AppArmor: add "file" details to securityfs

Create the "file" directory in the securityfs for tracking features
related to files.

Signed-off-by: Kees Cook <kees@ubuntu.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>

diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index f30dada0dca2d8cf1b525122d1afb197e82e4d1d..f9d0b5087beaf2652145c1c6a89b90af077099f6 100644 (file)
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -154,6 +154,9 @@ static int aa_fs_seq_show(struct seq_file *seq, void *v)
        case AA_FS_TYPE_BOOLEAN:
                seq_printf(seq, "%s\n", fs_file->v.boolean ? "yes" : "no");
                break;
+       case AA_FS_TYPE_STRING:
+               seq_printf(seq, "%s\n", fs_file->v.string);
+               break;
        case AA_FS_TYPE_U64:
                seq_printf(seq, "%#08lx\n", fs_file->v.u64);
                break;
@@ -180,6 +183,12 @@ const struct file_operations aa_fs_seq_file_ops = {
 
 /** Base file system setup **/
 
+static struct aa_fs_entry aa_fs_entry_file[] = {
+       AA_FS_FILE_STRING("mask", "create read write exec append mmap_exec " \
+                                 "link lock"),
+       { }
+};
+
 static struct aa_fs_entry aa_fs_entry_domain[] = {
        AA_FS_FILE_BOOLEAN("change_hat",        1),
        AA_FS_FILE_BOOLEAN("change_hatv",       1),
@@ -190,6 +199,7 @@ static struct aa_fs_entry aa_fs_entry_domain[] = {
 
 static struct aa_fs_entry aa_fs_entry_features[] = {
        AA_FS_DIR("domain",                     aa_fs_entry_domain),
+       AA_FS_DIR("file",                       aa_fs_entry_file),
        AA_FS_FILE_U64("capability",            VFS_CAP_FLAGS_MASK),
        { }
 };

diff --git a/security/apparmor/include/apparmorfs.h b/security/apparmor/include/apparmorfs.h
index 16e654530f30e5887d2df466516d0c88261dd3df..7ea4769fab3f7785c056dc0cd60e6a8f1b606c98 100644 (file)
--- a/security/apparmor/include/apparmorfs.h
+++ b/security/apparmor/include/apparmorfs.h
@@ -17,6 +17,7 @@
 
 enum aa_fs_type {
        AA_FS_TYPE_BOOLEAN,
+       AA_FS_TYPE_STRING,
        AA_FS_TYPE_U64,
        AA_FS_TYPE_FOPS,
        AA_FS_TYPE_DIR,
@@ -31,6 +32,7 @@ struct aa_fs_entry {
        enum aa_fs_type v_type;
        union {
                bool boolean;
+               char *string;
                unsigned long u64;
                struct aa_fs_entry *files;
        } v;
@@ -43,6 +45,10 @@ extern const struct file_operations aa_fs_seq_file_ops;
        { .name = (_name), .mode = 0444, \
          .v_type = AA_FS_TYPE_BOOLEAN, .v.boolean = (_value), \
          .file_ops = &aa_fs_seq_file_ops }
+#define AA_FS_FILE_STRING(_name, _value) \
+       { .name = (_name), .mode = 0444, \
+         .v_type = AA_FS_TYPE_STRING, .v.string = (_value), \
+         .file_ops = &aa_fs_seq_file_ops }
 #define AA_FS_FILE_U64(_name, _value) \
        { .name = (_name), .mode = 0444, \
          .v_type = AA_FS_TYPE_U64, .v.u64 = (_value), \