John Johansen 04b029c359 apparmor: fix module parameters can be changed after policy is locked ...

commit 58acf9d911 upstream.

the policy_lock parameter is a one way switch that prevents policy
from being further modified. Unfortunately some of the module parameters
can effectively modify policy by turning off enforcement.

split policy_admin_capable into a view check and a full admin check,
and update the admin check to test the policy_lock parameter.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2019-11-25 15:54:22 +01:00

..

apparmor

apparmor: fix module parameters can be changed after policy is locked

2019-11-25 15:54:22 +01:00

integrity

ima: always return negative code for error

2019-10-17 13:40:54 -07:00

keys

keys: Fix missing null pointer check in request_key_auth_describe()

2019-09-21 07:12:53 +02:00

selinux

selinux: fix memory leak in policydb_init()

2019-08-06 18:28:28 +02:00

smack

smack: use GFP_NOFS while holding inode_smack::smk_lock

2019-10-07 21:01:07 +02:00

tomoyo

mm: replace get_user_pages() write/force parameters with gup_flags

2018-12-17 21:55:16 +01:00

yama

Yama: Check for pid death before checking ancestry

2019-01-26 09:42:50 +01:00

commoncap.c

ptrace: use fsuid, fsgid, effective creds for fs access checks

2016-02-25 12:01:16 -08:00

device_cgroup.c

device_cgroup: fix RCU imbalance in error case

2019-04-27 09:34:02 +02:00

inode.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-07-04 19:36:06 -07:00

Kconfig

KPTI: Rename to PAGE_TABLE_ISOLATION

2018-01-05 15:44:26 +01:00

lsm_audit.c

missing barriers in some of unix_sock ->addr and ->path accesses

2019-03-23 08:44:31 +01:00

Makefile

LSM: Switch to lists of hooks

2015-05-12 15:00:41 +10:00

min_addr.c

mmap_min_addr check CAP_SYS_RAWIO only for write

2010-04-23 08:56:31 +10:00

security.c

LSM: Check for NULL cred-security on free

2019-01-26 09:42:50 +01:00