summaryrefslogtreecommitdiff
path: root/Documentation
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2024-11-29 11:10:30 -0800
committerLinus Torvalds <torvalds@linux-foundation.org>2024-11-29 11:10:30 -0800
commit29caf07e9dc6d585f784e094c766a3cfceea3822 (patch)
tree088d2ae049ffd70a837c82648a61ad8d66cb92bf /Documentation
parent509f806f7f70db42cbb95856d32a9a0d6700b2e5 (diff)
parent04b5f0a5bfee5a5886dc19296c90d9a6964275e4 (diff)
Merge tag 'apparmor-pr-2024-11-27' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor
Pull apparmor updates from John Johansen: "Features: - extend next/check table to add support for 2^24 states to the state machine. - rework capability audit cache to use broader cred information instead of just the profile. Also add a time stamp so old entries can be aged out of the cache. Bug Fixes: - fix 'Do simple duplicate message elimination' to clear previous state when updating in capability audit cache - Fix memory leak for aa_unpack_strdup() - properly handle cx/px lookup failure when in complain mode - allocate xmatch for nullpdb inside aa_alloc_null fixing a NULL ptr deref of tracking profiles in when in complain mode Cleanups: - Remove everything being reported as deadcode - replace misleading 'scrubbing environment' phrase in debug print - Remove unnecessary NULL check before kvfree() - clean up duplicated parts of handle_onexec() - Use IS_ERR_OR_NULL() helper function - move new_profile declaration to top of block instead immediately after label to remove C23 extension warning Documentation: - add comment to document capability.c:profile_capable ad ptr parameter can not be NULL - add comment to document first entry is in packed perms struct is reserved for future planned expansion. - Update LSM/apparmor.rst add blurb for DEFAULT_SECURITY_APPARMOR" * tag 'apparmor-pr-2024-11-27' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: apparmor: lift new_profile declaration to remove C23 extension warning apparmor: replace misleading 'scrubbing environment' phrase in debug print parser: drop dead code for XXX_comb macros apparmor: Remove unused parameter L1 in macro next_comb Docs: Update LSM/apparmor.rst apparmor: audit_cap dedup based on subj_cred instead of profile apparmor: add a cache entry expiration time aging out capability audit cache apparmor: document capability.c:profile_capable ad ptr not being NULL apparmor: fix 'Do simple duplicate message elimination' apparmor: document first entry is in packed perms struct is reserved apparmor: test: Fix memory leak for aa_unpack_strdup() apparmor: Remove deadcode apparmor: Remove unnecessary NULL check before kvfree() apparmor: domain: clean up duplicated parts of handle_onexec() apparmor: Use IS_ERR_OR_NULL() helper function apparmor: add support for 2^24 states to the dfa state machine. apparmor: properly handle cx/px lookup failure for complain apparmor: allocate xmatch for nullpdb inside aa_alloc_null
Diffstat (limited to 'Documentation')
-rw-r--r--Documentation/admin-guide/LSM/apparmor.rst7
1 files changed, 5 insertions, 2 deletions
diff --git a/Documentation/admin-guide/LSM/apparmor.rst b/Documentation/admin-guide/LSM/apparmor.rst
index 6cf81bbd7ce8..47939ee89d74 100644
--- a/Documentation/admin-guide/LSM/apparmor.rst
+++ b/Documentation/admin-guide/LSM/apparmor.rst
@@ -18,8 +18,11 @@ set ``CONFIG_SECURITY_APPARMOR=y``
If AppArmor should be selected as the default security module then set::
- CONFIG_DEFAULT_SECURITY="apparmor"
- CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1
+ CONFIG_DEFAULT_SECURITY_APPARMOR=y
+
+The CONFIG_LSM parameter manages the order and selection of LSMs.
+Specify apparmor as the first "major" module (e.g. AppArmor, SELinux, Smack)
+in the list.
Build the kernel