projects / platform / kernel / linux-rpi.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 5f20fdf) | patch
apparmor: fix module parameters can be changed after policy is locked
authorJohn Johansen <john.johansen@canonical.com>
Thu, 23 Jun 2016 01:01:08 +0000 (18:01 -0700)
committerJohn Johansen <john.johansen@canonical.com>
Tue, 12 Jul 2016 15:43:10 +0000 (08:43 -0700)
commit58acf9d911c8831156634a44d0b022d683e1e50c
treedf76653f50579f989c36eab7139919523f50d561tree | snapshot
parent5f20fdfed16bc599a325a145bf0123a8e1c9beeacommit | diff
apparmor: fix module parameters can be changed after policy is locked

the policy_lock parameter is a one way switch that prevents policy
from being further modified. Unfortunately some of the module parameters
can effectively modify policy by turning off enforcement.

split policy_admin_capable into a view check and a full admin check,
and update the admin check to test the policy_lock parameter.

Signed-off-by: John Johansen <john.johansen@canonical.com>
security/apparmor/include/policy.h diff | blob | history
security/apparmor/lsm.c diff | blob | history
security/apparmor/policy.c diff | blob | history
Domain: System / Kernel;