linux-kernel - Re: [PATCH 3/4] AppArmor: add "file" details to securityfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4F22FC57.4090008@canonical.com>
Date:	Fri, 27 Jan 2012 11:34:47 -0800
From:	John Johansen <john.johansen@...onical.com>
To:	Kees Cook <kees@...ntu.com>
CC:	linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 3/4] AppArmor: add "file" details to securityfs

On 01/26/2012 04:29 PM, Kees Cook wrote:
> Create the "file" directory in the securityfs for tracking features
> related to files.
> 
> Signed-off-by: Kees Cook <kees@...ntu.com>
Acked-by: John Johansen <john.johansen@...onical.com>

> ---
>  security/apparmor/apparmorfs.c         |   10 ++++++++++
>  security/apparmor/include/apparmorfs.h |    6 ++++++
>  2 files changed, 16 insertions(+), 0 deletions(-)
> 
> diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
> index 36efe64..68ce771 100644
> --- a/security/apparmor/apparmorfs.c
> +++ b/security/apparmor/apparmorfs.c
> @@ -154,6 +154,9 @@ static int aa_fs_seq_show(struct seq_file *seq, void *v)
>  	case AA_FS_TYPE_BOOLEAN:
>  		seq_printf(seq, "%s\n", fs_file->v.boolean ? "yes" : "no");
>  		break;
> +	case AA_FS_TYPE_STRING:
> +		seq_printf(seq, "%s\n", fs_file->v.string);
> +		break;
>  	case AA_FS_TYPE_U64:
>  		seq_printf(seq, "%#08lx\n", fs_file->v.u64);
>  		break;
> @@ -180,6 +183,12 @@ const struct file_operations aa_fs_seq_file_ops = {
>  
>  /** Base file system setup **/
>  
> +static struct aa_fs_entry aa_fs_entry_file[] = {
> +	AA_FS_FILE_STRING("mask", "create read write exec append mmap_exec " \
> +				  "link lock"),
> +	{ }
> +};
> +
>  static struct aa_fs_entry aa_fs_entry_domain[] = {
>  	AA_FS_FILE_BOOLEAN("change_hat",	1),
>  	AA_FS_FILE_BOOLEAN("change_hatv",	1),
> @@ -190,6 +199,7 @@ static struct aa_fs_entry aa_fs_entry_domain[] = {
>  
>  static struct aa_fs_entry aa_fs_entry_features[] = {
>  	AA_FS_DIR("domain",			aa_fs_entry_domain),
> +	AA_FS_DIR("file",			aa_fs_entry_file),
>  	AA_FS_FILE_BOOLEAN("namespaces",	1),
>  	AA_FS_FILE_U64("capability",		VFS_CAP_FLAGS_MASK),
>  	{ }
> diff --git a/security/apparmor/include/apparmorfs.h b/security/apparmor/include/apparmorfs.h
> index 16e6545..7ea4769 100644
> --- a/security/apparmor/include/apparmorfs.h
> +++ b/security/apparmor/include/apparmorfs.h
> @@ -17,6 +17,7 @@
>  
>  enum aa_fs_type {
>  	AA_FS_TYPE_BOOLEAN,
> +	AA_FS_TYPE_STRING,
>  	AA_FS_TYPE_U64,
>  	AA_FS_TYPE_FOPS,
>  	AA_FS_TYPE_DIR,
> @@ -31,6 +32,7 @@ struct aa_fs_entry {
>  	enum aa_fs_type v_type;
>  	union {
>  		bool boolean;
> +		char *string;
>  		unsigned long u64;
>  		struct aa_fs_entry *files;
>  	} v;
> @@ -43,6 +45,10 @@ extern const struct file_operations aa_fs_seq_file_ops;
>  	{ .name = (_name), .mode = 0444, \
>  	  .v_type = AA_FS_TYPE_BOOLEAN, .v.boolean = (_value), \
>  	  .file_ops = &aa_fs_seq_file_ops }
> +#define AA_FS_FILE_STRING(_name, _value) \
> +	{ .name = (_name), .mode = 0444, \
> +	  .v_type = AA_FS_TYPE_STRING, .v.string = (_value), \
> +	  .file_ops = &aa_fs_seq_file_ops }
>  #define AA_FS_FILE_U64(_name, _value) \
>  	{ .name = (_name), .mode = 0444, \
>  	  .v_type = AA_FS_TYPE_U64, .v.u64 = (_value), \

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/