From: John Johansen <john.johansen@canonical.com>
To: linux-kernel@vger.kernel.org
Cc: linux-security-module@vger.kernel.org
Subject: [AppArmor #3 0/12] AppArmor security module
Date: Tue, 10 Nov 2009 08:12:53 -0800 [thread overview]
Message-ID: <1257869585-7092-1-git-send-email-john.johansen@canonical.com> (raw)
This is the newest version of the AppArmor security module it has been
rewritten to use the security_path hooks instead of the previous vfs
approach. The current implementation is aimed at being as semantically
close to previous versions of AppArmor as possible while using the
existing LSM infrastructure.
The rewrite is functional and roughly equivalent to previous versions
of AppArmor based off of vfs patching. Development is on going and
improvements to file, capability, network, resource usage and ipc mediation
are planned.
_Issues NOT currently addressed and will be address in the next post_
* AppArmor audit framework has not yet been updated as suggested by
Eric Paris in
http://marc.info/?l=linux-security-module&m=125778105017307&w=2
* AppArmor mmap_min_addr is broken and needs to be fixed as pointed out by
Eric Paris in
http://marc.info/?l=linux-security-module&m=125778004815241&w=2
_Issues Addressed Since Last Time AppArmor was Posted_
* Implemented change recommended by Tetsuo Handa in feedback:
http://marc.info/?l=linux-security-module&m=125730973023168&w=2
http://marc.info/?l=linux-security-module&m=125740018700307&w=2
- removed read head reset in policy_unpack
- added addition comments on locking, refcounting, and memory allocation
- reworked ref counting some so that more references are held explicitly
- drop dead/unreachable code
- fix oops in putting caps cache cpu_local var
- fix refcounting bug causing leak of creds
- reworked __d_path race detection and removal of (deleted) string
* fixed bug in nameresolution failure in apparmor_bprm_set_creds that could
cause a null pointer dereference oops
* fix bug in removal of child profiles that would lead to null pointer
dereference oops. Cleaned up code and removed dead portions
* rework filter and newest profile cleaning them up after changes made for
above removal bug.
* Cleanup namespace code, removing unused fns and adding addition comments
* move profile load/replace/remove routines from policy_unpack.c to policy.c
this allowed cleaning up the interface, allowing for more core policy
functions to be static, and also allows policy_unpack to only contain
unpack code.
AppArmor documentation can currently be found at
http://developer.novell.com/wiki/index.php/Apparmor
The unflattened AppArmor git tree can be found at
git://kernel.ubuntu.com/jj/apparmor-mainline.git
The AppArmor project is currently in transition and will be moving
away from Novell forge. The current upstream for the AppArmor tools
can be found at
https://launchpad.net/apparmor
The final location of the documentation and mailing lists have
not been determined and will be updated when known.
next reply other threads:[~2009-11-10 16:13 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-11-10 16:12 John Johansen [this message]
2009-11-10 16:12 ` [PATCH 01/12] AppArmor: misc. base functions and defines John Johansen
2009-11-10 16:12 ` [PATCH 02/12] AppArmor: basic auditing infrastructure John Johansen
2009-11-10 16:12 ` [PATCH 03/12] AppArmor: contexts used in attaching policy to system objects John Johansen
2009-11-10 16:12 ` [PATCH 04/12] AppArmor: core policy routines John Johansen
2009-11-10 16:12 ` [PATCH 05/12] AppArmor: dfa match engine John Johansen
2009-11-10 16:12 ` [PATCH 06/12] AppArmor: policy routines for loading and unpacking policy John Johansen
2009-11-10 16:13 ` [PATCH 07/12] AppArmor: userspace interfaces John Johansen
2009-11-10 16:29 ` Pekka Enberg
2009-11-10 16:44 ` Andi Kleen
2009-11-10 18:21 ` Stephen Hemminger
2009-11-15 22:14 ` david
2009-11-15 22:13 ` david
2009-11-10 18:51 ` John Johansen
2009-11-10 16:13 ` [PATCH 08/12] AppArmor: file enforcement routines John Johansen
2009-11-10 16:13 ` [PATCH 09/12] AppArmor: mediation of non file objects John Johansen
2009-11-10 16:13 ` [PATCH 10/12] AppArmor: domain functions for domain transition John Johansen
2009-11-10 16:13 ` [PATCH 11/12] AppArmor: LSM interface, and security module initialization John Johansen
2009-11-10 16:13 ` [PATCH 12/12] AppArmor: Enable configuring and building of the AppArmor security module John Johansen
2009-11-13 17:44 ` [AppArmor #3 0/12] " Stephen Hemminger
2009-11-13 17:58 ` John Johansen
2009-11-20 17:39 ` Tetsuo Handa
2009-11-21 5:28 ` Tetsuo Handa
2009-11-22 11:49 ` Tetsuo Handa
2009-11-23 10:10 ` John Johansen
2009-11-23 10:11 ` John Johansen
2009-11-23 10:10 ` John Johansen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1257869585-7092-1-git-send-email-john.johansen@canonical.com \
--to=john.johansen@canonical.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®