Messages in this thread | | | From | John Johansen <> | Subject | [AppArmor #3 0/12] AppArmor security module | Date | Tue, 10 Nov 2009 08:12:53 -0800 |
| |
This is the newest version of the AppArmor security module it has been rewritten to use the security_path hooks instead of the previous vfs approach. The current implementation is aimed at being as semantically close to previous versions of AppArmor as possible while using the existing LSM infrastructure.
The rewrite is functional and roughly equivalent to previous versions of AppArmor based off of vfs patching. Development is on going and improvements to file, capability, network, resource usage and ipc mediation are planned.
_Issues NOT currently addressed and will be address in the next post_ * AppArmor audit framework has not yet been updated as suggested by Eric Paris in http://marc.info/?l=linux-security-module&m=125778105017307&w=2 * AppArmor mmap_min_addr is broken and needs to be fixed as pointed out by Eric Paris in http://marc.info/?l=linux-security-module&m=125778004815241&w=2
_Issues Addressed Since Last Time AppArmor was Posted_ * Implemented change recommended by Tetsuo Handa in feedback: http://marc.info/?l=linux-security-module&m=125730973023168&w=2 http://marc.info/?l=linux-security-module&m=125740018700307&w=2 - removed read head reset in policy_unpack - added addition comments on locking, refcounting, and memory allocation - reworked ref counting some so that more references are held explicitly - drop dead/unreachable code - fix oops in putting caps cache cpu_local var - fix refcounting bug causing leak of creds - reworked __d_path race detection and removal of (deleted) string * fixed bug in nameresolution failure in apparmor_bprm_set_creds that could cause a null pointer dereference oops * fix bug in removal of child profiles that would lead to null pointer dereference oops. Cleaned up code and removed dead portions * rework filter and newest profile cleaning them up after changes made for above removal bug. * Cleanup namespace code, removing unused fns and adding addition comments * move profile load/replace/remove routines from policy_unpack.c to policy.c this allowed cleaning up the interface, allowing for more core policy functions to be static, and also allows policy_unpack to only contain unpack code.
AppArmor documentation can currently be found at http://developer.novell.com/wiki/index.php/Apparmor
The unflattened AppArmor git tree can be found at git://kernel.ubuntu.com/jj/apparmor-mainline.git
The AppArmor project is currently in transition and will be moving away from Novell forge. The current upstream for the AppArmor tools can be found at https://launchpad.net/apparmor
The final location of the documentation and mailing lists have not been determined and will be updated when known.
| |