• John Johansen's avatar
    apparmor: add the ability to mediate signals · cd1dbf76
    John Johansen authored
    Add signal mediation where the signal can be mediated based on the
    signal, direction, or the label or the peer/target. The signal perms
    are verified on a cross check to ensure policy consistency in the case
    of incremental policy load/replacement.
    
    The optimization of skipping the cross check when policy is guaranteed
    to be consistent (single compile unit) remains to be done.
    
    policy rules have the form of
      SIGNAL_RULE = [ QUALIFIERS ] 'signal' [ SIGNAL ACCESS PERMISSIONS ]
                    [ SIGNAL SET ] [ SIGNAL PEER ]
    
      SIGNAL ACCESS PERMISSIONS = SIGNAL ACCESS | SIGNAL ACCESS LIST
    
      SIGNAL ACCESS LIST = '(' Comma or space separated list of SIGNAL
                               ACCESS ')'
    
      SIGNAL ACCESS = ( 'r' | 'w' | 'rw' | 'read' | 'write' | 'send' |
                        'receive' )
    
      SIGNAL SET = 'set' '=' '(' SIGNAL LIST ')'
    
      SIGNAL LIST = Comma or space separated list of SIGNALS
    
      SIGNALS = ( 'hup' | 'int' | 'quit' | 'ill' | 'trap' | 'abrt' |
                  'bus' | 'fpe' | 'kill' | 'usr1' | 'segv' | 'usr2' |
    	      'pipe' | 'alrm' | 'term' | 'stkflt' | 'chld' | 'cont' |
    	      'stop' | 'stp' | 'ttin' | 'ttou' | 'urg' | 'xcpu' |
    	      'xfsz' | 'vtalrm' | 'prof' | 'winch' | 'io' | 'pwr' |
    	      'sys' | 'emt' | 'exists' | 'rtmin+0' ... 'rtmin+32'
                )
    
      SIGNAL PEER = 'peer' '=' AARE
    
    eg.
      signal,                                 # allow all signals
      signal send set=(hup, kill) peer=foo,
    Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
    Acked-by: default avatarSeth Arnold <seth.arnold@canonical.com>
    cd1dbf76
audit.h 3.99 KB