Linux Kernel
3.7.1
|
#include <linux/slab.h>
#include <linux/spinlock.h>
#include <linux/string.h>
#include "include/apparmor.h"
#include "include/capability.h"
#include "include/context.h"
#include "include/file.h"
#include "include/ipc.h"
#include "include/match.h"
#include "include/path.h"
#include "include/policy.h"
#include "include/policy_unpack.h"
#include "include/resource.h"
#include "include/sid.h"
Go to the source code of this file.
Functions | |
: hname to find the base profile name component of (NOT NULL) | |
: name of the policy, init will make a copy of it (NOT NULL) | |
policy_init - initialize a policy structure : policy to initialize (NOT NULL) : prefix name if any is required. (MAYBE NULL) Note: this fn creates a copy of strings passed in Returns: true if policy init successful | |
: a preallocated name (NOT NULL) | |
alloc_namespace - allocate, initialize and return a new namespace : parent namespace name (MAYBE NULL) Returns: refcounted namespace or NULL on failure. | |
void | aa_free_namespace_kref (struct kref *kref) |
: name of namespace to look for (NOT NULL) | |
Returns: unrefcounted namespace Requires: ns lock be held | |
exists. | |
refcount released by caller | |
struct aa_namespace * | aa_find_namespace (struct aa_namespace *root, const char *name) |
: the namespace to find or add (MAYBE NULL) | |
Returns: refcounted namespace or NULL if failed to create one | |
int __init | aa_alloc_root_ns (void) |
void __init | aa_free_root_ns (void) |
struct aa_profile * | aa_alloc_profile (const char *hname) |
struct aa_profile * | aa_new_null_profile (struct aa_profile *parent, int hat) |
void | aa_free_profile_kref (struct kref *kref) |
: name of profile (NOT NULL) | |
: length of | |
substring to match | |
Requires: ns lock protecting list be held Returns: unrefcounted profile ptr, or NULL if not found | |
: profile name to search for (NOT NULL) | |
Returns: a refcounted profile or NULL if not found | |
struct aa_profile * | aa_find_child (struct aa_profile *parent, const char *name) |
struct aa_profile * | aa_lookup_profile (struct aa_namespace *ns, const char *hname) |
: name of profile being manipulated (NOT NULL) | |
aa_audit_policy - Do auditing of policy changes : policy operation being performed : memory allocation flags : any extra information to be audited (MAYBE NULL) : error code Returns: the error to be returned after audit is done | |
bool | aa_may_manage_policy (int op) |
ssize_t | aa_replace_profiles (void *udata, size_t size, bool noreplace) |
ssize_t | aa_remove_profiles (char *fqname, size_t size) |
Variables | |
struct aa_namespace * | root_ns |
const char *const | profile_mode_names [] |
or NULL if not found | |
bool | aa_ns_visible (struct aa_namespace *curr, struct aa_namespace *view) |
const char * | aa_ns_name (struct aa_namespace *curr, struct aa_namespace *view) |
|
read |
|
read |
|
read |
aa_free_namespace_kref - free aa_namespace by kref (see aa_put_namespace) : kref callback for freeing of a namespace (NOT NULL)
aa_free_profile_kref - free aa_profile by kref (called by aa_put_profile) : kref callback for freeing of a profile (NOT NULL)
|
read |
|
read |
aa_new_null_profile - create a new null-X learning profile : profile that caused this profile to be created (NOT NULL) : true if the null- learning profile is a hat
Create a null- complain mode profile used in learning mode. The name of the profile is unique and follows the format of parent//null-sid.
null profiles are added to the profile list but the list does not hold a count on them so that they are automatically released when not in use.
Returns: new refcounted profile else NULL on failure
const char* aa_ns_name | ( | struct aa_namespace * | curr, |
struct aa_namespace * | view | ||
) |
bool aa_ns_visible | ( | struct aa_namespace * | curr, |
struct aa_namespace * | view | ||
) |
aa_remove_profiles - remove profile(s) from the system : name of the profile or namespace to remove (NOT NULL) : size of the name
Remove a profile or sub namespace from the current namespace, so that they can not be found anymore and mark them as replaced by unconfined
NOTE: removing confinement does not restore rlimits to preconfinemnet values
Returns: size of data consume else error code if fails
aa_replace_profiles - replace profile(s) on the profile list : serialized data stream (NOT NULL) : size of the serialized data stream : true if only doing addition, no replacement allowed
unpack and replace a profile on the profile list and uses of that profile by any aa_task_cxt. If the profile does not exist on the profile list it is added.
Returns: size of data consumed else error code on failure.
struct aa_namespace* root_ns |