mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-31 14:25:52 +00:00
Code Issues Releases Wiki Activity

parser: Add support for a default_allow mode

Browse Source 
Add support for a default_allow mode that facillitates writing profiles
in that allow everything by default. This is not normally recomended
but fascilitates creating basic profiles while working to transition
policy away from unconfined.

This mode is being added specifically to replace the use of the
unconfined flag in these transitional profiles as the use of unconfined
in policy is confusing and does not reflect the semantics of what is
being done.

Generally the goal for policy should be to remove all default_allow
profiles once the policy is fully developed.

Note: this patch only adds parsing of default_allow mode. Currently
it sets the unconfined flag to achieve default allow but this
prevents deny rules from being applied. Once dominance is fixed a
subsequent patch will transition default_allow away from using
the unconfined flag.

Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen
2023-10-10 02:22:29 -07:00
parent 884adcc58f
commit 832bb8f417
33 changed files with 586 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
parser/profile.cc
View File

@@ -28,6 +28,7 @@ const char *profile_mode_table[] = {
"kill",
"unconfined",
"prompt",
"default_allow",
"conflict" /* should not ever be displayed */
};