On Wed, May 10, 2017 at 7:46 PM, John Johansen <[email protected]> wrote: > virtualize the apparmor policy/ directory so that the current namespace > affects what part of policy is seen. This is done by > > * creating a new apparmorfs filesystem > * creating a magic symlink from securityfs to the correct apparmorfs > file in the tree (similar to nsfs use). > > apparmor fs data and fns also get renamed some to help indicate where > they are used > > aafs - special magic apparmorfs > aa_sfs - for fns/data that go into securityfs > aa_fs - for fns/data that may be used in the either of aafs or securityfs > > Signed-off-by: John Johansen <[email protected]> > Reviewed-by: Seth Arnold <[email protected]>
This all looks fine to me. If you do a v2 of these patches, it might make sense to split up some of the logical changes here. For example, have one patch that does the renamings but no code changes. Then add the new fs, and finally integrate the new fs. That might make it easier to review. Regardless: Reviewed-by: Kees Cook <[email protected]> -Kees -- Kees Cook Pixel Security
