Comment 4 for bug 1499544

Revision history for this message
John Johansen (jjohansen) wrote :

Please Note: the use of long profile names (anything over 32 chars) is problematic.

There are other interfaces that have smaller limits and standard interfaces/programs that will truncate long names.
Eg. ps -Z will truncate a name if it is too long (note: the get_procattr interface allows for PAGE_SIZE but applications may read less or truncate for display purposes).

the cipso interface has a hard limit of 32 characters, so some form of mangling will have to be used to send info over the that interface.

stacking of profiles can make for extremely long names, so stacking of 10 profiles (possible) with 32 characters will result in a name that is 320 characters long.

The kernel audit buffer is restricted to PAGE_SIZE for all information being audited, so long profile names may result in either some information not being audited (truncated) or the log message failing.

Note: the xattr size limit of 255 for name and 64k for associated data should not be a problem for static labels as the name is short apparmor, and even stacked profile names should fit in 64k.