[lkml]   [2006]   [Apr]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [RFC][PATCH 5/11] security: AppArmor - Filesystem
Tony Jones wrote:     [Wed Apr 19 2006, 01:49:46PM EDT]
> This patch implements the AppArmor file structure underneath securityfs.
> Securityfs is normally mounted as /sys/kernel/security
> The following files are created under /sys/kernel/security/apparmor
> control
> audit - Controls the global setting for auditing all
> accesses.
> complain - Controls the global setting for learning mode
> (usually this is set per profile rather than
> globally)
> debug - Controls whether debugging is enabled.
> This needs to be made more fine grained
> logsyscall - Controls whether when logging to the audit
> subsystem full syscall auditing is enabled.

Why not use audit's audit_enabled toggle instead? This would
eliminate the overhead of data collection for syscall auditing, in
addition to eliminating the extra log data.

Is it likely that a user will want to keep syscall auditing on for
some applications, while having it disabled for AppArmor's use?

> The values by default for all of the above are 0.
> matching - Returns the features of the installed matching submodule
> profiles - Returns the profiles currently loaded and for each whether
> it is in complain (learning) or enforce mode.
> .load
> .remove
> .replace - Used by userspace tools to load, remove and replace new
> profiles.
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2006-04-21 23:16    [W:0.373 / U:0.496 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site