mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-09-01 14:55:10 +00:00
Code Issues Releases Wiki Activity

Update apparmor_kernel_development_guide

John Johansen
2018-10-09 05:54:40 +00:00
parent 59f81672ff
commit 3b7c542828
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
apparmor_kernel_development_guide.md

@@ -203,7 +203,7 @@ view
Domain transitions pre 4.13 are fairly straight forward. The task's confinement is a single profile, refcounted from the apparmor task_ctx struct off of the the task's cred. Domain transitions pre 4.13 are fairly straight forward. The task's confinement is a single profile, refcounted from the apparmor task_ctx struct off of the the task's cred.
task -> cred -> security (task_ctx) -> profile task -> cred -> security (task_ctx *) -> profile
The confining profile can transition to single profile, either the same or something different dependent on the profile rules. The confining profile can transition to single profile, either the same or something different dependent on the profile rules.
@@ -212,7 +212,11 @@ The confining profile can transition to single profile, either the same or somet
| A | -> | D | | A | -> | D |
## post 4.13 ## post 4.13
AppArmor replaced the profile* stored in the task_ctx stored off the cred with a label*. Domain transition now consist of building a new label. To do this we walk each profile in the cred label and they can each have a transition AppArmor replaced the profile* stored in the task_ctx stored off the cred with a label*.
task -> cred -> security (task_ctx *) -> label
Domain transition now consist of building a new label. To do this we walk each profile in the cred label and they can each have a transition
| Profile | |Transition | | Profile | |Transition |
|---------|--|-----------| |---------|--|-----------|
@@ -232,9 +236,9 @@ So for the above example the built label would be
## post 4.17 ## post 4.17
In 4.17 the confinement label was split from the task specific tracking information (change_hat, onexec, ...). The label becomes directly referenced by that cred->security field while that task_ctx is now referenced by the task's security field. In 4.17 the confinement label was split from the task specific tracking information (change_hat, onexec, ...). The label becomes directly referenced by that cred->security field while that task_ctx is now referenced by the task's security field.
task->cred->security (label) task->cred->security (label *)
task->security->task_ctx task->security (task_ctx *)
In addition the task_ctx picked up a new nnp field In addition the task_ctx picked up a new nnp field