apparmor: Initial support for compressed policies

Browse source

This patch allows policies to be compressed in userspace and be sent to
the kernel through the existing ".load" and ".replace" kernel interfaces.

The benefits of this approach are:
 - Save kernel time when loading policies
 - Allow userspace to provide a higher level of compression than the one
   provided by the kernel (ZSTD_CLEVEL_DEFAULT), thus saving space.
 - Allow small embedded systems to only store the compressed version of
   policies in userspace, saving memory.

Userspace-compressed policies improve system time by up to ~30% for big
profiles.

Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>

...

This commit is contained in:

Maxime Bélair 2024-02-01 09:09:50 +01:00 • committed by John Johansen

parent 37077e4cfa

commit 17b5758bf3

5 changed files with 123 additions and 10 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

97

security/apparmor/apparmorfs.c

View file

3

security/apparmor/include/policy.h

View file

3

security/apparmor/include/policy_unpack.h

View file

7

security/apparmor/policy.c

View file

23

security/apparmor/policy_unpack.c

View file