• John Johansen's avatar
    apparmor: add mount mediation · 2ea3ffb7
    John Johansen authored
    Add basic mount mediation. That allows controlling based on basic
    mount parameters. It does not include special mount parameters for
    apparmor, super block labeling, or any triggers for apparmor namespace
    parameter modifications on pivot root.
    
    default userspace policy rules have the form of
      MOUNT RULE = ( MOUNT | REMOUNT | UMOUNT )
    
      MOUNT = [ QUALIFIERS ] 'mount' [ MOUNT CONDITIONS ] [ SOURCE FILEGLOB ]
              [ '->' MOUNTPOINT FILEGLOB ]
    
      REMOUNT = [ QUALIFIERS ] 'remount' [ MOUNT CONDITIONS ]
                MOUNTPOINT FILEGLOB
    
      UMOUNT = [ QUALIFIERS ] 'umount' [ MOUNT CONDITIONS ] MOUNTPOINT FILEGLOB
    
      MOUNT CONDITIONS = [ ( 'fstype' | 'vfstype' ) ( '=' | 'in' )
                           MOUNT FSTYPE EXPRESSION ]
    		       [ 'options' ( '=' | 'in' ) MOUNT FLAGS EXPRESSION ]
    
      MOUNT FSTYPE EXPRESSION = ( MOUNT FSTYPE LIST | MOUNT EXPRESSION )
    
      MOUNT FSTYPE LIST = Comma separated list of valid filesystem and
                          virtual filesystem types (eg ext4, debugfs, etc)
    
      MOUNT FLAGS EXPRESSION = ( MOUNT FLAGS LIST | MOUNT EXPRESSION )
    
      MOUNT FLAGS LIST = Comma separated list of MOUNT FLAGS.
    
      MOUNT FLAGS = ( 'ro' | 'rw' | 'nosuid' | 'suid' | 'nodev' | 'dev' |
                      'noexec' | 'exec' | 'sync' | 'async' | 'remount' |
    		  'mand' | 'nomand' | 'dirsync' | 'noatime' | 'atime' |
    		  'nodiratime' | 'diratime' | 'bind' | 'rbind' | 'move' |
    		  'verbose' | 'silent' | 'loud' | 'acl' | 'noacl' |
    		  'unbindable' | 'runbindable' | 'private' | 'rprivate' |
    		  'slave' | 'rslave' | 'shared' | 'rshared' |
    		  'relatime' | 'norelatime' | 'iversion' | 'noiversion' |
    		  'strictatime' | 'nouser' | 'user' )
    
      MOUNT EXPRESSION = ( ALPHANUMERIC | AARE ) ...
    
      PIVOT ROOT RULE = [ QUALIFIERS ] pivot_root [ oldroot=OLD PUT FILEGLOB ]
                        [ NEW ROOT FILEGLOB ]
    
      SOURCE FILEGLOB = FILEGLOB
    
      MOUNTPOINT FILEGLOB = FILEGLOB
    
    eg.
      mount,
      mount /dev/foo,
      mount options=ro /dev/foo -> /mnt/,
      mount options in (ro,atime) /dev/foo -> /mnt/,
      mount options=ro options=atime,
    Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
    Acked-by: default avatarSeth Arnold <seth.arnold@canonical.com>
    2ea3ffb7
audit.h 4.2 KB