This stacks on the policyns permission-rule mediation [1] and enforces the remaining "policyns limits" constructs: the subtree accounting scope, the criu retained-policy reserve, routed budgets and the load_rate meter. It also moves children-percentage resolution to namespace-creation time, so the ratio no longer depends on the order blocks are loaded in.
Each construct appends its token to the policy/ns_quota mask as it starts being enforced, so userspace emits it only where the running kernel supports it. Based on [1]; matching userspace support in [2]. [1] https://lists.ubuntu.com/archives/apparmor/2026-July/014864.html [2] https://gitlab.com/apparmor/apparmor/-/merge_requests/2169 Maxime Bélair (7): apparmor: group the namespace caps into a capset apparmor: account subtree-aggregate resident bytes and profiles apparmor: enforce subtree-scoped policyns limits apparmor: enforce the criu retained-policy reserve apparmor: route policyns limits to descendants, root and named namespaces apparmor: meter policy loads against the load_rate cap apparmor: harden and test the scoped policyns budget semantics security/apparmor/apparmorfs.c | 32 +- security/apparmor/include/apparmorfs.h | 4 + security/apparmor/include/policy.h | 6 + security/apparmor/include/policy_ns.h | 71 ++- security/apparmor/policy.c | 44 +- security/apparmor/policy_ns.c | 589 ++++++++++++++++++++++--- security/apparmor/policy_unpack.c | 6 + security/apparmor/policy_unpack_test.c | 170 +++++++ 8 files changed, 824 insertions(+), 98 deletions(-) base-commit: ba229cfb77ebd0c7143aa856e610a7f833865388 -- 2.51.0
