• J
    apparmor: convert attaching profiles via xattrs to use dfa matching · 73f488cd
    John Johansen 提交于
    This converts profile attachment based on xattrs to a fixed extended
    conditional using dfa matching.
    
    This has a couple of advantages
    - pattern matching can be used for the xattr match
    
    - xattrs can be optional for an attachment or marked as required
    
    - the xattr attachment conditional will be able to be combined with
      other extended conditionals when the flexible extended conditional
      work lands.
    
    The xattr fixed extended conditional is appended to the xmatch
    conditional. If an xattr attachment is specified the profile xmatch
    will be generated regardless of whether there is a pattern match on
    the executable name.
    Signed-off-by: NJohn Johansen <john.johansen@canonical.com>
    Acked-by: NSeth Arnold <seth.arnold@canonical.com>
    73f488cd
policy.c 31.5 KB