On Thu, Feb 08, 2018 at 04:04:37PM -0800, John Johansen wrote:
> > If this step fails before completion, the xattrs array may have some
> > entries that weren't properly initialized; I suspect the free operation
> > will cause serious trouble in this case.
> >
> yep we can switch the
On 02/08/2018 02:07 PM, Seth Arnold wrote:
> Hello,
>
> On Thu, Feb 08, 2018 at 12:37:19PM -0800, John Johansen wrote:
>> +static bool unpack_xattrs(struct aa_ext *e, struct aa_profile *profile)
>> +{
>> +void *pos = e->pos;
>> +
>> +if (unpack_nameX(e, AA_STRUCT, "xattrs")) {
>> +
On Thu, Feb 08, 2018 at 12:38:57PM -0800, John Johansen wrote:
> This converts profile attachment based on xattrs to a fixed extended
> conditional using dfa matching.
>
> This has a couple of advantages
> - pattern matching can be used for the xattr match
>
> - xattrs can be optional for an
Hello,
On Thu, Feb 08, 2018 at 12:37:19PM -0800, John Johansen wrote:
> +static bool unpack_xattrs(struct aa_ext *e, struct aa_profile *profile)
> +{
> + void *pos = e->pos;
> +
> + if (unpack_nameX(e, AA_STRUCT, "xattrs")) {
> + int i, size;
> +
> + size =
On Thu, 2018-02-08 at 19:46 +0200, Vincas Dargis wrote:
> On 2/6/18 9:25 PM, Jamie Strandboge wrote:
> > > Anyway, do we _really_ want to allow mmap on writable files..?
> >
> > Not usually, but in the case of actual shared memory files, there
> > isn't
> > another choice atm. Some day we'll
Hi guys,
I checked out Ubuntu 16.04 and got this output:
$ cat /sys/kernel/security/apparmor/features/network/af_unix
yes
But Ubuntu 16.04 based on 4.4 kernel
$ uname -a
Linux 4.4.0-112-generic #135-Ubuntu SMP Fri Jan 19 11:48:36 UTC 2018 x86_64
x86_64 x86_64 GNU/Linux
I cloned xenial kernel
Overlapping domain attachments using the current longest left exact
match fail in some simple cases, and with the fix to ensure consistant
behavior by failing unresolvable attachments it becomes important to
do a better job.
eg. under the current match the following are unresolvable where
the
This converts profile attachment based on xattrs to a fixed extended
conditional using dfa matching.
This has a couple of advantages
- pattern matching can be used for the xattr match
- xattrs can be optional for an attachment or marked as required
- the xattr attachment conditional will be
Make it possible to tie Apparmor profiles to the presence of one or more
extended attributes, and optionally their values. An example usecase for
this is to automatically transition to a more privileged Apparmor profile
if an executable has a valid IMA signature, which can then be appraised
by the
So this is my counter proposal
Patch 1/3 your V2 patch rebased
Patch 2/3 modifies the V2 patch so that the xattrs are matched using
the dfa. This provides more flexibility in what can be done with xattr
matching, and also makes it so the xattr match can be better
integrated with other match
On 2/6/18 9:25 PM, Jamie Strandboge wrote:
Anyway, do we _really_ want to allow mmap on writable files..?
Not usually, but in the case of actual shared memory files, there isn't
another choice atm. Some day we'll mediate shared memory with non-file
rules[1].
There is a choice to deny it.
11 matches
Mail list logo
