bend-osdev-apparmor

Releases (1)

• 0.1.0.0 indexed

Definitions (1,104)

check.bend

• def load1a one-file policy
• def g
• def pol
• def big.rules
• def big.text
• def big.path.go
• def big.path
• def big.query
• def main

error.bend

• type AaError
• def AaError.line
• def AaError.name
• type AaSrcwhere a statement came from: what rule parsers report errors against
• def AaSrc.line
• def AaSrc.lex
• def AaSrc.syntax
• def AaSrc.glob
• def AaSrc.name
• def AaSrc.perms
• def AaSrc.unsupported
• def AaSrc.include
• def AaSrc.include_depth
• def AaSrc.var_undefined
• def AaSrc.var_redefined
• def AaSrc.preamble
• def AaSrc.flag
• def AaSrc.duplicate
• def AaSrc.exec_conflict

eval.bend

• type AaDecision
• def AaDecision.allowed
• def AaDecision.show
• type AaAcc
• def AaAcc.empty
• def AaAcc.jointwo accumulations together: each set the union
• def AaAcc.single.gowhat one grant contributes: allowed or denied; audited, or (for a denial without audit) quieted
• def AaAcc.single
• def AaAcc.add
• def AaAcc.from
• def AaAcc.of
• def AaAcc.allow
• def AaAcc.deny
• def AaAcc.audit
• def AaAcc.quiet
• def AaAcc.grantedwhat the grants allow and do not deny
• def AaEval.granted
• def AaEval.deniedwhat the grants deny
• def AaEval.choose
• def AaEval.decide.modecov: the grants cover the request; hit: a deny rule meets it; cd: AaOptions.complain_deny; ok: the allowed outcome; no: the denied one
• def AaEval.decide.acc
• def AaEval.decidethe decision on a request for the permissions req, given the grants of the rules that match it, under a profile's flags
• def AaEval.deny_applieswhether a deny rule decides under these options and mode: every mode but unconfined, and complain only with complain_deny
• def AaEval.file
• def AaEval.capability
• def AaEval.network
• def AaEval.signal
• def AaEval.ptrace
• def AaEval.mount
• def AaEval.dbus
• def AaEval.change_profile

example.bend

• def AaExample.qual
• def AaExample.rulea file rule on a literal path
• def AaExample.rulesprofile ex: /etc/x rw, deny /etc/x w, audit /var/log/x w, /lib/** (built as a literal-free pattern) r; no x rule anywhere
• def AaExample.profile
• def AaExample.policy
• def AaExample.query
• def AaExample.source
• def AaExample.files
• def AaExample.loaded
• def AaExample.pol
• def AaExample.file
• def AaExample.exec
• def AaExample.small_filesA smaller policy, for the laws' vectors (the checker's kernel evaluates them, so they are kept short)
• def AaExample.small
• def AaExample.small_file
• def AaExample.small_exec

glob.bend

• type AaGRange
• type AaGTok
• type AaGlob
• def AaGRange.has
• def AaGClass.any
• def AaGClass.has
• def AaGSeq.matches
• def AaGNfa.hd
• def AaGNfa.tl
• def AaGNfa.staya star stays on a byte (* on anything but '/', ** on anything)
• def AaGNfa.adva single-byte token moves past a byte it takes
• def AaGNfa.isstara star may match nothing: the position after it is active too
• def AaGNfa.nextthe positions active after the byte h: cin, the position is reached without a byte (after a star); ain, the previous position moved here
• def AaGNfa.semwhat a set of positions accepts: some active position's suffix matches s
• def AaGNfa.alivesome position is active
• def AaGNfa.runthe positions moved along the path; at its end, the active positions whose suffixes match the empty string accept.
• def AaGNfa.falses
• def AaGNfa.startonly the first position (the whole sequence) is active
• def AaGSeq.runthe matcher evaluation uses
• def AaGPiece.no_slashno byte of p is '/'
• def AaGPiece.onethe piece p is one byte b for which ok holds
• def AaGPiece.first
• def AaGTok.piecethe piece p matches the token
• def AaGCuts.empty_firstthe cuts with an empty first piece
• def AaGCuts.growthe cuts with h put in front of the first piece