Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1649890 > unrolled thread
| Started by | Kees Cook <keescook@google.com> |
|---|---|
| First post | 2017-05-24 21:40 +0200 |
| Last post | 2017-05-24 22:20 +0200 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.kernel
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
Re: [PATCH 3/3] apparmor: virtualize the policy/ directory Kees Cook <keescook@google.com> - 2017-05-24 21:40 +0200
Re: [PATCH 3/3] apparmor: virtualize the policy/ directory John Johansen <john.johansen@canonical.com> - 2017-05-24 22:20 +0200
| From | Kees Cook <keescook@google.com> |
|---|---|
| Date | 2017-05-24 21:40 +0200 |
| Subject | Re: [PATCH 3/3] apparmor: virtualize the policy/ directory |
| Message-ID | <tKKit-6rO-11@gated-at.bofh.it> |
On Wed, May 10, 2017 at 7:46 PM, John Johansen <john.johansen@canonical.com> wrote: > virtualize the apparmor policy/ directory so that the current namespace > affects what part of policy is seen. This is done by > > * creating a new apparmorfs filesystem > * creating a magic symlink from securityfs to the correct apparmorfs > file in the tree (similar to nsfs use). > > apparmor fs data and fns also get renamed some to help indicate where > they are used > > aafs - special magic apparmorfs > aa_sfs - for fns/data that go into securityfs > aa_fs - for fns/data that may be used in the either of aafs or securityfs > > Signed-off-by: John Johansen <john.johansen@canonical.com> > Reviewed-by: Seth Arnold <seth.arnold@canonical.com> This all looks fine to me. If you do a v2 of these patches, it might make sense to split up some of the logical changes here. For example, have one patch that does the renamings but no code changes. Then add the new fs, and finally integrate the new fs. That might make it easier to review. Regardless: Reviewed-by: Kees Cook <keescook@chromium.org> -Kees -- Kees Cook Pixel Security
[toc] | [next] | [standalone]
| From | John Johansen <john.johansen@canonical.com> |
|---|---|
| Date | 2017-05-24 22:20 +0200 |
| Message-ID | <tKKVd-6Ww-57@gated-at.bofh.it> |
| In reply to | #1649890 |
On 05/24/2017 12:38 PM, Kees Cook wrote: > On Wed, May 10, 2017 at 7:46 PM, John Johansen > <john.johansen@canonical.com> wrote: >> virtualize the apparmor policy/ directory so that the current namespace >> affects what part of policy is seen. This is done by >> >> * creating a new apparmorfs filesystem >> * creating a magic symlink from securityfs to the correct apparmorfs >> file in the tree (similar to nsfs use). >> >> apparmor fs data and fns also get renamed some to help indicate where >> they are used >> >> aafs - special magic apparmorfs >> aa_sfs - for fns/data that go into securityfs >> aa_fs - for fns/data that may be used in the either of aafs or securityfs >> >> Signed-off-by: John Johansen <john.johansen@canonical.com> >> Reviewed-by: Seth Arnold <seth.arnold@canonical.com> > > This all looks fine to me. If you do a v2 of these patches, it might > make sense to split up some of the logical changes here. For example, > have one patch that does the renamings but no code changes. Then add > the new fs, and finally integrate the new fs. That might make it > easier to review. Regardless: > > Reviewed-by: Kees Cook <keescook@chromium.org> > Okay, thanks will do.
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web