This stacks on the per-policy-namespace resource controls [1] and
enforces the "policyns" permission rule (create/load/replace/remove)
that the base series registered but did not consult.

The base series registered AA_CLASS_POLICY_NS and the parser emits the
rule's class DFA, but no chokepoint checked the grants, so a rule such
as "deny policyns remove self" had no effect. This series adds the DFA
matcher and checks it at the create, load, replace and remove
chokepoints, ahead of the resource-quota admission. Enforcement is
gated on a new "mediation" token in the policy/ns_quota mask, so a
kernel that enforces the rule can be told apart from one that only
parses it.

Based on [1]; the matching userspace parser support is in [2].

[1] https://lists.ubuntu.com/archives/apparmor/2026-July/014820.html
[2] https://gitlab.com/apparmor/apparmor/-/merge_requests/2169

Maxime Bélair (4):
  apparmor: add policyns permission-rule verb defs and audit op
  apparmor: mediate policyns namespace creation
  apparmor: mediate policyns load, replace and remove
  apparmor: advertise policyns permission mediation

 security/apparmor/apparmorfs.c        |  37 +++--
 security/apparmor/include/audit.h     |   1 +
 security/apparmor/include/policy.h    |  16 ++
 security/apparmor/include/policy_ns.h |  10 +-
 security/apparmor/policy.c            |  24 ++-
 security/apparmor/policy_ns.c         | 222 +++++++++++++++++++++++++-
 6 files changed, 292 insertions(+), 18 deletions(-)


base-commit: aa81cfdb3d36d09f517faeaacb8579d7585d630f
-- 
2.51.0


Reply via email to