xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

apparmor: Add support for audit rule filtering

Browse Source 
This patch adds support to Apparmor for integrating with audit rule
filtering. Right now it only handles SUBJ_ROLE, interpreting it as a
single component of a label. This is sufficient to get Apparmor working
with IMA's appraisal rules without any modifications on the IMA side.

Signed-off-by: Matthew Garrett <mjg59@google.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
Matthew Garrett
2018-04-16 11:23:58 -07:00
committed by John Johansen
parent b896c54e8d
commit e79c26d040
3 changed files with 107 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
security/apparmor/lsm.c
View File

@@ -1198,6 +1198,13 @@ static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit),
LSM_HOOK_INIT(task_kill, apparmor_task_kill),
#ifdef CONFIG_AUDIT
LSM_HOOK_INIT(audit_rule_init, aa_audit_rule_init),
LSM_HOOK_INIT(audit_rule_known, aa_audit_rule_known),
LSM_HOOK_INIT(audit_rule_match, aa_audit_rule_match),
LSM_HOOK_INIT(audit_rule_free, aa_audit_rule_free),
#endif
LSM_HOOK_INIT(secid_to_secctx, apparmor_secid_to_secctx),
LSM_HOOK_INIT(secctx_to_secid, apparmor_secctx_to_secid),
LSM_HOOK_INIT(release_secctx, apparmor_release_secctx),