10 Apr, 2012

2 commits

• 50c205f5e   LSM: do not initialize common_audit_data to 0 ... Browse Code »

  It isn't needed. If you don't set the type of the data associated with
  that type it is a pretty obvious programming bug. So why waste the cycles?

  Signed-off-by: Eric Paris

  Eric Paris

  2012-04-10 00:23:04 +0800  
• bd5e50f9c   LSM: remove the COMMON_AUDIT_DATA_INIT type expansion ... Browse Code »

  Just open code it so grep on the source code works better.

  Signed-off-by: Eric Paris

  Eric Paris

  2012-04-10 00:23:01 +0800  

04 Apr, 2012

1 commit

• 3b3b0e4fc   LSM: shrink sizeof LSM specific portion of common_audit_data ... Browse Code »

  Linus found that the gigantic size of the common audit data caused a big
  perf hit on something as simple as running stat() in a loop. This patch
  requires LSMs to declare the LSM specific portion separately rather than
  doing it in a union. Thus each LSM can be responsible for shrinking their
  portion and don't have to pay a penalty just because other LSMs have a
  bigger space requirement.

  Signed-off-by: Eric Paris
  Signed-off-by: Linus Torvalds

  Eric Paris

  2012-04-04 00:48:40 +0800  

28 Feb, 2012

1 commit

• d384b0a1a   AppArmor: export known rlimit names/value mappings in securityfs ... Browse Code »

  Since the parser needs to know which rlimits are known to the kernel,
  export the list via a mask file in the "rlimit" subdirectory in the
  securityfs "features" directory.

  Signed-off-by: Kees Cook
  Signed-off-by: John Johansen

  Kees Cook

  2012-02-28 03:38:19 +0800  

08 Sep, 2010

1 commit

• 3a2dc8382   AppArmor: Fix security_task_setrlimit logic for 2.6.36 changes ... Browse Code »

  2.6.36 introduced the abilitiy to specify the task that is having its
  rlimits set. Update mediation to ensure that confined tasks can only
  set their own group_leader as expected by current policy.

  Add TODO note about extending policy to support setting other tasks
  rlimits.

  Signed-off-by: John Johansen
  Signed-off-by: James Morris

  John Johansen

  2010-09-08 07:19:29 +0800  

02 Aug, 2010

1 commit

• 0ed3b28ab   AppArmor: mediation of non file objects ... Browse Code »

  ipc:
  AppArmor ipc is currently limited to mediation done by file mediation
  and basic ptrace tests. Improved mediation is a wip.

  rlimits:
  AppArmor provides basic abilities to set and control rlimits at
  a per profile level. Only resources specified in a profile are controled
  or set. AppArmor rules set the hard limit to a value
  Signed-off-by: James Morris

  John Johansen

  2010-08-02 13:38:35 +0800