diff options
| author | John Johansen <john.johansen@canonical.com> | 2012-02-16 11:16:02 -0800 |
|---|---|---|
| committer | John Rigby <john.rigby@linaro.org> | 2012-06-25 12:17:12 -0600 |
| commit | 38fc8ebdc596b0051acde8d5e82c992eca94968c (patch) | |
| tree | c63e04872c3c3d536012319d00162e961db32bdf /security/apparmor/Makefile | |
| parent | 73df18da7ebc6222c8baf45fddf17bc2c80be9b3 (diff) | |
UBUNTU: SAUCE: AppArmor: Add the ability to mediate mount
Add the ability for apparmor to do mediation of mount operations. Mount
rules require an updated apparmor_parser (2.8 series) for policy compilation.
The basic form of the rules are.
[audit] [deny] mount [conds]* [device] [ -> [conds] path],
[audit] [deny] remount [conds]* [path],
[audit] [deny] umount [conds]* [path],
[audit] [deny] pivotroot [oldroot=<value>] <path>
remount is just a short cut for mount options=remount
where [conds] can be
fstype=<expr>
options=<expr>
Example mount commands
mount, # allow all mounts, but not umount or pivotroot
mount fstype=procfs, # allow mounting procfs anywhere
mount options=(bind, ro) /foo -> /bar, # readonly bind mount
mount /dev/sda -> /mnt,
mount /dev/sd** -> /mnt/**,
mount fstype=overlayfs options=(rw,upperdir=/tmp/upper/,lowerdir=/) -> /mnt/
umount,
umount /m*,
See the apparmor userspace for full documentation
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Diffstat (limited to 'security/apparmor/Makefile')
| -rw-r--r-- | security/apparmor/Makefile | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/security/apparmor/Makefile b/security/apparmor/Makefile index 806bd19af7f..f6c51c03df0 100644 --- a/security/apparmor/Makefile +++ b/security/apparmor/Makefile @@ -4,11 +4,10 @@ obj-$(CONFIG_SECURITY_APPARMOR) += apparmor.o apparmor-y := apparmorfs.o audit.o capability.o context.o ipc.o lib.o match.o \ path.o domain.o policy.o policy_unpack.o procattr.o lsm.o \ - resource.o sid.o file.o + resource.o sid.o file.o mount.o clean-files := capability_names.h rlim_names.h - # Build a lower case string table of capability names # Transforms lines from # #define CAP_DAC_OVERRIDE 1 |