98e984f0da
commit 58acf9d911c8831156634a44d0b022d683e1e50c upstream. the policy_lock parameter is a one way switch that prevents policy from being further modified. Unfortunately some of the module parameters can effectively modify policy by turning off enforcement. split policy_admin_capable into a view check and a full admin check, and update the admin check to test the policy_lock parameter. Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|---|---|---|
| .. | ||
| include | ||
| apparmorfs.c | ||
| audit.c | ||
| capability.c | ||
| context.c | ||
| crypto.c | ||
| domain.c | ||
| file.c | ||
| ipc.c | ||
| Kconfig | ||
| lib.c | ||
| lsm.c | ||
| Makefile | ||
| match.c | ||
| path.c | ||
| policy_unpack.c | ||
| policy.c | ||
| procattr.c | ||
| resource.c | ||
| sid.c | ||