linux/security/apparmor/include/file.h, branch v5.3

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441

2019-06-05T15:37:17Z

Based on 1 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation version 2 of the license extracted by the scancode license scanner the SPDX license identifier GPL-2.0-only has been chosen to replace the boilerplate/reference in 315 file(s). Signed-off-by: Thomas Gleixner Reviewed-by: Allison Randal Reviewed-by: Armijn Hemel Cc: linux-spdx@vger.kernel.org Link: https://lkml.kernel.org/r/20190531190115.503150771@linutronix.de Signed-off-by: Greg Kroah-Hartman

LSM: Infrastructure management of the file security

2019-01-08T21:18:44Z

Move management of the file->f_security blob out of the individual security modules and into the infrastructure. The modules no longer allocate or free the data, instead they tell the infrastructure how much space they require. Signed-off-by: Casey Schaufler Reviewed-by: Kees Cook [kees: adjusted for ordered init series] Signed-off-by: Kees Cook

apparmor: Refactor to remove bprm_secureexec hook

2017-08-01T19:03:06Z

The AppArmor bprm_secureexec hook can be merged with the bprm_set_creds hook since it's dealing with the same information, and all of the details are finalized during the first call to the bprm_set_creds hook via prepare_binprm() (subsequent calls due to binfmt_script, etc, are ignored via bprm->called_set_creds). Here, all the comments describe how secureexec is actually calculated during bprm_set_creds, so this actually does it, drops the bprm flag that was being used internally by AppArmor, and drops the bprm_secureexec hook. Signed-off-by: Kees Cook Acked-by: John Johansen Reviewed-by: James Morris Acked-by: Serge Hallyn

apparmor: move path_link mediation to using labels

2017-06-11T00:11:44Z

Signed-off-by: John Johansen

apparmor: refactor path name lookup and permission checks around labels

2017-06-11T00:11:43Z

Signed-off-by: John Johansen

apparmor: update aa_audit_file() to use labels

2017-06-11T00:11:43Z

Signed-off-by: John Johansen

apparmor: move aa_file_perm() to use labels

2017-06-11T00:11:42Z

Signed-off-by: John Johansen

apparmor: revalidate files during exec

2017-06-11T00:11:37Z

Instead of running file revalidation lazily when read/write are called copy selinux and revalidate the file table on exec. This avoids extra mediation overhead in read/write and also prevents file handles being passed through to a grand child unchecked. Signed-off-by: John Johansen

apparmor: cleanup rename XXX_file_context() to XXX_file_ctx()

2017-06-11T00:11:37Z

Signed-off-by: John Johansen

apparmor: switch from file_perms to aa_perms

2017-06-11T00:11:30Z

Signed-off-by: John Johansen