diff options
| author | John Johansen <john.johansen@canonical.com> | 2016-06-22 18:01:08 -0700 |
|---|---|---|
| committer | Mister Oyster <oysterized@gmail.com> | 2017-07-04 11:51:27 +0200 |
| commit | 66205a5891ee4cf555db5c3d86bc2257037b127b (patch) | |
| tree | 2be41f3cf46ecf37d11bf745e84bdf6f4b0a1789 /security/apparmor/match.c | |
| parent | e8ab89e5484950967c8ef5d29586480b98bc09ee (diff) | |
apparmor: fix module parameters can be changed after policy is locked
commit 58acf9d911c8831156634a44d0b022d683e1e50c upstream.
the policy_lock parameter is a one way switch that prevents policy
from being further modified. Unfortunately some of the module parameters
can effectively modify policy by turning off enforcement.
split policy_admin_capable into a view check and a full admin check,
and update the admin check to test the policy_lock parameter.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Diffstat (limited to 'security/apparmor/match.c')
0 files changed, 0 insertions, 0 deletions