mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-02 15:18:19 +00:00
524d8e1425
Displaying the mode as part of the seectx takes up unnecessary memory, makes it so we can't use refcounted secctx so we need to alloc/free on every conversion from secid to secctx and introduces a space that could be potentially mishandled by tooling. Eg. In an audit record we get subj_type=firefix (enforce) Having the mode reported is not necessary, and might even be confusing eg. when writing an audit rule to match the above record field you would use -F subj_type=firefox ie. the mode is not included. AppArmor provides ways to find the mode without reporting as part of the secctx. So disable this by default before its use is wide spread and we can't. For now we add a sysctl to control the behavior as we can't guarantee no one is using this. Acked-by: Andrea Righi <andrea.righi@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com> |
||
|---|---|---|
| .. | ||
| include | ||
| .gitignore | ||
| apparmorfs.c | ||
| audit.c | ||
| capability.c | ||
| crypto.c | ||
| domain.c | ||
| file.c | ||
| ipc.c | ||
| Kconfig | ||
| label.c | ||
| lib.c | ||
| lsm.c | ||
| Makefile | ||
| match.c | ||
| mount.c | ||
| net.c | ||
| nulldfa.in | ||
| path.c | ||
| policy.c | ||
| policy_ns.c | ||
| policy_unpack.c | ||
| policy_unpack_test.c | ||
| procattr.c | ||
| resource.c | ||
| secid.c | ||
| stacksplitdfa.in | ||
| task.c | ||