linux-toradex.git/security/apparmor/policy_unpack.c, branch v4.9.15

apparmor: fix SECURITY_APPARMOR_HASH_DEFAULT parameter handling

2016-07-27T07:39:26+00:00

The newly added Kconfig option could never work and just causes a build error
when disabled:

security/apparmor/lsm.c:675:25: error: 'CONFIG_SECURITY_APPARMOR_HASH_DEFAULT' undeclared here (not in a function)
 bool aa_g_hash_policy = CONFIG_SECURITY_APPARMOR_HASH_DEFAULT;

The problem is that the macro undefined in this case, and we need to use the IS_ENABLED()
helper to turn it into a boolean constant.

Another minor problem with the original patch is that the option is even offered
in sysfs when SECURITY_APPARMOR_HASH is not enabled, so this also hides the option
in that case.

Signed-off-by: Arnd Bergmann 
Fixes: 6059f71f1e94 ("apparmor: add parameter to control whether policy hashing is used")
Signed-off-by: John Johansen 
Signed-off-by: James Morris

apparmor: fix oops in profile_unpack() when policy_db is not present

2016-07-12T15:43:10+00:00

BugLink: http://bugs.launchpad.net/bugs/1592547

If unpack_dfa() returns NULL due to the dfa not being present,
profile_unpack() is not checking if the dfa is not present (NULL).

Signed-off-by: John Johansen

apparmor: check that xindex is in trans_table bounds

2016-07-12T15:43:10+00:00

Signed-off-by: John Johansen 
Acked-by: Seth Arnold

apparmor: add parameter to control whether policy hashing is used

2016-07-12T15:43:10+00:00

Signed-off-by: John Johansen 
Acked-by: Tyler Hicks 
Acked-by: Seth Arnold

apparmor: add the ability to report a sha1 hash of loaded policy

2013-08-14T18:42:08+00:00

Provide userspace the ability to introspect a sha1 hash value for each
profile currently loaded.

Signed-off-by: John Johansen 
Acked-by: Seth Arnold

apparmor: add an optional profile attachment string for profiles

2013-08-14T18:42:07+00:00

Add the ability to take in and report a human readable profile attachment
string for profiles so that attachment specifications can be easily
inspected.

Signed-off-by: John Johansen 
Acked-by: Seth Arnold

apparmor: allow setting any profile into the unconfined state

2013-08-14T18:42:07+00:00

Allow emulating the default profile behavior from boot, by allowing
loading of a profile in the unconfined state into a new NS.

Signed-off-by: John Johansen 
Acked-by: Seth Arnold

apparmor: make free_profile available outside of policy.c

2013-08-14T18:42:06+00:00

Signed-off-by: John Johansen

apparmor: provide base for multiple profiles to be replaced at once

2013-08-14T18:42:06+00:00

previously profiles had to be loaded one at a time, which could result
in cases where a replacement of a set would partially succeed, and then fail
resulting in inconsistent policy.

Allow multiple profiles to replaced "atomically" so that the replacement
either succeeds or fails for the entire set of profiles.

Signed-off-by: John Johansen

apparmor: remove sid from profiles

2013-04-28T07:37:13+00:00

The sid is not going to be a direct property of a profile anymore, instead
it will be directly related to the label, and the profile will pickup
a label back reference.

For null-profiles replace the use of sid with a per namespace unique
id.

Signed-off-by: John Johansen 
Acked-by: Kees Cook