NAME¶
aa_features - an opaque object representing a set of AppArmor kernel features
aa_features_new - create a new aa_features object based on a path
aa_features_new_from_string - create a new aa_features object based on a string
aa_features_new_from_kernel - create a new aa_features object based on the
current kernel
aa_features_ref - increments the ref count of an aa_features object
aa_features_unref - decrements the ref count and frees the aa_features object
when 0
aa_features_write_to_file - write a string representation of an aa_features
object to a file
aa_features_is_equal - equality test for two aa_features objects
aa_features_supports - provides aa_features object support status
SYNOPSIS¶
#include <sys/apparmor.h>
typedef struct aa_features aa_features;
int aa_features_new(aa_features **features, int dirfd, const char *path);
int aa_features_new_from_string(aa_features **features, const char *string,
size_t size);
int aa_features_new_from_kernel(aa_features **features);
aa_features *aa_features_ref(aa_features *features);
void aa_features_unref(aa_features *features);
int aa_features_write_to_file(aa_features *features, int dirfd, const char
*path);
bool aa_features_is_equal(aa_features *features1, aa_features
*features2);
bool aa_features_supports(aa_features *features, const char *str);
Link with
-lapparmor when compiling.
DESCRIPTION¶
The
aa_features object contains information about the AppArmor features
supported by a kernel. The feature support information is based upon the files
AppArmor represents in securityfs, which is typically found at
/sys/kernel/security/apparmor/features/. That information may be parsed and
turned into a string or flat file in order to represent a set of features of a
kernel that is not currently running.
The
aa_features_new() function creates an
aa_features object based
upon a directory file descriptor and path. The
path can point to a file
or directory. See the
openat(2) man page for examples of
dirfd
and
path. The allocated
features object must be freed using
aa_features_unref().
The
aa_features_new_from_string() function is similar except that it
accepts a NUL-terminated string representation of the AppArmor features as the
string argument. The length of the features string, not counting the
NUL-terminator, must be specified as the
size argument. The allocated
features object must be freed using
aa_features_unref().
The
aa_features_new_from_kernel() function creates an
aa_features
object from the current running kernel. The allocated
features object
must be freed using
aa_features_unref().
aa_features_ref() increments the reference count on the
features
object.
aa_features_unref() decrements the reference count on the
features
object and releases all corresponding resources when the reference count
reaches zero.
The
aa_features_write_to_file() function writes a string representation
of the
features object to the file specified by the
dirfd and
path combination.
aa_features_is_equal() can be used to detect if the
features1 and
features2 objects are equal. The definition of equality is private to
libapparmor and may be changed in ways that do not break backward
compatibility.
The
aa_features_supports() function can be used to query the
features object to determine if a feature is supported. The
str
argument should be equal to the path, relative to the
"apparmor/features/" directory of securityfs, of the feature to
query. For example, to test if policy version 6 is supported,
str would
be "policy/versions/v6".
RETURN VALUE¶
The
aa_features_new() family of functions return 0 on success and
*features will point to an
aa_features object that must be freed
by
aa_features_unref(). -1 is returned on error, with errno set
appropriately, and
*features will be set to NULL.
aa_features_ref() returns the value of
features.
aa_features_write_to_file() returns 0 on success. -1 is returned on
error, with errno set appropriately.
aa_features_is_equal() returns true if
features1 and
features2 are equal and false if they are not equal.
aa_features_supports() returns true if the feature represented by
str is supported and false if it is not supported.
ERRORS¶
The errno value will be set according to the underlying error in the
aa_features family of functions that return -1 on error.
NOTES¶
All aa_features functions described above are present in libapparmor version
2.10 and newer.
BUGS¶
None known. If you find any, please report them at
<
https://bugs.launchpad.net/apparmor/+filebug>.
SEE ALSO¶
openat(2) and <
http://wiki.apparmor.net>.