Re: [PATCH 3/3] apparmor: virtualize the policy/ directory

[Kees Cook]

On Wed, May 10, 2017 at 7:46 PM, John Johansen
<john.johansen@xxxxxxxxxxxxx> wrote:
> virtualize the apparmor policy/ directory so that the current namespace
> affects what part of policy is seen. This is done by
>
>  * creating a new apparmorfs filesystem
>  * creating a magic symlink from securityfs to the correct apparmorfs
>    file in the tree (similar to nsfs use).
>
> apparmor fs data and fns also get renamed some to help indicate where
> they are used
>
>   aafs - special magic apparmorfs
>   aa_sfs - for fns/data that go into securityfs
>   aa_fs - for fns/data that may be used in the either of aafs or securityfs
>
> Signed-off-by: John Johansen <john.johansen@xxxxxxxxxxxxx>
> Reviewed-by: Seth Arnold <seth.arnold@xxxxxxxxxxxxx>

This all looks fine to me. If you do a v2 of these patches, it might
make sense to split up some of the logical changes here. For example,
have one patch that does the renamings but no code changes. Then add
the new fs, and finally integrate the new fs. That might make it
easier to review. Regardless:

Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>

-Kees

-- 
Kees Cook
Pixel Security