2019-06-01 10:08:55 +02:00
|
|
|
|
2010-07-29 14:47:57 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2017-01-16 00:42:13 -08:00
|
|
|
|
2010-07-29 14:47:57 -07:00
|
|
|
|
|
|
|
|
|
2017-06-09 08:14:28 -07:00
|
|
|
|
2010-07-29 14:47:57 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2017-01-16 00:42:13 -08:00
|
|
|
|
2010-07-29 14:47:57 -07:00
|
|
|
|
2012-02-16 07:07:53 -08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2022-04-19 16:25:55 -07:00
|
|
|
|
2012-02-16 07:07:53 -08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2017-07-18 23:18:33 -07:00
|
|
|
|
2012-02-16 07:07:53 -08:00
|
|
|
|
|
|
|
|
|
apparmor: add mount mediation
Add basic mount mediation. That allows controlling based on basic
mount parameters. It does not include special mount parameters for
apparmor, super block labeling, or any triggers for apparmor namespace
parameter modifications on pivot root.
default userspace policy rules have the form of
MOUNT RULE = ( MOUNT | REMOUNT | UMOUNT )
MOUNT = [ QUALIFIERS ] 'mount' [ MOUNT CONDITIONS ] [ SOURCE FILEGLOB ]
[ '->' MOUNTPOINT FILEGLOB ]
REMOUNT = [ QUALIFIERS ] 'remount' [ MOUNT CONDITIONS ]
MOUNTPOINT FILEGLOB
UMOUNT = [ QUALIFIERS ] 'umount' [ MOUNT CONDITIONS ] MOUNTPOINT FILEGLOB
MOUNT CONDITIONS = [ ( 'fstype' | 'vfstype' ) ( '=' | 'in' )
MOUNT FSTYPE EXPRESSION ]
[ 'options' ( '=' | 'in' ) MOUNT FLAGS EXPRESSION ]
MOUNT FSTYPE EXPRESSION = ( MOUNT FSTYPE LIST | MOUNT EXPRESSION )
MOUNT FSTYPE LIST = Comma separated list of valid filesystem and
virtual filesystem types (eg ext4, debugfs, etc)
MOUNT FLAGS EXPRESSION = ( MOUNT FLAGS LIST | MOUNT EXPRESSION )
MOUNT FLAGS LIST = Comma separated list of MOUNT FLAGS.
MOUNT FLAGS = ( 'ro' | 'rw' | 'nosuid' | 'suid' | 'nodev' | 'dev' |
'noexec' | 'exec' | 'sync' | 'async' | 'remount' |
'mand' | 'nomand' | 'dirsync' | 'noatime' | 'atime' |
'nodiratime' | 'diratime' | 'bind' | 'rbind' | 'move' |
'verbose' | 'silent' | 'loud' | 'acl' | 'noacl' |
'unbindable' | 'runbindable' | 'private' | 'rprivate' |
'slave' | 'rslave' | 'shared' | 'rshared' |
'relatime' | 'norelatime' | 'iversion' | 'noiversion' |
'strictatime' | 'nouser' | 'user' )
MOUNT EXPRESSION = ( ALPHANUMERIC | AARE ) ...
PIVOT ROOT RULE = [ QUALIFIERS ] pivot_root [ oldroot=OLD PUT FILEGLOB ]
[ NEW ROOT FILEGLOB ]
SOURCE FILEGLOB = FILEGLOB
MOUNTPOINT FILEGLOB = FILEGLOB
eg.
mount,
mount /dev/foo,
mount options=ro /dev/foo -> /mnt/,
mount options in (ro,atime) /dev/foo -> /mnt/,
mount options=ro options=atime,
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2017-07-18 23:04:47 -07:00
|
|
|
|
2017-06-09 14:22:14 -07:00
|
|
|
|
2017-07-18 22:56:22 -07:00
|
|
|
|
2020-11-21 01:42:40 -08:00
|
|
|
|
2017-07-18 23:18:33 -07:00
|
|
|
|
apparmor: add fine grained af_unix mediation
Extend af_unix mediation to support fine grained controls based on
the type (abstract, anonymous, fs), the address, and the labeling
on the socket.
This allows for using socket addresses to label and the socket and
control which subjects can communicate.
The unix rule format follows standard apparmor rules except that fs
based unix sockets can be mediated by existing file rules. None fs
unix sockets can be mediated by a unix socket rule. Where The address
of an abstract unix domain socket begins with the @ character, similar
to how they are reported (as paths) by netstat -x. The address then
follows and may contain pattern matching and any characters including
the null character. In apparmor null characters must be specified by
using an escape sequence \000 or \x00. The pattern matching is the
same as is used by file path matching so * will not match / even
though it has no special meaning with in an abstract socket name. Eg.
allow unix addr=@*,
Autobound unix domain sockets have a unix sun_path assigned to them by
the kernel, as such specifying a policy based address is not possible.
The autobinding of sockets can be controlled by specifying the special
auto keyword. Eg.
allow unix addr=auto,
To indicate that the rule only applies to auto binding of unix domain
sockets. It is important to note this only applies to the bind
permission as once the socket is bound to an address it is
indistinguishable from a socket that have an addr bound with a
specified name. When the auto keyword is used with other permissions
or as part of a peer addr it will be replaced with a pattern that can
match an autobound socket. Eg. For some kernels
allow unix rw addr=auto,
It is important to note, this pattern may match abstract sockets that
were not autobound but have an addr that fits what is generated by the
kernel when autobinding a socket.
Anonymous unix domain sockets have no sun_path associated with the
socket address, however it can be specified with the special none
keyword to indicate the rule only applies to anonymous unix domain
sockets. Eg.
allow unix addr=none,
If the address component of a rule is not specified then the rule
applies to autobind, abstract and anonymous sockets.
The label on the socket can be compared using the standard label=
rule conditional. Eg.
allow unix addr=@foo peer=(label=bar),
see man apparmor.d for full syntax description.
Signed-off-by: John Johansen <john.johansen@canonical.com>
2022-09-07 12:46:30 -07:00
|
|
|
|
2017-06-09 08:14:28 -07:00
|
|
|
|
2022-09-06 14:03:44 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2022-09-09 16:00:09 -07:00
|
|
|
|
2023-03-20 14:43:41 -03:00
|
|
|
|
2012-02-16 07:07:53 -08:00
|
|
|
|
2022-09-06 14:03:44 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2023-10-27 10:31:06 -07:00
|
|
|
|
2022-09-06 14:03:44 -07:00
|
|
|
|
2012-02-16 07:07:53 -08:00
|
|
|
|
2010-07-29 14:47:57 -07:00
|
|
|
|
|
|
|
|
|
2012-01-13 09:32:20 +10:30
|
|
|
|
2022-09-23 16:36:10 -07:00
|
|
|
|
2014-10-24 09:16:14 -07:00
|
|
|
|
2021-02-01 03:43:18 -08:00
|
|
|
|
2019-01-23 19:17:09 +00:00
|
|
|
|
2012-01-13 09:32:20 +10:30
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2010-07-29 14:47:57 -07:00
|
|
|
|
|
|
|
|
|
2022-09-29 06:24:29 -07:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2010-07-29 14:47:57 -07:00
|
|
|
|
