From patchwork Sat May 13 11:51:45 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 9725199 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 2F3DD60325 for ; Sat, 13 May 2017 11:55:21 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1DF55288DF for ; Sat, 13 May 2017 11:55:21 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 12F88288E4; Sat, 13 May 2017 11:55:21 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM, T_DKIM_INVALID autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 47524288E2 for ; Sat, 13 May 2017 11:55:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754646AbdEMLyH (ORCPT ); Sat, 13 May 2017 07:54:07 -0400 Received: from mail-pg0-f48.google.com ([74.125.83.48]:36679 "EHLO mail-pg0-f48.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753641AbdEMLwH (ORCPT ); Sat, 13 May 2017 07:52:07 -0400 Received: by mail-pg0-f48.google.com with SMTP id x64so21745316pgd.3 for ; Sat, 13 May 2017 04:52:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=5547dMXNHNA+9Xl0e4rKmICdh9VKct+C5TNfXZZyXZ0=; b=YCp5C8IQ57R6Bd8/RJ6UOEkleKVJYY2ga4QgLzRFc+iQ4SYL5REDJp0eKXPV1zmjU0 DYgcQDldL/2xzil4g/zVXBLK4bzSOY4gGve0W88M7UY8aypZdxTsYh30RafJVx79l2Dw VuUuYJbz5+VjJ0kLxJb6iC9c2ZAMCmdkUhiXA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=5547dMXNHNA+9Xl0e4rKmICdh9VKct+C5TNfXZZyXZ0=; b=QJn3f6BavCsGsAvYi45VWWeEmFr+tQVdDlekBrO8ChFamiWXIo8pgND024QICZFOr4 n1dNfWn+erz76NNOA4OcTUY9XIpWOc2wUZQpOA/ypBbWyvxTZYwvst2Mmiu3qfeyrmYA VpjqIodQ+7HY01ZK0HFElVCnzmlv/lP6VXlEccp9bJPi8+uKE+GYCU5VoC29huILWZ2s U3Grf6x87JyR5deAE2JKt2WI4vzib08Mh9kCsRUu+/eeTEcSDzyfAeNT+058xQRwvymf YGmtYn3mM5bSrs8Xjq1OfU/mp5NVOsaolX1qOK6ArN77ClkyOIuR6eZC27162Z5c5v9H dPPQ== X-Gm-Message-State: AODbwcDkvKFTnhfSCar9CS1EbkcXEWkZthtaub/nrQhQCxXo2gILcuKv DOOwUoG+fESVJadK X-Received: by 10.98.0.7 with SMTP id 7mr9377330pfa.127.1494676326558; Sat, 13 May 2017 04:52:06 -0700 (PDT) Received: from www.outflux.net (173-164-112-133-Oregon.hfc.comcastbusiness.net. [173.164.112.133]) by smtp.gmail.com with ESMTPSA id l7sm14791945pgn.10.2017.05.13.04.52.01 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 13 May 2017 04:52:02 -0700 (PDT) From: Kees Cook To: Jonathan Corbet Cc: Kees Cook , John Johansen , Tetsuo Handa , Paul Moore , David Howells , Mimi Zohar , Casey Schaufler , James Morris , Tyler Hicks , David Safford , linux-doc@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 09/17] doc: ReSTify apparmor.txt Date: Sat, 13 May 2017 04:51:45 -0700 Message-Id: <1494676313-144890-10-git-send-email-keescook@chromium.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1494676313-144890-1-git-send-email-keescook@chromium.org> References: <1494676313-144890-1-git-send-email-keescook@chromium.org> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Adjusts for ReST markup and moves under LSM admin guide. Cc: John Johansen Signed-off-by: Kees Cook Acked-by: John Johansen --- .../apparmor.txt => admin-guide/LSM/apparmor.rst} | 36 ++++++++++++++-------- Documentation/admin-guide/LSM/index.rst | 1 + Documentation/security/00-INDEX | 2 -- MAINTAINERS | 1 + security/apparmor/match.c | 2 +- security/apparmor/policy_unpack.c | 2 +- 6 files changed, 28 insertions(+), 16 deletions(-) rename Documentation/{security/apparmor.txt => admin-guide/LSM/apparmor.rst} (65%) diff --git a/Documentation/security/apparmor.txt b/Documentation/admin-guide/LSM/apparmor.rst similarity index 65% rename from Documentation/security/apparmor.txt rename to Documentation/admin-guide/LSM/apparmor.rst index 93c1fd7d0635..3e9734bd0e05 100644 --- a/Documentation/security/apparmor.txt +++ b/Documentation/admin-guide/LSM/apparmor.rst @@ -1,4 +1,9 @@ ---- What is AppArmor? --- +======== +AppArmor +======== + +What is AppArmor? +================= AppArmor is MAC style security extension for the Linux kernel. It implements a task centered policy, with task "profiles" being created and loaded @@ -6,34 +11,41 @@ from user space. Tasks on the system that do not have a profile defined for them run in an unconfined state which is equivalent to standard Linux DAC permissions. ---- How to enable/disable --- +How to enable/disable +===================== + +set ``CONFIG_SECURITY_APPARMOR=y`` -set CONFIG_SECURITY_APPARMOR=y +If AppArmor should be selected as the default security module then set:: -If AppArmor should be selected as the default security module then - set CONFIG_DEFAULT_SECURITY="apparmor" - and CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1 + CONFIG_DEFAULT_SECURITY="apparmor" + CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1 Build the kernel If AppArmor is not the default security module it can be enabled by passing -security=apparmor on the kernel's command line. +``security=apparmor`` on the kernel's command line. If AppArmor is the default security module it can be disabled by passing -apparmor=0, security=XXXX (where XXX is valid security module), on the -kernel's command line +``apparmor=0, security=XXXX`` (where ``XXXX`` is valid security module), on the +kernel's command line. For AppArmor to enforce any restrictions beyond standard Linux DAC permissions policy must be loaded into the kernel from user space (see the Documentation and tools links). ---- Documentation --- +Documentation +============= -Documentation can be found on the wiki. +Documentation can be found on the wiki, linked below. ---- Links --- +Links +===== Mailing List - apparmor@lists.ubuntu.com + Wiki - http://apparmor.wiki.kernel.org/ + User space tools - https://launchpad.net/apparmor + Kernel module - git://git.kernel.org/pub/scm/linux/kernel/git/jj/apparmor-dev.git diff --git a/Documentation/admin-guide/LSM/index.rst b/Documentation/admin-guide/LSM/index.rst index cc0e04d63bf9..a4db29410ea0 100644 --- a/Documentation/admin-guide/LSM/index.rst +++ b/Documentation/admin-guide/LSM/index.rst @@ -33,4 +33,5 @@ the one "major" module (e.g. SELinux) if there is one configured. .. toctree:: :maxdepth: 1 + apparmor SELinux diff --git a/Documentation/security/00-INDEX b/Documentation/security/00-INDEX index aaa0195418b3..22ebdc02f0dc 100644 --- a/Documentation/security/00-INDEX +++ b/Documentation/security/00-INDEX @@ -4,8 +4,6 @@ Smack.txt - documentation on the Smack Linux Security Module. Yama.txt - documentation on the Yama Linux Security Module. -apparmor.txt - - documentation on the AppArmor security extension. keys-ecryptfs.txt - description of the encryption keys for the ecryptfs filesystem. keys-request-key.txt diff --git a/MAINTAINERS b/MAINTAINERS index c85108b4f6c7..184cdd32a67e 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -11560,6 +11560,7 @@ W: apparmor.wiki.kernel.org T: git git://git.kernel.org/pub/scm/linux/kernel/git/jj/apparmor-dev.git S: Supported F: security/apparmor/ +F: Documentation/admin-guide/LSM/apparmor.rst LOADPIN SECURITY MODULE M: Kees Cook diff --git a/security/apparmor/match.c b/security/apparmor/match.c index 960c913381e2..72c604350e80 100644 --- a/security/apparmor/match.c +++ b/security/apparmor/match.c @@ -226,7 +226,7 @@ void aa_dfa_free_kref(struct kref *kref) * @flags: flags controlling what type of accept tables are acceptable * * Unpack a dfa that has been serialized. To find information on the dfa - * format look in Documentation/security/apparmor.txt + * format look in Documentation/admin-guide/LSM/apparmor.rst * Assumes the dfa @blob stream has been aligned on a 8 byte boundary * * Returns: an unpacked dfa ready for matching or ERR_PTR on failure diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c index f3422a91353c..981d570eebba 100644 --- a/security/apparmor/policy_unpack.c +++ b/security/apparmor/policy_unpack.c @@ -13,7 +13,7 @@ * License. * * AppArmor uses a serialized binary format for loading policy. To find - * policy format documentation look in Documentation/security/apparmor.txt + * policy format documentation see Documentation/admin-guide/LSM/apparmor.rst * All policy is validated before it is used. */