Add the create/load/replace/remove verb bits the parser encodes on the AA_CLASS_POLICY_NS DFA state, and the OP_POLICYNS audit operation.
Signed-off-by: Maxime Bélair <[email protected]> --- security/apparmor/include/audit.h | 1 + security/apparmor/include/policy.h | 16 ++++++++++++++++ 2 files changed, 17 insertions(+) diff --git a/security/apparmor/include/audit.h b/security/apparmor/include/audit.h index cf62c2994233..229c6acadfdb 100644 --- a/security/apparmor/include/audit.h +++ b/security/apparmor/include/audit.h @@ -106,6 +106,7 @@ enum audit_type { #define OP_USERNS_CREATE "userns_create" #define OP_NS_QUOTA "ns_quota" +#define OP_POLICYNS "policyns" #define OP_URING_OVERRIDE "uring_override" #define OP_URING_SQPOLL "uring_sqpoll" diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h index 22c6a80a7596..42fd18b12886 100644 --- a/security/apparmor/include/policy.h +++ b/security/apparmor/include/policy.h @@ -203,6 +203,22 @@ struct aa_ns_caps { }; +/* + * Verb permissions for the "policyns" permission rule, encoded on the + * AA_CLASS_POLICY_NS state of the class DFA. Wire ABI, MUST match + * parser/policyns.h. Kept clear of AA_MAY_READ, which marks the class as + * mediated. + */ +#define AA_POLICYNS_CREATE (1 << 3) +#define AA_POLICYNS_LOAD (1 << 4) +#define AA_POLICYNS_REPLACE (1 << 5) +#define AA_POLICYNS_REMOVE (1 << 6) +#define AA_VALID_POLICYNS_PERMS \ + (AA_POLICYNS_CREATE | AA_POLICYNS_LOAD | AA_POLICYNS_REPLACE | \ + AA_POLICYNS_REMOVE) +static_assert(!(AA_VALID_POLICYNS_PERMS & AA_MAY_READ), + "policyns verb perms must stay clear of the mediates marker"); + /* * Wire encoding of a "policyns limits" block. These constants are wire ABI * and MUST match parser/policyns.h; -- 2.51.0
