John Johansen 04b029c359 apparmor: fix module parameters can be changed after policy is locked ...

commit 58acf9d911c8831156634a44d0b022d683e1e50c upstream.

the policy_lock parameter is a one way switch that prevents policy
from being further modified. Unfortunately some of the module parameters
can effectively modify policy by turning off enforcement.

split policy_admin_capable into a view check and a full admin check,
and update the admin check to test the policy_lock parameter.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2019-11-25 15:54:22 +01:00

..

include

apparmor: fix module parameters can be changed after policy is locked

2019-11-25 15:54:22 +01:00

.gitignore

AppArmor: remove af_names.h from .gitignore

2012-09-01 08:35:34 -07:00

apparmorfs.c

apparmor: fix update the mtime of the profile file on replacement

2019-11-25 15:54:21 +01:00

audit.c

apparmor: fix uninitialized lsm_audit member

2019-11-25 15:54:21 +01:00

capability.c

apparmor: fix capability to not use the current task, during reporting

2013-10-29 21:33:37 -07:00

context.c

apparmor: change how profile replacement update is done

2013-08-14 11:42:06 -07:00

crypto.c

apparmor: Use shash crypto API interface for profile hashes

2013-09-30 09:53:59 +10:00

domain.c

apparmor: fix change_hat not finding hat after policy replacement

2016-12-02 09:09:01 +01:00

file.c

apparmor: fix uninitialized lsm_audit member

2019-11-25 15:54:21 +01:00

ipc.c

apparmor: fix capability to not use the current task, during reporting

2013-10-29 21:33:37 -07:00

Kconfig

apparmor: clarify CRYPTO dependency

2015-10-22 11:11:28 +11:00

lib.c

nick kvfree() from apparmor

2014-05-06 14:02:53 -04:00

lsm.c

apparmor: fix module parameters can be changed after policy is locked

2019-11-25 15:54:22 +01:00

Makefile

apparmor: add the ability to report a sha1 hash of loaded policy

2013-08-14 11:42:08 -07:00

match.c

apparmor: reserve and mask off the top 8 bits of the base field

2013-04-28 00:37:32 -07:00

path.c

Apparmor: Use d_is_positive/negative() rather than testing dentry->d_inode

2015-02-22 11:38:39 -05:00

policy_unpack.c

apparmor: enforce nullbyte at end of tag string

2019-07-10 09:56:31 +02:00

policy.c

apparmor: fix module parameters can be changed after policy is locked

2019-11-25 15:54:22 +01:00

procattr.c

apparmor: add interface files for profiles and namespaces

2013-08-14 11:42:07 -07:00

resource.c

apparmor: relax the restrictions on setting rlimits

2013-04-28 00:36:46 -07:00

sid.c

AppArmor: core policy routines

2010-08-02 15:38:37 +10:00