xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

apparmor: allow ptrace checks to be finer grained than just capability

Browse Source 
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen
2017-06-09 14:38:35 -07:00
parent b2d09ae449
commit 290f458a4f
3 changed files with 68 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
security/apparmor/apparmorfs.c
View File

@@ -2086,6 +2086,11 @@ static struct aa_sfs_entry aa_sfs_entry_file[] = {
{ }
};
static struct aa_sfs_entry aa_sfs_entry_ptrace[] = {
AA_SFS_FILE_STRING("mask", "read trace"),
{ }
};
static struct aa_sfs_entry aa_sfs_entry_domain[] = {
AA_SFS_FILE_BOOLEAN("change_hat", 1),
AA_SFS_FILE_BOOLEAN("change_hatv", 1),
@@ -2125,6 +2130,7 @@ static struct aa_sfs_entry aa_sfs_entry_features[] = {
AA_SFS_FILE_U64("capability", VFS_CAP_FLAGS_MASK),
AA_SFS_DIR("rlimit", aa_sfs_entry_rlimit),
AA_SFS_DIR("caps", aa_sfs_entry_caps),
AA_SFS_DIR("ptrace", aa_sfs_entry_ptrace),
AA_SFS_DIR("query", aa_sfs_entry_query),
{ }
};