Re: [apparmor] [PATCH 21/36] apparmor: baby step - now add labels to the labelset trees

2013-05-22 Thread John Johansen
On 05/21/2013 04:48 PM, Seth Arnold wrote: On Wed, May 01, 2013 at 02:31:06PM -0700, John Johansen wrote: Just add the labels to the tree to make sure insertions and deletions into the rb tree are working. @@ -1330,6 +1347,8 @@ ssize_t aa_remove_profiles(char *fqname, size_t size)

Re: [apparmor] [PATCH 18/36] apparmor: add basic support for implicit labeling of files

2013-05-22 Thread John Johansen
On 05/16/2013 03:38 PM, Seth Arnold wrote: On Wed, May 01, 2013 at 02:31:03PM -0700, John Johansen wrote: The labeling of files is implied by the set of rules and profiles. Add the ability to set implicit labels on files to reduce the number of path and rule lookups that are needed. +static

Re: [apparmor] default/system profile

2013-05-22 Thread John Johansen
On 05/21/2013 10:57 AM, Steve Beattie wrote: On Tue, May 21, 2013 at 12:49:32AM -0700, John Johansen wrote: On 05/21/2013 12:07 AM, Steve Beattie wrote: - For all other namespaces - the first profile is the init profile, and it is set as the default profile The first profile loaded? So

Re: [apparmor] [PATCH 07/36] apparmor: use free_profile instead of put_profile when erroring out early

2013-05-22 Thread John Johansen
On 05/01/2013 05:28 PM, Seth Arnold wrote: On Wed, May 01, 2013 at 02:30:52PM -0700, John Johansen wrote: aa_put_profile causes profiles to go throw an rcu based delayed free cycle. Discard profiles that can't be in use and hence don't need the delayed free call free_profile directly.

Re: [apparmor] default/system profile

2013-05-22 Thread Steve Beattie
On Wed, May 22, 2013 at 12:32:47AM -0700, John Johansen wrote: On 05/21/2013 10:57 AM, Steve Beattie wrote: On Tue, May 21, 2013 at 12:49:32AM -0700, John Johansen wrote: It comes back to my desire to grow namespaces as first class objects in policy (I have no doubt they are first class in

Re: [apparmor] [PATCH 23/36] apparmor: introduce using labels from contexts

2013-05-22 Thread Seth Arnold
On Wed, May 01, 2013 at 02:31:08PM -0700, John Johansen wrote: Baby step to using labels instead of profiles. Switch from using profile refs to label refs. Note this step does not make any functional changes Signed-off-by: John Johansen john.johan...@canonical.com A few small comments