AppArmor: mediation of non file objects
authorJohn Johansen <john.johansen@canonical.com>
Thu, 29 Jul 2010 21:48:05 +0000 (14:48 -0700)
committerJames Morris <jmorris@namei.org>
Mon, 2 Aug 2010 05:38:35 +0000 (15:38 +1000)
commit0ed3b28ab8bf460a3a026f3f1782bf4c53840184
tree9da3a2c6d9f55d3166726fe7c51671a6029c1269
parentb5e95b48685e3481139a5634d14d630d12c7d5ce
AppArmor: mediation of non file objects

ipc:
AppArmor ipc is currently limited to mediation done by file mediation
and basic ptrace tests.  Improved mediation is a wip.

rlimits:
AppArmor provides basic abilities to set and control rlimits at
a per profile level.  Only resources specified in a profile are controled
or set.  AppArmor rules set the hard limit to a value <= to the current
hard limit (ie. they can not currently raise hard limits), and if
necessary will lower the soft limit to the new hard limit value.

AppArmor does not track resource limits to reset them when a profile
is left so that children processes inherit the limits set by the
parent even if they are not confined by the same profile.

Capabilities:  AppArmor provides a per profile mask of capabilities,
that will further restrict.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: James Morris <jmorris@namei.org>
security/apparmor/capability.c [new file with mode: 0644]
security/apparmor/include/capability.h [new file with mode: 0644]
security/apparmor/include/ipc.h [new file with mode: 0644]
security/apparmor/include/resource.h [new file with mode: 0644]
security/apparmor/ipc.c [new file with mode: 0644]
security/apparmor/resource.c [new file with mode: 0644]