linux/security/apparmor/include/audit.h, branch v4.9

apparmor: remove parent task info from audit logging

2013-10-30T04:34:04Z

The reporting of the parent task info is a vestage from old versions of apparmor. The need for this information was removed by unique null- profiles before apparmor was upstreamed so remove this info from logging. Signed-off-by: John Johansen

apparmor: add interface files for profiles and namespaces

2013-08-14T18:42:07Z

Add basic interface files to access namespace and profile information. The interface files are created when a profile is loaded and removed when the profile or namespace is removed. Signed-off-by: John Johansen

userns: Convert apparmor to use kuid and kgid where appropriate

2012-09-21T10:13:21Z

Cc: John Johansen Acked-by: Serge Hallyn Signed-off-by: Eric W. Biederman

apparmor: move task from common_audit_data to apparmor_audit_data

2012-04-09T16:23:02Z

apparmor is the only LSM that uses the common_audit_data tsk field. Instead of making all LSMs pay for the stack space move the aa usage into the apparmor_audit_data. Signed-off-by: Eric Paris

LSM: shrink sizeof LSM specific portion of common_audit_data

2012-04-03T16:48:40Z

Linus found that the gigantic size of the common audit data caused a big perf hit on something as simple as running stat() in a loop. This patch requires LSMs to declare the LSM specific portion separately rather than doing it in a union. Thus each LSM can be responsible for shrinking their portion and don't have to pay a penalty just because other LSMs have a bigger space requirement. Signed-off-by: Eric Paris Signed-off-by: Linus Torvalds

AppArmor: add const qualifiers to string arrays

2012-03-15T02:09:13Z

Signed-off-by: Jan Engelhardt Signed-off-by: John Johansen

AppArmor: Fix dropping of allowed operations that are force audited

2012-02-27T19:38:21Z

The audit permission flag, that specifies an audit message should be provided when an operation is allowed, was being ignored in some cases. This is because the auto audit mode (which determines the audit mode from system flags) was incorrectly assigned the same value as audit mode. The shared value would result in messages that should be audited going through a second evaluation as to whether they should be audited based on the auto audit, resulting in some messages being dropped. Signed-off-by: John Johansen Acked-by: Kees Cook

AppArmor: basic auditing infrastructure.

2010-08-02T05:35:11Z

Update lsm_audit for AppArmor specific data, and add the core routines for AppArmor uses for auditing. Signed-off-by: John Johansen Signed-off-by: James Morris