From d9bf2c268be6064ae0c9980e4c37fdd262c7effc Mon Sep 17 00:00:00 2001 From: John Johansen Date: Fri, 26 May 2017 16:27:58 -0700 Subject: apparmor: add policy revision file interface Add a policy revision file to find the current revision of a ns's policy. There is a revision file per ns, as well as a virtualized global revision file in the base apparmor fs directory. The global revision file when opened will provide the revision of the opening task namespace. The revision file can be waited on via select/poll to detect apparmor policy changes from the last read revision of the opened file. This means that the revision file must be read after the select/poll other wise update data will remain ready for reading. Signed-off-by: John Johansen --- security/apparmor/include/apparmorfs.h | 2 ++ security/apparmor/include/policy_ns.h | 1 + 2 files changed, 3 insertions(+) (limited to 'security/apparmor/include') diff --git a/security/apparmor/include/apparmorfs.h b/security/apparmor/include/apparmorfs.h index 071a59a1f056..bd689114bf93 100644 --- a/security/apparmor/include/apparmorfs.h +++ b/security/apparmor/include/apparmorfs.h @@ -74,6 +74,7 @@ enum aafs_ns_type { AAFS_NS_LOAD, AAFS_NS_REPLACE, AAFS_NS_REMOVE, + AAFS_NS_REVISION, AAFS_NS_COUNT, AAFS_NS_MAX_COUNT, AAFS_NS_SIZE, @@ -102,6 +103,7 @@ enum aafs_prof_type { #define ns_subload(X) ((X)->dents[AAFS_NS_LOAD]) #define ns_subreplace(X) ((X)->dents[AAFS_NS_REPLACE]) #define ns_subremove(X) ((X)->dents[AAFS_NS_REMOVE]) +#define ns_subrevision(X) ((X)->dents[AAFS_NS_REVISION]) #define prof_dir(X) ((X)->dents[AAFS_PROF_DIR]) #define prof_child_dir(X) ((X)->dents[AAFS_PROF_PROFS]) diff --git a/security/apparmor/include/policy_ns.h b/security/apparmor/include/policy_ns.h index d7a07ac96168..23e7cb770226 100644 --- a/security/apparmor/include/policy_ns.h +++ b/security/apparmor/include/policy_ns.h @@ -69,6 +69,7 @@ struct aa_ns { long uniq_id; int level; long revision; + wait_queue_head_t wait; struct list_head rawdata_list; -- cgit v1.2.1