Micah Morton
87ca9aaf0c
LSM: generalize flag passing to security_capable ...
[ Upstream commit c1a85a00ea66cb6f0bd0f14e47c28c2b0999799f ]
This patch provides a general mechanism for passing flags to the
security_capable LSM hook. It replaces the specific 'audit' flag that is
used to tell security_capable whether it should log an audit message for
the given capability check. The reason for generalizing this flag
passing is so we can add an additional flag that signifies whether
security_capable is being called by a setid syscall (which is needed by
the proposed SafeSetID LSM).
Signed-off-by: Micah Morton <mortonm@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: James Morris <james.morris@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-01-23 08:21:29 +01:00
apparmor: add base infastructure for socket mediation
2018-03-13 17:25:48 -07:00
apparmor: add policy revision file interface
2017-06-10 17:11:27 -07:00
apparmor: Add support for audit rule filtering
2018-06-07 01:50:47 -07:00
LSM: generalize flag passing to security_capable
2020-01-23 08:21:29 +01:00
apparmor: move context.h to cred.h
2018-02-09 11:30:01 -08:00
apparmor: allow introspecting the loaded policy pre internal transform
2017-01-16 01:18:42 -08:00
+ Features
2017-09-23 05:33:29 -10:00
apparmor: Refactor to remove bprm_secureexec hook
2017-08-01 12:03:06 -07:00
apparmor: add the ability to mediate signals
2017-09-22 13:00:57 -07:00
apparmor: add support for mapping secids and using secctxes
2018-05-02 00:48:55 -07:00
Rename superblock flags (MS_xyz -> SB_xyz)
2017-11-27 13:05:09 -08:00
apparmor: improve overlapping domain attachment resolution
2018-02-09 11:30:02 -08:00
apparmor: add mount mediation
2017-09-22 13:00:57 -07:00
apparmor: add base infastructure for socket mediation
2018-03-13 17:25:48 -07:00
apparmor: improve get_buffers macro by using get_cpu_ptr
2018-06-07 01:49:21 -07:00
apparmor: Check buffer bounds when mapping permissions mask
2018-07-19 16:24:43 -07:00
apparmor: fix PROFILE_MEDIATES for untrusted input
2019-06-25 11:35:54 +08:00
apparmor: switch from profiles to using labels on contexts
2017-06-10 17:11:38 -07:00
apparmor: split load data into management struct and data blob
2018-02-09 11:30:00 -08:00
apparmor: switch getprocattr to using label_print fns()
2017-06-10 17:11:39 -07:00
apparmor: move resource checks to using labels
2017-06-10 17:11:40 -07:00
apparmor: fixup secid map conversion to using IDR
2018-06-07 01:50:49 -07:00
apparmor: audit unknown signal numbers
2018-02-09 11:30:01 -08:00
apparmor: update domain transitions that are subsets of confinement at nnp
2018-02-09 11:30:01 -08:00
87ca9aaf0c