apparmor: Add support for attaching profiles via xattr, presence and value

Browse source

Make it possible to tie Apparmor profiles to the presence of one or more
extended attributes, and optionally their values. An example usecase for
this is to automatically transition to a more privileged Apparmor profile
if an executable has a valid IMA signature, which can then be appraised
by the IMA subsystem.

Signed-off-by: Matthew Garrett <mjg59@google.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>

...

This commit is contained in:

Matthew Garrett 2018-02-08 12:37:19 -08:00 • committed by John Johansen

parent a0781209cb

commit 8e51f9087f

4 changed files with 217 additions and 34 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

150

security/apparmor/domain.c

View file

6

security/apparmor/include/policy.h

View file

8

security/apparmor/policy.c

View file

85

security/apparmor/policy_unpack.c

View file