- up apparmor to 2.5

[packages/kernel.git] / kernel-apparmor.patch

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 3c7a358..a1db25b 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -33,7 +33,7 @@
  * 1200 - 1299 messages internal to the audit daemon
  * 1300 - 1399 audit event messages
  * 1400 - 1499 SE Linux use
- * 1500 - 1599 kernel LSPP events
+ * 1500 - 1599 AppArmor use
  * 1600 - 1699 kernel crypto events
  * 1700 - 1799 kernel anomaly records
  * 1800 - 1899 kernel integrity events
@@ -122,6 +122,14 @@
 #define AUDIT_MAC_UNLBL_STCADD 1416    /* NetLabel: add a static label */
 #define AUDIT_MAC_UNLBL_STCDEL 1417    /* NetLabel: del a static label */
 
+#define AUDIT_APPARMOR_AUDIT   1501    /* AppArmor audited grants */
+#define AUDIT_APPARMOR_ALLOWED 1502    /* Allowed Access for learning */
+#define AUDIT_APPARMOR_DENIED  1503
+#define AUDIT_APPARMOR_HINT    1504    /* Process Tracking information */
+#define AUDIT_APPARMOR_STATUS  1505    /* Changes in config */
+#define AUDIT_APPARMOR_ERROR   1506    /* Internal AppArmor Errors */
+#define AUDIT_APPARMOR_KILL    1507    /* AppArmor killing processes */
+
 #define AUDIT_FIRST_KERN_ANOM_MSG   1700
 #define AUDIT_LAST_KERN_ANOM_MSG    1799
 #define AUDIT_ANOM_PROMISCUOUS      1700 /* Device changed promiscuous mode */
diff --git a/security/Kconfig b/security/Kconfig
index 226b955..bd72ae6 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -140,6 +140,7 @@ config LSM_MMAP_MIN_ADDR
 source security/selinux/Kconfig
 source security/smack/Kconfig
 source security/tomoyo/Kconfig
+source security/apparmor/Kconfig
 
 source security/integrity/ima/Kconfig
 
@@ -148,6 +149,7 @@ choice
        default DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX
        default DEFAULT_SECURITY_SMACK if SECURITY_SMACK
        default DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO
+       default DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR
        default DEFAULT_SECURITY_DAC
 
        help
@@ -163,6 +165,9 @@ choice
        config DEFAULT_SECURITY_TOMOYO
                bool "TOMOYO" if SECURITY_TOMOYO=y
 
+       config DEFAULT_SECURITY_APPARMOR
+               bool "AppArmor" if SECURITY_APPARMOR=y
+
        config DEFAULT_SECURITY_DAC
                bool "Unix Discretionary Access Controls"
 
@@ -173,6 +178,7 @@ config DEFAULT_SECURITY
        default "selinux" if DEFAULT_SECURITY_SELINUX
        default "smack" if DEFAULT_SECURITY_SMACK
        default "tomoyo" if DEFAULT_SECURITY_TOMOYO
+       default "apparmor" if DEFAULT_SECURITY_APPARMOR
        default "" if DEFAULT_SECURITY_DAC
 
 endmenu
diff --git a/security/Makefile b/security/Makefile
index da20a19..8bb0fe9 100644
--- a/security/Makefile
+++ b/security/Makefile
@@ -6,6 +6,7 @@ obj-$(CONFIG_KEYS)                      += keys/
 subdir-$(CONFIG_SECURITY_SELINUX)      += selinux
 subdir-$(CONFIG_SECURITY_SMACK)                += smack
 subdir-$(CONFIG_SECURITY_TOMOYO)        += tomoyo
+subdir-$(CONFIG_SECURITY_APPARMOR)     += apparmor
 
 # always enable default capabilities
 obj-y                                  += commoncap.o
@@ -19,6 +20,7 @@ obj-$(CONFIG_SECURITY_SELINUX)                += selinux/built-in.o
 obj-$(CONFIG_SECURITY_SMACK)           += smack/built-in.o
 obj-$(CONFIG_AUDIT)                    += lsm_audit.o
 obj-$(CONFIG_SECURITY_TOMOYO)          += tomoyo/built-in.o
+obj-$(CONFIG_SECURITY_APPARMOR)                += apparmor/built-in.o
 obj-$(CONFIG_CGROUP_DEVICE)            += device_cgroup.o
 
 # Object integrity file lists
diff --git a/security/apparmor/.gitignore b/security/apparmor/.gitignore
new file mode 100644
index 0000000..0a0a99f
--- /dev/null
+++ b/security/apparmor/.gitignore
@@ -0,0 +1,5 @@
+#
+# Generated include files
+#
+af_names.h
+capability_names.h
diff --git a/security/apparmor/Kconfig b/security/apparmor/Kconfig
new file mode 100644
index 0000000..5c57df7
--- /dev/null
+++ b/security/apparmor/Kconfig
@@ -0,0 +1,40 @@
+config SECURITY_APPARMOR
+       bool "AppArmor support"
+       depends on SECURITY
+       select AUDIT
+       select SECURITY_PATH
+       select SECURITYFS
+       select SECURITY_NETWORK
+       default n
+       help
+         This enables the AppArmor security module.
+         Required userspace tools (if they are not included in your
+         distribution) and further information may be found at
+         <http://forge.novell.com/modules/xfmod/project/?apparmor>
+
+         If you are unsure how to answer this question, answer N.
+
+config SECURITY_APPARMOR_BOOTPARAM_VALUE
+       int "AppArmor boot parameter default value"
+       depends on SECURITY_APPARMOR
+       range 0 1
+       default 1
+       help
+         This option sets the default value for the kernel parameter
+         'apparmor', which allows AppArmor to be enabled or disabled
+          at boot.  If this option is set to 0 (zero), the AppArmor
+         kernel parameter will default to 0, disabling AppArmor at
+         bootup.  If this option is set to 1 (one), the AppArmor
+         kernel parameter will default to 1, enabling AppArmor at
+         bootup.
+
+         If you are unsure how to answer this question, answer 1.
+
+config SECURITY_APPARMOR_COMPAT_24
+       bool "Enable AppArmor 2.4 compatability"
+       depends on SECURITY_APPARMOR
+       default y
+       help
+         This option enables compatability with AppArmor 2.4.  It is
+          recommended if compatability with older versions of AppArmor
+          is desired.
diff --git a/security/apparmor/Makefile b/security/apparmor/Makefile
new file mode 100644
index 0000000..554cba7
--- /dev/null
+++ b/security/apparmor/Makefile
@@ -0,0 +1,24 @@
+# Makefile for AppArmor Linux Security Module
+#
+obj-$(CONFIG_SECURITY_APPARMOR) += apparmor.o
+
+apparmor-y := apparmorfs.o audit.o capability.o context.o ipc.o lib.o match.o \
+              path.o domain.o policy.o policy_unpack.o procattr.o lsm.o \
+              resource.o sid.o file.o net.o
+
+apparmor-$(CONFIG_SECURITY_APPARMOR_COMPAT_24) += apparmorfs-24.o
+
+clean-files: capability_names.h af_names.h
+
+quiet_cmd_make-caps = GEN     $@
+cmd_make-caps = echo "static const char *capability_names[] = {" > $@ ; sed -n -e "/CAP_FS_MASK/d" -e "s/^\#define[ \\t]\\+CAP_\\([A-Z0-9_]\\+\\)[ \\t]\\+\\([0-9]\\+\\)\$$/[\\2]  = \"\\1\",/p" $< | tr A-Z a-z >> $@ ; echo "};" >> $@
+
+quiet_cmd_make-af = GEN     $@
+cmd_make-af = echo "static const char *address_family_names[] = {" > $@ ; sed -n -e "/AF_MAX/d" -e "/AF_LOCAL/d" -e "s/^\#define[ \\t]\\+AF_\\([A-Z0-9_]\\+\\)[ \\t]\\+\\([0-9]\\+\\)\\(.*\\)\$$/[\\2]  = \"\\1\",/p" $< | tr A-Z a-z >> $@ ; echo "};" >> $@
+
+$(obj)/capability.o : $(obj)/capability_names.h
+$(obj)/net.o : $(obj)/af_names.h
+$(obj)/capability_names.h : $(srctree)/include/linux/capability.h
+       $(call cmd,make-caps)
+$(obj)/af_names.h : $(srctree)/include/linux/socket.h
+       $(call cmd,make-af)
diff --git a/security/apparmor/apparmorfs-24.c b/security/apparmor/apparmorfs-24.c
new file mode 100644
index 0000000..f64aae8
--- /dev/null
+++ b/security/apparmor/apparmorfs-24.c
@@ -0,0 +1,61 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor /sys/kernel/secrutiy/apparmor interface functions
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ *
+ *
+ * This file contain functions providing an interface for <= AppArmor 2.4
+ * compatibility.  It is dependent on CONFIG_SECURITY_APPARMOR_COMPAT_24
+ * being set (see Makefile).
+ */
+
+#include <linux/security.h>
+#include <linux/vmalloc.h>
+#include <linux/module.h>
+#include <linux/seq_file.h>
+#include <linux/uaccess.h>
+#include <linux/namei.h>
+
+#include "include/apparmor.h"
+#include "include/audit.h"
+#include "include/context.h"
+#include "include/policy.h"
+
+
+/* apparmor/matching */
+static ssize_t aa_matching_read(struct file *file, char __user *buf,
+                               size_t size, loff_t *ppos)
+{
+       const char matching[] = "pattern=aadfa audit perms=crwxamlk/ "
+           "user::other";
+
+       return simple_read_from_buffer(buf, size, ppos, matching,
+                                      sizeof(matching) - 1);
+}
+
+const struct file_operations aa_fs_matching_fops = {
+       .read = aa_matching_read,
+};
+
+/* apparmor/features */
+static ssize_t aa_features_read(struct file *file, char __user *buf,
+                               size_t size, loff_t *ppos)
+{
+       const char features[] = "file=3.1 capability=2.0 network=1.0 "
+           "change_hat=1.5 change_profile=1.1 " "aanamespaces=1.1 rlimit=1.1";
+
+       return simple_read_from_buffer(buf, size, ppos, features,
+                                      sizeof(features) - 1);
+}
+
+const struct file_operations aa_fs_features_fops = {
+       .read = aa_features_read,
+};
diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
new file mode 100644
index 0000000..89a26a0
--- /dev/null
+++ b/security/apparmor/apparmorfs.c
@@ -0,0 +1,561 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor /sys/kernel/security/apparmor interface functions
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/security.h>
+#include <linux/vmalloc.h>
+#include <linux/module.h>
+#include <linux/seq_file.h>
+#include <linux/uaccess.h>
+#include <linux/namei.h>
+
+#include "include/apparmor.h"
+#include "include/apparmorfs.h"
+#include "include/audit.h"
+#include "include/context.h"
+#include "include/policy.h"
+
+/**
+ * kvmalloc - do allocation prefering kmalloc but falling back to vmalloc
+ * @size: size of allocation
+ *
+ * Return: allocated buffer or NULL if failed
+ *
+ * It is possible that policy being loaded from the user is larger than
+ * what can be allocated by kmalloc, in those cases fall back to vmalloc.
+ */
+static void *kvmalloc(size_t size)
+{
+       void *buffer;
+
+       if (size == 0)
+               return NULL;
+
+       buffer = kmalloc(size, GFP_KERNEL);
+       if (!buffer)
+               buffer = vmalloc(size);
+       return buffer;
+}
+
+/**
+ * kvfree - free an allocation do by kvmalloc
+ * @buffer: buffer to free
+ *
+ * Free a buffer allocated by kvmalloc
+ */
+static void kvfree(void *buffer)
+{
+       if (!buffer)
+               return;
+
+       if (is_vmalloc_addr(buffer))
+               vfree(buffer);
+       else
+               kfree(buffer);
+}
+
+/**
+ * aa_simple_write_to_buffer - common routine for getting policy from user
+ * @userbuf: user buffer to copy data from  (NOT NULL)
+ * @alloc_size: size of user buffer
+ * @copy_size: size of data to copy from user buffer
+ * @pos: position write is at in the file
+ * @operation: name of operation doing the user buffer copy (NOT NULL)
+ *
+ * Returns: kernel buffer containing copy of user buffer data or an
+ *          ERR_PTR on failure.
+ */
+static char *aa_simple_write_to_buffer(const char __user *userbuf,
+                                      size_t alloc_size, size_t copy_size,
+                                      loff_t *pos, const char *operation)
+{
+       char *data;
+
+       if (*pos != 0) {
+               /* only writes from pos 0, that is complete writes */
+               data = ERR_PTR(-ESPIPE);
+               goto out;
+       }
+
+       /*
+        * Don't allow profile load/replace/remove from profiles that don't
+        * have CAP_MAC_ADMIN
+        */
+       if (!capable(CAP_MAC_ADMIN)) {
+               struct aa_profile *profile = NULL;
+               struct aa_audit sa = {
+                       .operation = operation,
+                       .gfp_mask = GFP_KERNEL,
+                       .error = -EACCES,
+               };
+               profile = aa_current_profile();
+               data = ERR_PTR(aa_audit(AUDIT_APPARMOR_DENIED, profile, &sa,
+                                       NULL));
+               goto out;
+       }
+       /* freed by caller to aa_simple_write_to_buffer */
+       data = kvmalloc(alloc_size);
+       if (data == NULL) {
+               data = ERR_PTR(-ENOMEM);
+               goto out;
+       }
+
+       if (copy_from_user(data, userbuf, copy_size)) {
+               kvfree(data);
+               data = ERR_PTR(-EFAULT);
+               goto out;
+       }
+
+out:
+       return data;
+}
+
+
+/* .load file hook fn to load policy */
+static ssize_t aa_profile_load(struct file *f, const char __user *buf,
+                              size_t size, loff_t *pos)
+{
+       char *data;
+       ssize_t error;
+
+       data = aa_simple_write_to_buffer(buf, size, size, pos, "profile_load");
+
+       error = PTR_ERR(data);
+       if (!IS_ERR(data)) {
+               error = aa_interface_replace_profiles(data, size, 1);
+               kvfree(data);
+       }
+
+       return error;
+}
+
+static const struct file_operations aa_fs_profile_load = {
+       .write = aa_profile_load
+};
+
+/* .replace file hook fn to load and/or replace policy */
+static ssize_t aa_profile_replace(struct file *f, const char __user *buf,
+                                 size_t size, loff_t *pos)
+{
+       char *data;
+       ssize_t error;
+
+       data = aa_simple_write_to_buffer(buf, size, size, pos,
+                                        "profile_replace");
+       error = PTR_ERR(data);
+       if (!IS_ERR(data)) {
+               error = aa_interface_replace_profiles(data, size, 0);
+               kvfree(data);
+       }
+
+       return error;
+}
+
+static const struct file_operations aa_fs_profile_replace = {
+       .write = aa_profile_replace
+};
+
+/* .remove file hook fn to remove loaded policy */
+static ssize_t aa_profile_remove(struct file *f, const char __user *buf,
+                                size_t size, loff_t *pos)
+{
+       char *data;
+       ssize_t error;
+
+       /*
+        * aa_remove_profile needs a null terminated string so 1 extra
+        * byte is allocated and the copied data is null terminated.
+        */
+       data = aa_simple_write_to_buffer(buf, size + 1, size, pos,
+                                        "profile_remove");
+
+       error = PTR_ERR(data);
+       if (!IS_ERR(data)) {
+               data[size] = 0;
+               error = aa_interface_remove_profiles(data, size);
+               kvfree(data);
+       }
+
+       return error;
+}
+
+static const struct file_operations aa_fs_profile_remove = {
+       .write = aa_profile_remove
+};
+
+
+/**
+ * __next_namespace - find the next namespace to list
+ * @root: root namespace to stop search at (NOT NULL)
+ * @ns: current ns position (NOT NULL)
+ *
+ * Find the next namespace from @ns under @root and handle all locking needed
+ * while switching current namespace.
+ *
+ * Returns: next namespace or NULL if at last namespace under @root
+ * NOTE: will not unlock root->lock
+ */
+static struct aa_namespace *__next_namespace(struct aa_namespace *root,
+                                            struct aa_namespace *ns)
+{
+       struct aa_namespace *parent;
+
+       /* is next namespace a child */
+       if (!list_empty(&ns->sub_ns)) {
+               struct aa_namespace *next;
+               next = list_first_entry(&ns->sub_ns, typeof(*ns), base.list);
+               read_lock(&next->lock);
+               return next;
+       }
+
+       /* check if the next ns is a sibling, parent, gp, .. */
+       parent = ns->parent;
+       while (parent) {
+               read_unlock(&ns->lock);
+               list_for_each_entry_continue(ns, &parent->sub_ns, base.list) {
+                       read_lock(&ns->lock);
+                       return ns;
+               }
+               if (parent == root)
+                       return NULL;
+               ns = parent;
+               parent = parent->parent;
+       }
+
+       return NULL;
+}
+
+/**
+ * __first_profile - find the first profile in a namespace
+ * @root: namespace that is root of profiles being displayed (NOT NULL)
+ * @ns: namespace to start in   (NOT NULL)
+ *
+ * Returns: unrefcounted profile or NULL if no profile
+ */
+       static struct aa_profile *__first_profile(struct aa_namespace *root,
+                                                 struct aa_namespace *ns)
+{
+       for ( ; ns; ns = __next_namespace(root, ns)) {
+               if (!list_empty(&ns->base.profiles))
+                       return list_first_entry(&ns->base.profiles,
+                                               struct aa_profile, base.list);
+       }
+       return NULL;
+}
+
+/**
+ * __next_profile - step to the next profile in a profile tree
+ * @profile: current profile in tree (NOT NULL)
+ *
+ * Perform a depth first taversal on the profile tree in a namespace
+ *
+ * Returns: next profile or NULL if done
+ * Requires: profile->ns.lock to be held
+ */
+static struct aa_profile *__next_profile(struct aa_profile *p)
+{
+       struct aa_profile *parent;
+       struct aa_namespace *ns = p->ns;
+
+       /* is next profile a child */
+       if (!list_empty(&p->base.profiles))
+               return list_first_entry(&p->base.profiles, typeof(*p),
+                                       base.list);
+
+       /* is next profile a sibling, parent sibling, gp, subling, .. */
+       parent = p->parent;
+       while (parent) {
+               list_for_each_entry_continue(p, &parent->base.profiles,
+                                            base.list)
+                               return p;
+               p = parent;
+               parent = parent->parent;
+       }
+
+       /* is next another profile in the namespace */
+       list_for_each_entry_continue(p, &ns->base.profiles, base.list)
+               return p;
+
+       return NULL;
+}
+
+/**
+ * next_profile - step to the next profile in where ever it may be
+ * @root: root namespace  (NOT NULL)
+ * @profile: current profile  (NOT NULL)
+ *
+ * Returns: next profile or NULL if there isn't one
+ */
+static struct aa_profile *next_profile(struct aa_namespace *root,
+                                      struct aa_profile *profile)
+{
+       struct aa_profile *next = __next_profile(profile);
+       if (next)
+               return next;
+
+       /* finished all profiles in namespace move to next namespace */
+       return __first_profile(root, __next_namespace(root, profile->ns));
+}
+
+/**
+ * p_start - start a depth first traversal of profile tree
+ * @f: seq_file to fill
+ * @pos: current position
+ *
+ * Returns: first profile under current namespace or NULL if none found
+ *
+ * acquires first ns->lock
+ */
+static void *p_start(struct seq_file *f, loff_t *pos)
+       __acquires(root->lock)
+{
+       struct aa_profile *profile = NULL;
+       struct aa_namespace *root = aa_current_profile()->ns;
+       loff_t l = *pos;
+       f->private = aa_get_namespace(root);
+
+
+       /* find the first profile */
+       read_lock(&root->lock);
+       profile = __first_profile(root, root);
+
+       /* skip to position */
+       for (; profile && l > 0; l--)
+               profile = next_profile(root, profile);
+
+       return profile;
+}
+
+/**
+ * p_next - read the next profile entry
+ * @f: seq_file to fill
+ * @p: profile previously returned
+ * @pos: current position
+ *
+ * Returns: next profile after @p or NULL if none
+ *
+ * may acquire/release locks in namespace tree as necessary
+ */
+static void *p_next(struct seq_file *f, void *p, loff_t *pos)
+{
+       struct aa_profile *profile = p;
+       struct aa_namespace *root = f->private;
+       (*pos)++;
+
+       return next_profile(root, profile);
+}
+
+/**
+ * p_stop - stop depth first traversal
+ * @f: seq_file we are filling
+ * @p: the last profile writen
+ *
+ * Release all locking done by p_start/p_next on namespace tree
+ */
+static void p_stop(struct seq_file *f, void *p)
+       __releases(root->lock)
+{
+       struct aa_profile *profile = p;
+       struct aa_namespace *root = f->private, *ns;
+
+       if (profile) {
+               for (ns = profile->ns; ns && ns != root; ns = ns->parent)
+                       read_unlock(&ns->lock);
+       }
+       read_unlock(&root->lock);
+       aa_put_namespace(root);
+}
+
+/**
+ * print_ns_name - print a namespace name back to @root
+ * @root: root namespace to stop at
+ * @ns: namespace to gen name for
+ *
+ * Returns: true if it printed a name
+ */
+static bool print_ns_name(struct seq_file *f, struct aa_namespace *root,
+                         struct aa_namespace *ns)
+{
+       if (!ns || ns == root)
+               return 0;
+
+       if (ns->parent && print_ns_name(f, root, ns->parent))
+               seq_printf(f, "//");
+
+       seq_printf(f, "%s", ns->base.name);
+       return 1;
+}
+
+/**
+ * seq_show_profile - 
+ * @f: seq_file to file
+ * @p: current position (profile)    (NOT NULL)
+ *
+ * Returns: error on failure
+ */
+static int seq_show_profile(struct seq_file *f, void *p)
+{
+       struct aa_profile *profile = (struct aa_profile *)p;
+       struct aa_namespace *root = f->private;
+
+       if (profile->ns != root)
+               seq_printf(f, ":");
+       if (print_ns_name(f, root, profile->ns))
+               seq_printf(f, "://");
+       seq_printf(f, "%s (%s)\n", profile->base.hname,
+                  COMPLAIN_MODE(profile) ? "complain" : "enforce");
+
+       return 0;
+}
+
+static const struct seq_operations aa_fs_profiles_op = {
+       .start = p_start,
+       .next = p_next,
+       .stop = p_stop,
+       .show = seq_show_profile,
+};
+
+static int aa_profiles_open(struct inode *inode, struct file *file)
+{
+       return seq_open(file, &aa_fs_profiles_op);
+}
+
+static int aa_profiles_release(struct inode *inode, struct file *file)
+{
+       return seq_release(inode, file);
+}
+
+static const struct file_operations aa_fs_profiles_fops = {
+       .open = aa_profiles_open,
+       .read = seq_read,
+       .llseek = seq_lseek,
+       .release = aa_profiles_release,
+};
+
+
+/** Base file system setup **/
+
+static struct dentry *aa_fs_dentry;
+struct dentry *aa_fs_null;
+struct vfsmount *aa_fs_mnt;
+
+static void aafs_remove(const char *name)
+{
+       struct dentry *dentry;
+
+       dentry = lookup_one_len(name, aa_fs_dentry, strlen(name));
+       if (!IS_ERR(dentry)) {
+               securityfs_remove(dentry);
+               dput(dentry);
+       }
+}
+
+/**
+ * aafs_create - create an entry in the apparmor filesystem
+ * @name: name of the entry
+ * @mask: file permission mask of the file
+ * @fops: file operations for the file
+ *
+ * Used aafs_remove to remove entries created with this fn.
+ */
+static int aafs_create(const char *name, int mask,
+                      const struct file_operations *fops)
+{
+       struct dentry *dentry;
+
+       dentry = securityfs_create_file(name, S_IFREG | mask, aa_fs_dentry,
+                                       NULL, fops);
+
+       return IS_ERR(dentry) ? PTR_ERR(dentry) : 0;
+}
+
+/**
+ * aa_destroy_aafs - cleanup and free aafs
+ *
+ * releases dentries allocated by aa_create_aafs
+ */
+void aa_destroy_aafs(void)
+{
+       if (aa_fs_dentry) {
+               aafs_remove(".remove");
+               aafs_remove(".replace");
+               aafs_remove(".load");
+               aafs_remove("profiles");
+#ifdef CONFIG_SECURITY_APPARMOR_COMPAT_24
+               aafs_remove("matching");
+               aafs_remove("features");
+#endif
+               securityfs_remove(aa_fs_dentry);
+               aa_fs_dentry = NULL;
+       }
+}
+
+/**
+ * aa_create_aafs - create the apparmor security filesystem
+ *
+ * dentries created here are released by aa_destroy_aafs
+ *
+ * Returns: error on failure
+ */
+int aa_create_aafs(void)
+{
+       int error;
+
+       if (!apparmor_initialized)
+               return 0;
+
+       if (aa_fs_dentry) {
+               AA_ERROR("%s: AppArmor securityfs already exists\n", __func__);
+               return -EEXIST;
+       }
+
+       aa_fs_dentry = securityfs_create_dir("apparmor", NULL);
+       if (IS_ERR(aa_fs_dentry)) {
+               error = PTR_ERR(aa_fs_dentry);
+               aa_fs_dentry = NULL;
+               goto error;
+       }
+#ifdef CONFIG_SECURITY_APPARMOR_COMPAT_24
+       error = aafs_create("matching", 0444, &aa_fs_matching_fops);
+       if (error)
+               goto error;
+       error = aafs_create("features", 0444, &aa_fs_features_fops);
+       if (error)
+               goto error;
+#endif
+       error = aafs_create("profiles", 0440, &aa_fs_profiles_fops);
+       if (error)
+               goto error;
+       error = aafs_create(".load", 0640, &aa_fs_profile_load);
+       if (error)
+               goto error;
+       error = aafs_create(".replace", 0640, &aa_fs_profile_replace);
+       if (error)
+               goto error;
+       error = aafs_create(".remove", 0640, &aa_fs_profile_remove);
+       if (error)
+               goto error;
+
+       /* TODO: add support for apparmorfs_null and apparmorfs_mnt */
+
+       /* Report that AppArmor fs is enabled */
+       aa_info_message("AppArmor Filesystem Enabled");
+       return 0;
+
+error:
+       aa_destroy_aafs();
+       AA_ERROR("Error creating AppArmor securityfs\n");
+       return error;
+}
+
+fs_initcall(aa_create_aafs);
diff --git a/security/apparmor/audit.c b/security/apparmor/audit.c
new file mode 100644
index 0000000..38ac7a7
--- /dev/null
+++ b/security/apparmor/audit.c
@@ -0,0 +1,162 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor auditing functions
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/audit.h>
+#include <linux/socket.h>
+
+#include "include/apparmor.h"
+#include "include/audit.h"
+#include "include/policy.h"
+
+const char *audit_mode_names[] = {
+       "normal",
+       "quiet_denied",
+       "quiet",
+       "noquiet",
+       "all"
+};
+
+static char *aa_audit_type[] = {
+       "APPARMOR_AUDIT",
+       "APPARMOR_ALLOWED",
+       "APPARMOR_DENIED",
+       "APPARMOR_HINT",
+       "APPARMOR_STATUS",
+       "APPARMOR_ERROR",
+       "APPARMOR_KILLED"
+};
+
+/*
+ * Currently AppArmor auditing is fed straight into the audit framework.
+ *
+ * TODO:
+ * convert to LSM audit
+ * netlink interface for complain mode
+ * user auditing, - send user auditing to netlink interface
+ * system control of whether user audit messages go to system log
+ */
+
+/**
+ * aa_audit_base - core AppArmor function.
+ * @type: type of audit message (see include/linux/apparmor.h)
+ * @profile: active profile for event (MAY BE NULL)
+ * @sa: audit structure containing data to audit
+ * @audit_cxt: audit_cxt that event is under
+ * @cb: audit cb for this event
+ *
+ * Record an audit message for data is @sa, and handle deal with kill and
+ * complain messages switches.
+ *
+ * Returns: 0 or sa->error on success, else error
+ */
+static int aa_audit_base(int type, struct aa_profile *profile,
+                        struct aa_audit *sa, struct audit_context *audit_cxt,
+                        void (*cb) (struct audit_buffer *, struct aa_audit *))
+{
+       struct audit_buffer *ab = NULL;
+       struct task_struct *task = sa->task ? sa->task : current;
+
+       if (profile && DO_KILL(profile) && type == AUDIT_APPARMOR_DENIED)
+               type = AUDIT_APPARMOR_KILL;
+
+       /* ab freed below in audit_log_end */
+       ab = audit_log_start(audit_cxt, sa->gfp_mask, type);
+
+       if (!ab) {
+               AA_ERROR("(%d) Unable to log event of type (%d)\n",
+                        -ENOMEM, type);
+               sa->error = -ENOMEM;
+               goto out;
+       }
+
+       if (aa_g_audit_header) {
+               audit_log_format(ab, " type=");
+               audit_log_string(ab, aa_audit_type[type - AUDIT_APPARMOR_AUDIT]);
+       }
+
+       if (sa->operation) {
+               audit_log_format(ab, " operation=");
+               audit_log_string(ab, sa->operation);
+       }
+
+       if (sa->info) {
+               audit_log_format(ab, " info=");
+               audit_log_string(ab, sa->info);
+               if (sa->error)
+                       audit_log_format(ab, " error=%d", sa->error);
+       }
+
+       audit_log_format(ab, " pid=%d", task->pid);
+
+       if (profile && !unconfined(profile)) {
+               pid_t pid;
+               rcu_read_lock();
+               pid = task->real_parent->pid;
+               rcu_read_unlock();
+               audit_log_format(ab, " parent=%d", pid);
+               audit_log_format(ab, " profile=");
+               audit_log_untrustedstring(ab, profile->base.hname);
+
+               if (profile->ns != root_ns) {
+                       audit_log_format(ab, " namespace=");
+                       audit_log_untrustedstring(ab, profile->ns->base.hname);
+               }
+       }
+
+       if (cb)
+               cb(ab, sa);
+
+       audit_log_end(ab);
+
+out:
+       if (type == AUDIT_APPARMOR_KILL)
+               (void)send_sig_info(SIGKILL, NULL, task);
+
+       return type == AUDIT_APPARMOR_ALLOWED ? 0 : sa->error;
+}
+
+/**
+ * aa_audit - Log an audit event to the audit subsystem
+ * @type: audit type for the message
+ * @profile: profile to check against
+ * @sa: audit event
+ * @cb: optional callback fn for type specific fields
+ *
+ * Handle default message switching based off of audit mode flags
+ *
+ * Returns: error on failure
+ */
+int aa_audit(int type, struct aa_profile *profile, struct aa_audit *sa,
+            void (*cb) (struct audit_buffer *, struct aa_audit *))
+{
+       struct audit_context *audit_cxt;
+       audit_cxt = aa_g_logsyscall ? current->audit_context : NULL;
+
+       if (type == AUDIT_APPARMOR_AUTO) {
+               if (likely(!sa->error)) {
+                       if (AUDIT_MODE(profile) != AUDIT_ALL)
+                               return 0;
+                       type = AUDIT_APPARMOR_AUDIT;
+               } else if (COMPLAIN_MODE(profile))
+                       type = AUDIT_APPARMOR_ALLOWED;
+               else
+                       type = AUDIT_APPARMOR_DENIED;
+       }
+       if (AUDIT_MODE(profile) == AUDIT_QUIET ||
+           (type == AUDIT_APPARMOR_DENIED &&
+            AUDIT_MODE(profile) == AUDIT_QUIET))
+               return sa->error;
+
+       return aa_audit_base(type, profile, sa, audit_cxt, cb);
+}
diff --git a/security/apparmor/capability.c b/security/apparmor/capability.c
new file mode 100644
index 0000000..c8a80ba
--- /dev/null
+++ b/security/apparmor/capability.c
@@ -0,0 +1,146 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor capability mediation functions
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/capability.h>
+#include <linux/errno.h>
+#include <linux/gfp.h>
+
+#include "include/apparmor.h"
+#include "include/capability.h"
+#include "include/context.h"
+#include "include/policy.h"
+#include "include/audit.h"
+
+/*
+ * Table of capability names: we generate it from capabilities.h.
+ */
+#include "capability_names.h"
+
+struct audit_cache {
+       struct aa_profile *profile;
+       kernel_cap_t caps;
+};
+
+static DEFINE_PER_CPU(struct audit_cache, audit_cache);
+
+struct aa_audit_caps {
+       struct aa_audit base;
+
+       int cap;
+};
+
+/**
+ * audit_cb - call back for capability components of audit struct
+ * @ab - audit buffer   (NOT NULL)
+ * @va - audit struct to audit data from  (NOT NULL)
+ */
+static void audit_cb(struct audit_buffer *ab, struct aa_audit *va)
+{
+       struct aa_audit_caps *sa = container_of(va, struct aa_audit_caps, base);
+
+       audit_log_format(ab, " name=");
+       audit_log_untrustedstring(ab, capability_names[sa->cap]);
+}
+
+/**
+ * aa_audit_caps - audit a capability
+ * @profile: profile confining task
+ * @sa: audit structure containing data to audit
+ *
+ * Do auditing of capability and handle, audit/complain/kill modes switching
+ * and duplicate message elimination.
+ *
+ * returns: 0 or sa->error on succes,  error code on failure
+ */
+static int aa_audit_caps(struct aa_profile *profile, struct aa_audit_caps *sa)
+{
+       struct audit_cache *ent;
+       int type = AUDIT_APPARMOR_AUTO;
+
+       if (likely(!sa->base.error)) {
+               /* test if auditing is being forced */
+               if (likely((AUDIT_MODE(profile) != AUDIT_ALL) &&
+                          !cap_raised(profile->caps.audit, sa->cap)))
+                       return 0;
+               type = AUDIT_APPARMOR_AUDIT;
+       } else if (DO_KILL(profile) ||
+                  cap_raised(profile->caps.kill, sa->cap)) {
+               type = AUDIT_APPARMOR_KILL;
+       } else if (cap_raised(profile->caps.quiet, sa->cap) &&
+                  AUDIT_MODE(profile) != AUDIT_NOQUIET &&
+                  AUDIT_MODE(profile) != AUDIT_ALL) {
+               /* quiet auditing */
+               return sa->base.error;
+       }
+
+       /* Do simple duplicate message elimination */
+       ent = &get_cpu_var(audit_cache);
+       if (profile == ent->profile && cap_raised(ent->caps, sa->cap)) {
+               put_cpu_var(audit_cache);
+               if (COMPLAIN_MODE(profile))
+                       return 0;
+               return sa->base.error;
+       } else {
+               aa_put_profile(ent->profile);
+               ent->profile = aa_get_profile(profile);
+               cap_raise(ent->caps, sa->cap);
+       }
+       put_cpu_var(audit_cache);
+
+       return aa_audit(type, profile, &sa->base, audit_cb);
+}
+
+/**
+ * aa_profile_capable - test if profile allows use of capability @cap
+ * @profile: profile being enforced    (NOT NULL, NOT unconfined)
+ * @cap: capability to test if allowed
+ *
+ * Returns: 0 if allowed else -EPERM
+ */
+static int aa_profile_capable(struct aa_profile *profile, int cap)
+{
+       return cap_raised(profile->caps.allowed, cap) ? 0 : -EPERM;
+}
+
+/**
+ * aa_capable - test permission to use capability
+ * @task: task doing capability test against
+ * @profile: profile confining @task
+ * @cap: capability to be tested
+ * @audit: whether an audit record should be generated
+ *
+ * Look up capability in profile capability set.
+ *
+ * Returns: 0 on success, or else an error code.
+ */
+int aa_capable(struct task_struct *task, struct aa_profile *profile, int cap,
+              int audit)
+{
+       int error = aa_profile_capable(profile, cap);
+       struct aa_audit_caps sa = {
+               .base.operation = "capable",
+               .base.task = task,
+               .base.gfp_mask = GFP_ATOMIC,
+               .base.error = error,
+               .cap = cap,
+       };
+
+       if (!audit) {
+               if (COMPLAIN_MODE(profile))
+                       return 0;
+               return error;
+       }
+
+       return aa_audit_caps(profile, &sa);
+}
diff --git a/security/apparmor/context.c b/security/apparmor/context.c
new file mode 100644
index 0000000..caaa277
--- /dev/null
+++ b/security/apparmor/context.c
@@ -0,0 +1,220 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor functions used to manipulate object security
+ * contexts.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ *
+ *
+ * AppArmor sets confinement on every task, via the the aa_task_cxt and
+ * the aa_task_cxt profile, both of which are required and are not allowed
+ * to be NULL.  The aa_task_cxt is not reference counted and is unique
+ * to each cred (which is reference count).  The profile pointed to by
+ * the task_cxt is reference counted.
+ *
+ * TODO
+ * If a task uses change_hat it currently does not return to the old
+ * cred or task context but instead creates a new one.  Ideally the task
+ * should return to the previous cred if it has not been modified.
+ *
+ */
+
+#include "include/context.h"
+#include "include/policy.h"
+
+/**
+ * aa_alloc_task_context - allocat a new task_cxt
+ * @flags: gfp flags for allocation
+ *
+ * Returns: allocated buffer or NULL on failure
+ */
+struct aa_task_cxt *aa_alloc_task_context(gfp_t flags)
+{
+       return kzalloc(sizeof(struct aa_task_cxt), flags);
+}
+
+/**
+ * aa_free_task_context - free a task_cxt
+ * @cxt: task_cxt to free (MAYBE NULL)
+ */
+void aa_free_task_context(struct aa_task_cxt *cxt)
+{
+       if (cxt) {
+               aa_put_profile(cxt->profile);
+               aa_put_profile(cxt->previous);
+               aa_put_profile(cxt->onexec);
+
+               kzfree(cxt);
+       }
+}
+
+/**
+ * aa_dup_task_context - duplicate a task context, incrementing reference counts
+ * @new: a blank task context      (NOT NULL)
+ * @old: the task context to copy  (NOT NULL)
+ */
+void aa_dup_task_context(struct aa_task_cxt *new, const struct aa_task_cxt *old)
+{
+       *new = *old;
+       aa_get_profile(new->profile);
+       aa_get_profile(new->previous);
+       aa_get_profile(new->onexec);
+}
+
+/**
+ * replace_cxt - replace a context profile
+ * @cxt: task context  (NOT NULL)
+ * @profile: profile to replace cxt group  (NOT NULL)
+ *
+ * Replace context grouping profile reference with @profile
+ */
+static void replace_group(struct aa_task_cxt *cxt, struct aa_profile *profile)
+{
+       if (cxt->profile == profile)
+               return;
+
+       BUG_ON(!profile);
+       if (unconfined(profile) || (cxt->profile->ns != profile->ns)) {
+               /* if switching to unconfined or a different profile namespace
+                * clear out context state
+                */
+               aa_put_profile(cxt->previous);
+               aa_put_profile(cxt->onexec);
+               cxt->previous = NULL;
+               cxt->onexec = NULL;
+               cxt->token = 0;
+       }
+       aa_put_profile(cxt->profile);
+       cxt->profile = aa_get_profile(profile);
+}
+
+/**
+ * aa_replace_current_profiles - replace the current tasks profiles
+ * @profile: new profile  (NOT NULL)
+ *
+ * Returns: 0 or error on failure
+ */
+int aa_replace_current_profiles(struct aa_profile *profile)
+{
+       struct aa_task_cxt *cxt;
+       struct cred *new = prepare_creds();
+       if (!new)
+               return -ENOMEM;
+
+       cxt = new->security;
+       replace_group(cxt, profile);
+       /* todo add user group */
+
+       commit_creds(new);
+       return 0;
+}
+
+/**
+ * aa_set_current_onexec - set the tasks change_profile to happen onexec
+ * @profile: system profile to set at exec  (MAYBE NULL)
+ *
+ * Returns: 0 or error on failure
+ */
+int aa_set_current_onexec(struct aa_profile *profile)
+{
+       struct aa_task_cxt *cxt;
+       struct cred *new = prepare_creds();
+       if (!new)
+               return -ENOMEM;
+
+       cxt = new->security;
+       aa_put_profile(cxt->onexec);
+       cxt->onexec = aa_get_profile(profile);
+
+       commit_creds(new);
+       return 0;
+}
+
+/**
+ * aa_set_current_hat - set the current tasks hat
+ * @profile: profile to set as the current hat  (NOT NULL)
+ * @token: token value that must be specified to change from the hat
+ *
+ * Do switch of tasks hat.  If the task is currently in a hat
+ * validate the token to match.
+ *
+ * Returns: 0 or error on failure
+ */
+int aa_set_current_hat(struct aa_profile *profile, u64 token)
+{
+       struct aa_task_cxt *cxt;
+       struct cred *new = prepare_creds();
+       if (!new)
+               return -ENOMEM;
+       BUG_ON(!profile);
+
+       cxt = new->security;
+       if (!cxt->previous) {
+               cxt->previous = cxt->profile;
+               cxt->token = token;
+       } else if (cxt->token == token) {
+               aa_put_profile(cxt->profile);
+       } else {
+               /* previous_profile && cxt->token != token */
+               abort_creds(new);
+               return -EACCES;
+       }
+       cxt->profile = aa_get_profile(aa_newest_version(profile));
+       /* clear exec on switching context */
+       aa_put_profile(cxt->onexec);
+       cxt->onexec = NULL;
+
+       commit_creds(new);
+       return 0;
+}
+
+/**
+ * aa_restore_previous_profile - exit from hat context restoring the profile
+ * @token: the token that must be matched to exit hat context
+ *
+ * Attempt to return out of a hat to the previous profile.  The token
+ * must match the stored token value.
+ *
+ * Returns: 0 or error of failure
+ */
+int aa_restore_previous_profile(u64 token)
+{
+       struct aa_task_cxt *cxt;
+       struct cred *new = prepare_creds();
+       if (!new)
+               return -ENOMEM;
+
+       cxt = new->security;
+       if (cxt->token != token) {
+               abort_creds(new);
+               return -EACCES;
+       }
+       /* ignore restores when there is no saved profile */
+       if (!cxt->previous) {
+               abort_creds(new);
+               return 0;
+       }
+
+       aa_put_profile(cxt->profile);
+       cxt->profile = aa_newest_version(cxt->previous);
+       BUG_ON(!cxt->profile);
+       if (unlikely(cxt->profile != cxt->previous)) {
+               aa_get_profile(cxt->profile);
+               aa_put_profile(cxt->previous);
+       }
+       /* clear exec && prev information when restoring to previous context */
+       cxt->previous = NULL;
+       cxt->token = 0;
+       aa_put_profile(cxt->onexec);
+       cxt->onexec = NULL;
+
+       commit_creds(new);
+       return 0;
+}
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
new file mode 100644
index 0000000..cd8ec99
--- /dev/null
+++ b/security/apparmor/domain.c
@@ -0,0 +1,793 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor policy attachment and domain transitions
+ *
+ * Copyright (C) 2002-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/errno.h>
+#include <linux/fdtable.h>
+#include <linux/file.h>
+#include <linux/mount.h>
+#include <linux/syscalls.h>
+#include <linux/tracehook.h>
+#include <linux/personality.h>
+
+#include "include/audit.h"
+#include "include/apparmorfs.h"
+#include "include/context.h"
+#include "include/domain.h"
+#include "include/file.h"
+#include "include/ipc.h"
+#include "include/match.h"
+#include "include/path.h"
+#include "include/policy.h"
+
+/**
+ * aa_free_domain_entries - free entries in a domain table
+ * @domain: the domain table to free  (MAYBE NULL)
+ */
+void aa_free_domain_entries(struct aa_domain *domain)
+{
+       int i;
+       if (domain) {
+               if (!domain->table)
+                       return;
+
+               for (i = 0; i < domain->size; i++)
+                       kzfree(domain->table[i]);
+               kzfree(domain->table);
+               domain->table = NULL;
+       }
+}
+
+/**
+ * aa_may_change_ptraced_domain - check if can change profile on ptraced task
+ * @task: task we want to change profile of   (NOT NULL)
+ * @to_profile: profile to change to  (NOT NULL)
+ *
+ * Check if the task is ptraced and if so if the tracing task is allowed
+ * to trace the new domain
+ *
+ * Returns: %0 or error if change not allowed
+ */
+static int aa_may_change_ptraced_domain(struct task_struct *task,
+                                       struct aa_profile *to_profile)
+{
+       struct task_struct *tracer;
+       struct cred *cred = NULL;
+       struct aa_profile *tracerp = NULL;
+       int error = 0;
+
+       rcu_read_lock();
+       tracer = tracehook_tracer_task(task);
+       if (tracer) {
+               /* released below */
+               cred = get_task_cred(tracer);
+               tracerp = aa_cred_profile(cred);
+       }
+       rcu_read_unlock();
+
+       /* not ptraced */
+       if (!tracer || unconfined(tracerp))
+               goto out;
+
+       error = aa_may_ptrace(tracer, tracerp, to_profile, PTRACE_MODE_ATTACH);
+
+out:
+       if (cred)
+               put_cred(cred);
+
+       return error;
+}
+
+/**
+ * change_profile_perms - find permissions for change_profile
+ * @profile: the current profile  (NOT NULL)
+ * @ns: the namespace being switched to  (NOT NULL)
+ * @name: the name of the profile to change to  (NOT NULL)
+ * @rstate: if !NULL will contain the state the match finished in (MAYBE NULL)
+ *
+ * Returns: permission set
+ */
+static struct file_perms change_profile_perms(struct aa_profile *profile,
+                                             struct aa_namespace *ns,
+                                             const char *name,
+                                             unsigned int *rstate)
+{
+       struct file_perms perms;
+       struct path_cond cond = { };
+       unsigned int state;
+
+       if (unconfined(profile)) {
+               perms.allowed = AA_MAY_CHANGE_PROFILE;
+               perms.xindex = perms.xdelegate = perms.dindex = 0;
+               perms.audit = perms.quiet = perms.kill = 0;
+               if (rstate)
+                       *rstate = 0;
+               return perms;
+       } else if (!profile->file.dfa) {
+               return nullperms;
+       } else if ((ns == profile->ns)) {
+               /* try matching against rules with out namespace prependend */
+               perms = aa_str_perms(profile->file.dfa, profile->file.start,
+                                    name, &cond, rstate);
+               if (COMBINED_PERM_MASK(perms) & AA_MAY_CHANGE_PROFILE)
+                       return perms;
+       }
+
+       /* try matching with namespace name and then profile */
+       state = aa_dfa_match(profile->file.dfa, profile->file.start,
+                            ns->base.name);
+       state = aa_dfa_null_transition(profile->file.dfa, state, 0);
+       return aa_str_perms(profile->file.dfa, state, name, &cond, rstate);
+}
+
+/**
+ * __aa_attach_match_ - find an attachment match
+ * @name - to match against  (NOT NULL)
+ * @head - profile list to walk  (NOT NULL)
+ *
+ * Do a linear search on the profiles in the list.  There is a matching
+ * preference where an exact match is prefered over a name which uses
+ * expressions to match, and matching expressions with the greatest
+ * xmatch_len are prefered.
+ *
+ * Requires: @head not be shared or have appropriate locks held
+ *
+ * Returns: profile or NULL if no match found
+ */
+static struct aa_profile *__aa_attach_match(const char *name,
+                                           struct list_head *head)
+{
+       int len = 0;
+       struct aa_profile *profile, *candidate = NULL;
+
+       list_for_each_entry(profile, head, base.list) {
+               if (profile->flags & PFLAG_NULL)
+                       continue;
+               if (profile->xmatch && profile->xmatch_len > len) {
+                       unsigned int state = aa_dfa_match(profile->xmatch,
+                                                         DFA_START, name);
+                       u16 perm = dfa_user_allow(profile->xmatch, state);
+                       /* any accepting state means a valid match. */
+                       if (perm & MAY_EXEC) {
+                               candidate = profile;
+                               len = profile->xmatch_len;
+                       }
+               } else if (!strcmp(profile->base.name, name))
+                       /* exact non-re match, no more searching required */
+                       return profile;
+       }
+
+       return candidate;
+}
+
+/**
+ * aa_find_attach - do attachment search for unconfined processes
+ * @ns: the current namespace  (NOT NULL)
+ * @list: list to search  (NOT NULL)
+ * @name: the executable name to match against  (NOT NULL)
+ *
+ * Returns: profile or NULL if no match found
+ */
+static struct aa_profile *aa_find_attach(struct aa_namespace *ns,
+                                        struct list_head *list,
+                                        const char *name)
+{
+       struct aa_profile *profile;
+
+       read_lock(&ns->lock);
+       profile = aa_get_profile(__aa_attach_match(name, list));
+       read_unlock(&ns->lock);
+
+       return profile;
+}
+
+/**
+ * separate_fqname - separate the namespace and profile names
+ * @fqname: the fqname name to split  (NOT NULL)
+ * @ns_name: the namespace name if it exists  (NOT NULL)
+ *
+ * This is the xtable equivalent routine of aa_split_fqname.  It finds the
+ * split in an xtable fqname which contains an embedded \0 instead of a :
+ * if a namespace is specified.  This is done so the xtable is constant and
+ * isn't resplit on every lookup.
+ *
+ * Either the profile or namespace name may be optional but if the namespace
+ * is specified the profile name termination must be present.  This results
+ * in the following possible encodings:
+ * profile_name\0
+ * :ns_name\0profile_name\0
+ * :ns_name\0\0
+ *
+ * NOTE: the xtable fqname is prevalidated at load time in unpack_trans_table
+ *
+ * Returns: profile name if it is specified else NULL
+ */
+static const char *separate_fqname(const char *fqname, const char **ns_name)
+{
+       const char *name;
+
+       if (fqname[0] == ':') {
+               *ns_name = fqname + 1;          /* skip : */
+               name = *ns_name + strlen(*ns_name) + 1;
+               if (!*name)
+                       name = NULL;
+       } else {
+               *ns_name = NULL;
+               name = fqname;
+       }
+
+       return name;
+}
+
+static const char *next_name(int xtype, const char *name)
+{
+       return NULL;
+}
+
+/**
+ * x_to_profile - get target profile for a given xindex
+ * @profile: current profile  (NOT NULL)
+ * @name: to to lookup if specified  (NOT NULL)
+ * @xindex: index into x transition table
+ *
+ * find profile for a transition index
+ *
+ * Returns: refcounted profile or NULL if not found available
+ */
+static struct aa_profile *x_to_profile(struct aa_profile *profile,
+                                      const char *name, u16 xindex)
+{
+       struct aa_profile *new_profile = NULL;
+       struct aa_namespace *ns = profile->ns;
+       u16 xtype = xindex & AA_X_TYPE_MASK;
+       int index = xindex & AA_X_INDEX_MASK;
+
+       switch (xtype) {
+       case AA_X_NONE:
+               /* fail exec unless ix || ux fallback - handled by caller */
+               return NULL;
+       case AA_X_NAME:
+               if (xindex & AA_X_CHILD)
+                       /* released by caller */
+                       new_profile = aa_find_attach(ns,
+                                                    &profile->base.profiles,
+                                                    name);
+               else
+                       /* released by caller */
+                       new_profile = aa_find_attach(ns, &ns->base.profiles,
+                                                    name);
+               /* released by caller */
+               return new_profile;
+       case AA_X_TABLE:
+               /* index is guarenteed to be in range */
+               name = profile->file.trans.table[index];
+               break;
+       }
+
+       for (; !new_profile && name; name = next_name(xtype, name)) {
+               struct aa_namespace *new_ns;
+               const char *xname = NULL;
+
+               new_ns = NULL;
+               if (xindex & AA_X_CHILD) {
+                       /* release by caller */
+                       new_profile = aa_find_child(profile, name);
+                       if (new_profile)
+                               return new_profile;
+                       continue;
+               } else if (*name == ':') {
+                       /* switching namespace */
+                       const char *ns_name;
+                       xname = name = separate_fqname(name, &ns_name);
+                       if (!xname)
+                               /* no name so use profile name */
+                               xname = profile->base.hname;
+                       if (*ns_name == '@') {
+                               /* TODO: variable support */
+                               ;
+                       }
+                       /* released below */
+                       new_ns = aa_find_namespace(ns, ns_name);
+                       if (!new_ns)
+                               continue;
+               } else if (*name == '@') {
+                       /* TODO: variable support */
+                       continue;
+               } else {
+                       xname = name;
+               }
+
+               /* released by caller */
+               new_profile = aa_find_profile(new_ns ? new_ns : ns, xname);
+               aa_put_namespace(new_ns);
+       }
+
+       /* released by caller */
+       return new_profile;
+}
+
+/**
+ * apparmor_bprm_set_creds - set the new creds on the bprm struct
+ * @bprm: binprm for the exec  (NOT NULL)
+ *
+ * Returns: %0 or error on failure
+ */
+int apparmor_bprm_set_creds(struct linux_binprm *bprm)
+{
+       struct aa_task_cxt *cxt;
+       struct aa_profile *profile, *new_profile = NULL;
+       struct aa_namespace *ns;
+       char *buffer = NULL;
+       unsigned int state;
+       struct path_cond cond = {
+               bprm->file->f_path.dentry->d_inode->i_uid,
+               bprm->file->f_path.dentry->d_inode->i_mode
+       };
+       struct aa_audit_file sa = {
+               .base.operation = "exec",
+               .base.gfp_mask = GFP_KERNEL,
+               .request = MAY_EXEC,
+               .cond = &cond,
+       };
+
+       sa.base.error = cap_bprm_set_creds(bprm);
+       if (sa.base.error)
+               return sa.base.error;
+
+       if (bprm->cred_prepared)
+               return 0;
+
+       cxt = bprm->cred->security;
+       BUG_ON(!cxt);
+
+       profile = aa_newest_version(cxt->profile);
+       /*
+        * get the namespace from the replacement profile as replacement
+        * can change the namespace
+        */
+       ns = profile->ns;
+       state = profile->file.start;
+
+       /* buffer freed below, name is pointer inside of buffer */
+       sa.base.error = aa_get_name(&bprm->file->f_path, profile->path_flags,
+                                   &buffer, (char **)&sa.name);
+       if (sa.base.error) {
+               if (profile->flags &
+                   (PFLAG_IX_ON_NAME_ERROR | PFLAG_UNCONFINED))
+                       sa.base.error = 0;
+               sa.base.info = "Exec failed name resolution";
+               sa.name = bprm->filename;
+               goto audit;
+       }
+
+       if (unconfined(profile)) {
+               /* unconfined task - attach profile if one matches */
+               new_profile = aa_find_attach(ns, &ns->base.profiles, sa.name);
+               if (!new_profile)
+                       goto cleanup;
+               goto apply;
+       } else if (cxt->onexec) {
+               /*
+                * onexec permissions are stored in a pair, rewalk the
+                * dfa to get start of the exec path match.
+                */
+               sa.perms = change_profile_perms(profile, cxt->onexec->ns,
+                                               sa.name, &state);
+               state = aa_dfa_null_transition(profile->file.dfa, state, 0);
+       }
+       sa.perms = aa_str_perms(profile->file.dfa, state, sa.name, &cond, NULL);
+       if (cxt->onexec && sa.perms.allowed & AA_MAY_ONEXEC) {
+               /* transfer the onexec reference, this is allowed as the
+                * cred is being prepared, and isn't committed yet.
+                */
+               new_profile = cxt->onexec;
+               cxt->onexec = NULL;
+               sa.base.info = "change_profile onexec";
+       } else if (sa.perms.allowed & MAY_EXEC) {
+               new_profile = x_to_profile(profile, sa.name, sa.perms.xindex);
+               if (!new_profile) {
+                       if (sa.perms.xindex & AA_X_INHERIT) {
+                               /* (p|c|n)ix - don't change profile */
+                               sa.base.info = "ix fallback";
+                               goto x_clear;
+                       } else if (sa.perms.xindex & AA_X_UNCONFINED) {
+                               new_profile = aa_get_profile(ns->unconfined);
+                               sa.base.info = "ux fallback";
+                       } else {
+                               sa.base.error = -ENOENT;
+                               sa.base.info = "profile not found";
+                       }
+               }
+       } else if (COMPLAIN_MODE(profile)) {
+               new_profile = aa_new_null_profile(profile, 0);
+               sa.base.error = -EACCES;
+               if (!new_profile) {
+                       sa.base.error = -ENOMEM;
+                       sa.base.info = "could not create null profile";
+               } else
+                       sa.name2 = new_profile->base.hname;
+               sa.perms.xindex |= AA_X_UNSAFE;
+       } else {
+               sa.base.error = -EACCES;
+       }
+
+       if (!new_profile)
+               goto audit;
+
+       if (profile == new_profile) {
+               aa_put_profile(new_profile);
+               goto audit;
+       }
+
+       if (bprm->unsafe & LSM_UNSAFE_SHARE) {
+               /* FIXME: currently don't mediate shared state */
+               ;
+       }
+
+       if (bprm->unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
+               sa.base.error = aa_may_change_ptraced_domain(current,
+                                                            new_profile);
+               if (sa.base.error)
+                       goto audit;
+       }
+
+       /* Determine if secure exec is needed.
+        * Can be at this point for the following reasons:
+        * 1. unconfined switching to confined
+        * 2. confined switching to different confinement
+        * 3. confined switching to unconfined
+        *
+        * Cases 2 and 3 are marked as requiring secure exec
+        * (unless policy specified "unsafe exec")
+        *
+        * bprm->unsafe is used to cache the AA_X_UNSAFE permission
+        * to avoid having to recompute in secureexec
+        */
+       if (!(sa.perms.xindex & AA_X_UNSAFE)) {
+               AA_DEBUG("scubbing environment variables for %s profile=%s\n",
+                        sa.name, new_profile->base.hname);
+               bprm->unsafe |= AA_SECURE_X_NEEDED;
+       }
+apply:
+       sa.name2 = new_profile->base.hname;
+       /* When switching namespace ensure its part of audit message */
+       if (new_profile->ns != ns)
+               sa.name3 = new_profile->ns->base.hname;
+
+       /* when transitioning profiles clear unsafe personality bits */
+       bprm->per_clear |= PER_CLEAR_ON_SETID;
+
+       aa_put_profile(cxt->profile);
+       /* transfer new profile reference will be released when cxt is freed */
+       cxt->profile = new_profile;
+
+x_clear:
+       aa_put_profile(cxt->previous);
+       aa_put_profile(cxt->onexec);
+       cxt->previous = NULL;
+       cxt->onexec = NULL;
+       cxt->token = 0;
+
+audit:
+       sa.base.error = aa_audit_file(profile, &sa);
+
+cleanup:
+       kfree(buffer);
+
+       return sa.base.error;
+}
+
+/**
+ * apparmor_bprm_secureexec - determine if secureexec is needed
+ * @bprm: binprm for exec  (NOT NULL)
+ *
+ * Returns: %1 if secureexec is needed else %0
+ */
+int apparmor_bprm_secureexec(struct linux_binprm *bprm)
+{
+       int ret = cap_bprm_secureexec(bprm);
+
+       /* the decision to use secure exec is computed in set_creds
+        * and stored in bprm->unsafe.
+        */
+       if (!ret && (bprm->unsafe & AA_SECURE_X_NEEDED))
+               ret = 1;
+
+       return ret;
+}
+
+/**
+ * apparmor_bprm_committing_creds - do task cleanup on committing new creds
+ * @bprm: binprm for the exec  (NOT NULL)
+ */
+void apparmor_bprm_committing_creds(struct linux_binprm *bprm)
+{
+       struct aa_profile *profile = __aa_current_profile();
+       struct aa_task_cxt *new_cxt = bprm->cred->security;
+
+       /* bail out if unconfined or not changing profile */
+       if ((new_cxt->profile == profile) ||
+           (unconfined(new_cxt->profile)))
+               return;
+
+       current->pdeath_signal = 0;
+
+       /* reset soft limits and set hard limits for the new profile */
+       __aa_transition_rlimits(profile, new_cxt->profile);
+}
+
+/**
+ * apparmor_bprm_commited_cred - do cleanup after new creds committed
+ * @bprm: binprm for the exec  (NOT NULL)
+ */
+void apparmor_bprm_committed_creds(struct linux_binprm *bprm)
+{
+       /* TODO: cleanup signals - ipc mediation */
+       return;
+}
+
+/*
+ * Functions for self directed profile change
+ */
+
+/**
+ * new_compound_name - create an hname with @n2 appended to @n1
+ * @n1: base of hname  (NOT NULL)
+ * @n2: name to append (NOT NULL)
+ *
+ * Returns: new name or NULL on error
+ */
+static char *new_compound_name(const char *n1, const char *n2)
+{
+       char *name = kmalloc(strlen(n1) + strlen(n2) + 3, GFP_KERNEL);
+       if (name)
+               sprintf(name, "%s//%s", n1, n2);
+       return name;
+}
+
+/**
+ * aa_change_hat - change hat to/from subprofile
+ * @hats: vector of hat names to try changing into (unused if @count == 0)
+ * @count: number of hat names in @hats
+ * @token: magic value to validate the hat change
+ * @permtest: true if this is just a permission test
+ *
+ * Change to the first profile specified in @hats that exists, and store
+ * the @hat_magic in the current task context.  If the count == 0 and the
+ * @token matches that stored in the current task context, return to the
+ * top level profile.
+ *
+ * Returns %0 on success, error otherwise.
+ */
+int aa_change_hat(const char *hats[], int count, u64 token, bool permtest)
+{
+       const struct cred *cred;
+       struct aa_task_cxt *cxt;
+       struct aa_profile *profile, *previous_profile, *hat = NULL;
+       struct aa_audit_file sa = {
+               .base.gfp_mask = GFP_KERNEL,
+               .base.operation = "change_hat",
+               .request = AA_MAY_CHANGEHAT,
+       };
+       char *name = NULL;
+       int i;
+
+       /* released below */
+       cred = get_current_cred();
+       cxt = cred->security;
+       profile = aa_cred_profile(cred);
+       previous_profile = cxt->previous;
+
+       if (unconfined(profile)) {
+               sa.base.info = "unconfined";
+               sa.base.error = -EPERM;
+               goto audit;
+       }
+
+       if (count) {
+               /* attempting to change into a new hat or switch to a sibling */
+               struct aa_profile *root;
+               root = PROFILE_IS_HAT(profile) ? profile->parent : profile;
+               sa.name2 = profile->ns->base.hname;
+
+               /* find first matching hat */
+               for (i = 0; i < count && !hat; i++)
+                       /* released below */
+                       hat = aa_find_child(root, hats[i]);
+               if (!hat) {
+                       if (!COMPLAIN_MODE(root) || permtest) {
+                               sa.base.info = "hat not found";
+                               if (list_empty(&root->base.profiles))
+                                       sa.base.error = -ECHILD;
+                               else
+                                       sa.base.error = -ENOENT;
+                               goto out;
+                       }
+
+                       /*
+                        * In complain mode and failed to match any hats.
+                        * Audit the failure based off of the first hat
+                        * supplied.  This is done due how userspace
+                        * interacts with change_hat.
+                        *
+                        * TODO: Add logging of all failed hats
+                        */
+
+                       /* freed below */
+                       name = new_compound_name(root->base.hname, hats[0]);
+                       sa.name = name;
+                       /* released below */
+                       hat = aa_new_null_profile(profile, 1);
+                       if (!hat) {
+                               sa.base.info = "failed null profile create";
+                               sa.base.error = -ENOMEM;
+                               goto audit;
+                       }
+               } else {
+                       sa.name = hat->base.hname;
+                       if (!PROFILE_IS_HAT(hat)) {
+                               sa.base.info = "target not hat";
+                               sa.base.error = -EPERM;
+                               goto audit;
+                       }
+               }
+
+               sa.base.error = aa_may_change_ptraced_domain(current, hat);
+               if (sa.base.error) {
+                       sa.base.info = "ptraced";
+                       sa.base.error = -EPERM;
+                       goto audit;
+               }
+
+               if (!permtest) {
+                       sa.base.error = aa_set_current_hat(hat, token);
+                       if (sa.base.error == -EACCES)
+                               /* kill task incase of brute force attacks */
+                               sa.perms.kill = AA_MAY_CHANGEHAT;
+                       else if (name && !sa.base.error)
+                               /* reset error for learning of new hats */
+                               sa.base.error = -ENOENT;
+               }
+       } else if (previous_profile) {
+               /* Return to saved profile.  Kill task if restore fails
+                * to avoid brute force attacks
+                */
+               sa.name = previous_profile->base.hname;
+               sa.base.error = aa_restore_previous_profile(token);
+               sa.perms.kill = AA_MAY_CHANGEHAT;
+       } else
+               /* ignore restores when there is no saved profile */
+               goto out;
+
+audit:
+       if (!permtest)
+               sa.base.error = aa_audit_file(profile, &sa);
+
+out:
+       aa_put_profile(hat);
+       kfree(name);
+       put_cred(cred);
+
+       return sa.base.error;
+}
+
+/**
+ * aa_change_profile - perform a one-way profile transition
+ * @ns_name: name of the profile namespace to change to
+ * @hname: name of profile to change to
+ * @onexec: whether this transition is to take place immediately or at exec
+ * @permtest: true if this is just a permission test
+ *
+ * Change to new profile @name.  Unlike with hats, there is no way
+ * to change back.  If @onexec then the transition is delayed until
+ * the next exec.
+ *
+ * Returns %0 on success, error otherwise.
+ */
+int aa_change_profile(const char *ns_name, const char *hname, int onexec,
+                     bool permtest)
+{
+       const struct cred *cred;
+       struct aa_task_cxt *cxt;
+       struct aa_profile *profile, *target = NULL;
+       struct aa_namespace *ns = NULL;
+       struct aa_audit_file sa = {
+               .request = AA_MAY_CHANGE_PROFILE,
+               .base.gfp_mask = GFP_KERNEL,
+       };
+
+       if (!hname && !ns_name)
+               return -EINVAL;
+
+       if (onexec)
+               sa.base.operation = "change_onexec";
+       else
+               sa.base.operation = "change_profile";
+
+       cred = get_current_cred();
+       cxt = cred->security;
+       profile = aa_cred_profile(cred);
+
+       if (ns_name) {
+               /* released below */
+               ns = aa_find_namespace(profile->ns, ns_name);
+               if (!ns) {
+                       /* we don't create new namespace in complain mode */
+                       sa.name2 = ns_name;
+                       sa.base.info = "namespace not found";
+                       sa.base.error = -ENOENT;
+                       goto audit;
+               }
+               sa.name2 = ns->base.hname;
+       } else {
+               /* released below */
+               ns = aa_get_namespace(profile->ns);
+               sa.name2 = ns->base.hname;
+       }
+
+       /* if the name was not specified, use the name of the current profile */
+       if (!hname) {
+               if (unconfined(profile))
+                       hname = ns->unconfined->base.hname;
+               else
+                       hname = profile->base.hname;
+       }
+       sa.name = hname;
+
+       sa.perms = change_profile_perms(profile, ns, hname, NULL);
+       if (!(sa.perms.allowed & AA_MAY_CHANGE_PROFILE)) {
+               sa.base.error = -EACCES;
+               goto audit;
+       }
+
+       /* released below */
+       target = aa_find_profile(ns, hname);
+       if (!target) {
+               sa.base.info = "profile not found";
+               sa.base.error = -ENOENT;
+               if (permtest || !COMPLAIN_MODE(profile))
+                       goto audit;
+               /* release below */
+               target = aa_new_null_profile(profile, 0);
+               if (!target) {
+                       sa.base.info = "failed null profile create";
+                       sa.base.error = -ENOMEM;
+                       goto audit;
+               }
+       }
+
+       /* check if tracing task is allowed to trace target domain */
+       sa.base.error = aa_may_change_ptraced_domain(current, target);
+       if (sa.base.error) {
+               sa.base.info = "ptrace prevents transition";
+               goto audit;
+       }
+
+       if (permtest)
+               goto audit;
+
+       if (onexec)
+               sa.base.error = aa_set_current_onexec(target);
+       else
+               sa.base.error = aa_replace_current_profiles(target);
+
+audit:
+       if (!permtest)
+               sa.base.error = aa_audit_file(profile, &sa);
+
+       aa_put_namespace(ns);
+       aa_put_profile(target);
+       put_cred(cred);
+
+       return sa.base.error;
+}
diff --git a/security/apparmor/file.c b/security/apparmor/file.c
new file mode 100644
index 0000000..43be391
--- /dev/null
+++ b/security/apparmor/file.c
@@ -0,0 +1,556 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor mediation of files
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include "include/apparmor.h"
+#include "include/audit.h"
+#include "include/file.h"
+#include "include/match.h"
+#include "include/path.h"
+#include "include/policy.h"
+
+struct file_perms nullperms;
+
+/**
+ * aa_audit_file_sub_mask - convert a permission mask into string
+ * @buffer: buffer to write string to  (NOT NULL)
+ * @mask: permission mask to convert
+ * @xindex: xindex
+ *
+ * NOTE: caller must make sure buffer is large enough for @mask
+ */
+static void aa_audit_file_sub_mask(char *buffer, u16 mask, u16 xindex)
+{
+       char *m = buffer;
+
+       if (mask & AA_EXEC_MMAP)
+               *m++ = 'm';
+       if (mask & MAY_READ)
+               *m++ = 'r';
+       if (mask & (MAY_WRITE | AA_MAY_CHMOD | AA_MAY_CHOWN))
+               *m++ = 'w';
+       else if (mask & MAY_APPEND)
+               *m++ = 'a';
+       if (mask & AA_MAY_CREATE)
+               *m++ = 'c';
+       if (mask & AA_MAY_DELETE)
+               *m++ = 'd';
+       if (mask & AA_MAY_LINK)
+               *m++ = 'l';
+       if (mask & AA_MAY_LOCK)
+               *m++ = 'k';
+       if (mask & MAY_EXEC)
+               *m++ = 'x';
+       *m++ = '\0';
+}
+
+/**
+ * aa_audit_file_mask - convert mask to owner::other string
+ * @buffer: buffer to write string to (NOT NULL)
+ * @mask: permission mask to convert
+ * @xindex: xindex
+ * @owner: if the mask is for owner or other
+ */
+static void aa_audit_file_mask(struct audit_buffer *ab, u16 mask, int xindex,
+                              int owner)
+{
+       char str[10];
+
+       if (owner) {
+               aa_audit_file_sub_mask(str, mask, xindex);
+               strcat(str, "::");
+       } else {
+               strcpy(str, "::");
+               aa_audit_file_sub_mask(str + 2, mask, xindex);
+       }
+       audit_log_string(ab, str);
+}
+
+/**
+ * file_audit_cb - call back for file specific audit fields
+ * @ab: audit_buffer  (NOT NULL)
+ * @va: audit struct to audit values of  (NOT NULL)
+ */
+static void file_audit_cb(struct audit_buffer *ab, struct aa_audit *va)
+{
+       struct aa_audit_file *sa = container_of(va, struct aa_audit_file, base);
+       u16 denied = sa->request & ~sa->perms.allowed;
+       uid_t fsuid;
+
+       fsuid = current_fsuid();
+
+       if (sa->request & AA_AUDIT_FILE_MASK) {
+               audit_log_format(ab, " requested_mask=");
+               aa_audit_file_mask(ab, sa->request, AA_X_NONE,
+                                  fsuid == sa->cond->uid);
+       }
+       if (denied & AA_AUDIT_FILE_MASK) {
+               audit_log_format(ab, " denied_mask=");
+               aa_audit_file_mask(ab, denied, sa->perms.xindex,
+                                  fsuid == sa->cond->uid);
+       }
+       if (sa->request & AA_AUDIT_FILE_MASK) {
+               audit_log_format(ab, " fsuid=%d", fsuid);
+               audit_log_format(ab, " ouid=%d", sa->cond->uid);
+       }
+
+       if (sa->name) {
+               audit_log_format(ab, " name=");
+               audit_log_untrustedstring(ab, sa->name);
+       }
+
+       if (sa->name2) {
+               audit_log_format(ab, " name2=");
+               audit_log_untrustedstring(ab, sa->name2);
+       }
+
+       if (sa->name3) {
+               audit_log_format(ab, " name3=");
+               audit_log_untrustedstring(ab, sa->name3);
+       }
+}
+
+/**
+ * aa_audit_file - handle the auditing of file operations
+ * @profile: the profile being enforced  (NOT NULL)
+ * @sa: file auditing context  (NOT NULL)
+ *
+ * Returns: %0 or error on failure
+ */
+int aa_audit_file(struct aa_profile *profile, struct aa_audit_file *sa)
+{
+       int type = AUDIT_APPARMOR_AUTO;
+
+       if (likely(!sa->base.error)) {
+               u16 mask = sa->perms.audit;
+
+               if (unlikely(AUDIT_MODE(profile) == AUDIT_ALL))
+                       mask = 0xffff;
+
+               /* mask off perms that are not being force audited */
+               sa->request &= mask;
+
+               if (likely(!sa->request))
+                       return 0;
+               type = AUDIT_APPARMOR_AUDIT;
+       } else {
+               /* only report permissions that were denied */
+               sa->request = sa->request & ~sa->perms.allowed;
+
+               if (sa->request & sa->perms.kill)
+                       type = AUDIT_APPARMOR_KILL;
+
+               /* quiet known rejects, assumes quiet and kill do not overlap */
+               if ((sa->request & sa->perms.quiet) &&
+                   AUDIT_MODE(profile) != AUDIT_NOQUIET &&
+                   AUDIT_MODE(profile) != AUDIT_ALL)
+                       sa->request &= ~sa->perms.quiet;
+
+               if (!sa->request)
+                       return COMPLAIN_MODE(profile) ? 0 : sa->base.error;
+       }
+       return aa_audit(type, profile, &sa->base, file_audit_cb);
+}
+
+/**
+ * aa_compute_perms - convert dfa compressed perms to internal perms
+ * @dfa: dfa to compute perms for   (NOT NULL)
+ * @state: state in dfa
+ * @cond:  conditions to consider  (NOT NULL)
+ *
+ * TODO: convert from dfa + state to permission entry, do computation conversion
+ *       at load time.
+ *
+ * Returns: computed permission set
+ */
+static struct file_perms aa_compute_perms(struct aa_dfa *dfa,
+                                         unsigned int state,
+                                         struct path_cond *cond)
+{
+       struct file_perms perms;
+
+       /* FIXME: change over to new dfa format
+        * currently file perms are encoded in the dfa, new format
+        * splits the permissions from the dfa.  This mapping can be
+        * done at profile load
+        */
+       perms.kill = 0;
+       perms.dindex = 0;
+
+       if (current_fsuid() == cond->uid) {
+               perms.allowed = dfa_user_allow(dfa, state);
+               perms.audit = dfa_user_audit(dfa, state);
+               perms.quiet = dfa_user_quiet(dfa, state);
+               perms.xindex = dfa_user_xindex(dfa, state);
+       } else {
+               perms.allowed = dfa_other_allow(dfa, state);
+               perms.audit = dfa_other_audit(dfa, state);
+               perms.quiet = dfa_other_quiet(dfa, state);
+               perms.xindex = dfa_other_xindex(dfa, state);
+       }
+       /* in the old mapping MAY_WRITE implies
+        * AA_MAY_CREATE | AA_MAY_CHMOD | AA_MAY_CHOWN */
+       if (perms.allowed & MAY_WRITE)
+               perms.allowed |= AA_MAY_CREATE | AA_MAY_CHMOD | AA_MAY_CHOWN |
+                       AA_MAY_DELETE;
+       if (perms.audit & MAY_WRITE)
+               perms.audit |= AA_MAY_CREATE | AA_MAY_CHMOD | AA_MAY_CHOWN |
+                       AA_MAY_DELETE;
+       if (perms.quiet & MAY_WRITE)
+               perms.quiet |= AA_MAY_CREATE | AA_MAY_CHMOD | AA_MAY_CHOWN |
+                       AA_MAY_DELETE;
+
+       /* in the old mapping AA_MAY_LOCK and link subset are overlayed
+        * and only determined by which part of a pair they are  in
+        */
+       if (perms.allowed & AA_MAY_LOCK)
+               perms.allowed |= AA_LINK_SUBSET;
+
+       /* change_profile wasn't determined by ownership in old mapping */
+       if (ACCEPT_TABLE(dfa)[state] & 0x80000000)
+               perms.allowed |= AA_MAY_CHANGE_PROFILE;
+
+       return perms;
+}
+
+/**
+ * aa_str_perms - find permission that match @name
+ * @dfa: to match against  (NOT NULL)
+ * @state: state to start matching in
+ * @name: string to match against dfa  (NOT NULL)
+ * @cond: conditions to consider for permission set computation  (NOT NULL)
+ * @rstate: if !NULL return state match finished in (MAYBE NULL)
+ *
+ * TODO: Update when permission mapping is moved to load time
+ *
+ * Returns: file permission for @name
+ */
+struct file_perms aa_str_perms(struct aa_dfa *dfa, unsigned int start,
+                              const char *name, struct path_cond *cond,
+                              unsigned int *rstate)
+{
+       unsigned int state;
+       if (!dfa)
+               return nullperms;
+
+       state = aa_dfa_match(dfa, start, name);
+
+       if (rstate)
+               *rstate = state;
+
+       /* TODO: convert to new dfa format */
+
+       return aa_compute_perms(dfa, state, cond);
+}
+
+/**
+ * aa_pathstr_perm - do permission check & audit for @name
+ * @profile: profile being enforced  (NOT NULL)
+ * @op: name of the operation  (NOT NULL)
+ * @name: path string to check permission for  (NOT NULL)
+ * @request: requested permissions
+ * @cond: conditional info for this request  (NOT NULL)
+ *
+ * Do permission check for paths that are predefined.  This fn will
+ * be removed once security_sysctl goes away.
+ *
+ * Returns: %0 else error if access denied or other error
+ */
+int aa_pathstr_perm(struct aa_profile *profile, const char *op,
+                   const char *name, u16 request, struct path_cond *cond)
+{
+       struct aa_audit_file sa = {
+               .base.operation = op,
+               .base.gfp_mask = GFP_KERNEL,
+               .request = request,
+               .name = name,
+               .cond = cond,
+       };
+
+       sa.perms = aa_str_perms(profile->file.dfa, profile->file.start, sa.name,
+                               cond,
+                               NULL);
+       if (request & ~sa.perms.allowed)
+               sa.base.error = -EACCES;
+       return aa_audit_file(profile, &sa);
+}
+
+/**
+ * aa_path_perm - do permissions check & audit for @path
+ * @profile: profile being enforced  (NOT NULL)
+ * @operation: name of the operation being enforced  (NOT NULL)
+ * @path: path to check permissions of  (NOT NULL)
+ * @request: requested permissions
+ * @cond: conditional info for this request  (NOT NULL)
+ *
+ * Returns: %0 else error if access denied or other error
+ */
+int aa_path_perm(struct aa_profile *profile, const char *operation,
+                struct path *path, u16 request, struct path_cond *cond)
+{
+       char *buffer, *name;
+       struct aa_audit_file sa = {
+               .base.operation = operation,
+               .base.gfp_mask = GFP_KERNEL,
+               .request = request,
+               .cond = cond,
+       };
+       int flags = profile->path_flags |
+               (S_ISDIR(cond->mode) ? PATH_IS_DIR : 0);
+       /* buffer freed below - name is pointer inside buffer */
+       sa.base.error = aa_get_name(path, flags, &buffer, &name);
+       sa.name = name;
+       if (sa.base.error) {
+               sa.perms = nullperms;
+               if (sa.base.error == -ENOENT)
+                       sa.base.info = "Failed name lookup - deleted entry";
+               else if (sa.base.error == -ESTALE)
+                       sa.base.info = "Failed name lookup - disconnected path";
+               else if (sa.base.error == -ENAMETOOLONG)
+                       sa.base.info = "Failed name lookup - name too long";
+               else
+                       sa.base.info = "Failed name lookup";
+       } else {
+               sa.perms = aa_str_perms(profile->file.dfa, profile->file.start,
+                                       sa.name, cond, NULL);
+               if (request & ~sa.perms.allowed)
+                       sa.base.error = -EACCES;
+       }
+       sa.base.error = aa_audit_file(profile, &sa);
+       kfree(buffer);
+
+       return sa.base.error;
+}
+
+/**
+ * xindex_is_subset - helper for aa_path_link
+ * @link: link permission set
+ * @target: target permission set
+ *
+ * test target x permissions are equal OR a subset of link x permissions
+ * this is done as part of the subset test, where a hardlink must have
+ * a subset of permissions that the target has.
+ *
+ * Returns: %1 if subset else %0
+ */
+static inline bool xindex_is_subset(u16 link, u16 target)
+{
+       if (((link & ~AA_X_UNSAFE) != (target & ~AA_X_UNSAFE)) ||
+           ((link & AA_X_UNSAFE) && !(target & AA_X_UNSAFE)))
+               return 0;
+
+       return 1;
+}
+
+/**
+ * aa_path_link - Handle hard link permission check
+ * @profile: the profile being enforced  (NOT NULL)
+ * @old_dentry: the target dentry  (NOT NULL)
+ * @new_dir: directory the new link will be created in  (NOT NULL)
+ * @new_dentry: the link being created  (NOT NULL)
+ *
+ * Handle the permission test for a link & target pair.  Permission
+ * is encoded as a pair where the link permission is determined
+ * first, and if allowed, the target is tested.  The target test
+ * is done from the point of the link match (not start of DFA)
+ * making the target permission dependent on the link permission match.
+ *
+ * The subset test if required forces that permissions granted
+ * on link are a subset of the permission granted to target.
+ *
+ * Returns: %0 if allowed else error
+ */
+int aa_path_link(struct aa_profile *profile, struct dentry *old_dentry,
+                struct path *new_dir, struct dentry *new_dentry)
+{
+       struct path link = { new_dir->mnt, new_dentry };
+       struct path target = { new_dir->mnt, old_dentry };
+       struct path_cond cond = {
+               old_dentry->d_inode->i_uid,
+               old_dentry->d_inode->i_mode
+       };
+       char *buffer = NULL, *buffer2 = NULL;
+       char *lname, *tname;
+       struct file_perms perms;
+       unsigned int state;
+
+       struct aa_audit_file sa = {
+               .base.operation = "link",
+               .base.gfp_mask = GFP_KERNEL,
+               .request = AA_MAY_LINK,
+               .cond = &cond,
+               .perms = nullperms,
+       };
+       /* buffer freed below, lname is pointer in buffer */
+       sa.base.error = aa_get_name(&link, profile->path_flags, &buffer,
+                                   &lname);
+       sa.name = lname;
+       if (sa.base.error)
+               goto audit;
+
+       /* buffer2 freed below, tname is pointer in buffer2 */
+       sa.base.error = aa_get_name(&target, profile->path_flags, &buffer2,
+                                   &tname);
+       sa.name2 = tname;
+       if (sa.base.error)
+               goto audit;
+
+       sa.base.error = -EACCES;
+
+       /* aa_str_perms - handles the case of the dfa being NULL */
+       sa.perms = aa_str_perms(profile->file.dfa, profile->file.start, lname,
+                               &cond, &state);
+       sa.perms.audit &= AA_MAY_LINK;
+       sa.perms.quiet &= AA_MAY_LINK;
+       sa.perms.kill &= AA_MAY_LINK;
+
+       if (!(sa.perms.allowed & AA_MAY_LINK))
+               goto audit;
+
+       /* test to see if target can be paired with link */
+       state = aa_dfa_null_transition(profile->file.dfa, state,
+                                      profile->flags & PFLAG_OLD_NULL_TRANS);
+       perms = aa_str_perms(profile->file.dfa, state, tname, &cond, NULL);
+       if (!(perms.allowed & AA_MAY_LINK)) {
+               sa.base.info = "target restricted";
+               goto audit;
+       }
+
+       /* done if link subset test is not required */
+       if (!(perms.allowed & AA_LINK_SUBSET))
+               goto done_tests;
+
+       /* Do link perm subset test requiring allowed permission on link are a
+        * subset of the allowed permissions on target.
+        */
+       perms = aa_str_perms(profile->file.dfa, profile->file.start, tname,
+                            &cond, NULL);
+
+       /* AA_MAY_LINK is not considered in the subset test */
+       sa.request = sa.perms.allowed & ~AA_MAY_LINK;
+       sa.perms.allowed &= perms.allowed | AA_MAY_LINK;
+
+       sa.request |= AA_AUDIT_FILE_MASK & (sa.perms.allowed & ~perms.allowed);
+       if (sa.request & ~sa.perms.allowed) {
+               goto audit;
+       } else if ((sa.perms.allowed & MAY_EXEC) &&
+                  !xindex_is_subset(sa.perms.xindex, perms.xindex)) {
+               sa.perms.allowed &= ~MAY_EXEC;
+               sa.request |= MAY_EXEC;
+               sa.base.info = "link not subset of target";
+               goto audit;
+       }
+
+done_tests:
+       sa.base.error = 0;
+
+audit:
+       sa.base.error = aa_audit_file(profile, &sa);
+       kfree(buffer);
+       kfree(buffer2);
+
+       return sa.base.error;
+}
+
+/**
+ * aa_is_deleted_file - test if a file has been completely unlinked
+ * @dentry: dentry of file to test for deletion  (NOT NULL)
+ *
+ * Returns: %1 if deleted else %0
+ */
+static inline bool aa_is_deleted_file(struct dentry *dentry)
+{
+       if (d_unlinked(dentry) && dentry->d_inode->i_nlink == 0)
+               return 1;
+       return 0;
+}
+
+/**
+ * aa_file_common_perm - core permission check & audit for files
+ * @profile: profile being enforced   (NOT NULL)
+ * @operation: name of operation      (NOT NULL)
+ * @file: file to check permissions of  (NOT NULL)
+ * @request: requested permissions
+ * @name: path name to revalidate permission on  (MAYBE NULL if @error != 0)
+ * @error: error result of name lookup when find @name
+ *
+ * Returns: %0 if access allowed else %1
+ */
+static int aa_file_common_perm(struct aa_profile *profile,
+                              const char *operation, struct file *file,
+                              u16 request, const char *name, int error)
+{
+       struct path_cond cond = {
+               .uid = file->f_path.dentry->d_inode->i_uid,
+               .mode = file->f_path.dentry->d_inode->i_mode
+       };
+       struct aa_audit_file sa = {
+               .base.operation = operation,
+               .base.gfp_mask = GFP_KERNEL,
+               .request = request,
+               .base.error = error,
+               .name = name,
+               .cond = &cond,
+       };
+
+       if (sa.base.error) {
+               sa.perms = nullperms;
+               if (sa.base.error == -ENOENT &&
+                   aa_is_deleted_file(file->f_path.dentry)) {
+                       /* Access to open files that are deleted are
+                        * give a pass (implicit delegation)
+                        */
+                       sa.base.error = 0;
+                       sa.perms.allowed = sa.request;
+               } else if (sa.base.error == -ENOENT)
+                       sa.base.info = "Failed name lookup - deleted entry";
+               else if (sa.base.error == -ESTALE)
+                       sa.base.info = "Failed name lookup - disconnected path";
+               else if (sa.base.error == -ENAMETOOLONG)
+                       sa.base.info = "Failed name lookup - name too long";
+               else
+                       sa.base.info = "Failed name lookup";
+       } else {
+               sa.perms = aa_str_perms(profile->file.dfa, profile->file.start,
+                                       sa.name, &cond, NULL);
+               if (request & ~sa.perms.allowed)
+                       sa.base.error = -EACCES;
+       }
+       sa.base.error = aa_audit_file(profile, &sa);
+
+       return sa.base.error;
+}
+
+/**
+ * aa_file_perm - do permission revalidation check & audit for @file
+ * @profile: profile being enforced   (NOT NULL)
+ * @operation: name of the operation  (NOT NULL)
+ * @file: file to revalidate access permissions on  (NOT NULL)
+ * @request: requested permissions
+ *
+ * Returns: %0 if access allowed else error
+ */
+int aa_file_perm(struct aa_profile *profile, const char *operation,
+                struct file *file, u16 request)
+{
+       char *buffer, *name;
+       umode_t mode = file->f_path.dentry->d_inode->i_mode;
+       /* buffer freed below, name is a pointer inside of buffer */
+       int flags = profile->path_flags | (S_ISDIR(mode) ? PATH_IS_DIR : 0);
+       int error = aa_get_name(&file->f_path, flags, &buffer, &name);
+
+       error = aa_file_common_perm(profile, operation, file, request, name,
+                                   error);
+       kfree(buffer);
+       return error;
+}
diff --git a/security/apparmor/include/apparmor.h b/security/apparmor/include/apparmor.h
new file mode 100644
index 0000000..25c1647
--- /dev/null
+++ b/security/apparmor/include/apparmor.h
@@ -0,0 +1,82 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor basic global and lib definitions
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __APPARMOR_H
+#define __APPARMOR_H
+
+#include <linux/fs.h>
+
+#include "match.h"
+
+/* Control parameters settable thru module/boot flags or
+ * via /sys/kernel/security/apparmor/control */
+extern enum audit_mode aa_g_audit;
+extern int aa_g_audit_header;
+extern int aa_g_debug;
+extern int aa_g_lock_policy;
+extern int aa_g_logsyscall;
+extern int aa_g_paranoid_load;
+extern unsigned int aa_g_path_max;
+
+/*
+ * DEBUG remains global (no per profile flag) since it is mostly used in sysctl
+ * which is not related to profile accesses.
+ */
+
+#define AA_DEBUG(fmt, args...)                                         \
+       do {                                                            \
+               if (aa_g_debug && printk_ratelimit())                   \
+                       printk(KERN_DEBUG "AppArmor: " fmt, ##args);    \
+       } while (0)
+
+#define AA_ERROR(fmt, args...)                                         \
+       do {                                                            \
+               if (printk_ratelimit())                                 \
+                       printk(KERN_ERR "AppArmor: " fmt, ##args);      \
+       } while (0)
+
+/* Flag indicating whether initialization completed */
+extern int apparmor_initialized;
+void apparmor_disable(void);
+
+/* fn's in lib */
+char *aa_split_fqname(char *args, char **ns_name);
+bool aa_strneq(const char *str, const char *sub, int len);
+void aa_info_message(const char *str);
+
+/**
+ * aa_dfa_null_transition - step to next state after null character
+ * @dfa: the dfa to match against
+ * @start: the state of the dfa to start matching in
+ * @old: true if using // as the null transition
+ *
+ * aa_dfa_null_transition transitions to the next state after a null
+ * character which is not used in standard matching and is only
+ * used to seperate pairs.
+ */
+static inline unsigned int aa_dfa_null_transition(struct aa_dfa *dfa,
+                                                 unsigned int start, bool old)
+{
+       if (unlikely(old))
+               return aa_dfa_match_len(dfa, start, "//", 2);
+       else
+               return aa_dfa_match_len(dfa, start, "\0", 1);
+}
+
+static inline bool mediated_filesystem(struct inode *inode)
+{
+       return !(inode->i_sb->s_flags & MS_NOUSER);
+}
+
+#endif /* __APPARMOR_H */
diff --git a/security/apparmor/include/apparmorfs.h b/security/apparmor/include/apparmorfs.h
new file mode 100644
index 0000000..d071bf1
--- /dev/null
+++ b/security/apparmor/include/apparmorfs.h
@@ -0,0 +1,28 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor filesystem definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_APPARMORFS_H
+#define __AA_APPARMORFS_H
+
+extern struct dentry *aa_fs_null;
+extern struct vfsmount *aa_fs_mnt;
+
+extern void aa_destroy_aafs(void);
+
+#ifdef CONFIG_SECURITY_APPARMOR_COMPAT_24
+extern const struct file_operations aa_fs_matching_fops;
+extern const struct file_operations aa_fs_features_fops;
+#endif
+
+#endif /* __AA_APPARMORFS_H */
diff --git a/security/apparmor/include/audit.h b/security/apparmor/include/audit.h
new file mode 100644
index 0000000..d86cfee
--- /dev/null
+++ b/security/apparmor/include/audit.h
@@ -0,0 +1,54 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor auditing function definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_AUDIT_H
+#define __AA_AUDIT_H
+
+#include <linux/audit.h>
+#include <linux/fs.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+
+struct aa_profile;
+
+extern const char *audit_mode_names[];
+#define AUDIT_MAX_INDEX 5
+
+#define AUDIT_APPARMOR_AUTO 0  /* auto choose audit message type */
+
+enum audit_mode {
+       AUDIT_NORMAL,           /* follow normal auditing of accesses */
+       AUDIT_QUIET_DENIED,     /* quiet all denied access messages */
+       AUDIT_QUIET,            /* quiet all messages */
+       AUDIT_NOQUIET,          /* do not quiet audit messages */
+       AUDIT_ALL               /* audit all accesses */
+};
+
+/*
+ * aa_audit - AppArmor auditing structure
+ * Structure is populated by access control code and passed to aa_audit which
+ * provides for a single point of logging.
+ */
+struct aa_audit {
+       struct task_struct *task;
+       gfp_t gfp_mask;
+       int error;
+       const char *operation;
+       const char *info;
+};
+
+int aa_audit(int type, struct aa_profile *profile, struct aa_audit *sa,
+            void (*cb) (struct audit_buffer *, struct aa_audit *));
+
+#endif /* __AA_AUDIT_H */
diff --git a/security/apparmor/include/capability.h b/security/apparmor/include/capability.h
new file mode 100644
index 0000000..8287e9d
--- /dev/null
+++ b/security/apparmor/include/capability.h
@@ -0,0 +1,45 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor capability mediation definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_CAPABILITY_H
+#define __AA_CAPABILITY_H
+
+#include <linux/sched.h>
+
+struct aa_profile;
+
+/* aa_caps - confinement data for capabilities
+ * @allowed: capabilities mask
+ * @audit: caps that are to be audited
+ * @quiet: caps that should not be audited
+ * @kill: caps that when requested will result in the task being killed
+ * @extended: caps that are subject finer grained mediation
+ */
+struct aa_caps {
+       kernel_cap_t allowed;
+       kernel_cap_t audit;
+       kernel_cap_t quiet;
+       kernel_cap_t kill;
+       kernel_cap_t extended;
+};
+
+int aa_capable(struct task_struct *task, struct aa_profile *profile, int cap,
+              int audit);
+
+static inline void aa_free_cap_rules(struct aa_caps *caps)
+{
+       /* NOP */
+}
+
+#endif /* __AA_CAPBILITY_H */
diff --git a/security/apparmor/include/context.h b/security/apparmor/include/context.h
new file mode 100644
index 0000000..1560adc
--- /dev/null
+++ b/security/apparmor/include/context.h
@@ -0,0 +1,154 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor contexts used to associate "labels" to objects.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_CONTEXT_H
+#define __AA_CONTEXT_H
+
+#include <linux/cred.h>
+#include <linux/slab.h>
+#include <linux/sched.h>
+
+#include "policy.h"
+
+/* struct aa_file_cxt - the AppArmor context the file was opened in
+ * @profile: the profile the file was opened under
+ * @perms: the permission the file was opened with
+ */
+struct aa_file_cxt {
+       struct aa_profile *profile;
+       u16 allowed;
+};
+
+/**
+ * aa_alloc_file_context - allocate file_cxt
+ * @gfp: gfp flags for allocation
+ *
+ * Returns: file_cxt or NULL on failure
+ */
+static inline struct aa_file_cxt *aa_alloc_file_context(gfp_t gfp)
+{
+       return kzalloc(sizeof(struct aa_file_cxt), gfp);
+}
+
+/**
+ * aa_free_file_context - free a file_cxt
+ * @cxt: file_cxt to free  (MAYBE_NULL)
+ */
+static inline void aa_free_file_context(struct aa_file_cxt *cxt)
+{
+       if (cxt) {
+               aa_put_profile(cxt->profile);
+               kzfree(cxt);
+       }
+}
+
+/**
+ * struct aa_task_cxt - primary label for confined tasks
+ * @profile: the current profile   (NOT NULL)
+ * @exec: profile to transition to on next exec  (MAYBE NULL)
+ * @previous: profile the task may return to     (MAYBE NULL)
+ * @token: magic value the task must know for returning to @previous_profile
+ *
+ * Contains the task's current profile (which could change due to
+ * change_hat).  Plus the hat_magic needed during change_hat.
+ *
+ * TODO: make so a task can be confined by a stack of contexts
+ */
+struct aa_task_cxt {
+       struct aa_profile *profile;
+       struct aa_profile *onexec;
+       struct aa_profile *previous;
+       u64 token;
+};
+
+struct aa_task_cxt *aa_alloc_task_context(gfp_t flags);
+void aa_free_task_context(struct aa_task_cxt *cxt);
+void aa_dup_task_context(struct aa_task_cxt *new,
+                        const struct aa_task_cxt *old);
+int aa_replace_current_profiles(struct aa_profile *profile);
+int aa_set_current_onexec(struct aa_profile *profile);
+int aa_set_current_hat(struct aa_profile *profile, u64 token);
+int aa_restore_previous_profile(u64 cookie);
+
+/**
+ * __aa_task_is_confined - determine if @task has any confinement
+ * @task: task to check confinement of  (NOT NULL)
+ *
+ * If @task != current needs to be called in RCU safe critical section
+ */
+static inline bool __aa_task_is_confined(struct task_struct *task)
+{
+       struct aa_task_cxt *cxt = __task_cred(task)->security;
+
+       BUG_ON(!cxt || !cxt->profile);
+       if (unconfined(aa_newest_version(cxt->profile)))
+               return 0;
+
+       return 1;
+}
+
+/**
+ * aa_cred_profile - obtain cred's profiles
+ * @cred: cred to obtain profiles from  (NOT NULL)
+ *
+ * Returns: confining profile
+ *
+ * does NOT increment reference count
+ */
+static inline struct aa_profile *aa_cred_profile(const struct cred *cred)
+{
+       struct aa_task_cxt *cxt = cred->security;
+       BUG_ON(!cxt || !cxt->profile);
+       return aa_newest_version(cxt->profile);
+}
+
+/**
+ * __aa_current_profile - find the current tasks confining profile
+ *
+ * Returns: up to date confining profile or the ns unconfined profile (NOT NULL)
+ *
+ * This fn will not update the tasks cred to the most up to date version
+ * of the profile so it is safe to call when inside of locks.
+ */
+static inline struct aa_profile *__aa_current_profile(void)
+{
+       return aa_cred_profile(current_cred());
+}
+
+/**
+ * aa_current_profile - find the current tasks confining profile and do updates
+ *
+ * Returns: up to date confining profile or the ns unconfined profile (NOT NULL)
+ *
+ * This fn will update the tasks cred structure if the profile has been
+ * replaced.  Not safe to call inside locks
+ */
+static inline struct aa_profile *aa_current_profile(void)
+{
+       const struct aa_task_cxt *cxt = current_cred()->security;
+       struct aa_profile *profile;
+       BUG_ON(!cxt || !cxt->profile);
+
+       profile = aa_newest_version(cxt->profile);
+       /*
+        * Whether or not replacement succeeds, use newest profile so
+        * there is no need to update it after replacement.
+        */
+       if (unlikely((cxt->profile != profile)))
+               aa_replace_current_profiles(profile);
+
+       return profile;
+}
+
+#endif /* __AA_CONTEXT_H */
diff --git a/security/apparmor/include/domain.h b/security/apparmor/include/domain.h
new file mode 100644
index 0000000..b1ba488
--- /dev/null
+++ b/security/apparmor/include/domain.h
@@ -0,0 +1,36 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor security domain transition function definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/binfmts.h>
+#include <linux/types.h>
+
+#ifndef __AA_DOMAIN_H
+#define __AA_DOMAIN_H
+
+struct aa_domain {
+       int size;
+       char **table;
+};
+
+int apparmor_bprm_set_creds(struct linux_binprm *bprm);
+int apparmor_bprm_secureexec(struct linux_binprm *bprm);
+void apparmor_bprm_committing_creds(struct linux_binprm *bprm);
+void apparmor_bprm_committed_creds(struct linux_binprm *bprm);
+
+void aa_free_domain_entries(struct aa_domain *domain);
+int aa_change_hat(const char *hats[], int count, u64 token, bool permtest);
+int aa_change_profile(const char *ns_name, const char *name, int onexec,
+                     bool permtest);
+
+#endif /* __AA_DOMAIN_H */
diff --git a/security/apparmor/include/file.h b/security/apparmor/include/file.h
new file mode 100644
index 0000000..559f085
--- /dev/null
+++ b/security/apparmor/include/file.h
@@ -0,0 +1,228 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor file mediation function definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_FILE_H
+#define __AA_FILE_H
+
+#include <linux/path.h>
+
+#include "audit.h"
+#include "domain.h"
+#include "match.h"
+
+struct aa_profile;
+
+/*
+ * We use MAY_EXEC, MAY_WRITE, MAY_READ, MAY_APPEND and the following flags
+ * for profile permissions
+ */
+#define AA_MAY_LINK                    0x0010
+#define AA_MAY_LOCK                    0x0020
+#define AA_EXEC_MMAP                   0x0040
+
+#define AA_MAY_CREATE                  0x0080
+#define AA_MAY_DELETE                  0x0100
+#define AA_MAY_CHMOD                   0x0200
+#define AA_MAY_CHOWN                   0x0400
+
+#define AA_LINK_SUBSET                 0x0800
+#define AA_MAY_CHANGEHAT               0x2000  /* ctrl auditing only */
+#define AA_MAY_ONEXEC                  0x4000  /* exec allows onexec */
+#define AA_MAY_CHANGE_PROFILE          0x8000
+
+#define AA_AUDIT_FILE_MASK     (MAY_READ | MAY_WRITE | MAY_EXEC | MAY_APPEND |\
+                                AA_MAY_LINK | AA_MAY_LOCK | AA_EXEC_MMAP | \
+                                AA_MAY_CREATE | AA_MAY_DELETE | AA_MAY_CHMOD |\
+                                AA_MAY_CHOWN)
+
+/*
+ * The xindex is broken into 3 parts
+ * - index - an index into either the exec name table or the variable table
+ * - exec type - which determines how the executable name and index are used
+ * - flags - which modify how the destination name is applied
+ */
+#define AA_X_INDEX_MASK                0x03ff
+
+#define AA_X_TYPE_MASK         0x0c00
+#define AA_X_TYPE_SHIFT                10
+#define AA_X_NONE              0x0000
+#define AA_X_NAME              0x0400  /* use executable name px */
+#define AA_X_TABLE             0x0800  /* use a specified name ->n# */
+
+#define AA_X_UNSAFE            0x1000
+#define AA_X_CHILD             0x2000  /* make >AA_X_NONE apply to children */
+#define AA_X_INHERIT           0x4000
+#define AA_X_UNCONFINED                0x8000
+
+/* AA_SECURE_X_NEEDED - is passed in the bprm->unsafe field */
+#define AA_SECURE_X_NEEDED     0x8000
+
+/* need to conditionalize which ones are being set */
+struct path_cond {
+       uid_t uid;
+       umode_t mode;
+};
+
+/* struct file_perms - file permission fo
+ * @allowed: mask of permissions that are allowed
+ * @audit: mask of permissions to force an audit message for
+ * @quiet: mask of permissions to quiet audit messages for
+ * @kill: mask of permissions that when matched will kill the task
+ * @xindex: exec transition index if @allowed contains MAY_EXEC
+ * @xdelegate: used by exec to determine set of delegates allowed
+ * @dindex: delegate table index, 0 if no delegation allowed
+ *
+ * The @audit and @queit mask should be mutually exclusive.
+ */
+struct file_perms {
+       u16 allowed;
+       u16 audit;
+       u16 quiet;
+       u16 kill;
+       u16 xindex;
+       u16 xdelegate;
+       u16 dindex;
+};
+
+extern struct file_perms nullperms;
+
+#define COMBINED_PERM_MASK(X) ((X).allowed | (X).audit | (X).quiet | (X).kill)
+
+/* FIXME: split perms from dfa and match this to description
+ *        also add delegation info.
+ */
+static inline u16 dfa_map_xindex(u16 mask)
+{
+       u16 old_index = (mask >> 10) & 0xf;
+       u16 index = 0;
+
+       if (mask & 0x100)
+               index |= AA_X_UNSAFE;
+       if (mask & 0x200)
+               index |= AA_X_INHERIT;
+       if (mask & 0x80)
+               index |= AA_X_UNCONFINED;
+
+       if (old_index == 1) {
+               index |= AA_X_UNCONFINED;
+       } else if (old_index == 2) {
+               index |= AA_X_NAME;
+       } else if (old_index == 3) {
+               index |= AA_X_NAME | AA_X_CHILD;
+       } else {
+               index |= AA_X_TABLE;
+               index |= old_index - 4;
+       }
+
+       return index;
+}
+
+/*
+ * map old dfa inline permissions to new format
+ */
+#define dfa_user_allow(dfa, state) ((ACCEPT_TABLE(dfa)[state]) & 0x7f)
+#define dfa_user_audit(dfa, state) ((ACCEPT_TABLE2(dfa)[state]) & 0x7f)
+#define dfa_user_quiet(dfa, state) (((ACCEPT_TABLE2(dfa)[state]) >> 7) & 0x7f)
+#define dfa_user_xindex(dfa, state) \
+       (dfa_map_xindex(ACCEPT_TABLE(dfa)[state] & 0x3fff))
+
+#define dfa_other_allow(dfa, state) (((ACCEPT_TABLE(dfa)[state]) >> 14) & 0x7f)
+#define dfa_other_audit(dfa, state) (((ACCEPT_TABLE2(dfa)[state]) >> 14) & 0x7f)
+#define dfa_other_quiet(dfa, state) \
+       ((((ACCEPT_TABLE2(dfa)[state]) >> 7) >> 14) & 0x7f)
+#define dfa_other_xindex(dfa, state) \
+       dfa_map_xindex((ACCEPT_TABLE(dfa)[state] >> 14) & 0x3fff)
+
+struct aa_audit_file {
+       struct aa_audit base;
+
+       const char *name;
+       const char *name2;
+       const char *name3;
+       struct file_perms perms;
+       u16 request;
+       struct path_cond *cond;
+};
+
+int aa_audit_file(struct aa_profile *profile, struct aa_audit_file *sa);
+
+/**
+ * struct aa_file_rules - components used for file rule permissions
+ * @dfa: dfa to match path names and conditionals against
+ * @perms: permission table indexed by the matched state accept entry of @dfa
+ * @trans: transition table for indexed by named x transitions
+ *
+ * File permission are determined by matching a path against @dfa and then
+ * then using the value of the accept entry for the matching state as
+ * an index into @perms.  If a named exec transition is required it is
+ * looked up in the transition table.
+ */
+struct aa_file_rules {
+       unsigned int start;
+       struct aa_dfa *dfa;
+       /* struct perms perms; */
+       struct aa_domain trans;
+       /* TODO: add delegate table */
+};
+
+struct file_perms aa_str_perms(struct aa_dfa *dfa, unsigned int start,
+                              const char *name, struct path_cond *cond,
+                              unsigned int *rstate);
+
+int aa_pathstr_perm(struct aa_profile *profile, const char *op,
+                   const char *name, u16 request, struct path_cond *cond);
+
+int aa_path_perm(struct aa_profile *profile, const char *operation,
+                struct path *path, u16 request, struct path_cond *cond);
+
+int aa_path_link(struct aa_profile *profile, struct dentry *old_dentry,
+                struct path *new_dir, struct dentry *new_dentry);
+
+int aa_file_perm(struct aa_profile *profile, const char *operation,
+                struct file *file, u16 request);
+
+static inline void aa_free_file_rules(struct aa_file_rules *rules)
+{
+       aa_put_dfa(rules->dfa);
+       aa_free_domain_entries(&rules->trans);
+}
+
+#define ACC_FMODE(x) (("\000\004\002\006"[(x)&O_ACCMODE]) | (((x) << 1) & 0x40))
+
+/* from namei.c */
+#define MAP_OPEN_FLAGS(x) ((((x) + 1) & O_ACCMODE) ? (x) + 1 : (x))
+
+/**
+ * aa_map_file_perms - map file flags to AppArmor permissions
+ * @file: open file to map flags to AppArmor permissions
+ *
+ * Returns: apparmor permission set for the file
+ */
+static inline u16 aa_map_file_to_perms(struct file *file)
+{
+       int flags = MAP_OPEN_FLAGS(file->f_flags);
+       u16 perms = ACC_FMODE(file->f_mode);
+
+       if ((flags & O_APPEND) && (perms & MAY_WRITE))
+               perms = (perms & ~MAY_WRITE) | MAY_APPEND;
+       /* trunc implies write permission */
+       if (flags & O_TRUNC)
+               perms |= MAY_WRITE;
+       if (flags & O_CREAT)
+               perms |= AA_MAY_CREATE;
+
+       return perms;
+}
+
+#endif /* __AA_FILE_H */
diff --git a/security/apparmor/include/ipc.h b/security/apparmor/include/ipc.h
new file mode 100644
index 0000000..aeda0fb
--- /dev/null
+++ b/security/apparmor/include/ipc.h
@@ -0,0 +1,28 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor ipc mediation function definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_IPC_H
+#define __AA_IPC_H
+
+#include <linux/sched.h>
+
+struct aa_profile;
+
+int aa_may_ptrace(struct task_struct *tracer_task, struct aa_profile *tracer,
+                 struct aa_profile *tracee, unsigned int mode);
+
+int aa_ptrace(struct task_struct *tracer, struct task_struct *tracee,
+             unsigned int mode);
+
+#endif /* __AA_IPC_H */
diff --git a/security/apparmor/include/match.h b/security/apparmor/include/match.h
new file mode 100644
index 0000000..5465d4d
--- /dev/null
+++ b/security/apparmor/include/match.h
@@ -0,0 +1,130 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor policy dfa matching engine definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_MATCH_H
+#define __AA_MATCH_H
+
+#define DFA_NOMATCH                    0
+#define DFA_START                      1
+
+#define DFA_VALID_PERM_MASK            0xffffffff
+#define DFA_VALID_PERM2_MASK           0xffffffff
+
+/**
+ * The format used for transition tables is based on the GNU flex table
+ * file format (--tables-file option; see Table File Format in the flex
+ * info pages and the flex sources for documentation). The magic number
+ * used in the header is 0x1B5E783D insted of 0xF13C57B1 though, because
+ * the YY_ID_CHK (check) and YY_ID_DEF (default) tables are used
+ * slightly differently (see the apparmor-parser package).
+ */
+
+#define YYTH_MAGIC     0x1B5E783D
+#define YYTH_DEF_RECURSE 0x1                   /* DEF Table is recursive */
+
+struct table_set_header {
+       u32 th_magic;           /* YYTH_MAGIC */
+       u32 th_hsize;
+       u32 th_ssize;
+       u16 th_flags;
+       char th_version[];
+};
+
+/* The YYTD_ID are one less than flex table mappings.  The flex id
+ * has 1 subtracted at table load time, this allows us to directly use the
+ * ID's as indexes.
+ */
+#define        YYTD_ID_ACCEPT  0
+#define YYTD_ID_BASE   1
+#define YYTD_ID_CHK    2
+#define YYTD_ID_DEF    3
+#define YYTD_ID_EC     4
+#define YYTD_ID_META   5
+#define YYTD_ID_ACCEPT2 6
+#define YYTD_ID_NXT    7
+#define YYTD_ID_TSIZE  8
+
+#define YYTD_DATA8     1
+#define YYTD_DATA16    2
+#define YYTD_DATA32    4
+#define YYTD_DATA64    8
+
+/* Each ACCEPT2 table gets 6 dedicated flags, YYTD_DATAX define the
+ * first flags
+ */
+#define ACCEPT1_FLAGS(X) ((X) & 0x3f)
+#define ACCEPT2_FLAGS(X) ACCEPT1_FLAGS((X) >> YYTD_ID_ACCEPT2)
+#define TO_ACCEPT1_FLAG(X) ACCEPT1_FLAGS(X)
+#define TO_ACCEPT2_FLAG(X) (ACCEPT1_FLAGS(X) << YYTD_ID_ACCEPT2)
+#define DFA_FLAG_VERIFY_STATES 0x1000
+
+struct table_header {
+       u16 td_id;
+       u16 td_flags;
+       u32 td_hilen;
+       u32 td_lolen;
+       char td_data[];
+};
+
+#define DEFAULT_TABLE(DFA) ((u16 *)((DFA)->tables[YYTD_ID_DEF]->td_data))
+#define BASE_TABLE(DFA) ((u32 *)((DFA)->tables[YYTD_ID_BASE]->td_data))
+#define NEXT_TABLE(DFA) ((u16 *)((DFA)->tables[YYTD_ID_NXT]->td_data))
+#define CHECK_TABLE(DFA) ((u16 *)((DFA)->tables[YYTD_ID_CHK]->td_data))
+#define EQUIV_TABLE(DFA) ((u8 *)((DFA)->tables[YYTD_ID_EC]->td_data))
+#define ACCEPT_TABLE(DFA) ((u32 *)((DFA)->tables[YYTD_ID_ACCEPT]->td_data))
+#define ACCEPT_TABLE2(DFA) ((u32 *)((DFA)->tables[YYTD_ID_ACCEPT2]->td_data))
+
+struct aa_dfa {
+       struct kref count;
+       u16 flags;
+       struct table_header *tables[YYTD_ID_TSIZE];
+};
+
+#define byte_to_byte(X) (X)
+
+#define UNPACK_ARRAY(TABLE, BLOB, LEN, TYPE, NTOHX) \
+       do { \
+               typeof(LEN) __i; \
+               TYPE *__t = (TYPE *) TABLE; \
+               TYPE *__b = (TYPE *) BLOB; \
+               for (__i = 0; __i < LEN; __i++) { \
+                       __t[__i] = NTOHX(__b[__i]); \
+               } \
+       } while (0)
+
+static inline size_t table_size(size_t len, size_t el_size)
+{
+       return ALIGN(sizeof(struct table_header) + len * el_size, 8);
+}
+
+struct aa_dfa *aa_dfa_unpack(void *blob, size_t size, int flags);
+unsigned int aa_dfa_match_len(struct aa_dfa *dfa, unsigned int start,
+                             const char *str, int len);
+unsigned int aa_dfa_match(struct aa_dfa *dfa, unsigned int start,
+                         const char *str);
+void aa_dfa_free_kref(struct kref *kref);
+
+/**
+ * aa_put_dfa - put a dfa refcount
+ * @dfa: dfa to put refcount   (MAYBE NULL)
+ *
+ * Requires: if @dfa != NULL that valid refcount be held
+ */
+static inline void aa_put_dfa(struct aa_dfa *dfa)
+{
+       if (dfa)
+               kref_put(&dfa->count, aa_dfa_free_kref);
+}
+
+#endif /* __AA_MATCH_H */
diff --git a/security/apparmor/include/net.h b/security/apparmor/include/net.h
new file mode 100644
index 0000000..7d6ddeb
--- /dev/null
+++ b/security/apparmor/include/net.h
@@ -0,0 +1,40 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor network mediation definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_NET_H
+#define __AA_NET_H
+
+#include <net/sock.h>
+
+/* struct aa_net - network confinement data
+ * @allowed: basic network families permissions
+ * @audit_network: which network permissions to force audit
+ * @quiet_network: which network permissions to quiet rejects
+ */
+struct aa_net {
+       u16 allowed[AF_MAX];
+       u16 audit[AF_MAX];
+       u16 quiet[AF_MAX];
+};
+
+extern int aa_net_perm(struct aa_profile *profile, char *operation,
+                      int family, int type, int protocol);
+extern int aa_revalidate_sk(struct sock *sk, char *operation);
+
+static inline void aa_free_net_rules(struct aa_net *new)
+{
+       /* NOP */
+}
+
+#endif /* __AA_NET_H */
diff --git a/security/apparmor/include/path.h b/security/apparmor/include/path.h
new file mode 100644
index 0000000..6933d64
--- /dev/null
+++ b/security/apparmor/include/path.h
@@ -0,0 +1,31 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor basic path manipulation function definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_PATH_H
+#define __AA_PATH_H
+
+
+enum path_flags {
+       PATH_IS_DIR = 0x1,              /* path is a directory */
+       PATH_CONNECT_PATH = 0x4,        /* connect disconnected paths to / */
+       PATH_CHROOT_REL = 0x8,          /* do path lookup relative to chroot */
+       PATH_CHROOT_NSCONNECT = 0x10,   /* connect paths that are at ns root */
+
+       PATH_MEDIATE_DELETED = 0x10000, /* mediate deleted paths */
+};
+
+int aa_get_name(struct path *path, int flags, char **buffer, char **name);
+char *sysctl_pathname(struct ctl_table *table, char *buffer, int buflen);
+
+#endif /* __AA_PATH_H */
diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
new file mode 100644
index 0000000..56fc38a
--- /dev/null
+++ b/security/apparmor/include/policy.h
@@ -0,0 +1,307 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor policy definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_POLICY_H
+#define __AA_POLICY_H
+
+#include <linux/capability.h>
+#include <linux/cred.h>
+#include <linux/kref.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/socket.h>
+
+#include "apparmor.h"
+#include "audit.h"
+#include "capability.h"
+#include "domain.h"
+#include "file.h"
+#include "net.h"
+#include "resource.h"
+
+extern const char *profile_mode_names[];
+#define APPARMOR_NAMES_MAX_INDEX 3
+
+#define COMPLAIN_MODE(_profile)                                \
+       ((aa_g_profile_mode == APPARMOR_COMPLAIN) || ((_profile) &&     \
+                                       (_profile)->mode == APPARMOR_COMPLAIN))
+
+#define DO_KILL(_profile)                                      \
+       ((aa_g_profile_mode == APPARMOR_KILL) || ((_profile) && \
+                                       (_profile)->mode == APPARMOR_KILL))
+
+#define PROFILE_IS_HAT(_profile) \
+       ((_profile) && (_profile)->flags & PFLAG_HAT)
+
+/*
+ * FIXME: currently need a clean way to replace and remove profiles as a
+ * set.  It should be done at the namespace level.
+ * Either, with a set of profiles loaded at the namespace level or via
+ * a mark and remove marked interface.
+ */
+enum profile_mode {
+       APPARMOR_ENFORCE,       /* enforce access rules */
+       APPARMOR_COMPLAIN,      /* allow and log access violations */
+       APPARMOR_KILL,          /* kill task on access violation */
+};
+
+enum profile_flags {
+       PFLAG_HAT = 1,                  /* profile is a hat */
+       PFLAG_UNCONFINED = 2,           /* profile is the unconfined profile */
+       PFLAG_NULL = 4,                 /* profile is null learning profile */
+       PFLAG_IX_ON_NAME_ERROR = 8,     /* fallback to ix on name lookup fail */
+       PFLAG_IMMUTABLE = 0x10,         /* don't allow changes/replacement */
+       PFLAG_USER_DEFINED = 0x20,      /* user based profile */
+       PFLAG_NO_LIST_REF = 0x40,       /* list doesn't keep profile ref */
+       PFLAG_MMAP_MIN_ADDR = 0x80,     /* profile controls mmap_min_addr */
+       PFLAG_OLD_NULL_TRANS = 0x100,   /* use // as the null transition */
+
+       /* These flags must coorespond with PATH_flags */
+       PFLAG_MEDIATE_DELETED = 0x10000, /* mediate instead delegate deleted */
+};
+
+#define AA_NEW_SID 0
+
+struct aa_profile;
+
+/* struct aa_policy - common part of both namespaces and profiles
+ * @name: name of the object
+ * @hname - The hierarchical name
+ * @count: reference count of the obj
+ * @list: list policy object is on
+ * @profiles: head of the profiles list contained in the object
+ */
+struct aa_policy {
+       char *name;
+       char *hname;
+       struct kref count;
+       struct list_head list;
+       struct list_head profiles;
+};
+
+/* struct aa_ns_acct - accounting of profiles in namespace
+ * @max_size: maximum space allowed for all profiles in namespace
+ * @max_count: maximum number of profiles that can be in this namespace
+ * @size: current size of profiles
+ * @count: current count of profiles (includes null profiles)
+ */
+struct aa_ns_acct {
+       int max_size;
+       int max_count;
+       int size;
+       int count;
+};
+
+/* struct aa_namespace - namespace for a set of profiles
+ * @base: common policy
+ * @parent: parent of namespace
+ * @lock: lock for modifying the object
+ * @acct: accounting for the namespace
+ * @unconfined: special unconfined profile for the namespace
+ * @sub_ns: list of namespaces under the current namespace.
+ *
+ * An aa_namespace defines the set profiles that are searched to determine
+ * which profile to attach to a task.  Profiles can not be shared between
+ * aa_namespaces and profile names within a namespace are guarenteed to be
+ * unique.  When profiles in seperate namespaces have the same name they
+ * are NOT considered to be equivalent.
+ *
+ * Namespaces are hierarchical and only namespaces and profiles below the
+ * current namespace are visible.
+ *
+ * Namespace names must be unique and can not contain the characters :/\0
+ *
+ * FIXME TODO: add vserver support so a vserer (can it all be done in userspace)
+ */
+struct aa_namespace {
+       struct aa_policy base;
+       struct aa_namespace *parent;
+       rwlock_t lock;
+       struct aa_ns_acct acct;
+       struct aa_profile *unconfined;
+       struct list_head sub_ns;
+};
+
+/* struct aa_profile - basic confinement data
+ * @base - base componets of the profile (name, refcount, lists, lock ...)
+ * @parent: parent of profile
+ * @ns: namespace the profile is in
+ * @replacedby: is set profile that replaced this profile
+ * @xmatch: optional extended matching for unconfined executables names
+ * @xmatch_len: xmatch prefix len, used to determine xmatch priority
+ * @sid: the unique security id number of this profile
+ * @audit: the auditing mode of the profile
+ * @mode: the enforcement mode of the profile
+ * @flags: flags controlling profile behavior
+ * @path_flags: flags controlling path generation behavior
+ * @size: the memory consumed by this profiles rules
+ * @file: The set of rules governing basic file access and domain transitions
+ * @caps: capabilities for the profile
+ * @net: network controls for the profile
+ * @rlimits: rlimits for the profile
+ *
+ * The AppArmor profile contains the basic confinement data.  Each profile
+ * has a name, and exist in a namespace.  The @name and @exec_match are
+ * used to determine profile attachment against unconfined tasks.  All other
+ * attachments are determined by in profile X transition rules.
+ *
+ * The @replacedby field is write protected by the profile lock.  Reads
+ * are assumed to be atomic, and are done without locking.
+ *
+ * Profiles have a hierachy where hats and children profiles keep
+ * a reference to their parent.
+ *
+ * Profile names can not begin with a : and can not contain the \0
+ * character.  If a profile name begins with / it will be considered when
+ * determining profile attachment on "unconfined" tasks.
+ */
+struct aa_profile {
+       struct aa_policy base;
+       struct aa_profile *parent;
+
+       struct aa_namespace *ns;
+       union {
+               struct aa_profile *replacedby;
+               const char *rename;
+       };
+       struct aa_dfa *xmatch;
+       int xmatch_len;
+       u32 sid;
+       enum audit_mode audit;
+       enum profile_mode mode;
+       u32 flags;
+       u32 path_flags;
+       int size;
+
+       unsigned long mmap_min_addr;
+
+       struct aa_file_rules file;
+       struct aa_caps caps;
+       struct aa_net net;
+       struct aa_rlimit rlimits;
+};
+
+extern struct aa_namespace *root_ns;
+extern enum profile_mode aa_g_profile_mode;
+
+void aa_add_profile(struct aa_policy *common, struct aa_profile *profile);
+
+int aa_alloc_root_ns(void);
+void aa_free_root_ns(void);
+void aa_free_namespace_kref(struct kref *kref);
+
+struct aa_namespace *aa_find_namespace(struct aa_namespace *root,
+                                      const char *name);
+
+static inline struct aa_policy *aa_get_common(struct aa_policy *c)
+{
+       if (c)
+               kref_get(&c->count);
+
+       return c;
+}
+
+/**
+ * aa_get_namespace - increment references count on @ns
+ * @ns: namespace to increment reference count of (MAYBE NULL)
+ *
+ * Returns: pointer to @ns if @ns is NULL returns NULL
+ * Requires: @ns must be held with valid refcount when called
+ */
+static inline struct aa_namespace *aa_get_namespace(struct aa_namespace *ns)
+{
+       if (ns)
+               kref_get(&(ns->base.count));
+
+       return ns;
+}
+
+/**
+ * aa_put_namespace - decrement refcount on @ns
+ * @ns: namespace to put reference to
+ *
+ * Decrement reference count to @ns and if no longer in use free it
+ */
+static inline void aa_put_namespace(struct aa_namespace *ns)
+{
+       if (ns)
+               kref_put(&ns->base.count, aa_free_namespace_kref);
+}
+
+struct aa_profile *aa_alloc_profile(const char *name);
+struct aa_profile *aa_new_null_profile(struct aa_profile *parent, int hat);
+void aa_free_profile_kref(struct kref *kref);
+struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name);
+struct aa_profile *aa_find_profile(struct aa_namespace *ns, const char *name);
+struct aa_profile *aa_match_profile(struct aa_namespace *ns, const char *name);
+
+ssize_t aa_interface_replace_profiles(void *udata, size_t size, bool add_only);
+ssize_t aa_interface_remove_profiles(char *name, size_t size);
+
+#define unconfined(X) ((X)->flags & PFLAG_UNCONFINED)
+
+/**
+ * aa_newest_version - find the newest version of @profile
+ * @profile: the profile to check for newer versions of (NOT NULL)
+ *
+ * Returns: newest version of @profile, if @profile is the newest version
+ *          return @profile.
+ *
+ * NOTE: the profile returned is not refcounted, The refcount on @profile
+ * must be held until the caller decides what to do with the returned newest
+ * version.
+ */
+static inline struct aa_profile *aa_newest_version(struct aa_profile *profile)
+{
+       if (unlikely(profile && profile->replacedby))
+               for (; profile->replacedby; profile = profile->replacedby) ;
+
+       return profile;
+}
+
+/**
+ * aa_get_profile - increment refcount on profile @p
+ * @p: profile  (MAYBE NULL)
+ *
+ * Returns: pointer to @p if @p is NULL will return NULL
+ * Requires: @p must be held with valid refcount when called
+ */
+static inline struct aa_profile *aa_get_profile(struct aa_profile *p)
+{
+       if (p)
+               kref_get(&(p->base.count));
+
+       return p;
+}
+
+/**
+ * aa_put_profile - decrement refcount on profile @p
+ * @p: profile  (MAYBE NULL)
+ */
+static inline void aa_put_profile(struct aa_profile *p)
+{
+       if (p)
+               kref_put(&p->base.count, aa_free_profile_kref);
+}
+
+static inline int AUDIT_MODE(struct aa_profile *profile)
+{
+       if (aa_g_audit != AUDIT_NORMAL)
+               return aa_g_audit;
+       if (profile)
+               return profile->audit;
+       return AUDIT_NORMAL;
+}
+
+#endif /* __AA_POLICY_H */
diff --git a/security/apparmor/include/policy_unpack.h b/security/apparmor/include/policy_unpack.h
new file mode 100644
index 0000000..5605a3e
--- /dev/null
+++ b/security/apparmor/include/policy_unpack.h
@@ -0,0 +1,30 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor policy loading interface function definitions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __POLICY_INTERFACE_H
+#define __POLICY_INTERFACE_H
+
+struct aa_audit_iface {
+       struct aa_audit base;
+
+       const char *name;
+       const char *name2;
+       long pos;
+};
+
+int aa_audit_iface(struct aa_audit_iface *sa);
+struct aa_profile *aa_unpack(void *udata, size_t size,
+                            struct aa_audit_iface *sa);
+
+#endif /* __POLICY_INTERFACE_H */
diff --git a/security/apparmor/include/procattr.h b/security/apparmor/include/procattr.h
new file mode 100644
index 0000000..6c6f271
--- /dev/null
+++ b/security/apparmor/include/procattr.h
@@ -0,0 +1,26 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor /proc/<pid>/attr/ interface function defintions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_PROCATTR_H
+#define __AA_PROCATTR_H
+
+#define AA_DO_TEST 1
+#define AA_ONEXEC  1
+
+int aa_getprocattr(struct aa_profile *profile, char **string);
+int aa_setprocattr_changehat(char *args, size_t size, int test);
+int aa_setprocattr_changeprofile(char *fqname, int onexec, int test);
+int aa_setprocattr_permipc(char *fqname);
+
+#endif /* __AA_PROCATTR_H */
diff --git a/security/apparmor/include/resource.h b/security/apparmor/include/resource.h
new file mode 100644
index 0000000..e8fc079
--- /dev/null
+++ b/security/apparmor/include/resource.h
@@ -0,0 +1,45 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor resource limits function defintions.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_RESOURCE_H
+#define __AA_RESOURCE_H
+
+#include <linux/resource.h>
+#include <linux/sched.h>
+
+struct aa_profile;
+
+/* struct aa_rlimit - rlimits settings for the profile
+ * @mask: which hard limits to set
+ * @limits: rlimit values that override task limits
+ *
+ * AppArmor rlimits are used to set confined task rlimits.  Only the
+ * limits specified in @mask will be controlled by apparmor.
+ */
+struct aa_rlimit {
+       unsigned int mask;
+       struct rlimit limits[RLIM_NLIMITS];
+};
+
+int aa_task_setrlimit(struct aa_profile *profile, unsigned int resource,
+                     struct rlimit *new_rlim);
+
+void __aa_transition_rlimits(struct aa_profile *old, struct aa_profile *new);
+
+static inline void aa_free_rlimit_rules(struct aa_rlimit *rlims)
+{
+       /* NOP */
+}
+
+#endif /* __AA_RESOURCE_H */
diff --git a/security/apparmor/include/sid.h b/security/apparmor/include/sid.h
new file mode 100644
index 0000000..020db35
--- /dev/null
+++ b/security/apparmor/include/sid.h
@@ -0,0 +1,24 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor security identifier (sid) definitions
+ *
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#ifndef __AA_SID_H
+#define __AA_SID_H
+
+#include <linux/types.h>
+
+struct aa_profile;
+
+u32 aa_alloc_sid(void);
+void aa_free_sid(u32 sid);
+
+#endif /* __AA_SID_H */
diff --git a/security/apparmor/ipc.c b/security/apparmor/ipc.c
new file mode 100644
index 0000000..dbad011
--- /dev/null
+++ b/security/apparmor/ipc.c
@@ -0,0 +1,124 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor ipc mediation
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/gfp.h>
+#include <linux/ptrace.h>
+
+#include "include/audit.h"
+#include "include/capability.h"
+#include "include/context.h"
+#include "include/policy.h"
+
+struct aa_audit_ptrace {
+       struct aa_audit base;
+
+       pid_t tracer, tracee;
+};
+
+/* call back to audit ptrace fields */
+static void audit_cb(struct audit_buffer *ab, struct aa_audit *va)
+{
+       struct aa_audit_ptrace *sa = container_of(va, struct aa_audit_ptrace,
+                                                 base);
+       audit_log_format(ab, " tracer=%d tracee=%d", sa->tracer, sa->tracee);
+}
+
+/**
+ * aa_audit_ptrace - do auditing for ptrace
+ * @profile: profile being enforced  (NOT NULL)
+ * @sa: audit structure  (NOT NULL)
+ *
+ * Returns: %0 or error code
+ */
+static int aa_audit_ptrace(struct aa_profile *profile,
+                          struct aa_audit_ptrace *sa)
+{
+       return aa_audit(AUDIT_APPARMOR_AUTO, profile, &sa->base, audit_cb);
+}
+
+/**
+ * aa_may_ptrace - test if tracer task can trace the tracee
+ * @tracer_task: task who will do the tracing  (NOT NULL)
+ * @tracer: profile of the task doing the tracing  (NOT NULL)
+ * @tracee: task to be traced
+ * @mode: whether PTRACE_MODE_READ || PTRACE_MODE_ATTACH
+ *
+ * Returns: %0 else error code if permission denied or error
+ */
+int aa_may_ptrace(struct task_struct *tracer_task, struct aa_profile *tracer,
+                 struct aa_profile *tracee, unsigned int mode)
+{
+       /* TODO: currently only based on capability, not extended ptrace
+        *       rules,
+        *       Test mode for PTRACE_MODE_READ || PTRACE_MODE_ATTACH
+        */
+
+       if (!tracer || tracer == tracee)
+               return 0;
+       /* log this capability request */
+       return aa_capable(tracer_task, tracer, CAP_SYS_PTRACE, 1);
+}
+
+/**
+ * aa_ptrace - do ptrace permission check and auditing
+ * @tracer: task doing the tracing
+ * @tracee: task being traced
+ * @mode: ptrace mode either PTRACE_MODE_READ || PTRACE_MODE_ATTACH
+ *
+ * Returns: %0 else error code if permission denied or error
+ */
+int aa_ptrace(struct task_struct *tracer, struct task_struct *tracee,
+             unsigned int mode)
+{
+       /*
+        * tracer can ptrace tracee when
+        * - tracer is unconfined ||
+        * - tracer & tracee are in the same namespace &&
+        *   - tracer is in complain mode
+        *   - tracer has rules allowing it to trace tracee currently this is:
+        *       - confined by the same profile ||
+        *       - tracer profile has CAP_SYS_PTRACE
+        */
+
+       struct aa_profile *tracer_p;
+       /* cred released below */
+       const struct cred *cred = get_task_cred(tracer);
+       int error = 0;
+       tracer_p = aa_cred_profile(cred);
+
+       if (!unconfined(tracer_p)) {
+               struct aa_audit_ptrace sa = {
+                       .base.operation = "ptrace",
+                       .base.gfp_mask = GFP_ATOMIC,
+                       .tracer = tracer->pid,
+                       .tracee = tracee->pid,
+               };
+               /* FIXME: different namespace restriction can be lifted
+                * if, namespace are matched to AppArmor namespaces
+                */
+               struct aa_profile *tracee_p;
+               /* lcred released below */
+               struct cred *lcred = get_task_cred(tracee);
+               tracee_p = aa_cred_profile(lcred);
+
+               sa.base.error = aa_may_ptrace(tracer, tracer_p, tracee_p, mode);
+               sa.base.error = aa_audit_ptrace(tracer_p, &sa);
+
+               put_cred(lcred);
+               error = sa.base.error;
+       }
+       put_cred(cred);
+
+       return error;
+}
diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c
new file mode 100644
index 0000000..1e18a44
--- /dev/null
+++ b/security/apparmor/lib.c
@@ -0,0 +1,85 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains basic common functions used in AppArmor
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/slab.h>
+#include <linux/string.h>
+
+#include "include/audit.h"
+
+
+/**
+ * aa_split_fqname - split a fqname into a profile and namespace name
+ * @fqname: a full qualified name in namespace profile format
+ * @ns_name: pointer to portion of the string containing the ns name
+ *
+ * Returns: profile name or NULL if one is not specified
+ *
+ * Split a namespace name from a profile name (see policy.c for naming
+ * description).  If a portion of the name is missing it returns NULL for
+ * that portion.
+ *
+ * NOTE: may modifiy the @fqname string.  The pointers returned point
+ *       into the @fqname string.
+ */
+char *aa_split_fqname(char *fqname, char **ns_name)
+{
+       char *name = strim(fqname);
+
+       *ns_name = NULL;
+       if (name[0] == ':') {
+               char *split = strchr(&name[1], ':');
+               if (split) {
+                       /* overwrite ':' with \0 */
+                       *split = 0;
+                       name = skip_spaces(split + 1);
+               } else
+                       /* a ns name without a following profile is allowed */
+                       name = NULL;
+               *ns_name = &name[1];
+       }
+       if (name && *name == 0)
+               name = NULL;
+
+       return name;
+}
+
+/**
+ * aa_strneq - compare null terminated @str to a non null terminated substring
+ * @str: a null terminated string
+ * @sub: a substring, not necessarily null terminated
+ * @len: length of @sub to compare
+ *
+ * The @str string must be full consumed for this to be considered a match
+ */
+bool aa_strneq(const char *str, const char *sub, int len)
+{
+       int res = strncmp(str, sub, len);
+       if (res)
+               return 0;
+       if (str[len] == 0)
+               return 1;
+       return 0;
+}
+
+void aa_info_message(const char *str)
+{
+       struct aa_audit sa = {
+               .gfp_mask = GFP_KERNEL,
+               .info = str,
+       };
+       printk(KERN_INFO "AppArmor: %s\n", str);
+       if (audit_enabled)
+               aa_audit(AUDIT_APPARMOR_STATUS, NULL, &sa, NULL);
+}
+
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
new file mode 100644
index 0000000..a0ab74b
--- /dev/null
+++ b/security/apparmor/lsm.c
@@ -0,0 +1,1085 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor LSM hooks.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/security.h>
+#include <linux/moduleparam.h>
+#include <linux/mm.h>
+#include <linux/mman.h>
+#include <linux/mount.h>
+#include <linux/namei.h>
+#include <linux/ptrace.h>
+#include <linux/ctype.h>
+#include <linux/sysctl.h>
+#include <linux/audit.h>
+#include <net/sock.h>
+
+#include "include/apparmor.h"
+#include "include/apparmorfs.h"
+#include "include/audit.h"
+#include "include/capability.h"
+#include "include/context.h"
+#include "include/file.h"
+#include "include/ipc.h"
+#include "include/net.h"
+#include "include/path.h"
+#include "include/policy.h"
+#include "include/procattr.h"
+
+/* Flag indicating whether initialization completed */
+int apparmor_initialized;
+
+/*
+ * LSM hook functions
+ */
+
+/*
+ * free the associated aa_task_cxt and put its profiles
+ */
+static void apparmor_cred_free(struct cred *cred)
+{
+       aa_free_task_context(cred->security);
+       cred->security = NULL;
+}
+
+/*
+ * allocate the apparmor part of blank credentials
+ */
+static int apparmor_cred_alloc_blank(struct cred *cred, gfp_t gfp)
+{
+       /* freed by apparmor_cred_free */
+       struct aa_task_cxt *cxt = aa_alloc_task_context(gfp);
+       if (!cxt)
+               return -ENOMEM;
+
+       cred->security = cxt;
+       return 0;
+}
+
+/*
+ * prepare new aa_task_cxt for modification by prepare_cred block
+ */
+static int apparmor_cred_prepare(struct cred *new, const struct cred *old,
+                                gfp_t gfp)
+{
+       /* freed by apparmor_cred_free */
+       struct aa_task_cxt *cxt = aa_alloc_task_context(gfp);
+       if (!cxt)
+               return -ENOMEM;
+
+       aa_dup_task_context(cxt, old->security);
+       new->security = cxt;
+       return 0;
+}
+
+/*
+ * transfer the apparmor data to a blank set of creds
+ */
+static void apparmor_cred_transfer(struct cred *new, const struct cred *old)
+{
+       const struct aa_task_cxt *old_cxt = old->security;
+       struct aa_task_cxt *new_cxt = new->security;
+
+       aa_dup_task_context(new_cxt, old_cxt);
+}
+
+static int apparmor_ptrace_access_check(struct task_struct *child,
+                                       unsigned int mode)
+{
+       int rc;
+
+       rc = cap_ptrace_access_check(child, mode);
+       if (rc)
+               return rc;
+
+       return aa_ptrace(current, child, mode);
+}
+
+static int apparmor_ptrace_traceme(struct task_struct *parent)
+{
+       return aa_ptrace(parent, current, PTRACE_MODE_ATTACH);
+}
+
+/* Derived from security/commoncap.c:cap_capget */
+static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective,
+                          kernel_cap_t *inheritable, kernel_cap_t *permitted)
+{
+       struct aa_profile *profile;
+       const struct cred *cred;
+
+       rcu_read_lock();
+       cred = __task_cred(target);
+       profile = aa_cred_profile(cred);
+
+       *effective = cred->cap_effective;
+       *inheritable = cred->cap_inheritable;
+       *permitted = cred->cap_permitted;
+
+       if (!unconfined(profile))
+               *effective = cap_intersect(*effective, profile->caps.allowed);
+       rcu_read_unlock();
+
+       return 0;
+}
+
+static int apparmor_capable(struct task_struct *task, const struct cred *cred,
+                           int cap, int audit)
+{
+       struct aa_profile *profile;
+       /* cap_capable returns 0 on success, else -EPERM */
+       int error = cap_capable(task, cred, cap, audit);
+
+       profile = aa_cred_profile(cred);
+       if (!error  && !unconfined(profile))
+               error = aa_capable(task, profile, cap, audit);
+
+       return error;
+}
+
+static int apparmor_sysctl(struct ctl_table *table, int op)
+{
+       int error = 0;
+       struct aa_profile *profile = aa_current_profile();
+
+       if (!unconfined(profile)) {
+               char *buffer, *name;
+               int mask;
+
+               mask = 0;
+               if (op & 4)
+                       mask |= MAY_READ;
+               if (op & 2)
+                       mask |= MAY_WRITE;
+
+               error = -ENOMEM;
+               /* freed below */
+               buffer = (char *)__get_free_page(GFP_KERNEL);
+               if (!buffer)
+                       goto out;
+
+               /*
+                * TODO: convert this over to using a global or per
+                * namespace control instead of a hard coded /proc
+                */
+               name = sysctl_pathname(table, buffer, PAGE_SIZE);
+               if (name && name - buffer >= 5) {
+                       struct path_cond cond = { 0, S_IFREG };
+                       name -= 5;
+                       memcpy(name, "/proc", 5);
+                       error = aa_pathstr_perm(profile, "sysctl", name, mask,
+                                               &cond);
+               }
+               free_page((unsigned long)buffer);
+       }
+
+out:
+       return error;
+}
+
+/**
+ * common_perm - basic common permission check wrapper fn for paths
+ * @op: operation name  (NOT NULL)
+ * @path: path to check permission of  (NOT NULL)
+ * @mask: requested permissions mask
+ * @cond: conditional info for the permission request  (NOT NULL)
+ *
+ * Returns: %0 else error code if error or permission denied
+ */
+static int common_perm(const char *op, struct path *path, u16 mask,
+                      struct path_cond *cond)
+{
+       struct aa_profile *profile;
+       int error = 0;
+
+       profile = __aa_current_profile();
+       if (!unconfined(profile))
+               error = aa_path_perm(profile, op, path, mask, cond);
+
+       return error;
+}
+
+/**
+ * common_perm_dentry - common permission wrapper when path is dir, dentry
+ * @op: operation name  (NOT NULL)
+ * @dir: directory of the dentry  (NOT NULL)
+ * @dentry: dentry to check  (NOT NULL)
+ * @mask: requested permissions mask
+ * @cond: conditional info for the permission request  (NOT NULL)
+ *
+ * Returns: %0 else error code if error or permission denied
+ */
+static int common_perm_dentry(const char *op, struct path *dir,
+                             struct dentry *dentry, u16 mask,
+                             struct path_cond *cond)
+{
+       struct path path = { dir->mnt, dentry };
+
+       return common_perm(op, &path, mask, cond);
+}
+
+/**
+ * common_perm_rm - common permission wrapper for operations doing rm
+ * @op: operation name  (NOT NULL)
+ * @dir: directory that the dentry is in  (NOT NULL)
+ * @dentry: dentry being rm'd  (NOT NULL)
+ * @mask: requested permission mask
+ *
+ * Returns: %0 else error code if error or permission denied
+ */
+static int common_perm_rm(const char *op, struct path *dir,
+                         struct dentry *dentry, u16 mask)
+{
+       struct inode *inode = dentry->d_inode;
+       struct path_cond cond = { };
+
+       if (!dir->mnt || !inode || !mediated_filesystem(inode))
+               return 0;
+
+       cond.uid = inode->i_uid;
+       cond.mode = inode->i_mode;
+
+       return common_perm_dentry(op, dir, dentry, mask, &cond);
+}
+
+/**
+ * common_perm_create - common permission wrapper for operations doing create
+ * @op: operation name  (NOT NULL)
+ * @dir: directory that dentry will be created in  (NOT NULL)
+ * @dentry: dentry to create   (NOT NULL)
+ * @mask: request permission mask
+ * @mode: created file mode
+ *
+ * Returns: %0 else error code if error or permission denied
+ */
+static int common_perm_create(const char *op, struct path *dir,
+                             struct dentry *dentry, u16 mask, umode_t mode)
+{
+       struct path_cond cond = { current_fsuid(), mode };
+
+       if (!dir->mnt || !mediated_filesystem(dir->dentry->d_inode))
+               return 0;
+
+       return common_perm_dentry(op, dir, dentry, mask, &cond);
+}
+
+static int apparmor_path_unlink(struct path *dir, struct dentry *dentry)
+{
+       return common_perm_rm("unlink", dir, dentry, AA_MAY_DELETE);
+}
+
+static int apparmor_path_mkdir(struct path *dir, struct dentry *dentry,
+                              int mode)
+{
+       return common_perm_create("mkdir", dir, dentry, AA_MAY_CREATE, S_IFDIR);
+}
+
+static int apparmor_path_rmdir(struct path *dir, struct dentry *dentry)
+{
+       return common_perm_rm("rmdir", dir, dentry, AA_MAY_DELETE);
+}
+
+static int apparmor_path_mknod(struct path *dir, struct dentry *dentry,
+                              int mode, unsigned int dev)
+{
+       return common_perm_create("mknod", dir, dentry, AA_MAY_CREATE, mode);
+}
+
+static int apparmor_path_truncate(struct path *path, loff_t length,
+                                 unsigned int time_attrs)
+{
+       struct path_cond cond = { path->dentry->d_inode->i_uid,
+                                 path->dentry->d_inode->i_mode
+       };
+
+       if (!path->mnt || !mediated_filesystem(path->dentry->d_inode))
+               return 0;
+       return common_perm("truncate", path, MAY_WRITE, &cond);
+}
+
+static int apparmor_path_symlink(struct path *dir, struct dentry *dentry,
+                                const char *old_name)
+{
+       return common_perm_create("symlink_create", dir, dentry, AA_MAY_CREATE,
+                                 S_IFLNK);
+}
+
+static int apparmor_path_link(struct dentry *old_dentry, struct path *new_dir,
+                             struct dentry *new_dentry)
+{
+       struct aa_profile *profile;
+       int error = 0;
+
+       if (!mediated_filesystem(old_dentry->d_inode))
+               return 0;
+
+       profile = aa_current_profile();
+       if (!unconfined(profile))
+               error = aa_path_link(profile, old_dentry, new_dir, new_dentry);
+       return error;
+}
+
+static int apparmor_path_rename(struct path *old_dir, struct dentry *old_dentry,
+                               struct path *new_dir, struct dentry *new_dentry)
+{
+       struct aa_profile *profile;
+       int error = 0;
+
+       if (!mediated_filesystem(old_dentry->d_inode))
+               return 0;
+
+       profile = aa_current_profile();
+       if (!unconfined(profile)) {
+               struct path old_path = { old_dir->mnt, old_dentry };
+               struct path new_path = { new_dir->mnt, new_dentry };
+               struct path_cond cond = { old_dentry->d_inode->i_uid,
+                                         old_dentry->d_inode->i_mode
+               };
+
+               error = aa_path_perm(profile, "rename_src", &old_path,
+                                    MAY_READ | MAY_WRITE, &cond);
+               if (!error)
+                       error = aa_path_perm(profile, "rename_dest", &new_path,
+                                            AA_MAY_CREATE | MAY_WRITE, &cond);
+
+       }
+       return error;
+}
+
+static int apparmor_path_chmod(struct dentry *dentry, struct vfsmount *mnt,
+                              mode_t mode)
+{
+       struct aa_profile *profile;
+       int error = 0;
+
+       if (!mediated_filesystem(dentry->d_inode))
+               return 0;
+
+       profile = aa_current_profile();
+       if (!unconfined(profile)) {
+               struct path path = { mnt, dentry };
+               struct path_cond cond = { dentry->d_inode->i_uid,
+                                         dentry->d_inode->i_mode
+               };
+
+               error = aa_path_perm(profile, "chmod", &path, AA_MAY_CHMOD,
+                       &cond);
+       }
+
+       return error;
+}
+
+static int apparmor_path_chown(struct path *path, uid_t uid, gid_t gid)
+{
+       struct aa_profile *profile;
+       int error = 0;
+
+       if (!mediated_filesystem(path->dentry->d_inode))
+               return 0;
+
+       profile = aa_current_profile();
+       if (!unconfined(profile)) {
+               struct path_cond cond =  { path->dentry->d_inode->i_uid,
+                                          path->dentry->d_inode->i_mode
+               };
+               error = aa_path_perm(profile, "chown", path, AA_MAY_CHOWN,
+                                    &cond);
+       }
+
+       return error;
+}
+
+static int apparmor_dentry_open(struct file *file, const struct cred *cred)
+{
+       struct aa_profile *profile;
+       int error = 0;
+
+       /* If in exec, permission is handled by bprm hooks */
+       if (current->in_execve ||
+           !mediated_filesystem(file->f_path.dentry->d_inode))
+               return 0;
+
+       profile = aa_cred_profile(cred);
+       if (!unconfined(profile)) {
+               struct aa_file_cxt *fcxt = file->f_security;
+               struct inode *inode = file->f_path.dentry->d_inode;
+               struct path_cond cond = { inode->i_uid, inode->i_mode };
+
+               error = aa_path_perm(profile, "open", &file->f_path,
+                                    aa_map_file_to_perms(file), &cond);
+               /* released by aa_free_file_context */
+               fcxt->profile = aa_get_profile(profile);
+               /* todo cache actual allowed permissions */
+               fcxt->allowed = 0;
+       }
+
+       return error;
+}
+
+static int apparmor_file_alloc_security(struct file *file)
+{
+       /* freed by apparmor_file_free_security */
+       file->f_security = aa_alloc_file_context(GFP_KERNEL);
+       if (!file->f_security)
+               return -ENOMEM;
+       return 0;
+
+}
+
+static void apparmor_file_free_security(struct file *file)
+{
+       struct aa_file_cxt *cxt = file->f_security;
+
+       aa_free_file_context(cxt);
+}
+
+static int apparmor_file_permission(struct file *file, int mask)
+{
+       /*
+        * TODO: cache profiles that have revalidated?
+        */
+       struct aa_file_cxt *fcxt = file->f_security;
+       struct aa_profile *profile, *fprofile = fcxt->profile;
+       int error = 0;
+
+       if (!fprofile || !file->f_path.mnt ||
+           !mediated_filesystem(file->f_path.dentry->d_inode))
+               return 0;
+
+       profile = __aa_current_profile();
+
+#ifdef CONFIG_SECURITY_APPARMOR_COMPAT_24
+       /*
+        * AppArmor <= 2.4 revalidates files at access time instead
+        * of at exec.
+        */
+       if (!unconfined(profile) &&
+           ((fprofile != profile) || (mask & ~fcxt->allowed)))
+               error = aa_file_perm(profile, "file_perm", file, mask);
+#endif
+
+       return error;
+}
+
+static int common_file_perm(const char *op, struct file *file, u16 mask)
+{
+       const struct aa_file_cxt *fcxt = file->f_security;
+       struct aa_profile *profile, *fprofile = fcxt->profile;
+       int error = 0;
+
+       if (!fprofile || !file->f_path.mnt ||
+           !mediated_filesystem(file->f_path.dentry->d_inode))
+               return 0;
+
+       profile = aa_current_profile();
+       if (!unconfined(profile) && ((fprofile != profile) ||
+                                    (mask & ~fcxt->allowed)))
+               error = aa_file_perm(profile, op, file, mask);
+
+       return error;
+}
+
+static int apparmor_file_lock(struct file *file, unsigned int cmd)
+{
+       u16 mask = AA_MAY_LOCK;
+
+       if (cmd == F_WRLCK)
+               mask |= MAY_WRITE;
+
+       return common_file_perm("file_lock", file, mask);
+}
+
+static int common_mmap(struct file *file, const char *operation,
+                      unsigned long prot, unsigned long flags)
+{
+       struct dentry *dentry;
+       int mask = 0;
+
+       if (!file || !file->f_security)
+               return 0;
+
+       if (prot & PROT_READ)
+               mask |= MAY_READ;
+       /*
+        * Private mappings don't require write perms since they don't
+        * write back to the files
+        */
+       if ((prot & PROT_WRITE) && !(flags & MAP_PRIVATE))
+               mask |= MAY_WRITE;
+       if (prot & PROT_EXEC)
+               mask |= AA_EXEC_MMAP;
+
+       dentry = file->f_path.dentry;
+       return common_file_perm(operation, file, mask);
+}
+
+static int apparmor_file_mmap(struct file *file, unsigned long reqprot,
+                             unsigned long prot, unsigned long flags,
+                             unsigned long addr, unsigned long addr_only)
+{
+       int rc = 0;
+
+       /* do DAC check */
+       rc = cap_file_mmap(file, reqprot, prot, flags, addr, addr_only);
+       if (rc || addr_only)
+               return rc;
+
+       return common_mmap(file, "file_mmap", prot, flags);
+}
+
+static int apparmor_file_mprotect(struct vm_area_struct *vma,
+                                 unsigned long reqprot, unsigned long prot)
+{
+       return common_mmap(vma->vm_file, "file_mprotect", prot,
+                          !(vma->vm_flags & VM_SHARED) ? MAP_PRIVATE : 0);
+}
+
+static int apparmor_getprocattr(struct task_struct *task, char *name,
+                               char **value)
+{
+       int error = -ENOENT;
+       struct aa_profile *profile;
+       /* released below */
+       const struct cred *cred = get_task_cred(task);
+       struct aa_task_cxt *cxt = cred->security;
+       profile = aa_cred_profile(cred);
+
+       if (strcmp(name, "current") == 0)
+               error = aa_getprocattr(aa_newest_version(cxt->profile),
+                                      value);
+       else if (strcmp(name, "prev") == 0  && cxt->previous)
+               error = aa_getprocattr(aa_newest_version(cxt->previous),
+                                      value);
+       else if (strcmp(name, "exec") == 0 && cxt->onexec)
+               error = aa_getprocattr(aa_newest_version(cxt->onexec),
+                                      value);
+       else
+               error = -EINVAL;
+
+       put_cred(cred);
+
+       return error;
+}
+
+static int apparmor_setprocattr(struct task_struct *task, char *name,
+                               void *value, size_t size)
+{
+       char *command, *args;
+       size_t arg_size;
+       int error;
+
+       if (size == 0 || size >= PAGE_SIZE)
+               return -EINVAL;
+
+       /* task can only write its own attributes */
+       if (current != task)
+               return -EACCES;
+
+       args = value;
+       args[size] = '\0';
+       args = strim(args);
+       command = strsep(&args, " ");
+       if (!args)
+               return -EINVAL;
+       args = skip_spaces(args);
+       if (!*args)
+               return -EINVAL;
+
+       arg_size = size - (args - (char *) value);
+       if (strcmp(name, "current") == 0) {
+               if (strcmp(command, "changehat") == 0) {
+                       error = aa_setprocattr_changehat(args, arg_size,
+                                                        !AA_DO_TEST);
+               } else if (strcmp(command, "permhat") == 0) {
+                       error = aa_setprocattr_changehat(args, arg_size,
+                                                        AA_DO_TEST);
+               } else if (strcmp(command, "changeprofile") == 0) {
+                       error = aa_setprocattr_changeprofile(args, !AA_ONEXEC,
+                                                            !AA_DO_TEST);
+               } else if (strcmp(command, "permprofile") == 0) {
+                       error = aa_setprocattr_changeprofile(args, !AA_ONEXEC,
+                                                            AA_DO_TEST);
+               } else if (strcmp(command, "permipc") == 0) {
+                       error = aa_setprocattr_permipc(args);
+               } else {
+                       struct aa_audit sa = {
+                               .operation = "setprocattr",
+                               .gfp_mask = GFP_KERNEL,
+                               .info = name,
+                               .error = -EINVAL,
+                       };
+                       return aa_audit(AUDIT_APPARMOR_DENIED, NULL, &sa, NULL);
+               }
+       } else if (strcmp(name, "exec") == 0) {
+               error = aa_setprocattr_changeprofile(args, AA_ONEXEC,
+                                                    !AA_DO_TEST);
+       } else {
+               /* only support the "current" and "exec" process attributes */
+               return -EINVAL;
+       }
+       if (!error)
+               error = size;
+       return error;
+}
+
+static int apparmor_task_setrlimit(unsigned int resource,
+                                  struct rlimit *new_rlim)
+{
+       struct aa_profile *profile = aa_current_profile();
+       int error = 0;
+
+       if (!unconfined(profile))
+               error = aa_task_setrlimit(profile, resource, new_rlim);
+
+       return error;
+}
+
+static int apparmor_socket_create(int family, int type, int protocol, int kern)
+{
+       struct aa_profile *profile;
+       int error = 0;
+
+       if (kern)
+               return 0;
+
+       profile = __aa_current_profile();
+       if (!unconfined(profile))
+               error = aa_net_perm(profile, "socket_create", family,
+                                   type, protocol);
+       return error;
+}
+
+static int apparmor_socket_post_create(struct socket *sock, int family,
+                                      int type, int protocol, int kern)
+{
+       struct sock *sk = sock->sk;
+
+       if (kern)
+               return 0;
+
+       return aa_revalidate_sk(sk, "socket_post_create");
+}
+
+static int apparmor_socket_bind(struct socket *sock,
+                               struct sockaddr *address, int addrlen)
+{
+       struct sock *sk = sock->sk;
+
+       return aa_revalidate_sk(sk, "socket_bind");
+}
+
+static int apparmor_socket_connect(struct socket *sock,
+                                  struct sockaddr *address, int addrlen)
+{
+       struct sock *sk = sock->sk;
+
+       return aa_revalidate_sk(sk, "socket_connect");
+}
+
+static int apparmor_socket_listen(struct socket *sock, int backlog)
+{
+       struct sock *sk = sock->sk;
+
+       return aa_revalidate_sk(sk, "socket_listen");
+}
+
+static int apparmor_socket_accept(struct socket *sock, struct socket *newsock)
+{
+       struct sock *sk = sock->sk;
+
+       return aa_revalidate_sk(sk, "socket_accept");
+}
+
+static int apparmor_socket_sendmsg(struct socket *sock,
+                                  struct msghdr *msg, int size)
+{
+       struct sock *sk = sock->sk;
+
+       return aa_revalidate_sk(sk, "socket_sendmsg");
+}
+
+static int apparmor_socket_recvmsg(struct socket *sock,
+                                  struct msghdr *msg, int size, int flags)
+{
+       struct sock *sk = sock->sk;
+
+       return aa_revalidate_sk(sk, "socket_recvmsg");
+}
+
+static int apparmor_socket_getsockname(struct socket *sock)
+{
+       struct sock *sk = sock->sk;
+
+       return aa_revalidate_sk(sk, "socket_getsockname");
+}
+
+static int apparmor_socket_getpeername(struct socket *sock)
+{
+       struct sock *sk = sock->sk;
+
+       return aa_revalidate_sk(sk, "socket_getpeername");
+}
+
+static int apparmor_socket_getsockopt(struct socket *sock, int level,
+                                     int optname)
+{
+       struct sock *sk = sock->sk;
+
+       return aa_revalidate_sk(sk, "socket_getsockopt");
+}
+
+static int apparmor_socket_setsockopt(struct socket *sock, int level,
+                                     int optname)
+{
+       struct sock *sk = sock->sk;
+
+       return aa_revalidate_sk(sk, "socket_setsockopt");
+}
+
+static int apparmor_socket_shutdown(struct socket *sock, int how)
+{
+       struct sock *sk = sock->sk;
+
+       return aa_revalidate_sk(sk, "socket_shutdown");
+}
+
+static struct security_operations apparmor_ops = {
+       .name =                         "apparmor",
+
+       .ptrace_access_check =          apparmor_ptrace_access_check,
+       .ptrace_traceme =               apparmor_ptrace_traceme,
+       .capget =                       apparmor_capget,
+       .sysctl =                       apparmor_sysctl,
+       .capable =                      apparmor_capable,
+
+       .path_link =                    apparmor_path_link,
+       .path_unlink =                  apparmor_path_unlink,
+       .path_symlink =                 apparmor_path_symlink,
+       .path_mkdir =                   apparmor_path_mkdir,
+       .path_rmdir =                   apparmor_path_rmdir,
+       .path_mknod =                   apparmor_path_mknod,
+       .path_rename =                  apparmor_path_rename,
+       .path_chmod =                   apparmor_path_chmod,
+       .path_chown =                   apparmor_path_chown,
+       .path_truncate =                apparmor_path_truncate,
+       .dentry_open =                  apparmor_dentry_open,
+
+       .file_permission =              apparmor_file_permission,
+       .file_alloc_security =          apparmor_file_alloc_security,
+       .file_free_security =           apparmor_file_free_security,
+       .file_mmap =                    apparmor_file_mmap,
+       .file_mprotect =                apparmor_file_mprotect,
+       .file_lock =                    apparmor_file_lock,
+
+       .getprocattr =                  apparmor_getprocattr,
+       .setprocattr =                  apparmor_setprocattr,
+
+       .socket_create =                apparmor_socket_create,
+       .socket_post_create =           apparmor_socket_post_create,
+       .socket_bind =                  apparmor_socket_bind,
+       .socket_connect =               apparmor_socket_connect,
+       .socket_listen =                apparmor_socket_listen,
+       .socket_accept =                apparmor_socket_accept,
+       .socket_sendmsg =               apparmor_socket_sendmsg,
+       .socket_recvmsg =               apparmor_socket_recvmsg,
+       .socket_getsockname =           apparmor_socket_getsockname,
+       .socket_getpeername =           apparmor_socket_getpeername,
+       .socket_getsockopt =            apparmor_socket_getsockopt,
+       .socket_setsockopt =            apparmor_socket_setsockopt,
+       .socket_shutdown =              apparmor_socket_shutdown,
+
+       .cred_alloc_blank =             apparmor_cred_alloc_blank,
+       .cred_free =                    apparmor_cred_free,
+       .cred_prepare =                 apparmor_cred_prepare,
+       .cred_transfer =                apparmor_cred_transfer,
+
+       .bprm_set_creds =               apparmor_bprm_set_creds,
+       .bprm_committing_creds =        apparmor_bprm_committing_creds,
+       .bprm_committed_creds =         apparmor_bprm_committed_creds,
+       .bprm_secureexec =              apparmor_bprm_secureexec,
+
+       .task_setrlimit =               apparmor_task_setrlimit,
+};
+
+/*
+ * AppArmor sysfs module parameters
+ */
+
+static int param_set_aabool(const char *val, struct kernel_param *kp);
+static int param_get_aabool(char *buffer, struct kernel_param *kp);
+#define param_check_aabool(name, p) __param_check(name, p, int)
+
+static int param_set_aauint(const char *val, struct kernel_param *kp);
+static int param_get_aauint(char *buffer, struct kernel_param *kp);
+#define param_check_aauint(name, p) __param_check(name, p, int)
+
+static int param_set_aalockpolicy(const char *val, struct kernel_param *kp);
+static int param_get_aalockpolicy(char *buffer, struct kernel_param *kp);
+#define param_check_aalockpolicy(name, p) __param_check(name, p, int)
+
+static int param_set_audit(const char *val, struct kernel_param *kp);
+static int param_get_audit(char *buffer, struct kernel_param *kp);
+#define param_check_audit(name, p) __param_check(name, p, int)
+
+static int param_set_mode(const char *val, struct kernel_param *kp);
+static int param_get_mode(char *buffer, struct kernel_param *kp);
+#define param_check_mode(name, p) __param_check(name, p, int)
+
+/* Flag values, also controllable via /sys/module/apparmor/parameters
+ * We define special types as we want to do additional mediation.
+ */
+
+/* AppArmor global enforcement switch - complain, enforce, kill */
+enum profile_mode aa_g_profile_mode = APPARMOR_ENFORCE;
+module_param_call(mode, param_set_mode, param_get_mode,
+                 &aa_g_profile_mode, S_IRUSR | S_IWUSR);
+
+/* Debug mode */
+int aa_g_debug;
+module_param_named(debug, aa_g_debug, aabool, S_IRUSR | S_IWUSR);
+
+/* Audit mode */
+enum audit_mode aa_g_audit;
+module_param_call(audit, param_set_audit, param_get_audit,
+                 &aa_g_audit, S_IRUSR | S_IWUSR);
+
+/* Determines if audit header is included in audited messages.  This
+ * provides more context if the audit daemon is not running
+ */
+int aa_g_audit_header;
+module_param_named(audit_header, aa_g_audit_header, aabool,
+                  S_IRUSR | S_IWUSR);
+
+/* lock out loading/removal of policy
+ * TODO: add in at boot loading of policy, which is the only way to
+ *       load policy, if lock_policy is set
+ */
+int aa_g_lock_policy;
+module_param_named(lock_policy, aa_g_lock_policy, aalockpolicy,
+                  S_IRUSR | S_IWUSR);
+
+/* Syscall logging mode */
+int aa_g_logsyscall;
+module_param_named(logsyscall, aa_g_logsyscall, aabool, S_IRUSR | S_IWUSR);
+
+/* Maximum pathname length before accesses will start getting rejected */
+unsigned int aa_g_path_max = 2 * PATH_MAX;
+module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR | S_IWUSR);
+
+/* Determines how paranoid loading of policy is and how much verification
+ * on the loaded policy is done.
+ */
+int aa_g_paranoid_load = 1;
+module_param_named(paranoid_load, aa_g_paranoid_load, aabool,
+                  S_IRUSR | S_IWUSR);
+
+/* Boot time disable flag */
+static unsigned int apparmor_enabled = CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE;
+module_param_named(enabled, apparmor_enabled, aabool, S_IRUSR);
+
+static int __init apparmor_enabled_setup(char *str)
+{
+       unsigned long enabled;
+       int error = strict_strtoul(str, 0, &enabled);
+       if (!error)
+               apparmor_enabled = enabled ? 1 : 0;
+       return 1;
+}
+
+__setup("apparmor=", apparmor_enabled_setup);
+
+/* set global flag turning off the ability to load policy */
+static int param_set_aalockpolicy(const char *val, struct kernel_param *kp)
+{
+       if (!capable(CAP_MAC_ADMIN))
+               return -EPERM;
+       if (aa_g_lock_policy)
+               return -EACCES;
+       return param_set_bool(val, kp);
+}
+
+static int param_get_aalockpolicy(char *buffer, struct kernel_param *kp)
+{
+       if (!capable(CAP_MAC_ADMIN))
+               return -EPERM;
+       return param_get_bool(buffer, kp);
+}
+
+static int param_set_aabool(const char *val, struct kernel_param *kp)
+{
+       if (!capable(CAP_MAC_ADMIN))
+               return -EPERM;
+       return param_set_bool(val, kp);
+}
+
+static int param_get_aabool(char *buffer, struct kernel_param *kp)
+{
+       if (!capable(CAP_MAC_ADMIN))
+               return -EPERM;
+       return param_get_bool(buffer, kp);
+}
+
+static int param_set_aauint(const char *val, struct kernel_param *kp)
+{
+       if (!capable(CAP_MAC_ADMIN))
+               return -EPERM;
+       return param_set_uint(val, kp);
+}
+
+static int param_get_aauint(char *buffer, struct kernel_param *kp)
+{
+       if (!capable(CAP_MAC_ADMIN))
+               return -EPERM;
+       return param_get_uint(buffer, kp);
+}
+
+static int param_get_audit(char *buffer, struct kernel_param *kp)
+{
+       if (!capable(CAP_MAC_ADMIN))
+               return -EPERM;
+
+       if (!apparmor_enabled)
+               return -EINVAL;
+
+       return sprintf(buffer, "%s", audit_mode_names[aa_g_audit]);
+}
+
+static int param_set_audit(const char *val, struct kernel_param *kp)
+{
+       int i;
+       if (!capable(CAP_MAC_ADMIN))
+               return -EPERM;
+
+       if (!apparmor_enabled)
+               return -EINVAL;
+
+       if (!val)
+               return -EINVAL;
+
+       for (i = 0; i < AUDIT_MAX_INDEX; i++) {
+               if (strcmp(val, audit_mode_names[i]) == 0) {
+                       aa_g_audit = i;
+                       return 0;
+               }
+       }
+
+       return -EINVAL;
+}
+
+static int param_get_mode(char *buffer, struct kernel_param *kp)
+{
+       if (!capable(CAP_MAC_ADMIN))
+               return -EPERM;
+
+       if (!apparmor_enabled)
+               return -EINVAL;
+
+       return sprintf(buffer, "%s", profile_mode_names[aa_g_profile_mode]);
+}
+
+static int param_set_mode(const char *val, struct kernel_param *kp)
+{
+       int i;
+       if (!capable(CAP_MAC_ADMIN))
+               return -EPERM;
+
+       if (!apparmor_enabled)
+               return -EINVAL;
+
+       if (!val)
+               return -EINVAL;
+
+       for (i = 0; i < APPARMOR_NAMES_MAX_INDEX; i++) {
+               if (strcmp(val, profile_mode_names[i]) == 0) {
+                       aa_g_profile_mode = i;
+                       return 0;
+               }
+       }
+
+       return -EINVAL;
+}
+
+/*
+ * AppArmor init functions
+ */
+
+/**
+ * set_init_cxt - set a task context and profile on the first task.
+ *
+ * TODO: allow setting an alternate profile than unconfined
+ */
+static int __init set_init_cxt(void)
+{
+       struct cred *cred = (struct cred *)current->real_cred;
+       struct aa_task_cxt *cxt;
+
+       cxt = aa_alloc_task_context(GFP_KERNEL);
+       if (!cxt)
+               return -ENOMEM;
+
+       cxt->profile = aa_get_profile(root_ns->unconfined);
+       cred->security = cxt;
+
+       return 0;
+}
+
+static int __init apparmor_init(void)
+{
+       int error;
+
+       if (!apparmor_enabled || !security_module_enable(&apparmor_ops)) {
+               aa_info_message("AppArmor disabled by boot time parameter\n");
+               apparmor_enabled = 0;
+               return 0;
+       }
+
+       error = aa_alloc_root_ns();
+       if (error) {
+               AA_ERROR("Unable to allocate default profile namespace\n");
+               goto alloc_out;
+       }
+
+       error = set_init_cxt();
+       if (error) {
+               AA_ERROR("Failed to set context on init task\n");
+               goto register_security_out;
+       }
+
+       error = register_security(&apparmor_ops);
+       if (error) {
+               AA_ERROR("Unable to register AppArmor\n");
+               goto register_security_out;
+       }
+
+       /* Report that AppArmor successfully initialized */
+       apparmor_initialized = 1;
+       if (aa_g_profile_mode == APPARMOR_COMPLAIN)
+               aa_info_message("AppArmor initialized: complain mode enabled");
+       else if (aa_g_profile_mode == APPARMOR_KILL)
+               aa_info_message("AppArmor initialized: kill mode enabled");
+       else
+               aa_info_message("AppArmor initialized");
+
+       return error;
+
+register_security_out:
+       aa_free_root_ns();
+
+alloc_out:
+       aa_destroy_aafs();
+
+       apparmor_enabled = 0;
+       return error;
+
+}
+
+security_initcall(apparmor_init);
diff --git a/security/apparmor/match.c b/security/apparmor/match.c
new file mode 100644
index 0000000..677d1c2
--- /dev/null
+++ b/security/apparmor/match.c
@@ -0,0 +1,363 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor dfa based regular expression matching engine
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <linux/err.h>
+#include <linux/kref.h>
+
+#include "include/match.h"
+
+/**
+ * free_table - free a table allocated by unpack table
+ * @table: table to unpack  (MAYBE NULL)
+ */
+static void free_table(struct table_header *table)
+{
+       if (!table)
+               return;
+
+       if (is_vmalloc_addr(table))
+               vfree(table);
+       else
+               kzfree(table);
+}
+
+/**
+ * unpack_table - unpack a dfa table (one of accept, default, base, next check)
+ * @blob: data to unpack
+ * @bsize: size of blob
+ *
+ * Returns: pointer to table else NULL on failure
+ *
+ * NOTE: must be freed by free_table (not kmalloc)
+ */
+static struct table_header *unpack_table(char *blob, size_t bsize)
+{
+       struct table_header *table = NULL;
+       struct table_header th;
+       size_t tsize;
+
+       if (bsize < sizeof(struct table_header))
+               goto out;
+
+       /* loaded td_id's start at 1, subtract 1 now to avoid doing
+        * it every time we use td_id as an index
+        */
+       th.td_id = be16_to_cpu(*(u16 *) (blob)) - 1;
+       th.td_flags = be16_to_cpu(*(u16 *) (blob + 2));
+       th.td_lolen = be32_to_cpu(*(u32 *) (blob + 8));
+       blob += sizeof(struct table_header);
+
+       if (!(th.td_flags == YYTD_DATA16 || th.td_flags == YYTD_DATA32 ||
+             th.td_flags == YYTD_DATA8))
+               goto out;
+
+       tsize = table_size(th.td_lolen, th.td_flags);
+       if (bsize < tsize)
+               goto out;
+
+       /* freed by free_table */
+       table = kmalloc(tsize, GFP_KERNEL);
+       if (!table)
+               table = vmalloc(tsize);
+       if (table) {
+               *table = th;
+               if (th.td_flags == YYTD_DATA8)
+                       UNPACK_ARRAY(table->td_data, blob, th.td_lolen,
+                                    u8, byte_to_byte);
+               else if (th.td_flags == YYTD_DATA16)
+                       UNPACK_ARRAY(table->td_data, blob, th.td_lolen,
+                                    u16, be16_to_cpu);
+               else if (th.td_flags == YYTD_DATA32)
+                       UNPACK_ARRAY(table->td_data, blob, th.td_lolen,
+                                    u32, be32_to_cpu);
+               else
+                       goto fail;
+       }
+
+out:
+       return table;
+fail:
+       free_table(table);
+       return NULL;
+}
+
+/**
+ * verify_dfa - verify that all the transitions and states in the dfa tables
+ *              are in bounds.
+ * @dfa: dfa to test  (NOT NULL)
+ * @flags: flags controlling what type of accept table are acceptable
+ *
+ * Assumes dfa has gone through the first pass verification done by unpacking
+ * NOTE: this does not valid accept table values
+ *
+ * Returns: %0 else error code on failure to verify
+ */
+static int verify_dfa(struct aa_dfa *dfa, int flags)
+{
+       size_t i, state_count, trans_count;
+       int error = -EPROTO;
+
+       /* check that required tables exist */
+       if (!(dfa->tables[YYTD_ID_DEF] &&
+             dfa->tables[YYTD_ID_BASE] &&
+             dfa->tables[YYTD_ID_NXT] && dfa->tables[YYTD_ID_CHK]))
+               goto out;
+
+       /* accept.size == default.size == base.size */
+       state_count = dfa->tables[YYTD_ID_BASE]->td_lolen;
+       if (ACCEPT1_FLAGS(flags)) {
+               if (!dfa->tables[YYTD_ID_ACCEPT])
+                       goto out;
+               if (state_count != dfa->tables[YYTD_ID_ACCEPT]->td_lolen)
+                       goto out;
+       }
+       if (ACCEPT2_FLAGS(flags)) {
+               if (!dfa->tables[YYTD_ID_ACCEPT2])
+                       goto out;
+               if (state_count != dfa->tables[YYTD_ID_ACCEPT2]->td_lolen)
+                       goto out;
+       }
+       if (state_count != dfa->tables[YYTD_ID_DEF]->td_lolen)
+               goto out;
+
+       /* next.size == chk.size */
+       trans_count = dfa->tables[YYTD_ID_NXT]->td_lolen;
+       if (trans_count != dfa->tables[YYTD_ID_CHK]->td_lolen)
+               goto out;
+
+       /* if equivalence classes then its table size must be 256 */
+       if (dfa->tables[YYTD_ID_EC] &&
+           dfa->tables[YYTD_ID_EC]->td_lolen != 256)
+               goto out;
+
+       if (flags & DFA_FLAG_VERIFY_STATES) {
+               for (i = 0; i < state_count; i++) {
+                       if (DEFAULT_TABLE(dfa)[i] >= state_count)
+                               goto out;
+                       /* TODO: do check that DEF state recursion terminates */
+                       if (BASE_TABLE(dfa)[i] >= trans_count + 256)
+                               goto out;
+               }
+
+               for (i = 0; i < trans_count; i++) {
+                       if (NEXT_TABLE(dfa)[i] >= state_count)
+                               goto out;
+                       if (CHECK_TABLE(dfa)[i] >= state_count)
+                               goto out;
+               }
+       }
+
+       error = 0;
+out:
+       return error;
+}
+
+/**
+ * aa_dfa_free - free a dfa allocated by aa_dfa_unpack
+ * @dfa: the dfa to free  (MAYBE NULL)
+ *
+ * Requires: reference count to dfa == 0
+ */
+static void aa_dfa_free(struct aa_dfa *dfa)
+{
+       if (dfa) {
+               int i;
+
+               for (i = 0; i < ARRAY_SIZE(dfa->tables); i++) {
+                       free_table(dfa->tables[i]);
+                       dfa->tables[i] = NULL;
+               }
+       }
+       kfree(dfa);
+}
+
+/**
+ * aa_dfa_free_kref - free aa_dfa by kref (called by aa_put_dfa)
+ * @kr: kref callback for freeing of a dfa  (NOT NULL)
+ */
+void aa_dfa_free_kref(struct kref *kref)
+{
+       struct aa_dfa *dfa = container_of(kref, struct aa_dfa, count);
+       aa_dfa_free(dfa);
+}
+
+/**
+ * aa_dfa_unpack - unpack the binary tables of a serialized dfa
+ * @blob: aligned serialized stream of data to unpack  (NOT NULL)
+ * @size: size of data to unpack
+ * @flags: flags controlling what type of accept tables are acceptable
+ *
+ * Unpack a dfa that has been serialized.  Dfa format and information in
+ * Documentation/AppArmor/dfa.txt
+ * Assumes the dfa @blob stream has been aligned on a 8 byte boundry
+ *
+ * Returns: an unpacked dfa ready for matching or ERR_PTR on failure
+ */
+struct aa_dfa *aa_dfa_unpack(void *blob, size_t size, int flags)
+{
+       int hsize;
+       int error = -ENOMEM;
+       char *data = blob;
+       struct table_header *table = NULL;
+       struct aa_dfa *dfa = kzalloc(sizeof(struct aa_dfa), GFP_KERNEL);
+       if (!dfa)
+               goto fail;
+
+       kref_init(&dfa->count);
+
+       error = -EPROTO;
+
+       /* get dfa table set header */
+       if (size < sizeof(struct table_set_header))
+               goto fail;
+
+       if (ntohl(*(u32 *) data) != YYTH_MAGIC)
+               goto fail;
+
+       hsize = ntohl(*(u32 *) (data + 4));
+       if (size < hsize)
+               goto fail;
+
+       dfa->flags = ntohs(*(u16 *) (data + 12));
+       data += hsize;
+       size -= hsize;
+
+       while (size > 0) {
+               table = unpack_table(data, size);
+               if (!table)
+                       goto fail;
+
+               switch (table->td_id) {
+               case YYTD_ID_ACCEPT:
+                       if (!(table->td_flags & ACCEPT1_FLAGS(flags)))
+                               goto fail;
+                       break;
+               case YYTD_ID_ACCEPT2:
+                       if (!(table->td_flags & ACCEPT2_FLAGS(flags)))
+                               goto fail;
+                       break;
+               case YYTD_ID_BASE:
+                       if (table->td_flags != YYTD_DATA32)
+                               goto fail;
+                       break;
+               case YYTD_ID_DEF:
+               case YYTD_ID_NXT:
+               case YYTD_ID_CHK:
+                       if (table->td_flags != YYTD_DATA16)
+                               goto fail;
+                       break;
+               case YYTD_ID_EC:
+                       if (table->td_flags != YYTD_DATA8)
+                               goto fail;
+                       break;
+               default:
+                       goto fail;
+               }
+               /* check for duplicate table entry */
+               if (dfa->tables[table->td_id])
+                       goto fail;
+               dfa->tables[table->td_id] = table;
+               data += table_size(table->td_lolen, table->td_flags);
+               size -= table_size(table->td_lolen, table->td_flags);
+               table = NULL;
+       }
+
+       error = verify_dfa(dfa, flags);
+       if (error)
+               goto fail;
+
+       return dfa;
+
+fail:
+       free_table(table);
+       aa_dfa_free(dfa);
+       return ERR_PTR(error);
+}
+
+/**
+ * aa_dfa_match_len - traverse @dfa to find state @str stops at
+ * @dfa: the dfa to match @str against  (NOT NULL)
+ * @start: the state of the dfa to start matching in
+ * @str: the string of bytes to match against the dfa  (NOT NULL)
+ * @len: length of the string of bytes to match
+ *
+ * aa_dfa_match_len will match @str against the dfa and return the state it
+ * finished matching in. The final state can be used to look up the accepting
+ * label, or as the start state of a continuing match.
+ *
+ * This function will happily match again the 0 byte and only finishes
+ * when @len input is consumed.
+ *
+ * Returns: final state reached after input is consumed
+ */
+unsigned int aa_dfa_match_len(struct aa_dfa *dfa, unsigned int start,
+                             const char *str, int len)
+{
+       u16 *def = DEFAULT_TABLE(dfa);
+       u32 *base = BASE_TABLE(dfa);
+       u16 *next = NEXT_TABLE(dfa);
+       u16 *check = CHECK_TABLE(dfa);
+       unsigned int state = start, pos;
+
+       if (state == 0)
+               return 0;
+
+       /* current state is <state>, matching character *str */
+       if (dfa->tables[YYTD_ID_EC]) {
+               /* Equivalence class table defined */
+               u8 *equiv = EQUIV_TABLE(dfa);
+               /* default is direct to next state */
+               for (; len; len--) {
+                       pos = base[state] + equiv[(u8) *str++];
+                       if (check[pos] == state)
+                               state = next[pos];
+                       else
+                               state = def[state];
+               }
+       } else {
+               /* default is direct to next state */
+               for (; len; len--) {
+                       pos = base[state] + (u8) *str++;
+                       if (check[pos] == state)
+                               state = next[pos];
+                       else
+                               state = def[state];
+               }
+       }
+
+       return state;
+}
+
+/**
+ * aa_dfa_next_state - traverse @dfa to find state @str stops at
+ * @dfa: the dfa to match @str against  (NOT NULL)
+ * @start: the state of the dfa to start matching in
+ * @str: the null terminated string of bytes to match against the dfa (NOT NULL)
+ *
+ * aa_dfa_next_state will match @str against the dfa and return the state it
+ * finished matching in. The final state can be used to look up the accepting
+ * label, or as the start state of a continuing match.
+ *
+ * Returns: final state reached after input is consumed
+ */
+unsigned int aa_dfa_match(struct aa_dfa *dfa, unsigned int start,
+                         const char *str)
+{
+       return aa_dfa_match_len(dfa, start, str, strlen(str));
+}
diff --git a/security/apparmor/net.c b/security/apparmor/net.c
new file mode 100644
index 0000000..e9b1d1e
--- /dev/null
+++ b/security/apparmor/net.c
@@ -0,0 +1,167 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor network mediation
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include "include/apparmor.h"
+#include "include/audit.h"
+#include "include/context.h"
+#include "include/net.h"
+#include "include/policy.h"
+
+#include "af_names.h"
+
+static const char *sock_type_names[] = {
+       "unknown(0)",
+       "stream",
+       "dgram",
+       "raw",
+       "rdm",
+       "seqpacket",
+       "dccp",
+       "unknown(7)",
+       "unknown(8)",
+       "unknown(9)",
+       "packet",
+};
+
+struct aa_audit_net {
+       struct aa_audit base;
+
+       int family, type, protocol;
+
+};
+
+/* audit callback for net specific fields */
+static void audit_cb(struct audit_buffer *ab, struct aa_audit *va)
+{
+       struct aa_audit_net *sa = container_of(va, struct aa_audit_net, base);
+
+       if (sa->family || sa->type) {
+               if (address_family_names[sa->family]) {
+                       audit_log_format(ab, " family=");
+                       audit_log_string(ab, address_family_names[sa->family]);
+               } else {
+                       audit_log_format(ab, " family=\"unknown(%d)\"",
+                                        sa->family);
+               }
+               if (sock_type_names[sa->type]) {
+                       audit_log_format(ab, " sock_type=");
+                       audit_log_string(ab, sock_type_names[sa->type]);
+               } else {
+                       audit_log_format(ab, " sock_type=\"unknown(%d)\"",
+                                        sa->type);
+               }
+               audit_log_format(ab, " protocol=%d", sa->protocol);
+       }
+
+}
+
+/**
+ * aa_audit_net - audit network access
+ * @profile: profile being enforced  (NOT NULL)
+ * @sa: audit data  (NOT NULL)
+ *
+ * Returns: %0 or sa->error else other errorcode on failure
+ */
+static int aa_audit_net(struct aa_profile *profile, struct aa_audit_net *sa)
+{
+       int type = AUDIT_APPARMOR_AUTO;
+
+       if (likely(!sa->base.error)) {
+               u16 audit_mask = profile->net.audit[sa->family];
+               if (likely((AUDIT_MODE(profile) != AUDIT_ALL) &&
+                          !(1 << sa->type & audit_mask)))
+                       return 0;
+               type = AUDIT_APPARMOR_AUDIT;
+       } else {
+               u16 quiet_mask = profile->net.quiet[sa->family];
+               u16 kill_mask = 0;
+               u16 denied = (1 << sa->type) & ~quiet_mask;
+
+               if (denied & kill_mask)
+                       type = AUDIT_APPARMOR_KILL;
+
+               if ((denied & quiet_mask) &&
+                   AUDIT_MODE(profile) != AUDIT_NOQUIET &&
+                   AUDIT_MODE(profile) != AUDIT_ALL)
+                       return COMPLAIN_MODE(profile) ? 0 : sa->base.error;
+       }
+
+       return aa_audit(type, profile, &sa->base, audit_cb);
+}
+
+/**
+ * aa_net_perm - very course network access check
+ * @profile: profile being enforced  (NOT NULL)
+ * @operation: name of the operation being checked  (NOT NULL)
+ * @family: network family
+ * @type:   network type
+ * @protocol: network protocol
+ *
+ * Returns: %0 else error if permission denied
+ */
+int aa_net_perm(struct aa_profile *profile, char *operation,
+               int family, int type, int protocol)
+{
+       u16 family_mask;
+       struct aa_audit_net sa = {
+               .base.operation = operation,
+               .base.gfp_mask = GFP_KERNEL,
+               .family = family,
+               .type = type,
+               .protocol = protocol,
+       };
+
+       if ((family < 0) || (family >= AF_MAX))
+               return -EINVAL;
+
+       if ((type < 0) || (type >= SOCK_MAX))
+               return -EINVAL;
+
+       /* unix domain and netlink sockets are handled by ipc */
+       if (family == AF_UNIX || family == AF_NETLINK)
+               return 0;
+
+       family_mask = profile->net.allowed[family];
+
+       sa.base.error = (family_mask & (1 << type)) ? 0 : -EACCES;
+
+       return aa_audit_net(profile, &sa);
+}
+
+/**
+ * aa_revalidate_sk - Revalidate access to a sock
+ * @sk: sock being revalidated  (NOT NULL)
+ * @operation: name of operation being checked  (NOT NULL)
+ *
+ * Returns: %0 else error if permission denied
+ */
+int aa_revalidate_sk(struct sock *sk, char *operation)
+{
+       struct aa_profile *profile;
+       int error = 0;
+
+       /* aa_revalidate_sk should not be called from interrupt context
+        * don't mediate these calls as they are not task related
+        */
+       if (in_interrupt())
+               return 0;
+
+       profile = __aa_current_profile();
+       if (!unconfined(profile))
+               error = aa_net_perm(profile, operation,
+                                   sk->sk_family, sk->sk_type,
+                                   sk->sk_protocol);
+
+       return error;
+}
diff --git a/security/apparmor/path.c b/security/apparmor/path.c
new file mode 100644
index 0000000..81ce71d
--- /dev/null
+++ b/security/apparmor/path.c
@@ -0,0 +1,243 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor function for pathnames
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/mnt_namespace.h>
+#include <linux/mount.h>
+#include <linux/namei.h>
+#include <linux/nsproxy.h>
+#include <linux/path.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/fs_struct.h>
+
+#include "include/apparmor.h"
+#include "include/path.h"
+#include "include/policy.h"
+
+/**
+ * d_namespace_path - lookup a name associated with a given path
+ * @path: path to lookup  (NOT NULL)
+ * @buf:  buffer to store path to  (NOT NULL)
+ * @buflen: length of @buf
+ * @name: return pointer for start of path name with in @buf  (NOT NULL)
+ * @flags: flags controling path lookup
+ *
+ * Handle path name lookup.
+ *
+ * Returns: %0 else error code if path lookup fails
+ *          When no error the path name is returned in @name which points to
+ *          to a position in @buf
+ */
+static int d_namespace_path(struct path *path, char *buf, int buflen,
+                           char **name, int flags)
+{
+       struct path root, tmp;
+       char *res;
+       int deleted, connected;
+       int error = 0;
+
+       /* Get the root we want to resolve too */
+       if (flags & PATH_CHROOT_REL) {
+               /* resolve paths relative to chroot */
+               read_lock(&current->fs->lock);
+               root = current->fs->root;
+               /* released below */
+               path_get(&root);
+               read_unlock(&current->fs->lock);
+       } else {
+               /* resolve paths relative to namespace */
+               root.mnt = current->nsproxy->mnt_ns->root;
+               root.dentry = root.mnt->mnt_root;
+               /* released below */
+               path_get(&root);
+       }
+
+       spin_lock(&dcache_lock);
+       /* There is a race window between path lookup here and the
+        * need to strip the " (deleted) string that __d_path applies
+        * Detect the race and relookup the path
+        *
+        * The stripping of (deleted) is a hack that could be removed
+        * with an updated __d_path
+        */
+       do {
+               tmp = root;
+               deleted = d_unlinked(path->dentry);
+               res = __d_path(path, &tmp, buf, buflen);
+
+       } while (deleted != d_unlinked(path->dentry));
+       spin_unlock(&dcache_lock);
+
+       *name = res;
+       /* handle error conditions - and still allow a partial path to
+        * be returned.
+        */
+       if (IS_ERR(res)) {
+               error = PTR_ERR(res);
+               *name = buf;
+               goto out;
+       }
+       if (deleted) {
+               /* On some filesystems, newly allocated dentries appear to the
+                * security_path hooks as a deleted dentry except without an
+                * inode allocated.
+                *
+                * Remove the appended deleted text and return as string for
+                * normal mediation, or auditing.  The (deleted) string is
+                * guarenteed to be added in this case, so just strip it.
+                */
+               buf[buflen - 11] = 0;   /* - (len(" (deleted)") +\0) */
+
+               if (path->dentry->d_inode && !(flags & PATH_MEDIATE_DELETED)) {
+                       error = -ENOENT;
+                       goto out;
+               }
+       }
+
+       /* Determine if the path is connected to the expected root */
+       connected = tmp.dentry == root.dentry && tmp.mnt == root.mnt;
+
+       /* If the path is not connected, then remove any leading / that
+        * __d_path may have returned.
+        * Unless
+        *     specifically directed to connect the path,
+        * OR
+        *     if in a chroot and doing chroot relative paths and the path
+        *     resolves to the namespace root (would be connected outside
+        *     of chroot) and specifically directed to connect paths to
+        *     namespace root.
+        */
+       if (!connected && 
+           !(flags & PATH_CONNECT_PATH) &&
+           !((flags & PATH_CHROOT_REL) && (flags & PATH_CHROOT_NSCONNECT) &&
+             (tmp.mnt == current->nsproxy->mnt_ns->root &&
+              tmp.dentry == current->nsproxy->mnt_ns->root->mnt_root))) {
+               /* disconnected path, don't return pathname starting with '/' */
+               error = -ESTALE;
+               if (*res == '/')
+                       *name = res + 1;
+       }
+
+out:
+       path_put(&root);
+
+       return error;
+}
+
+/**
+ * get_name_to_buffer - get the pathname to a buffer ensure dir / is appended
+ * @path: path to get name for  (NOT NULL)
+ * @flags: flags controlling path lookup
+ * @buffer: buffer to put name in  (NOT NULL)
+ * @size: size of buffer
+ * @name: on return contains position of path name in @buffer  (NOT NULL)
+ *
+ * Returns: %0 else error on failure
+ */
+static int get_name_to_buffer(struct path *path, int flags, char *buffer,
+                             int size, char **name)
+{
+       int adjust = (flags & PATH_IS_DIR) ? 1 : 0;
+       int error = d_namespace_path(path, buffer, size - adjust, name, flags);
+
+       if (!error && (flags & PATH_IS_DIR) && (*name)[1] != '\0')
+               /*
+                * Append "/" to the pathname.  The root directory is a special
+                * case; it already ends in slash.
+                */
+               strcpy(&buffer[size - 2], "/");
+
+       return error;
+}
+
+/**
+ * aa_get_name - compute the pathname of a file
+ * @path: path the file  (NOT NULL)
+ * @flags: flags controling path name generation
+ * @buffer: buffer that aa_get_name() allocated  (NOT NULL)
+ * @name: the generated path name if !error
+ *
+ * @name is a pointer to the beginning of the pathname (which usually differs
+ * from the beginning of the buffer), or NULL.  If there is an error @name
+ * may contain a partial or invalid name that can be used for audit purposes,
+ * but it can not be used for mediation.
+ *
+ * We need PATH_IS_DIR to indicate whether the file is a directory or not
+ * because the file may not yet exist, and so we cannot check the inode's
+ * file type.
+ *
+ * Returns: %0 else error code if could retrieve name
+ */
+int aa_get_name(struct path *path, int flags, char **buffer, char **name)
+{
+       char *buf, *str = NULL;
+       int size = 256;
+       int error;
+
+       *name = NULL;
+       *buffer = NULL;
+       for (;;) {
+               /* freed by caller */
+               buf = kmalloc(size, GFP_KERNEL);
+               if (!buf)
+                       return -ENOMEM;
+
+               error = get_name_to_buffer(path, flags, buf, size, &str);
+               if (!error || (error == -ENOENT) || (error == -ESTALE))
+                       break;
+
+               kfree(buf);
+               size <<= 1;
+               if (size > aa_g_path_max)
+                       return -ENAMETOOLONG;
+       }
+       *buffer = buf;
+       *name = str;
+
+       return error;
+}
+
+/**
+ * sysctl_pathname - generate a pathname for a sysctl
+ * @table: sysctl name table  (NOT NULL)
+ * @buffer: buffer to put name in  (NOT NULL)
+ * @buflen: length of @buffer
+ *
+ * Returns: sysctl path name in @buffer or NULL on error
+ */
+char *sysctl_pathname(struct ctl_table *table, char *buffer, int buflen)
+{
+       if (buflen < 1)
+               return NULL;
+       buffer += --buflen;
+       *buffer = '\0';
+
+       while (table) {
+               int namelen = strlen(table->procname);
+
+               if (buflen < namelen + 1)
+                       return NULL;
+               buflen -= namelen + 1;
+               buffer -= namelen;
+               memcpy(buffer, table->procname, namelen);
+               *--buffer = '/';
+               table = table->parent;
+       }
+       if (buflen < 4)
+               return NULL;
+       buffer -= 4;
+       memcpy(buffer, "/sys", 4);
+
+       return buffer;
+}
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
new file mode 100644
index 0000000..c4532d6
--- /dev/null
+++ b/security/apparmor/policy.c
@@ -0,0 +1,1100 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor policy manipulation functions
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ *
+ *
+ * AppArmor policy is based around profiles, which contain the rules a
+ * task is confined by.  Every task in the sytem has a profile attached
+ * to it determined either by matching "unconfined" tasks against the
+ * visible set of profiles or by following a profiles attachment rules.
+ *
+ * Each profile exists in a profile namespace which is a container of
+ * visible profiles.  Each namespace contains a special "unconfined" profile,
+ * which doesn't enforce any confinement on a task beyond DAC.
+ *
+ * Namespace and profile names can be written together in either
+ * of two syntaxes.
+ *     :namespace:profile - used by kernel interfaces for easy detection
+ *     namespace://profile - used by policy
+ *
+ * Profile names can not start with : or @ or ^ and may not contain \0
+ * 
+ * Reserved profile names
+ *     unconfined - special automatically generated unconfined profile
+ *     inherit - special name to indicate profile inheritance
+ *     null-XXXX-YYYY - special automically generated learning profiles
+ *
+ * Namespace names may not start with / or @ and may not contain \0 or :
+ * Reserved namespace namespace
+ *     user-XXXX - user defined profiles
+ *
+ * a // in a profile or namespace name indicates a hierarcical name with the
+ * name before the // being the parent and the name after the child.
+ *
+ * Profile and namespace hierachies serve two different but similar purposes.
+ * The namespace contains the set of visible profiles that are considered
+ * for attachment.  The hierarchy of namespaces allows for virtualizing
+ * the namespace so that for example a chroot can have its own set of profiles
+ * which may define some local user namespaces.
+ * The profile hierachy severs two distinct purposes,
+ * -  it allows for sub profiles or hats, which allows an application to run
+ *    subprograms under its own profile with different restriction than it
+ *    self, and not have it use the system profile.
+ *    eg. if a mail program starts an editor, the policy might make the
+ *        restrictions tighter on the editor tighter than the mail program,
+ *        and definitely different than general editor restrictions
+ * - it allows for binary hierarchy of profiles, so that execution history
+ *   is preserved.  This feature isn't exploited by AppArmor reference policy
+ *   but is allowed.  NOTE: this is currently suboptimal because profile
+ *   aliasing is not currently implemented so that a profile for each
+ *   level must be defined.
+ *   eg. /bin/bash///bin/ls as a name would indicate /bin/ls was started
+ *       from /bin/bash
+ *
+ *   A profile or namespace name that can contain one or more // seperators
+ *   is refered to as an hname (hierarchical).
+ *   eg.  /bin/bash//bin/ls
+ *
+ *   An fqname is a name that may contain both namespace and profile hnames.
+ *   eg. :ns:/bin/bash//bin/ls
+ *
+ * NOTES:
+ *   - locking of profile lists is currently fairly coarse.  All profile
+ *     lists within a namespace use the namespace lock.
+ * FIXME: move profile lists to using rcu_lists
+ */
+
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/string.h>
+
+#include "include/apparmor.h"
+#include "include/capability.h"
+#include "include/context.h"
+#include "include/file.h"
+#include "include/ipc.h"
+#include "include/match.h"
+#include "include/path.h"
+#include "include/policy.h"
+#include "include/policy_unpack.h"
+#include "include/resource.h"
+#include "include/sid.h"
+
+
+/* root profile namespace */
+struct aa_namespace *root_ns;
+
+const char *profile_mode_names[] = {
+       "enforce",
+       "complain",
+       "kill",
+};
+
+/**
+ * hname_tail - find the last component of an hname
+ * @name: hname to find the tail component of  (NOT NULL)
+ *
+ * Returns: the tail name component of an hname
+ */
+static const char *hname_tail(const char *hname)
+{
+       char *split;
+       hname = strim((char *)hname);
+       for (split = strstr(hname, "//"); split; split = strstr(hname, "//"))
+               hname = split + 2;
+
+       return hname;
+}
+
+/**
+ * policy_init - initialize a policy structure
+ * @policy: policy to initialize  (NOT NULL)
+ * @name: name of the policy, init will make a copy of it  (NOT NULL)
+ */
+static bool policy_init(struct aa_policy *policy, const char *name)
+{
+       /* freed by policy_free */
+       policy->hname = kstrdup(name, GFP_KERNEL);
+       if (!policy->hname)
+               return 0;
+       /* base.name is a substring of fqname */
+       policy->name = (char *)hname_tail(policy->hname);
+
+       INIT_LIST_HEAD(&policy->list);
+       INIT_LIST_HEAD(&policy->profiles);
+       kref_init(&policy->count);
+
+       return 1;
+}
+
+/**
+ * policy_destroy - free the elements referenced by @policy
+ * @policy: policy that is to have its elements freed  (NOT NULL)
+ */
+static void policy_destroy(struct aa_policy *policy)
+{
+       /* still contains profiles -- invalid */
+       if (!list_empty(&policy->profiles)) {
+               AA_ERROR("%s: internal error, "
+                        "policy '%s' still contains profiles\n",
+                        __func__, policy->name);
+               BUG();
+       }
+       if (!list_empty(&policy->list)) {
+               AA_ERROR("%s: internal error, policy '%s' still on list\n",
+                        __func__, policy->name);
+               BUG();
+       }
+
+       /* don't free name as its a subset of hname */
+       kzfree(policy->hname);
+}
+
+/**
+ * __policy_find - find a policy by @name on a policy list
+ * @head: list to search  (NOT NULL)
+ * @name: name to search for  (NOT NULL)
+ *
+ * Requires: correct locks for the @head list be held
+ *
+ * Returns: policy that match @name or NULL if not found
+ */
+static struct aa_policy *__policy_find(struct list_head *head, const char *name)
+{
+       struct aa_policy *policy;
+
+       list_for_each_entry(policy, head, list) {
+               if (!strcmp(policy->name, name))
+                       return policy;
+       }
+       return NULL;
+}
+
+/**
+ * __policy_strn_find - find a policy thats name matches @len chars of @str
+ * @head: list to search  (NOT NULL)
+ * @str: string to search for  (NOT NULL)
+ * @len: length of match required
+ *
+ * Requires: correct locks for the @head list be held
+ *
+ * Returns: policy that match @str or NULL if not found
+ *
+ * if @len == strlen(@strlen) then this is equiv to __policy_find
+ * other wise it allows searching for policy by a partial match of name
+ */
+static struct aa_policy *__policy_strn_find(struct list_head *head,
+                                           const char *str, int len)
+{
+       struct aa_policy *policy;
+
+       list_for_each_entry(policy, head, list) {
+               if (aa_strneq(policy->name, str, len))
+                       return policy;
+       }
+
+       return NULL;
+}
+
+/*
+ * Routines for AppArmor namespaces
+ */
+
+/**
+ * aa_alloc_namespace - allocate, initialize and return a new namespace
+ * @name: a preallocated name  (NOT NULL)
+ *
+ * Returns: NULL on failure.
+ */
+static struct aa_namespace *aa_alloc_namespace(const char *name)
+{
+       struct aa_namespace *ns;
+
+       ns = kzalloc(sizeof(*ns), GFP_KERNEL);
+       AA_DEBUG("%s(%p)\n", __func__, ns);
+       if (!ns)
+               return NULL;
+
+       if (!policy_init(&ns->base, name))
+               goto fail_ns;
+       INIT_LIST_HEAD(&ns->sub_ns);
+       rwlock_init(&ns->lock);
+
+       /*
+        * null profile is not added to the profile list,
+        * released by aa_free_namespace
+        */
+       ns->unconfined = aa_alloc_profile("unconfined");
+       if (!ns->unconfined)
+               goto fail_unconfined;
+
+       ns->unconfined->sid = aa_alloc_sid();
+       ns->unconfined->flags = PFLAG_UNCONFINED | PFLAG_IX_ON_NAME_ERROR |
+           PFLAG_IMMUTABLE;
+
+       /*
+        * released by aa_free_namespace, however aa_remove_namespace breaks
+        * the cyclic references (ns->unconfined, and unconfined->ns) and
+        * replaces with refs to parent namespace unconfined
+        */
+       ns->unconfined->ns = aa_get_namespace(ns);
+
+       return ns;
+
+fail_unconfined:
+       kzfree(ns->base.name);
+fail_ns:
+       kzfree(ns);
+       return NULL;
+}
+
+/**
+ * aa_free_namespace - free a profile namespace
+ * @ns: the namespace to free  (MAYBE NULL)
+ *
+ * Requires: All references to the namespace must have been put, if the
+ *           namespace was referenced by a profile confining a task,
+ */
+static void aa_free_namespace(struct aa_namespace *ns)
+{
+       if (!ns)
+               return;
+
+       policy_destroy(&ns->base);
+       aa_put_namespace(ns->parent);
+
+       if (ns->unconfined && ns->unconfined->ns == ns)
+               ns->unconfined->ns = NULL;
+
+       aa_put_profile(ns->unconfined);
+       kzfree(ns);
+}
+
+/**
+ * aa_free_namespace_kref - free aa_namespace by kref (see aa_put_namespace)
+ * @kr: kref callback for freeing of a namespace  (NOT NULL)
+ */
+void aa_free_namespace_kref(struct kref *kref)
+{
+       aa_free_namespace(container_of(kref, struct aa_namespace, base.count));
+}
+
+/**
+ * __aa_find_namespace - find a namespace on a list by @name
+ * @head: list to search for namespace on  (NOT NULL)
+ * @name: name of namespace to look for  (NOT NULL)
+ *
+ * Returns: unrefcounted namespace
+ *
+ * Requires: ns lock be held
+ */
+static struct aa_namespace *__aa_find_namespace(struct list_head *head,
+                                               const char *name)
+{
+       return (struct aa_namespace *)__policy_find(head, name);
+}
+
+/**
+ * aa_find_namespace  -  look up a profile namespace on the namespace list
+ * @root: namespace to search in  (NOT NULL)
+ * @name: name of namespace to find  (NOT NULL)
+ *
+ * Returns: a pointer to the namespace on the list, or NULL if no namespace
+ * called @name exists.
+ *
+ * refcount released by caller
+ */
+struct aa_namespace *aa_find_namespace(struct aa_namespace *root,
+                                      const char *name)
+{
+       struct aa_namespace *ns = NULL;
+
+       read_lock(&root->lock);
+       ns = aa_get_namespace(__aa_find_namespace(&root->sub_ns, name));
+       read_unlock(&root->lock);
+
+       return ns;
+}
+
+/**
+ * aa_prepare_namespace - find an existing or create a new namespace of @name
+ * @name: the namespace to find or add  (NOT NULL)
+ *
+ * Returns: refcounted namespace or NULL if failed to create one
+ */
+static struct aa_namespace *aa_prepare_namespace(const char *name)
+{
+       struct aa_namespace *ns, *root;
+
+       root = aa_current_profile()->ns;
+
+       write_lock(&root->lock);
+
+       /* if name isn't specified the profile is loaded to the current ns */
+       if (!name) {
+               /* released by caller */
+               ns = aa_get_namespace(root);
+               goto out;
+       }
+
+       /* try and find the specified ns and if it doesn't exist create it */
+       /* released by caller */
+       ns = aa_get_namespace(__aa_find_namespace(&root->sub_ns, name));
+       if (!ns) {
+               /* name && namespace not found */
+               struct aa_namespace *new_ns;
+               write_unlock(&root->lock);
+               new_ns = aa_alloc_namespace(name);
+               if (!new_ns)
+                       return NULL;
+               write_lock(&root->lock);
+               /* test for race when new_ns was allocated */
+               ns = __aa_find_namespace(&root->sub_ns, name);
+               if (!ns) {
+                       /* add parent ref */
+                       new_ns->parent = aa_get_namespace(root);
+
+                       list_add(&new_ns->base.list, &root->sub_ns);
+                       /* add list ref */
+                       ns = aa_get_namespace(new_ns);
+               } else {
+                       /* raced so free the new one */
+                       aa_free_namespace(new_ns);
+                       /* get reference on namespace */
+                       aa_get_namespace(ns);
+               }
+       }
+out:
+       write_unlock(&root->lock);
+
+       /* return ref */
+       return ns;
+}
+
+/**
+ * __aa_add_profile - add a profile to a list
+ * @list: list to add it to  (NOT NULL)
+ * @profile: the profile to add  (NOT NULL)
+ *
+ * refcount @profile, should be put by __aa_remove_profile
+ *
+ * Requires: namespace lock be held, or list not be shared
+ */
+static void __aa_add_profile(struct list_head *list,
+                            struct aa_profile *profile)
+{
+       list_add(&profile->base.list, list);
+       /* get list reference */
+       aa_get_profile(profile);
+}
+
+/**
+ * __aa_remove_profile - remove a profile from the list it is one
+ * @profile: the profile to remove  (NOT NULL)
+ *
+ * remove a profile from the list, warning generally removal should
+ * be done with __aa_replace_profile as most profile removals are
+ * replacements to the unconfined profile.
+ *
+ * put @profile list refcount
+ *
+ * Requires: namespace lock be held, or list not have been live
+ */
+static void __aa_remove_profile(struct aa_profile *profile)
+{
+       list_del_init(&profile->base.list);
+       if (!(profile->flags & PFLAG_NO_LIST_REF))
+               /* release list reference */
+               aa_put_profile(profile);
+}
+
+/**
+ * __aa_replace_profile - replace @old with @new on a list
+ * @old: profile to be replaced  (NOT NULL)
+ * @new: profile to replace @old with  (MAYBE NULL)
+ *
+ * Will duplicaticate and refcount elements that @new inherits from @old
+ * and will inherit @old children.  If new is NULL it will replace to the
+ * unconfined profile for old's namespace.
+ *
+ * refcount @new for list, put @old list refcount
+ *
+ * Requires: namespace list lock be held, or list not be shared
+ */
+static void __aa_replace_profile(struct aa_profile *old,
+                                struct aa_profile *new)
+{
+       struct aa_policy *policy;
+       struct aa_profile *child, *tmp;
+
+       if (old->parent)
+               policy = &old->parent->base;
+       else
+               policy = &old->ns->base;
+
+       if (new) {
+               /* released when @new is freed */
+               new->parent = aa_get_profile(old->parent);
+               new->ns = aa_get_namespace(old->ns);
+               new->sid = old->sid;
+               __aa_add_profile(&policy->profiles, new);
+       } else {
+               /* refcount not taken, held via @old refcount */
+               new = old->ns->unconfined;
+       }
+
+       /* inherit children */
+       list_for_each_entry_safe(child, tmp, &old->base.profiles, base.list) {
+               aa_put_profile(child->parent);
+               child->parent = aa_get_profile(new);
+               /* list refcount transfered to @new*/
+               list_move(&child->base.list, &new->base.profiles);
+       }
+
+       /* released by aa_free_profile */
+       old->replacedby = aa_get_profile(new);
+       __aa_remove_profile(old);
+}
+
+/**
+ * __aa_profile_list_release - remove all profiles on the list and put refs
+ * @head: list of profiles  (NOT NULL)
+ *
+ * Requires: namespace lock be held
+ */
+static void __aa_profile_list_release(struct list_head *head)
+{
+       struct aa_profile *profile, *tmp;
+       list_for_each_entry_safe(profile, tmp, head, base.list) {
+               /* release any children lists first */
+               __aa_profile_list_release(&profile->base.profiles);
+               __aa_replace_profile(profile, NULL);
+       }
+}
+
+static void __aa_remove_namespace(struct aa_namespace *ns);
+
+/**
+ * __aa_ns_list_release - remove all profile namespaces on the list put refs
+ * @head: list of profile namespaces  (NOT NULL)
+ *
+ * Requires: namespace lock be held
+ */
+static void __aa_ns_list_release(struct list_head *head)
+{
+       struct aa_namespace *ns, *tmp;
+       list_for_each_entry_safe(ns, tmp, head, base.list)
+               __aa_remove_namespace(ns);
+
+}
+
+/**
+ * aa_destroy_namespace - remove everything contained by @ns
+ * @ns: namespace to have it contents removed  (NOT NULL)
+ */
+static void aa_destroy_namespace(struct aa_namespace *ns)
+{
+       if (!ns)
+               return;
+
+       write_lock(&ns->lock);
+       /* release all profiles in this namespace */
+       __aa_profile_list_release(&ns->base.profiles);
+
+       /* release all sub namespaces */
+       __aa_ns_list_release(&ns->sub_ns);
+
+       write_unlock(&ns->lock);
+}
+
+/**
+ * __aa_remove_namespace - remove a namespace and all its children
+ * @ns: namespace to be removed  (NOT NULL)
+ * 
+ * Requires: ns->parent->lock be held and ns removed from parent.
+ */
+static void __aa_remove_namespace(struct aa_namespace *ns)
+{
+       struct aa_profile *unconfined = ns->unconfined;
+
+       /* remove ns from namespace list */
+       list_del_init(&ns->base.list);
+
+       /*
+        * break the ns, unconfined profile cyclic reference and forward
+        * all new unconfined profiles requests to the parent namespace
+        * This will result in all confined tasks that have a profile
+        * being removed, inheriting the parent->unconfined profile.
+        */
+       if (ns->parent)
+               ns->unconfined = aa_get_profile(ns->parent->unconfined);
+
+       aa_destroy_namespace(ns);
+
+       /* release original ns->unconfined ref */
+       aa_put_profile(unconfined);
+       /* release ns->base.list ref, from removal above */
+       aa_put_namespace(ns);
+}
+
+/**
+ * aa_alloc_root_ns - allocate the root profile namespace
+ *
+ * Returns: %0 on success else error
+ *
+ */
+int __init aa_alloc_root_ns(void)
+{
+       /* released by aa_free_root_ns - used as list ref*/
+       root_ns = aa_alloc_namespace("root");
+       if (!root_ns)
+               return -ENOMEM;
+
+       return 0;
+}
+
+ /**
+  * aa_free_root_ns - free the root profile namespace
+  */
+void aa_free_root_ns(void)
+ {
+        struct aa_namespace *ns = root_ns;
+        root_ns = NULL;
+ 
+        aa_destroy_namespace(ns);
+        aa_put_namespace(ns);
+}
+
+/**
+ * aa_alloc_profile - allocate, initialize and return a new profile
+ * @hname: name of the profile  (NOT NULL)
+ *
+ * Returns: NULL on failure, else refcounted profile
+ */
+struct aa_profile *aa_alloc_profile(const char *hname)
+{
+       struct aa_profile *profile;
+
+       /* freed by aa_free_profile - usually through aa_put_profile */
+       profile = kzalloc(sizeof(*profile), GFP_KERNEL);
+       if (!profile)
+               return NULL;
+
+       if (!policy_init(&profile->base, hname)) {
+               kzfree(profile);
+               return NULL;
+       }
+
+       /* return ref */
+       return profile;
+}
+
+/**
+ * aa_new_null_profile - create a new null-X learning profile
+ * @parent: profile that caused this profile to be created (NOT NULL)
+ * @hat: true if the null- learning profile is a hat
+ *
+ * Create a null- complain mode profile used in learning mode.  The name of
+ * the profile is unique and follows the format of parent//null-sid.
+ *
+ * null profiles are added to the profile list but the list does not
+ * hold a count on them so that they are automatically released when
+ * not in use.
+ *
+ * Returns: new profile else NULL on failure
+ */
+struct aa_profile *aa_new_null_profile(struct aa_profile *parent, int hat)
+{
+       struct aa_profile *profile = NULL;
+       char *name;
+       u32 sid = aa_alloc_sid();
+
+       /* freed below */
+       name = kmalloc(strlen(parent->base.hname) + 2 + 7 + 8, GFP_KERNEL);
+       if (!name)
+               goto fail;
+       sprintf(name, "%s//null-%x", parent->base.hname, sid);
+
+       profile = aa_alloc_profile(name);
+       kfree(name);
+       if (!profile)
+               goto fail;
+
+       profile->sid = sid;
+       profile->mode = APPARMOR_COMPLAIN;
+       profile->flags = PFLAG_NULL | PFLAG_NO_LIST_REF;
+       if (hat)
+               profile->flags |= PFLAG_HAT;
+
+       /* released on aa_free_profile */
+       profile->parent = aa_get_profile(parent);
+       profile->ns = aa_get_namespace(parent->ns);
+
+       write_lock(&profile->ns->lock);
+       __aa_add_profile(&parent->base.profiles, profile);
+       write_unlock(&profile->ns->lock);
+
+       return profile;
+
+fail:
+       aa_free_sid(sid);
+       return NULL;
+}
+
+/**
+ * aa_free_profile - free a profile
+ * @profile: the profile to free  (MAYBE NULL)
+ *
+ * Free a profile, its hats and null_profile. All references to the profile,
+ * its hats and null_profile must have been put.
+ *
+ * If the profile was referenced from a task context, aa_free_profile() will
+ * be called from an rcu callback routine, so we must not sleep here.
+ */
+static void aa_free_profile(struct aa_profile *profile)
+{
+       AA_DEBUG("%s(%p)\n", __func__, profile);
+
+       if (!profile)
+               return;
+
+       if (!list_empty(&profile->base.list)) {
+               AA_ERROR("%s: internal error, "
+                        "profile '%s' still on ns list\n",
+                        __func__, profile->base.name);
+               BUG();
+       }
+
+       /* free children profiles */
+       policy_destroy(&profile->base);
+       aa_put_profile(profile->parent);
+
+       aa_put_namespace(profile->ns);
+
+       aa_free_file_rules(&profile->file);
+       aa_free_cap_rules(&profile->caps);
+       aa_free_net_rules(&profile->net);
+       aa_free_rlimit_rules(&profile->rlimits);
+
+       aa_free_sid(profile->sid);
+       aa_put_dfa(profile->xmatch);
+
+       if (profile->replacedby)
+               aa_put_profile(profile->replacedby);
+
+       kzfree(profile);
+}
+
+/**
+ * aa_free_profile_kref - free aa_profile by kref (called by aa_put_profile)
+ * @kr: kref callback for freeing of a profile  (NOT NULL)
+ */
+void aa_free_profile_kref(struct kref *kref)
+{
+       struct aa_profile *p = container_of(kref, struct aa_profile,
+                                           base.count);
+
+       aa_free_profile(p);
+}
+
+/* TODO: profile count accounting - setup in remove */
+
+/**
+ * __aa_find_child - find a profile on @head list with a name matching @name
+ * @head: list to search  (NOT NULL)
+ * @name: name of profile (NOT NULL)
+ *
+ * Requires: ns lock protecting list be held
+ *
+ * Returns: unrefcounted profile ptr, or NULL if not found
+ */
+static struct aa_profile *__aa_find_child(struct list_head *head,
+                                         const char *name)
+{
+       return (struct aa_profile *)__policy_find(head, name);
+}
+
+/**
+ * __aa_strn_find_child - find a profile on @head list using substring of @name
+ * @head: list to search  (NOT NULL)
+ * @name: name of profile (NOT NULL)
+ * @len: length of @name substring to match
+ *
+ * Requires: ns lock protecting list be held
+ *
+ * Returns: unrefcounted profile ptr, or NULL if not found
+ */
+static struct aa_profile *__aa_strn_find_child(struct list_head *head,
+                                              const char *name, int len)
+{
+       return (struct aa_profile *)__policy_strn_find(head, name, len);
+}
+
+/**
+ * aa_find_child - find a profile by @name in @parent
+ * @parent: profile to search  (NOT NULL)
+ * @name: profile name to search for  (NOT NULL)
+ *
+ * Returns: a ref counted profile or NULL if not found
+ */
+struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name)
+{
+       struct aa_profile *profile;
+
+       read_lock(&parent->ns->lock);
+       profile = aa_get_profile(__aa_find_child(&parent->base.profiles, name));
+       read_unlock(&parent->ns->lock);
+
+       return profile;
+}
+
+/**
+ * __aa_find_parent - lookup the parent of a profile of name @hname
+ * @ns: namespace to lookup profile in  (NOT NULL)
+ * @hname: hierarchical profile name to find parent of  (NOT NULL)
+ *
+ * Lookups up the parent of a fully qualified profile name, the profile
+ * that matches hname does not need to exist, in general this
+ * is used to load a new profile.
+ *
+ * Requires: ns->lock be held
+ *
+ * Returns: unrefcounted policy or NULL if not found
+ */
+static struct aa_policy *__aa_find_parent(struct aa_namespace *ns,
+                                         const char *hname)
+{
+       struct aa_policy *policy;
+       struct aa_profile *profile = NULL;
+       char *split;
+
+       policy = &ns->base;
+
+       for (split = strstr(hname, "//"); split;) {
+               profile = __aa_strn_find_child(&policy->profiles, hname,
+                                              split - hname);
+               if (!profile)
+                       return NULL;
+               policy = &profile->base;
+               hname = split + 2;
+               split = strstr(hname, "//");
+       }
+       if (!profile)
+               return &ns->base;
+       return &profile->base;
+}
+
+/**
+ * __aa_find_profile - lookup the profile matching @hname
+ * @base: base list to start looking up profile name from  (NOT NULL)
+ * @hname: hierarchical profile name  (NOT NULL)
+ *
+ * Requires: ns->lock be held
+ *
+ * Returns: unrefcounted profile pointer or NULL if not found
+ *
+ * Do a relative name lookup, recursing through profile tree.
+ */
+static struct aa_profile *__aa_find_profile(struct aa_policy *base,
+                                           const char *hname)
+{
+       struct aa_profile *profile = NULL;
+       char *split;
+
+       for (split = strstr(hname, "//"); split;) {
+               profile = __aa_strn_find_child(&base->profiles, hname,
+                                              split - hname);
+               if (!profile)
+                       return NULL;
+
+               base = &profile->base;
+               hname = split + 2;
+               split = strstr(hname, "//");
+       }
+
+       profile = __aa_find_child(&base->profiles, hname);
+
+       return profile;
+}
+
+/**
+ * aa_find_profile_by_name - find a profile by its full or partial name
+ * @ns: the namespace to start from
+ * @hname: name to do lookup on.  Does not contain namespace prefix
+ *
+ * Returns: refcounted profile or NULL if not found
+ */
+struct aa_profile *aa_find_profile(struct aa_namespace *ns, const char *hname)
+{
+       struct aa_profile *profile;
+
+       read_lock(&ns->lock);
+       profile = aa_get_profile(__aa_find_profile(&ns->base, hname));
+       read_unlock(&ns->lock);
+       return profile;
+}
+
+/**
+ * replacement_allowed - test to see if replacement is allowed
+ * @profile: profile to test if it can be replaced  (MAYBE NULL)
+ * @sa: audit data  (NOT NULL)
+ * @add_only: true if replacement shouldn't be allowed but addition is okay
+ *
+ * Returns: %1 if replacement allowed else %0
+ */
+static bool replacement_allowed(struct aa_profile *profile,
+                               struct aa_audit_iface *sa,
+                               int add_only)
+{
+       if (profile) {
+               if (profile->flags & PFLAG_IMMUTABLE) {
+                       sa->base.info = "cannot replace immutible profile";
+                       sa->base.error = -EPERM;
+                       return 0;
+               } else if (add_only) {
+                       sa->base.info = "profile already exists";
+                       sa->base.error = -EEXIST;
+                       return 0;
+               }
+       }
+       return 1;
+}
+
+/**
+ * __add_new_profile - simple wrapper around __aa_add_profile
+ * @ns: namespace that profile is being added to  (NOT NULL)
+ * @policy: the policy container to add the profile to  (NOT NULL)
+ * @profile: profile to add  (NOT NULL)
+ *
+ * add a profile to a list and do other required basic allocations
+ */
+static void __add_new_profile(struct aa_namespace *ns,
+                             struct aa_policy *policy,
+                             struct aa_profile *profile)
+{
+       if (policy != &ns->base)
+               /* released on profile replacement or aa_free_profile */
+               profile->parent = aa_get_profile((struct aa_profile *) policy);
+       __aa_add_profile(&policy->profiles, profile);
+       /* released on aa_free_profile */
+       profile->sid = aa_alloc_sid();
+       profile->ns = aa_get_namespace(ns);
+}
+
+/**
+ * aa_interface_replace_profiles - replace profile(s) on the profile list
+ * @udata: serialized data stream  (NOT NULL)
+ * @size: size of the serialized data stream
+ * @add_only: true if only doing addition, no replacement allowed
+ *
+ * unpack and replace a profile on the profile list and uses of that profile
+ * by any aa_task_cxt.  If the profile does not exist on the profile list
+ * it is added.
+ *
+ * Returns: size of data consumed else error code on failure.
+ */
+ssize_t aa_interface_replace_profiles(void *udata, size_t size, bool add_only)
+{
+       struct aa_policy *policy;
+       struct aa_profile *old_profile = NULL, *new_profile = NULL;
+       struct aa_profile *rename_profile = NULL;
+       struct aa_namespace *ns;
+       ssize_t error;
+       struct aa_audit_iface sa = {
+               .base.operation = "profile_replace",
+               .base.gfp_mask = GFP_ATOMIC,
+       };
+
+       /* check if loading policy is locked out */
+       if (aa_g_lock_policy) {
+               sa.base.info = "policy locked";
+               sa.base.error = -EACCES;
+               goto fail;
+       }
+
+       /* released below */
+       new_profile = aa_unpack(udata, size, &sa);
+       if (IS_ERR(new_profile)) {
+               sa.base.error = PTR_ERR(new_profile);
+               goto fail;
+       }
+
+       /* released below */
+       ns = aa_prepare_namespace(sa.name2);
+       if (!ns) {
+               sa.base.info = "failed to prepare namespace";
+               sa.base.error = -ENOMEM;
+               goto fail;
+       }
+
+       sa.name = new_profile->base.hname;
+
+       write_lock(&ns->lock);
+       /* no ref on policy only use inside lock */
+       policy = __aa_find_parent(ns, new_profile->base.hname);
+
+       if (!policy) {
+               sa.base.info = "parent does not exist";
+               sa.base.error = -ENOENT;
+               goto audit;
+       }
+
+       old_profile = __aa_find_child(&policy->profiles,
+                                     new_profile->base.name);
+       /* released below */
+       aa_get_profile(old_profile);
+
+       if (new_profile->rename) {
+               rename_profile = __aa_find_profile(&ns->base,
+                                                  new_profile->rename);
+               /* released below */
+               aa_get_profile(rename_profile);
+
+               if (!rename_profile) {
+                       sa.base.info = "profile to rename does not exist";
+                       sa.name = new_profile->rename;
+                       sa.base.error = -ENOENT;
+                       goto audit;
+               }
+       }
+
+       if (!replacement_allowed(old_profile, &sa, add_only))
+               goto audit;
+
+       if (!replacement_allowed(rename_profile, &sa, add_only))
+               goto audit;
+
+audit:
+       if (!old_profile && !rename_profile)
+               sa.base.operation = "profile_load";
+
+       error = aa_audit_iface(&sa);
+
+       /* rename field must be cleared as it is shared with replaced-by */
+       if (new_profile->rename) {
+               kzfree(new_profile->rename);
+               new_profile->rename = NULL;
+       }
+
+       if (!error) {
+               if (old_profile)
+                       __aa_replace_profile(old_profile, new_profile);
+               if (rename_profile)
+                       __aa_replace_profile(rename_profile, new_profile);
+               if (!(old_profile || rename_profile))
+                       __add_new_profile(ns, policy, new_profile);
+       }
+       write_unlock(&ns->lock);
+
+out:
+       aa_put_namespace(ns);
+       aa_put_profile(rename_profile);
+       aa_put_profile(old_profile);
+       aa_put_profile(new_profile);
+       if (error)
+               return error;
+       return size;
+
+fail:
+       error = aa_audit_iface(&sa);
+       goto out;
+}
+
+/**
+ * aa_interface_remove_profiles - remove profile(s) from the system
+ * @fqname: name of the profile or namespace to remove  (NOT NULL)
+ * @size: size of the name
+ *
+ * Remove a profile or sub namespace from the current namespace, so that
+ * they can not be found anymore and mark them as replaced by unconfined
+ *
+ * NOTE: removing confinement does not restore rlimits to preconfinemnet values
+ *
+ * Returns: size of data consume else error code if fails
+ */
+ssize_t aa_interface_remove_profiles(char *fqname, size_t size)
+{
+       struct aa_namespace *root, *ns = NULL;
+       struct aa_profile *profile = NULL;
+       struct aa_audit_iface sa = {
+               .base.operation = "profile_remove",
+               .base.gfp_mask = GFP_ATOMIC,
+       };
+       const char *name = fqname;
+       int error;
+
+       /* check if loading policy is locked out */
+       if (aa_g_lock_policy) {
+               sa.base.info = "policy locked";
+               sa.base.error = -EACCES;
+               goto fail;
+       }
+
+       if (*fqname == 0) {
+               sa.base.info = "no profile specified";
+               sa.base.error = -ENOENT;
+               goto fail;
+       }
+
+       /* ref count held by cred */
+       root = aa_current_profile()->ns;
+
+       if (fqname[0] == ':') {
+               char *ns_name;
+               name = aa_split_fqname(fqname, &ns_name);
+               if (ns_name)
+                       /* released below */
+                       ns = aa_find_namespace(root, ns_name);
+       } else
+               /* released below */
+               ns = aa_get_namespace(root);
+
+       if (!ns) {
+               sa.base.info = "namespace does not exist";
+               sa.base.error = -ENOENT;
+               goto fail;
+       }
+
+       sa.name2 = ns->base.name;
+       write_lock(&ns->lock);
+       if (!name) {
+               /* remove namespace - can only happen if fqname[0] == ':' */
+               __aa_remove_namespace(ns);
+       } else {
+               /* remove profile */
+               profile = aa_get_profile(__aa_find_profile(&ns->base, name));
+               if (!profile) {
+                       sa.name = name;
+                       sa.base.error = -ENOENT;
+                       sa.base.info = "profile does not exist";
+                       goto fail_ns_lock;
+               }
+               sa.name = profile->base.hname;
+               __aa_profile_list_release(&profile->base.profiles);
+               __aa_replace_profile(profile, NULL);
+       }
+       write_unlock(&ns->lock);
+
+       /* don't fail removal if audit fails */
+       (void) aa_audit_iface(&sa);
+       aa_put_namespace(ns);
+       aa_put_profile(profile);
+       return size;
+
+fail_ns_lock:
+       write_unlock(&ns->lock);
+       aa_put_namespace(ns);
+
+fail:
+       error = aa_audit_iface(&sa);
+       return error;
+}
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
new file mode 100644
index 0000000..20bdf9c
--- /dev/null
+++ b/security/apparmor/policy_unpack.c
@@ -0,0 +1,721 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor functions for unpacking policy loaded from
+ * userspace.
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ *
+ * AppArmor uses a serialized binary format for loading policy.
+ * The policy format is documented in Documentation/???
+ * All policy is validated all before it is used.
+ */
+
+#include <asm/unaligned.h>
+#include <linux/ctype.h>
+#include <linux/errno.h>
+
+#include "include/apparmor.h"
+#include "include/audit.h"
+#include "include/context.h"
+#include "include/match.h"
+#include "include/policy.h"
+#include "include/policy_unpack.h"
+#include "include/sid.h"
+
+/*
+ * The AppArmor interface treats data as a type byte followed by the
+ * actual data.  The interface has the notion of a a named entry
+ * which has a name (AA_NAME typecode followed by name string) followed by
+ * the entries typecode and data.  Named types allow for optional
+ * elements and extensions to be added and tested for without breaking
+ * backwards compatability.
+ */
+
+enum aa_code {
+       AA_U8,
+       AA_U16,
+       AA_U32,
+       AA_U64,
+       AA_NAME,                /* same as string except it is items name */
+       AA_STRING,
+       AA_BLOB,
+       AA_STRUCT,
+       AA_STRUCTEND,
+       AA_LIST,
+       AA_LISTEND,
+       AA_ARRAY,
+       AA_ARRAYEND,
+};
+
+/*
+ * aa_ext is the read of the buffer containing the serialized profile.  The
+ * data is copied into a kernel buffer in apparmorfs and then handed off to
+ * the unpack routines.
+ */
+struct aa_ext {
+       void *start;
+       void *end;
+       void *pos;              /* pointer to current position in the buffer */
+       u32 version;
+};
+
+/* audit callback for unpack fields */
+static void audit_cb(struct audit_buffer *ab, struct aa_audit *va)
+{
+       struct aa_audit_iface *sa = container_of(va, struct aa_audit_iface,
+                                                base);
+
+       if (sa->name) {
+               audit_log_format(ab, " name=");
+               audit_log_string(ab, sa->name);
+       }
+       if (sa->name2) {
+               audit_log_format(ab, " namespace=");
+               audit_log_string(ab, sa->name2);
+       }
+       if (sa->base.error && sa->pos)
+               audit_log_format(ab, " offset=%ld", sa->pos);
+}
+
+/**
+ * aa_audit_iface - do audit message for policy unpacking/load/replace/remove
+ * @sa: audit date to send to audit  (NOT NULL)
+ *
+ * Returns: %0 or error
+ */
+int aa_audit_iface(struct aa_audit_iface *sa)
+{
+       struct aa_profile *profile;
+       const struct cred *cred = get_current_cred();
+       int error;
+       profile = aa_cred_profile(cred);
+       error = aa_audit(AUDIT_APPARMOR_STATUS, profile, &sa->base, audit_cb);
+       put_cred(cred);
+       return error;
+}
+
+/* test if read will be in packed data bounds */
+static bool aa_inbounds(struct aa_ext *e, size_t size)
+{
+       return (size <= e->end - e->pos);
+}
+
+/**
+ * aa_u16_chunck - test and do bounds checking for a u16 size based chunk
+ * @e: serialized data read head
+ * @chunk: start address for chunk of data
+ *
+ * Returns: the size of chunk found with the read head at the end of the chunk.
+ */
+static size_t unpack_u16_chunk(struct aa_ext *e, char **chunk)
+{
+       size_t size = 0;
+
+       if (!aa_inbounds(e, sizeof(u16)))
+               return 0;
+       size = le16_to_cpu(get_unaligned((u16 *) e->pos));
+       e->pos += sizeof(u16);
+       if (!aa_inbounds(e, size))
+               return 0;
+       *chunk = e->pos;
+       e->pos += size;
+       return size;
+}
+
+/* unpack control byte */
+static bool unpack_X(struct aa_ext *e, enum aa_code code)
+{
+       if (!aa_inbounds(e, 1))
+               return 0;
+       if (*(u8 *) e->pos != code)
+               return 0;
+       e->pos++;
+       return 1;
+}
+
+/**
+ * unpack_nameX - check is the next element is of type X with a name of @name
+ * @e: serialized data extent information  (NOT NULL)
+ * @code: type code
+ * @name: name to match to the serialized element.  (MAYBE NULL)
+ *
+ * check that the next serialized data element is of type X and has a tag
+ * name @name.  If @name is specified then there must be a matching
+ * name element in the stream.  If @name is NULL any name element will be
+ * skipped and only the typecode will be tested.
+ * returns 1 on success (both type code and name tests match) and the read
+ * head is advanced past the headers
+ *
+ * Returns: 0 if either match failes, the read head does not move
+ */
+static bool unpack_nameX(struct aa_ext *e, enum aa_code code, const char *name)
+{
+       /*
+        * May need to reset pos if name or type doesn't match
+        */
+       void *pos = e->pos;
+       /*
+        * Check for presence of a tagname, and if present name size
+        * AA_NAME tag value is a u16.
+        */
+       if (unpack_X(e, AA_NAME)) {
+               char *tag = NULL;
+               size_t size = unpack_u16_chunk(e, &tag);
+               /* if a name is specified it must match. otherwise skip tag */
+               if (name && (!size || strcmp(name, tag)))
+                       goto fail;
+       } else if (name) {
+               /* if a name is specified and there is no name tag fail */
+               goto fail;
+       }
+
+       /* now check if type code matches */
+       if (unpack_X(e, code))
+               return 1;
+
+fail:
+       e->pos = pos;
+       return 0;
+}
+
+static bool unpack_u16(struct aa_ext *e, u16 *data, const char *name)
+{
+       if (unpack_nameX(e, AA_U16, name)) {
+               if (!aa_inbounds(e, sizeof(u16)))
+                       return 0;
+               if (data)
+                       *data = le16_to_cpu(get_unaligned((u16 *) e->pos));
+               e->pos += sizeof(u16);
+               return 1;
+       }
+       return 0;
+}
+
+static bool unpack_u32(struct aa_ext *e, u32 *data, const char *name)
+{
+       if (unpack_nameX(e, AA_U32, name)) {
+               if (!aa_inbounds(e, sizeof(u32)))
+                       return 0;
+               if (data)
+                       *data = le32_to_cpu(get_unaligned((u32 *) e->pos));
+               e->pos += sizeof(u32);
+               return 1;
+       }
+       return 0;
+}
+
+static bool unpack_u64(struct aa_ext *e, u64 *data, const char *name)
+{
+       if (unpack_nameX(e, AA_U64, name)) {
+               if (!aa_inbounds(e, sizeof(u64)))
+                       return 0;
+               if (data)
+                       *data = le64_to_cpu(get_unaligned((u64 *) e->pos));
+               e->pos += sizeof(u64);
+               return 1;
+       }
+       return 0;
+}
+
+static size_t unpack_array(struct aa_ext *e, const char *name)
+{
+       if (unpack_nameX(e, AA_ARRAY, name)) {
+               int size;
+               if (!aa_inbounds(e, sizeof(u16)))
+                       return 0;
+               size = (int)le16_to_cpu(get_unaligned((u16 *) e->pos));
+               e->pos += sizeof(u16);
+               return size;
+       }
+       return 0;
+}
+
+static size_t unpack_blob(struct aa_ext *e, char **blob, const char *name)
+{
+       if (unpack_nameX(e, AA_BLOB, name)) {
+               u32 size;
+               if (!aa_inbounds(e, sizeof(u32)))
+                       return 0;
+               size = le32_to_cpu(get_unaligned((u32 *) e->pos));
+               e->pos += sizeof(u32);
+               if (aa_inbounds(e, (size_t) size)) {
+                       *blob = e->pos;
+                       e->pos += size;
+                       return size;
+               }
+       }
+       return 0;
+}
+
+static int unpack_str(struct aa_ext *e, const char **string, const char *name)
+{
+       char *src_str;
+       size_t size = 0;
+       void *pos = e->pos;
+       *string = NULL;
+       if (unpack_nameX(e, AA_STRING, name)) {
+               size = unpack_u16_chunk(e, &src_str);
+               if (size) {
+                       /* strings are null terminated, length is size - 1 */
+                       if (src_str[size - 1] != 0)
+                               goto fail;
+                       *string = src_str;
+               }
+       }
+       return size;
+
+fail:
+       e->pos = pos;
+       return 0;
+}
+
+static int unpack_strdup(struct aa_ext *e, char **string, const char *name)
+{
+       const char *tmp;
+       void *pos = e->pos;
+       int res = unpack_str(e, &tmp, name);
+       *string = NULL;
+
+       if (!res)
+               return 0;
+
+       *string = kmemdup(tmp, res, GFP_KERNEL);
+       if (!*string) {
+               e->pos = pos;
+               return 0;
+       }
+
+       return res;
+}
+
+static bool verify_accept(struct aa_dfa *dfa, int flags)
+{
+       int i;
+
+       /* verify accept permissions */
+       for (i = 0; i < dfa->tables[YYTD_ID_ACCEPT]->td_lolen; i++) {
+               int mode = ACCEPT_TABLE(dfa)[i];
+
+               if (mode & ~DFA_VALID_PERM_MASK)
+                       return 0;
+
+               if (ACCEPT_TABLE2(dfa)[i] & ~DFA_VALID_PERM2_MASK)
+                       return 0;
+       }
+       return 1;
+}
+
+/**
+ * unpack_dfa - unpack a file rule dfa
+ * @e: serialized data extent information
+ *
+ * returns dfa or ERR_PTR or NULL if no dfa
+ */
+static struct aa_dfa *unpack_dfa(struct aa_ext *e)
+{
+       char *blob = NULL;
+       size_t size;
+       struct aa_dfa *dfa = NULL;
+
+       size = unpack_blob(e, &blob, "aadfa");
+       if (size) {
+               /*
+                * The dfa is aligned with in the blob to 8 bytes
+                * from the beginning of the stream.
+                */
+               size_t sz = blob - (char *)e->start;
+               size_t pad = ALIGN(sz, 8) - sz;
+               int flags = TO_ACCEPT1_FLAG(YYTD_DATA32) |
+                       TO_ACCEPT2_FLAG(YYTD_DATA32);
+
+
+               if (aa_g_paranoid_load)
+                       flags |= DFA_FLAG_VERIFY_STATES;
+
+               dfa = aa_dfa_unpack(blob + pad, size - pad, flags);
+               
+               if (!IS_ERR(dfa) && !verify_accept(dfa, flags))
+                       goto fail;
+       }
+
+       return dfa;
+
+fail:
+       aa_put_dfa(dfa);
+       return ERR_PTR(-EPROTO);
+}
+
+static bool unpack_trans_table(struct aa_ext *e, struct aa_profile *profile)
+{
+       void *pos = e->pos;
+
+       /* exec table is optional */
+       if (unpack_nameX(e, AA_STRUCT, "xtable")) {
+               int i, size;
+
+               size = unpack_array(e, NULL);
+               /* currently 4 exec bits and entries 0-3 are reserved iupcx */
+               if (size > 16 - 4)
+                       goto fail;
+               profile->file.trans.table = kzalloc(sizeof(char *) * size,
+                                                   GFP_KERNEL);
+               if (!profile->file.trans.table)
+                       goto fail;
+
+               profile->file.trans.size = size;
+               for (i = 0; i < size; i++) {
+                       char *str;
+                       int c, j, size = unpack_strdup(e, &str, NULL);
+                       if (!size)
+                               goto fail;
+                       profile->file.trans.table[i] = str;
+                       /* verify that name doesn't start with space */
+                       if (isspace(*str))
+                               goto fail;
+
+                       /* count internal #  of internal \0 */
+                       for (c = j = 0; j < size - 2; j++) {
+                               if (!str[j])
+                                       c++;
+                       }
+                       if (*str == ':') {
+                               /* beginning with : requires an embedded \0 */
+                               if (c != 1)
+                                       goto fail;
+                               /* first character after : must be valid */
+                               if (!str[1])
+                                       goto fail;
+                       } else if (c)
+                               /* fail - all other cases with embedded \0 */
+                               goto fail;
+               }
+               if (!unpack_nameX(e, AA_ARRAYEND, NULL))
+                       goto fail;
+               if (!unpack_nameX(e, AA_STRUCTEND, NULL))
+                       goto fail;
+       }
+       return 1;
+
+fail:
+       aa_free_domain_entries(&profile->file.trans);
+       e->pos = pos;
+       return 0;
+}
+
+static bool unpack_rlimits(struct aa_ext *e, struct aa_profile *profile)
+{
+       void *pos = e->pos;
+
+       /* rlimits are optional */
+       if (unpack_nameX(e, AA_STRUCT, "rlimits")) {
+               int i, size;
+               u32 tmp = 0;
+               if (!unpack_u32(e, &tmp, NULL))
+                       goto fail;
+               profile->rlimits.mask = tmp;
+
+               size = unpack_array(e, NULL);
+               if (size > RLIM_NLIMITS)
+                       goto fail;
+               for (i = 0; i < size; i++) {
+                       u64 tmp = 0;
+                       if (!unpack_u64(e, &tmp, NULL))
+                               goto fail;
+                       profile->rlimits.limits[i].rlim_max = tmp;
+               }
+               if (!unpack_nameX(e, AA_ARRAYEND, NULL))
+                       goto fail;
+               if (!unpack_nameX(e, AA_STRUCTEND, NULL))
+                       goto fail;
+       }
+       return 1;
+
+fail:
+       e->pos = pos;
+       return 0;
+}
+
+/**
+ * unpack_profile - unpack a serialized profile
+ * @e: serialized data extent information
+ * @sa: audit struct for the operation
+ *
+ * NOTE: unpack profile sets audit struct if there is a failure
+ */
+static struct aa_profile *unpack_profile(struct aa_ext *e,
+                                        struct aa_audit_iface *sa)
+{
+       struct aa_profile *profile = NULL;
+       const char *name = NULL;
+       size_t size = 0;
+       int i, error = -EPROTO;
+       kernel_cap_t tmpcap;
+       u32 tmp;
+       u64 tmp64;
+
+       /* check that we have the right struct being passed */
+       if (!unpack_nameX(e, AA_STRUCT, "profile"))
+               goto fail;
+       if (!unpack_str(e, &name, NULL))
+               goto fail;
+
+       profile = aa_alloc_profile(name);
+       if (!profile)
+               return ERR_PTR(-ENOMEM);
+
+       /* profile renaming is optional */
+       (void) unpack_str(e, &profile->rename, "rename");
+
+       /* xmatch is optional and may be NULL */
+       profile->xmatch = unpack_dfa(e);
+       if (IS_ERR(profile->xmatch)) {
+               error = PTR_ERR(profile->xmatch);
+               profile->xmatch = NULL;
+               goto fail;
+       }
+       /* xmatch_len is not optional if xmatch is set */
+       if (profile->xmatch) {
+               if (!unpack_u32(e, &tmp, NULL))
+                       goto fail;
+               profile->xmatch_len = tmp;
+       }
+
+       /* per profile debug flags (complain, audit) */
+       if (!unpack_nameX(e, AA_STRUCT, "flags"))
+               goto fail;
+       if (!unpack_u32(e, &tmp, NULL))
+               goto fail;
+       if (tmp)
+               profile->flags |= PFLAG_HAT;
+       if (!unpack_u32(e, &tmp, NULL))
+               goto fail;
+       if (tmp)
+               profile->mode = APPARMOR_COMPLAIN;
+       if (!unpack_u32(e, &tmp, NULL))
+               goto fail;
+       if (tmp)
+               profile->audit = AUDIT_ALL;
+
+       if (!unpack_nameX(e, AA_STRUCTEND, NULL))
+               goto fail;
+
+       /* path_flags is optional */
+       unpack_u32(e, &profile->path_flags, "path_flags");
+       profile->path_flags |= profile->flags & PFLAG_MEDIATE_DELETED;
+
+       /* mmap_min_addr is optional */
+       if (unpack_u64(e, &tmp64, "mmap_min_addr")) {
+               profile->mmap_min_addr = (unsigned long)tmp64;
+               if (((u64) profile->mmap_min_addr) == tmp64) {
+                       profile->flags |= PFLAG_MMAP_MIN_ADDR;
+               } else {
+                       sa->base.info = "invalid set mmap_min_addr";
+                       goto fail;
+               }
+       }
+
+       if (!unpack_u32(e, &(profile->caps.allowed.cap[0]), NULL))
+               goto fail;
+       if (!unpack_u32(e, &(profile->caps.audit.cap[0]), NULL))
+               goto fail;
+       if (!unpack_u32(e, &(profile->caps.quiet.cap[0]), NULL))
+               goto fail;
+       if (!unpack_u32(e, &tmpcap.cap[0], NULL))
+               goto fail;
+
+       if (unpack_nameX(e, AA_STRUCT, "caps64")) {
+               /* optional upper half of 64 bit caps */
+               if (!unpack_u32(e, &(profile->caps.allowed.cap[1]), NULL))
+                       goto fail;
+               if (!unpack_u32(e, &(profile->caps.audit.cap[1]), NULL))
+                       goto fail;
+               if (!unpack_u32(e, &(profile->caps.quiet.cap[1]), NULL))
+                       goto fail;
+               if (!unpack_u32(e, &(tmpcap.cap[1]), NULL))
+                       goto fail;
+               if (!unpack_nameX(e, AA_STRUCTEND, NULL))
+                       goto fail;
+       }
+
+       if (unpack_nameX(e, AA_STRUCT, "capsx")) {
+               /* optional extended caps mediation mask */
+               if (!unpack_u32(e, &(profile->caps.extended.cap[0]), NULL))
+                       goto fail;
+               if (!unpack_u32(e, &(profile->caps.extended.cap[1]), NULL))
+                       goto fail;
+       }
+
+       if (!unpack_rlimits(e, profile))
+               goto fail;
+
+       size = unpack_array(e, "net_allowed_af");
+       if (size) {
+               if (size > AF_MAX)
+                       goto fail;
+
+               for (i = 0; i < size; i++) {
+                       if (!unpack_u16(e, &profile->net.allowed[i], NULL))
+                               goto fail;
+                       if (!unpack_u16(e, &profile->net.audit[i], NULL))
+                               goto fail;
+                       if (!unpack_u16(e, &profile->net.quiet[i], NULL))
+                               goto fail;
+               }
+               if (!unpack_nameX(e, AA_ARRAYEND, NULL))
+                       goto fail;
+               /*
+                * allow unix domain and netlink sockets they are handled
+                * by IPC
+                */
+       }
+       profile->net.allowed[AF_UNIX] = 0xffff;
+       profile->net.allowed[AF_NETLINK] = 0xffff;
+
+       /* get file rules */
+       profile->file.dfa = unpack_dfa(e);
+       if (IS_ERR(profile->file.dfa)) {
+               error = PTR_ERR(profile->file.dfa);
+               profile->file.dfa = NULL;
+               goto fail;
+       }
+
+       if (!unpack_u32(e, &profile->file.start, "dfa_start"))
+               /* default start state */
+               profile->file.start = DFA_START;
+
+       if (!unpack_trans_table(e, profile))
+               goto fail;
+
+       if (!unpack_nameX(e, AA_STRUCTEND, NULL))
+               goto fail;
+
+       return profile;
+
+fail:
+       sa->name = name ? name : "unknown";
+       if (!sa->base.info)
+               sa->base.info = "failed to unpack profile";
+
+       aa_put_profile(profile);
+
+       return ERR_PTR(error);
+}
+
+/**
+ * aa_verify_head - unpack serialized stream header
+ * @e: serialized data read head
+ * @operation: operation header is being verified for
+ *
+ * Returns: error or 0 if header is good
+ */
+static int aa_verify_header(struct aa_ext *e, struct aa_audit_iface *sa)
+{
+       /* get the interface version */
+       if (!unpack_u32(e, &e->version, "version")) {
+               sa->base.info = "invalid profile format";
+               aa_audit_iface(sa);
+               return -EPROTONOSUPPORT;
+       }
+
+       /* check that the interface version is currently supported */
+       if (e->version != 5) {
+               sa->base.info = "unsupported interface version";
+               aa_audit_iface(sa);
+               return -EPROTONOSUPPORT;
+       }
+
+       /* read the namespace if present */
+       if (!unpack_str(e, &sa->name2, "namespace"))
+               sa->name2 = NULL;
+
+       return 0;
+}
+
+/**
+ * verify_profile - Do post unpack analysis to verify profile consistency
+ * @profile: profile to verify
+ *
+ * Returns: 0 if passes verification else error
+ */
+static bool verify_xindex(int xindex, int table_size)
+{
+       int index, xtype;
+       xtype = xindex & AA_X_TYPE_MASK;
+       index = xindex & AA_X_INDEX_MASK;
+       if (xtype == AA_X_TABLE && index > table_size)
+               return 0;
+       return 1;
+}
+
+/* verify dfa xindexes are in range of transition tables */
+static bool verify_dfa_xindex(struct aa_dfa *dfa, int table_size)
+{
+       int i;
+       for (i = 0; i < dfa->tables[YYTD_ID_ACCEPT]->td_lolen; i++) {
+               if (!verify_xindex(dfa_user_xindex(dfa, i), table_size))
+                       return 0;
+               if (!verify_xindex(dfa_other_xindex(dfa, i), table_size))
+                       return 0;
+       }
+       return 1;
+}
+
+static int verify_profile(struct aa_profile *profile, struct aa_audit_iface *sa)
+{
+       if (aa_g_paranoid_load) {
+               if (profile->file.dfa &&
+                   !verify_dfa_xindex(profile->file.dfa,
+                                      profile->file.trans.size)) {
+                       sa->base.info = "Invalid named transition";
+                       return -EPROTO;
+               }
+       }
+
+       return 0;
+}
+
+/**
+ * aa_unpack - unpack packed binary profile data loaded from user space
+ * @udata: user data copied to kmem  (NOT NULL)
+ * @size: the size of the user data
+ * @sa: audit struct for unpacking  (NOT NULL)
+ *
+ * Unpack user data and return refcounted allocated profile or ERR_PTR
+ *
+ * Returns: profile else error pointer if fails to unpack
+ */
+struct aa_profile *aa_unpack(void *udata, size_t size,
+                            struct aa_audit_iface *sa)
+{
+       struct aa_profile *profile;
+       int error;
+       struct aa_ext e = {
+               .start = udata,
+               .end = udata + size,
+               .pos = udata,
+       };
+
+       error = aa_verify_header(&e, sa);
+       if (error)
+               return ERR_PTR(error);
+
+       profile = unpack_profile(&e, sa);
+       if (IS_ERR(profile))
+               sa->pos = e.pos - e.start;
+
+       error = verify_profile(profile, sa);
+       if (error) {
+               aa_put_profile(profile);
+               profile = ERR_PTR(error);
+       }
+
+       /* return refcount */
+       return profile;
+}
diff --git a/security/apparmor/procattr.c b/security/apparmor/procattr.c
new file mode 100644
index 0000000..4991f9d
--- /dev/null
+++ b/security/apparmor/procattr.c
@@ -0,0 +1,150 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor /proc/<pid>/attr/ interface functions
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include "include/apparmor.h"
+#include "include/policy.h"
+#include "include/domain.h"
+
+/**
+ * aa_getprocattr - Return the profile information for @profile
+ * @profile: the profile to print profile info about  (NOT NULL)
+ * @string: the string that will contain the profile and namespace info (!NULL)
+ *
+ * Returns: length of @string on success else error on failure
+ *
+ * Requires: profile != NULL
+ *
+ * Creates a string containing the namespace_name://profile_name for
+ * @profile.
+ *
+ * Returns: size of string placed in @string else error code on failure
+ */
+int aa_getprocattr(struct aa_profile *profile, char **string)
+{
+       char *str;
+       int len = 0, mode_len, name_len, ns_len = 0;
+       const char *mode_str = profile_mode_names[profile->mode];
+       struct aa_namespace *ns = profile->ns;
+       char *s;
+
+       mode_len = strlen(mode_str) + 3;        /* + 3 for _() */
+       name_len = strlen(profile->base.hname);
+       if (ns != root_ns)
+               ns_len = strlen(ns->base.name) + 3; /*+ 3 for :// */
+       len = mode_len + ns_len + name_len + 1;     /*+ 1 for \n */
+       s = str = kmalloc(len + 1, GFP_ATOMIC);     /* + 1 \0 */
+       if (!str)
+               return -ENOMEM;
+
+       if (ns_len) {
+               sprintf(s, "%s://", ns->base.name);
+               s += ns_len;
+       }
+       if (profile->flags & PFLAG_UNCONFINED)
+               sprintf(s, "%s\n", profile->base.hname);
+       else
+               sprintf(s, "%s (%s)\n", profile->base.hname, mode_str);
+       *string = str;
+
+       /* NOTE: len does not include \0 of string, not saved as part of file */
+       return len;
+}
+
+/**
+ * split_token_from_name - separate a string of form  <token>^<name>
+ * @op: operation name  (NOT NULL)
+ * @args: string to parse  (NOT NULL)
+ * @token: stores returned parsed token value  (NOT NULL)
+ *
+ * Returns: start position of name after token else NULL on failure
+ */
+static char *split_token_from_name(const char *op, char *args, u64 * token)
+{
+       char *name;
+
+       *token = simple_strtoull(args, &name, 16);
+       if ((name == args) || *name != '^') {
+               AA_ERROR("%s: Invalid input '%s'", op, args);
+               return ERR_PTR(-EINVAL);
+       }
+
+       name++;                 /* skip ^ */
+       if (!*name)
+               name = NULL;
+       return name;
+}
+
+/**
+ * aa_setprocattr_chagnehat - handle procattr interface to change_hat
+ * @args: args received from writing to /proc/<pid>/attr/current (NOT NULL)
+ * @size: size of the args
+ * @test: true if this is a test of change_hat permissions
+ *
+ * Returns: %0 or error code if change_hat fails
+ */
+int aa_setprocattr_changehat(char *args, size_t size, int test)
+{
+       char *hat;
+       u64 token;
+       const char *hats[16];           /* current hard limit on # of names */
+       int count = 0;
+
+       hat = split_token_from_name("change_hat", args, &token);
+       if (IS_ERR(hat))
+               return PTR_ERR(hat);
+
+       if (!hat && !token) {
+               AA_ERROR("change_hat: Invalid input, NULL hat and NULL magic");
+               return -EINVAL;
+       }
+
+       if (hat) {
+               /* set up hat name vector, args guarenteed null terminated
+                * at args[size]
+                */
+               char *end = args + size;
+               for (count = 0; (hat < end) && count < 16; ++count) {
+                       char *next = hat + strlen(hat) + 1;
+                       hats[count] = hat;
+                       hat = next;
+               }
+       }
+
+       AA_DEBUG("%s: Magic 0x%llx Hat '%s'\n",
+                __func__, token, hat ? hat : NULL);
+
+       return aa_change_hat(hats, count, token, test);
+}
+
+/**
+ * aa_setprocattr_changeprofile - handle procattr interface to changeprofile
+ * @fqname: args received from writting to /proc/<pid>/attr/current (NOT NULL)
+ * @onexec: true if change_profile should be delayed until exec
+ * @test: true if this is a test of change_profile permissions
+ *
+ * Returns: %0 or error code if change_profile fails
+ */
+int aa_setprocattr_changeprofile(char *fqname, int onexec, int test)
+{
+       char *name, *ns_name;
+
+       name = aa_split_fqname(fqname, &ns_name);
+       return aa_change_profile(ns_name, name, onexec, test);
+}
+
+int aa_setprocattr_permipc(char *fqname)
+{
+       /* TODO: add ipc permission querying */
+       return -ENOTSUPP;
+}
diff --git a/security/apparmor/resource.c b/security/apparmor/resource.c
new file mode 100644
index 0000000..b330102
--- /dev/null
+++ b/security/apparmor/resource.c
@@ -0,0 +1,119 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor resource mediation and attachment
+ *
+ * Copyright (C) 1998-2008 Novell/SUSE
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+
+#include <linux/audit.h>
+
+#include "include/audit.h"
+#include "include/resource.h"
+#include "include/policy.h"
+
+struct aa_audit_resource {
+       struct aa_audit base;
+
+       int rlimit;
+};
+
+/* audit callback for resource specific fields */
+static void audit_cb(struct audit_buffer *ab, struct aa_audit *va)
+{
+       struct aa_audit_resource *sa = container_of(va,
+                                                   struct aa_audit_resource,
+                                                   base);
+
+       if (sa->rlimit)
+               audit_log_format(ab, " rlimit=%d", sa->rlimit - 1);
+}
+
+/**
+ * aa_audit_resource - audit setting resource limit
+ * @profile: profile being enforced  (NOT NULL)
+ * @sa: audit data  (NOT NULL)
+ *
+ * Returns: 0 or sa->error else other error code on failure
+ */
+static int aa_audit_resource(struct aa_profile *profile,
+                            struct aa_audit_resource *sa)
+{
+       return aa_audit(AUDIT_APPARMOR_AUTO, profile, &sa->base, audit_cb);
+}
+
+/**
+ * aa_task_setrlimit - test permission to set an rlimit
+ * @profile - profile confining the task  (NOT NULL)
+ * @resource - the resource being set
+ * @new_rlim - the new resource limit  (NOT NULL)
+ *
+ * Control raising the processes hard limit.
+ *
+ * Returns: 0 or error code if setting resource failed
+ */
+int aa_task_setrlimit(struct aa_profile *profile, unsigned int resource,
+                     struct rlimit *new_rlim)
+{
+       struct aa_audit_resource sa = {
+               .base.operation = "setrlimit",
+               .base.gfp_mask = GFP_KERNEL,
+               .rlimit = resource + 1,
+       };
+       int error = 0;
+
+       if (profile->rlimits.mask & (1 << resource) &&
+           new_rlim->rlim_max > profile->rlimits.limits[resource].rlim_max) {
+               sa.base.error = -EACCES;
+
+               error = aa_audit_resource(profile, &sa);
+       }
+
+       return error;
+}
+
+/**
+ * __aa_transition_rlimits - apply new profile rlimits
+ * @old: old profile on task  (MAYBE NULL)
+ * @new: new profile with rlimits to apply  (NOT NULL)
+ */
+void __aa_transition_rlimits(struct aa_profile *old, struct aa_profile *new)
+{
+       unsigned int mask = 0;
+       struct rlimit *rlim, *initrlim;
+       int i;
+
+       /* for any rlimits the profile controlled reset the soft limit
+        * to the less of the tasks hard limit and the init tasks soft limit
+        */
+       if (old && old->rlimits.mask) {
+               for (i = 0, mask = 1; i < RLIM_NLIMITS; i++, mask <<= 1) {
+                       if (old->rlimits.mask & mask) {
+                               rlim = current->signal->rlim + i;
+                               initrlim = init_task.signal->rlim + i;
+                               rlim->rlim_cur = min(rlim->rlim_max,
+                                                    initrlim->rlim_cur);
+                       }
+               }
+       }
+
+       /* set any new hard limits as dictated by the new profile */
+       if (!(new && new->rlimits.mask))
+               return;
+       for (i = 0, mask = 1; i < RLIM_NLIMITS; i++, mask <<= 1) {
+               if (!(new->rlimits.mask & mask))
+                       continue;
+
+               rlim = current->signal->rlim + i;
+               rlim->rlim_max = min(rlim->rlim_max,
+                                    new->rlimits.limits[i].rlim_max);
+               /* soft limit should not exceed hard limit */
+               rlim->rlim_cur = min(rlim->rlim_cur, rlim->rlim_max);
+       }
+}
diff --git a/security/apparmor/sid.c b/security/apparmor/sid.c
new file mode 100644
index 0000000..e0b76de
--- /dev/null
+++ b/security/apparmor/sid.c
@@ -0,0 +1,55 @@
+/*
+ * AppArmor security module
+ *
+ * This file contains AppArmor security identifier (sid) manipulation fns
+ *
+ * Copyright 2009-2010 Canonical Ltd.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ *
+ *
+ * AppArmor allocates a unique sid for every profile loaded.  If a profile
+ * is replaced it receive the sid of the profile it is replacing.
+ *
+ * The sid value of 0 is invalid.
+ */
+
+#include <linux/spinlock.h>
+#include <linux/errno.h>
+#include <linux/err.h>
+
+#include "include/sid.h"
+
+/* global counter from which sids are allocated */
+static u16 global_sid;
+static DEFINE_SPINLOCK(sid_lock);
+
+/* TODO FIXME: add sid to profile mapping, and sid recycling */
+
+/**
+ * aa_alloc_sid - allocate a new sid for a profile
+ */
+u32 aa_alloc_sid(void)
+{
+       u32 sid;
+
+       /*
+        * TODO FIXME: sid recycling - part of profile mapping table
+        */
+       spin_lock(&sid_lock);
+       sid = (++global_sid);
+       spin_unlock(&sid_lock);
+       return sid;
+}
+
+/**
+ * aa_free_sid - free a sid
+ * @sid: sid to free
+ */
+void aa_free_sid(u32 sid)
+{
+       ;                       /* NOP ATM */
+}