AppArmor policy namespaces can be delegated: a container manager holding CAP_MAC_ADMIN in its namespace, or a task using the unprivileged self-policy interface, can create nested namespaces and load policy into them. None of this is accounted today, so a delegated workload can pin unbounded kernel memory (resident DFAs and permission tables), create unbounded profiles and namespaces, and nest namespaces up to the global limit, all charged to the host.
This series adds per-policy-namespace resource controls. Policy can set caps on a namespace (memory, per-profile size, profile count, child namespaces, nesting depth) through a new "policyns limits" block. The kernel accounts resident policy bytes and object counts per namespace and enforces the caps at the two chokepoints every load and namespace creation path shares. A load set is admitted or rejected as a whole before anything installs, and a child cannot increase its capabilities. The matching userspace work has been sent separately as [1]. The first patch removes an aa_ruleset field that has had no reader or writer since 2010. The rest add the feature: helpers to compute resident policy size, the AA_CLASS_POLICY_NS class with its audit plumbing and sysctl, the per-namespace accounting, cap enforcement, the wire format carrying the caps, and the securityfs and feature exposure. A final patch adds KUnit coverage for the new wire parsing, which is untrusted input. Mediation of the "policyns" permission rule and the remaining limits constructs (subtree scope, criu, name-routed targets, load_rate) follow in two later series once this lands. [1] https://gitlab.com/apparmor/apparmor/-/merge_requests/2169 Maxime Bélair (8): apparmor: drop the dead aa_ruleset size field apparmor: add helpers to compute resident policy size apparmor: add AA_CLASS_POLICY_NS class and ns_quota audit apparmor: revive per-namespace resource accounting apparmor: enforce per-namespace resource quotas apparmor: parse and apply policyns limits budget blob apparmor: wire per-namespace securityfs files + advertise policy/ns_quota apparmor: add KUnit tests for the policyns budget unpack security/apparmor/apparmorfs.c | 98 +++++ security/apparmor/audit.c | 2 +- security/apparmor/include/apparmor.h | 2 + security/apparmor/include/apparmorfs.h | 4 + security/apparmor/include/audit.h | 5 + security/apparmor/include/lib.h | 1 + security/apparmor/include/match.h | 1 + security/apparmor/include/policy.h | 107 +++++- security/apparmor/include/policy_ns.h | 57 ++- security/apparmor/include/policy_unpack.h | 12 + security/apparmor/lib.c | 21 + security/apparmor/lsm.c | 31 ++ security/apparmor/match.c | 25 ++ security/apparmor/policy.c | 147 ++++++- security/apparmor/policy_ns.c | 445 ++++++++++++++++++++++ security/apparmor/policy_unpack.c | 127 ++++++ security/apparmor/policy_unpack_test.c | 427 +++++++++++++++++++++ 17 files changed, 1497 insertions(+), 15 deletions(-) base-commit: 58f2024c92721f9e72a1b681cca6b8e4d3b89f86 -- 2.51.0
