org 
[lkml]   [2012]   [Jan]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 2/4] AppArmor: add initial "features" directory to securityfs
On 01/26/2012 04:29 PM, Kees Cook wrote:
> From: Kees Cook <kees@outflux.net>
>
> This adds the "features" subdirectory to the AppArmor securityfs
> to display boolean features flags and the known capability mask.
>
> Signed-off-by: Kees Cook <kees@ubuntu.com>
Acked-by: John Johansen <john.johansen@canonical.com>

> ---
> security/apparmor/apparmorfs.c | 52 ++++++++++++++++++++++++++++++++
> security/apparmor/include/apparmorfs.h | 14 ++++++++
> 2 files changed, 66 insertions(+), 0 deletions(-)
>
> diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
> index 1e22bb3..36efe64 100644
> --- a/security/apparmor/apparmorfs.c
> +++ b/security/apparmor/apparmorfs.c
> @@ -18,6 +18,7 @@
> #include <linux/seq_file.h>
> #include <linux/uaccess.h>
> #include <linux/namei.h>
> +#include <linux/capability.h>
>
> #include "include/apparmor.h"
> #include "include/apparmorfs.h"
> @@ -142,12 +143,63 @@ static const struct file_operations aa_fs_profile_remove = {
> .llseek = default_llseek,
> };
>
> +static int aa_fs_seq_show(struct seq_file *seq, void *v)
> +{
> + struct aa_fs_entry *fs_file = seq->private;
> +
> + if (!fs_file)
> + return 0;
> +
> + switch (fs_file->v_type) {
> + case AA_FS_TYPE_BOOLEAN:
> + seq_printf(seq, "%s\n", fs_file->v.boolean ? "yes" : "no");
> + break;
> + case AA_FS_TYPE_U64:
> + seq_printf(seq, "%#08lx\n", fs_file->v.u64);
> + break;
> + default:
> + /* Ignore unpritable entry types. */
> + break;
> + }
> +
> + return 0;
> +}
> +
> +static int aa_fs_seq_open(struct inode *inode, struct file *file)
> +{
> + return single_open(file, aa_fs_seq_show, inode->i_private);
> +}
> +
> +const struct file_operations aa_fs_seq_file_ops = {
> + .owner = THIS_MODULE,
> + .open = aa_fs_seq_open,
> + .read = seq_read,
> + .llseek = seq_lseek,
> + .release = single_release,
> +};
> +
> /** Base file system setup **/
>
> +static struct aa_fs_entry aa_fs_entry_domain[] = {
> + AA_FS_FILE_BOOLEAN("change_hat", 1),
> + AA_FS_FILE_BOOLEAN("change_hatv", 1),
> + AA_FS_FILE_BOOLEAN("change_onexec", 1),
> + AA_FS_FILE_BOOLEAN("change_profile", 1),
> + { }
> +};
> +
> +static struct aa_fs_entry aa_fs_entry_features[] = {
> + AA_FS_DIR("domain", aa_fs_entry_domain),
> + AA_FS_FILE_BOOLEAN("namespaces", 1),
> + AA_FS_FILE_U64("capability", VFS_CAP_FLAGS_MASK),
> + { }
> +};
> +
> static struct aa_fs_entry aa_fs_entry_apparmor[] = {
> AA_FS_FILE_FOPS(".load", 0640, &aa_fs_profile_load),
> AA_FS_FILE_FOPS(".replace", 0640, &aa_fs_profile_replace),
> AA_FS_FILE_FOPS(".remove", 0640, &aa_fs_profile_remove),
> + AA_FS_DIR("features", aa_fs_entry_features),
> { }
> };
>
> diff --git a/security/apparmor/include/apparmorfs.h b/security/apparmor/include/apparmorfs.h
> index 4fdf02f..16e6545 100644
> --- a/security/apparmor/include/apparmorfs.h
> +++ b/security/apparmor/include/apparmorfs.h
> @@ -16,6 +16,8 @@
> #define __AA_APPARMORFS_H
>
> enum aa_fs_type {
> + AA_FS_TYPE_BOOLEAN,
> + AA_FS_TYPE_U64,
> AA_FS_TYPE_FOPS,
> AA_FS_TYPE_DIR,
> };
> @@ -28,11 +30,23 @@ struct aa_fs_entry {
> umode_t mode;
> enum aa_fs_type v_type;
> union {
> + bool boolean;
> + unsigned long u64;
> struct aa_fs_entry *files;
> } v;
> const struct file_operations *file_ops;
> };
>
> +extern const struct file_operations aa_fs_seq_file_ops;
> +
> +#define AA_FS_FILE_BOOLEAN(_name, _value) \
> + { .name = (_name), .mode = 0444, \
> + .v_type = AA_FS_TYPE_BOOLEAN, .v.boolean = (_value), \
> + .file_ops = &aa_fs_seq_file_ops }
> +#define AA_FS_FILE_U64(_name, _value) \
> + { .name = (_name), .mode = 0444, \
> + .v_type = AA_FS_TYPE_U64, .v.u64 = (_value), \
> + .file_ops = &aa_fs_seq_file_ops }
> #define AA_FS_FILE_FOPS(_name, _mode, _fops) \
> { .name = (_name), .v_type = AA_FS_TYPE_FOPS, \
> .mode = (_mode), .file_ops = (_fops) }



\
 
 \ /
  Last update: 2012-01-27 20:37    [W:0.049 / U:3.668 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site