AppArmor: Support for loading a set of pre-compiled profiles at startup time

Let systemd load a set of pre-compiled AppArmor profile files from a policy
cache at /etc/apparmor/earlypolicy. Maintenance of that policy cache must be
done outside of systemd.

After successfully loading the profiles systemd will attempt to change to a
profile named systemd.

If systemd is already confined in a profile, it will not load any profile files
and will not attempt to change it's profile.

If anything goes wrong, systemd will only log failures. It will not fail to
start.

This commit is contained in:

YmrDtnJu

2020-06-09 20:27:47 +02:00

committed by

Lennart Poettering

parent d689f0f20a

commit 2ffadd3cee

5 changed files with 114 additions and 0 deletions

									
										src/core/apparmor-setup.h
									
		+4
		
												View File
												
				@@ -0,0 +1,4 @@

				/* SPDX-License-Identifier: LGPL-2.1+ */

				#pragma once

				int mac_apparmor_setup(void);