Get the latest tech news

AppArmor For Linux 6.17 Set To Introduce AF_UNIX Mediation, Other Improvements

Canonical engineer John Johansen sent out the AppArmor pull request today for the Linux 6.17 merge window that is heavy on changes for this Linux kernel security module.

The headline feature of the AppArmor changes submitted for Linux 6.17 is AF_UNIX mediation support after Ubuntu had been carrying similar patches for years. With fine-grained AF_UNIX mediation in AppArmor it allows for controls based on the type (abstract, anonymous, fs), the address, and labeling on the socket. The AppArmor pull request also has a number of debug printing improvements, bug fixes, and other enhancements:+ Features - improve debug printing - carry mediation check on label (optimization) - improve ability for compiler to optimize __begin_current_label_crit_section - transition for a linked list of rulesets to a vector of rulesets - don't hardcode profile signal, allow it to be set by policy - ability to mediate caps via the state machine instead of lut - Add Ubuntu af_unix mediation, put it behind new v9 abi + Cleanups - fix typos and spelling errors - cleanup kernel doc and code inconsistencies - remove redundant checks/code - remove unused variables - Use str_yes_no() helper function - mark tables static where appropriate - make all generated string array headers const char *const - refactor to doc semantics of file_perm checks - replace macro calls to network/socket fns with explicit calls - refactor/cleanup socket mediation code preparing for finer grained mediation of different network families - several updates to kernel doc comments

Get the Android app