Searched hist:"58 acf9d9" (Results 1 – 3 of 3) sorted by relevance
| /openbmc/linux/security/apparmor/include/ |
| H A D | policy.h | 58acf9d9 Wed Jun 22 20:01:08 CDT 2016 John Johansen <john.johansen@canonical.com> apparmor: fix module parameters can be changed after policy is locked
the policy_lock parameter is a one way switch that prevents policy
from being further modified. Unfortunately some of the module parameters
can effectively modify policy by turning off enforcement.
split policy_admin_capable into a view check and a full admin check,
and update the admin check to test the policy_lock parameter.
Signed-off-by: John Johansen <john.johansen@canonical.com>
58acf9d9 Wed Jun 22 20:01:08 CDT 2016 John Johansen <john.johansen@canonical.com> apparmor: fix module parameters can be changed after policy is locked
the policy_lock parameter is a one way switch that prevents policy
from being further modified. Unfortunately some of the module parameters
can effectively modify policy by turning off enforcement.
split policy_admin_capable into a view check and a full admin check,
and update the admin check to test the policy_lock parameter.
Signed-off-by: John Johansen <john.johansen@canonical.com>
|
| /openbmc/linux/security/apparmor/ |
| H A D | policy.c | 58acf9d9 Wed Jun 22 20:01:08 CDT 2016 John Johansen <john.johansen@canonical.com> apparmor: fix module parameters can be changed after policy is locked
the policy_lock parameter is a one way switch that prevents policy
from being further modified. Unfortunately some of the module parameters
can effectively modify policy by turning off enforcement.
split policy_admin_capable into a view check and a full admin check,
and update the admin check to test the policy_lock parameter.
Signed-off-by: John Johansen <john.johansen@canonical.com>
|
| H A D | lsm.c | 58acf9d9 Wed Jun 22 20:01:08 CDT 2016 John Johansen <john.johansen@canonical.com> apparmor: fix module parameters can be changed after policy is locked
the policy_lock parameter is a one way switch that prevents policy
from being further modified. Unfortunately some of the module parameters
can effectively modify policy by turning off enforcement.
split policy_admin_capable into a view check and a full admin check,
and update the admin check to test the policy_lock parameter.
Signed-off-by: John Johansen <john.johansen@canonical.com>
|