Create the "file" directory in the securityfs for tracking features related to files.
Change-Id: Ia12babbd48e7d9b4eb3ce6cb5e51f4b46ba3a1b0 Signed-off-by: Kees Cook <[email protected]> --- security/apparmor/apparmorfs.c | 10 ++++++++++ security/apparmor/include/apparmorfs.h | 6 ++++++ 2 files changed, 16 insertions(+), 0 deletions(-) diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c index 4f61ef5..435bd37 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c @@ -155,6 +155,9 @@ static int aa_fs_seq_show(struct seq_file *seq, void *v) seq_printf(seq, "%s\n", fs_file->v.boolean ? "yes" : "no"); break; + case AA_FS_TYPE_STRING: + seq_printf(seq, "%s\n", fs_file->v.string); + break; case AA_FS_TYPE_U64: seq_printf(seq, "%#08lx\n", fs_file->v.u64); break; @@ -181,6 +184,12 @@ const struct file_operations aa_fs_seq_file_ops = { /** Base file system setup **/ +static struct aa_fs_entry aa_fs_entry_file[] = { + AA_FS_FILE_STRING("mask", "create read write exec append mmap_exec " \ + "link lock"), + { } +}; + static struct aa_fs_entry aa_fs_entry_domain[] = { AA_FS_FILE_BOOLEAN("change_hat", 1), AA_FS_FILE_BOOLEAN("change_hatv", 1), @@ -191,6 +200,7 @@ static struct aa_fs_entry aa_fs_entry_domain[] = { static struct aa_fs_entry aa_fs_entry_features[] = { AA_FS_DIR("domain", aa_fs_entry_domain), + AA_FS_DIR("file", aa_fs_entry_file), AA_FS_FILE_BOOLEAN("namespaces", 1), AA_FS_FILE_U64("capability", VFS_CAP_FLAGS_MASK), { } diff --git a/security/apparmor/include/apparmorfs.h b/security/apparmor/include/apparmorfs.h index 0312361..2de5a73 100644 --- a/security/apparmor/include/apparmorfs.h +++ b/security/apparmor/include/apparmorfs.h @@ -17,6 +17,7 @@ enum aa_fs_type { AA_FS_TYPE_BOOLEAN, + AA_FS_TYPE_STRING, AA_FS_TYPE_U64, AA_FS_TYPE_FOPS, AA_FS_TYPE_DIR, @@ -31,6 +32,7 @@ struct aa_fs_entry { enum aa_fs_type v_type; union { bool boolean; + char *string; unsigned long u64; struct aa_fs_entry *files; } v; @@ -43,6 +45,10 @@ extern const struct file_operations aa_fs_seq_file_ops; { .name = (_name), .mode = 0444, \ .v_type = AA_FS_TYPE_BOOLEAN, .v.boolean = (_value), \ .file_ops = &aa_fs_seq_file_ops } +#define AA_FS_FILE_STRING(_name, _value) \ + { .name = (_name), .mode = 0444, \ + .v_type = AA_FS_TYPE_STRING, .v.string = (_value), \ + .file_ops = &aa_fs_seq_file_ops } #define AA_FS_FILE_U64(_name, _value) \ { .name = (_name), .mode = 0444, \ .v_type = AA_FS_TYPE_U64, .v.u64 = (_value), \ -- 1.7.2.3 -- Kees Cook -- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
