29 Kernel_Feature_Matrix

John Johansen edited this page 2021-11-16 09:03:16 +00:00

Table of Contents

• Upstream kernel
• SUSE/openSUSE kernel
• Ubuntu Kernel

Upstream kernel

Kernel Version	Feature	Required userspace version and notes
2.6.36	Base functionality lands upstream mediation of1: File owner conditional read, write, link, lock, mmap exec Execute [pP]x, [cC]x, ix, ux, [pP]ix, [pP]ux named transitions attachment conditional separate from profile name Change hat single hat Change Profile Capability policy namespaces created through policy load rlimit Bug fixes and code cleanups	1 AppArmor 2.5.1
2.6.37 - 3.3	Bug fixes and code cleanups
3.4	Add support for extensible policydb1 feature set add features/ directory as a userspace api to discover kernel supported feature set add file mediation details add capability mediation details export known rlimit mappings	1 AppArmor 2.8
3.5	Fail exec transitions due to no_new_privs unconfined is allowed to transition to anything inherit is allowed when task has nnp set all other domain transitions are blocked when a task has nnp set Bug fixes and code cleanups
3.6 - 3.10	Bug fixes and code cleanups
3.11	relax restrictions on setting rlimits Bug fixes and code cleanups
3.12	support unconfined flag on any profile4 support multiple profiles being loaded in a single write1 introspection interface add ability to query whether apparmor is enabled? allow introspecting the loaded set of profiles virtualized to the opening tasks namespace via the profiles file? add policy/ directory which can be used to introspect profiles and namespaces of loaded policy? add policy/namespaces/ dir to introspect policy namespaces add policy/profiles/ dir to report on profiles loaded into the current namespace report profile name policy/profiles/PROFILE/name report profile mode policy/profiles/PROFILE/mode report sha1 of profile policy/profiles/PROFILE/sha1 allow human readable attachment string to be loaded and reported in the policy/profiles/PROFILE/attach feature set export set of capabilities supported Bug fixes and code cleanups	1 AppArmor 2.10 2 ??? 3 ???? 4 AppArmor 3.0
3.13 - 4.7	Bug fixes and code cleanups
4.8	allow CAP_SYS_RESOURCE to prlimit another task add kernel parameter and kconfig to allow controlling if profile hashing is used Bug fixes and code cleanups
4.9 - 4.10	Bug fixes and code cleanups
4.11	add /sys/kernel/security/lsm to enable detecting currently in use lsm kernel parameters remove paranoid load parameter - all policy loads now do full checking speedup mediation by use of percpu buffers add sysctl /proc/sys/kernel/unprivileged_userns_apparmor_policy to allow disabling user namespaces from loading policy add query interface for extended profile key,value data store1 allow profile hashing to be disabled with a kconfing2 policy namespaces add namespace view support and restrictions on visibility add per namespace policy interface file to directly load policy into a namespace policy/namespaces/NAMESPACE/.load policy/namespaces/NAMESPACE/.replace policy/namespaces/NAMESPACE/.remove allow introspecting and checkpoint and restore of loaded profile data via policy/profiles/PROFILE/raw_abi policy/profiles/PROFILE/raw_data policy/profiles/PROFILE/raw_sha1 on exec dup2 opened files that the task won't have permission to access to a special .null device file3 Complain mode support force complain flag1 try to create null profiles using the exec name null-EXECNAME feature set add features/domain/fix_binfmt_elf_mmap to enable userspace to detect the semantic change caused by 9f834ec18def report namespace name in audit messages Bug fixes and code cleanups	1 AppArmor 3.0 2 Disables kernel profile load dedup to improve initial profile load performance 3 Does not change file access permissions, just where the check is done. Can result in mediation that would not occur under the old scheme due to some inherited fds never being accessed. 4 gen/logprof support???
4.12	kernel parameters make path_max readonly Bug fixes and code cleanups
4.13	add v7 abi1 speedup path lookups with preallocated buffers revalidate files at exec transition time fine grained ptrace mediation domain bounding through profile stacking1 profile stacking api extended change_profile to support profile stacking support profile stacks in exec transitions nnp restrictions loosened to any transition that is a strict subset. New profiles can be added to the stack but profiles can not be transitioned. apparmorfs interface apparmorfs policy virtualization the policy/ entry is now a special symlink to a virtualized policy directory policy/ directory is now virtualized based on opening task confinement so tasks can only see the subset of policy in their view add namespace level rawdata files unique profile based rawdata files for each namespace in policy/raw_data/ profile raw_data files are now a symlink to the appropriate policy/raw_data/ files. mkdir/rmdir fs based interface for creating namespaces mkdir policy/namespaces/NAMESPACE rmdir policy/namespaces/NAMESPACE revision file interface2 read current policy revision and select/poll for when policy changes via revision for reading the current task's policy namespace revision policy/revision for the current namespace revision policy/namespaces/NAMESPACE/revision for a given namespace policy revision query interface support multiple queries per query transaction3 support querying if a profile supports a given mediation type4 features set add namespace support to available feature set add label data query availability to feature set Bug fixes and code cleanups	1 AppArmor 2.10 2 library interface added to AppArmor 3.0, can be used directly with any version apparmor 3 AppArmor 3.0 4 AppArmor 3.0????
4.14	mount mediation1 new mount remount bind mount change type umount pivot_root signal mediation2 policy unpack log extended error messages Bug fixes and code cleanups	1 AppArmor 2.8 2 AppArmor 2.9
4.15 - 4.16	Bug fixes and code cleanups
4.17	v8 abi1 generic socket mediation (ie. basic network mediation)1 improved profile attachment logic handle overlapping expression resolution up to 8 characters dynamic overlap in kernel2 xattr attachment conditional1 no_new_privs improved attachment with subset test based on confinement at time no_new_privs was entered3 signal mediation of profile stacks4 Bug fixes and code cleanups	1 AppArmor 3.0 and requires policy using feature abi rules 2 Any userspace that supports attachment conditionasl 2.5+ 3 no userspace requirements, reduces cases where nnp prevents a transition 4Same userspace as regular signal mediation AppArmor 2.9
4.18	add support for secids and using secctxes the ability to get a task's secid add support for audit rules filtering. AppArmor task label can be used in audit rule filters Bug fixes and code cleanups	No apparmor userspace requirements.
4.19	Bug fixes and code cleanups
4.20	Secmark mediation for custom policy1 Bug fixes and code cleanups	1 Custom patch not in upstream apparmor
5.0	Bug fixes and code cleanups
5.1	LSM stacking with generic blobs (sara/landlock). Does not include secids so insufficient to stack with selinux and smack. Bug fixes and code cleanups	no userspace requirements. There is a new kernel parameter lsm= that is used in place of the old security= parameter
5.2	bug fixes
5.5	raw policy data compression buffer allocation converted to memory pool instead of per cpu buffers increase left match history buffer to 24
5.6	kunit tests for policy unpack
5.7	memory leak bug fixes
5.8	add out of band transitions more kunit tests fix introspection of unconfined tasks fix nonewprivs subset test for unconfined
5.16	improved locking on the query interface fix capability checks when LSM stacking is used

SUSE/openSUSE kernel

Network rules are supported since sles11-sp1 (source: https://bugzilla.suse.com/show_bug.cgi?id=917431#c10)

Ubuntu Kernel