Searched hist:"58 acf9d9" (Results 1 – 3 of 3) sorted by relevance
/openbmc/linux/security/apparmor/include/ |
H A D | policy.h | 58acf9d9 Wed Jun 22 20:01:08 CDT 2016 John Johansen <john.johansen@canonical.com> apparmor: fix module parameters can be changed after policy is locked
the policy_lock parameter is a one way switch that prevents policy from being further modified. Unfortunately some of the module parameters can effectively modify policy by turning off enforcement.
split policy_admin_capable into a view check and a full admin check, and update the admin check to test the policy_lock parameter.
Signed-off-by: John Johansen <john.johansen@canonical.com> 58acf9d9 Wed Jun 22 20:01:08 CDT 2016 John Johansen <john.johansen@canonical.com> apparmor: fix module parameters can be changed after policy is locked the policy_lock parameter is a one way switch that prevents policy from being further modified. Unfortunately some of the module parameters can effectively modify policy by turning off enforcement. split policy_admin_capable into a view check and a full admin check, and update the admin check to test the policy_lock parameter. Signed-off-by: John Johansen <john.johansen@canonical.com>
|
/openbmc/linux/security/apparmor/ |
H A D | policy.c | 58acf9d9 Wed Jun 22 20:01:08 CDT 2016 John Johansen <john.johansen@canonical.com> apparmor: fix module parameters can be changed after policy is locked
the policy_lock parameter is a one way switch that prevents policy from being further modified. Unfortunately some of the module parameters can effectively modify policy by turning off enforcement.
split policy_admin_capable into a view check and a full admin check, and update the admin check to test the policy_lock parameter.
Signed-off-by: John Johansen <john.johansen@canonical.com>
|
H A D | lsm.c | 58acf9d9 Wed Jun 22 20:01:08 CDT 2016 John Johansen <john.johansen@canonical.com> apparmor: fix module parameters can be changed after policy is locked
the policy_lock parameter is a one way switch that prevents policy from being further modified. Unfortunately some of the module parameters can effectively modify policy by turning off enforcement.
split policy_admin_capable into a view check and a full admin check, and update the admin check to test the policy_lock parameter.
Signed-off-by: John Johansen <john.johansen@canonical.com>
|