From e79c26d04043b15de64f082d4da52e9fff7ca607 Mon Sep 17 00:00:00 2001 From: Matthew Garrett Date: Mon, 16 Apr 2018 11:23:58 -0700 Subject: apparmor: Add support for audit rule filtering This patch adds support to Apparmor for integrating with audit rule filtering. Right now it only handles SUBJ_ROLE, interpreting it as a single component of a label. This is sufficient to get Apparmor working with IMA's appraisal rules without any modifications on the IMA side. Signed-off-by: Matthew Garrett Signed-off-by: John Johansen --- security/apparmor/include/audit.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'security/apparmor/include/audit.h') diff --git a/security/apparmor/include/audit.h b/security/apparmor/include/audit.h index 9c9be9c98c15..b8c8b1066b0a 100644 --- a/security/apparmor/include/audit.h +++ b/security/apparmor/include/audit.h @@ -189,4 +189,10 @@ static inline int complain_error(int error) return error; } +void aa_audit_rule_free(void *vrule); +int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule); +int aa_audit_rule_known(struct audit_krule *rule); +int aa_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule, + struct audit_context *actx); + #endif /* __AA_AUDIT_H */ -- cgit v1.2.3-59-g8ed1b