diff options
author | John Johansen <john.johansen@canonical.com> | 2010-07-29 17:48:00 -0400 |
---|---|---|
committer | James Morris <jmorris@namei.org> | 2010-08-02 01:38:37 -0400 |
commit | c88d4c7b049e87998ac0a9f455aa545cc895ef92 (patch) | |
tree | 1859582b4afec1116b6831ea89ae27c35209991a /security/apparmor/sid.c | |
parent | 736ec752d95e91e77cc0e8c97c057ab076ac2f51 (diff) |
AppArmor: core policy routines
The basic routines and defines for AppArmor policy. AppArmor policy
is defined by a few basic components.
profiles - the basic unit of confinement contain all the information
to enforce policy on a task
Profiles tend to be named after an executable that they
will attach to but this is not required.
namespaces - a container for a set of profiles that will be used
during attachment and transitions between profiles.
sids - which provide a unique id for each profile
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security/apparmor/sid.c')
-rw-r--r-- | security/apparmor/sid.c | 55 |
1 files changed, 55 insertions, 0 deletions
diff --git a/security/apparmor/sid.c b/security/apparmor/sid.c new file mode 100644 index 000000000000..f0b34f76ebef --- /dev/null +++ b/security/apparmor/sid.c | |||
@@ -0,0 +1,55 @@ | |||
1 | /* | ||
2 | * AppArmor security module | ||
3 | * | ||
4 | * This file contains AppArmor security identifier (sid) manipulation fns | ||
5 | * | ||
6 | * Copyright 2009-2010 Canonical Ltd. | ||
7 | * | ||
8 | * This program is free software; you can redistribute it and/or | ||
9 | * modify it under the terms of the GNU General Public License as | ||
10 | * published by the Free Software Foundation, version 2 of the | ||
11 | * License. | ||
12 | * | ||
13 | * | ||
14 | * AppArmor allocates a unique sid for every profile loaded. If a profile | ||
15 | * is replaced it receives the sid of the profile it is replacing. | ||
16 | * | ||
17 | * The sid value of 0 is invalid. | ||
18 | */ | ||
19 | |||
20 | #include <linux/spinlock.h> | ||
21 | #include <linux/errno.h> | ||
22 | #include <linux/err.h> | ||
23 | |||
24 | #include "include/sid.h" | ||
25 | |||
26 | /* global counter from which sids are allocated */ | ||
27 | static u32 global_sid; | ||
28 | static DEFINE_SPINLOCK(sid_lock); | ||
29 | |||
30 | /* TODO FIXME: add sid to profile mapping, and sid recycling */ | ||
31 | |||
32 | /** | ||
33 | * aa_alloc_sid - allocate a new sid for a profile | ||
34 | */ | ||
35 | u32 aa_alloc_sid(void) | ||
36 | { | ||
37 | u32 sid; | ||
38 | |||
39 | /* | ||
40 | * TODO FIXME: sid recycling - part of profile mapping table | ||
41 | */ | ||
42 | spin_lock(&sid_lock); | ||
43 | sid = (++global_sid); | ||
44 | spin_unlock(&sid_lock); | ||
45 | return sid; | ||
46 | } | ||
47 | |||
48 | /** | ||
49 | * aa_free_sid - free a sid | ||
50 | * @sid: sid to free | ||
51 | */ | ||
52 | void aa_free_sid(u32 sid) | ||
53 | { | ||
54 | ; /* NOP ATM */ | ||
55 | } | ||