aboutsummaryrefslogtreecommitdiffstats
path: root/security/apparmor/include/audit.h
diff options
context:
space:
mode:
authorJohn Johansen <john.johansen@canonical.com>2017-07-18 23:18:33 -0700
committerJohn Johansen <john.johansen@canonical.com>2017-09-22 13:00:58 -0700
commit651e28c5537abb39076d3949fb7618536f1d242e (patch)
tree376539d1a5b97339f9123809707fe5c442afc193 /security/apparmor/include/audit.h
parentapparmor: add more debug asserts to apparmorfs (diff)
downloadlinux-dev-651e28c5537abb39076d3949fb7618536f1d242e.tar.xz
linux-dev-651e28c5537abb39076d3949fb7618536f1d242e.zip
apparmor: add base infastructure for socket mediation
Provide a basic mediation of sockets. This is not a full net mediation but just whether a spcific family of socket can be used by an application, along with setting up some basic infrastructure for network mediation to follow. the user space rule hav the basic form of NETWORK RULE = [ QUALIFIERS ] 'network' [ DOMAIN ] [ TYPE | PROTOCOL ] DOMAIN = ( 'inet' | 'ax25' | 'ipx' | 'appletalk' | 'netrom' | 'bridge' | 'atmpvc' | 'x25' | 'inet6' | 'rose' | 'netbeui' | 'security' | 'key' | 'packet' | 'ash' | 'econet' | 'atmsvc' | 'sna' | 'irda' | 'pppox' | 'wanpipe' | 'bluetooth' | 'netlink' | 'unix' | 'rds' | 'llc' | 'can' | 'tipc' | 'iucv' | 'rxrpc' | 'isdn' | 'phonet' | 'ieee802154' | 'caif' | 'alg' | 'nfc' | 'vsock' | 'mpls' | 'ib' | 'kcm' ) ',' TYPE = ( 'stream' | 'dgram' | 'seqpacket' | 'rdm' | 'raw' | 'packet' ) PROTOCOL = ( 'tcp' | 'udp' | 'icmp' ) eg. network, network inet, Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>
Diffstat (limited to 'security/apparmor/include/audit.h')
-rw-r--r--security/apparmor/include/audit.h26
1 files changed, 17 insertions, 9 deletions
diff --git a/security/apparmor/include/audit.h b/security/apparmor/include/audit.h
index 620e81169659..ff4316e1068d 100644
--- a/security/apparmor/include/audit.h
+++ b/security/apparmor/include/audit.h
@@ -121,21 +121,29 @@ struct apparmor_audit_data {
/* these entries require a custom callback fn */
struct {
struct aa_label *peer;
- struct {
- const char *target;
- kuid_t ouid;
- } fs;
+ union {
+ struct {
+ kuid_t ouid;
+ const char *target;
+ } fs;
+ struct {
+ int type, protocol;
+ struct sock *peer_sk;
+ void *addr;
+ int addrlen;
+ } net;
+ int signal;
+ struct {
+ int rlim;
+ unsigned long max;
+ } rlim;
+ };
};
struct {
struct aa_profile *profile;
const char *ns;
long pos;
} iface;
- int signal;
- struct {
- int rlim;
- unsigned long max;
- } rlim;
struct {
const char *src_name;
const char *type;