tree c8845bd204b1c4b120f1be1cceea4ff96f749e53
parent 6380bd8ddf613b29f478396308b591867d401de4
author John Johansen <john.johansen@canonical.com> 1280440086 -0700
committer James Morris <jmorris@namei.org> 1280727314 +1000

AppArmor: functions for domain transitions

AppArmor routines for controling domain transitions, which can occur at
exec or through self directed change_profile/change_hat calls.

Unconfined tasks are checked at exec against the profiles in the confining
profile namespace to determine if a profile should be attached to the task.

Confined tasks execs are controlled by the profile which provides rules
determining which execs are allowed and if so which profiles should be
transitioned to.

Self directed domain transitions allow a task to request transition
to a given profile.  If the transition is allowed then the profile will
be applied, either immeditately or at exec time depending on the request.
Immeditate self directed transitions have several security limitations
but have uses in setting up stub transition profiles and other limited
cases.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: James Morris <jmorris@namei.org>