[apparmor] [patch] apparmor: add parameter to control whether policy hashing is used

[Seth Arnold]

On Thu, Oct 23, 2014 at 11:51:30AM -0400, John Johansen wrote:
> From 0c0a584c0d073a51e2e8b4c23e7c96f1d3abc358 Mon Sep 17 00:00:00 2001
> From: John Johansen <john.johansen at canonical.com>
> Date: Wed, 22 Oct 2014 18:04:34 -0400
> Subject: [PATCH] apparmor: add parameter to control whether policy hashing is
>  used
> 
> Signed-off-by: John Johansen <john.johansen at canonical.com>

Acked-by: Seth Arnold <seth.arnold at canonical.com>

Thanks

> ---
>  security/apparmor/include/apparmor.h | 1 +
>  security/apparmor/lsm.c              | 4 ++++
>  security/apparmor/policy_unpack.c    | 5 +++--
>  3 files changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/security/apparmor/include/apparmor.h b/security/apparmor/include/apparmor.h
> index a59a330..7d2f457 100644
> --- a/security/apparmor/include/apparmor.h
> +++ b/security/apparmor/include/apparmor.h
> @@ -52,6 +52,7 @@
>  extern enum audit_mode aa_g_audit;
>  extern bool aa_g_audit_header;
>  extern bool aa_g_debug;
> +extern bool aa_g_hash_policy;
>  extern bool aa_g_lock_policy;
>  extern bool aa_g_logsyscall;
>  extern bool aa_g_paranoid_load;
> diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
> index cd2b4f4..5a7eb43 100644
> --- a/security/apparmor/lsm.c
> +++ b/security/apparmor/lsm.c
> @@ -1248,6 +1248,10 @@ enum profile_mode aa_g_profile_mode = APPARMOR_ENFORCE;
>  module_param_call(mode, param_set_mode, param_get_mode,
>  		  &aa_g_profile_mode, S_IRUSR | S_IWUSR);
>  
> +/* whether policy verification hashing is enabled */
> +bool aa_g_hash_policy = CONFIG_SECURITY_APPARMOR_HASH;
> +module_param_named(hash_policy, aa_g_hash_policy, aabool, S_IRUSR | S_IWUSR);
> +
>  /* Debug mode */
>  bool aa_g_debug;
>  module_param_named(debug, aa_g_debug, aabool, S_IRUSR | S_IWUSR);
> diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
> index 188d36e..7f63b67 100644
> --- a/security/apparmor/policy_unpack.c
> +++ b/security/apparmor/policy_unpack.c
> @@ -832,8 +832,9 @@ int aa_unpack(void *udata, size_t size, struct list_head *lh, const char **ns)
>  		if (error)
>  			goto fail_profile;
>  
> -		error = aa_calc_profile_hash(profile, e.version, start,
> -					     e.pos - start);
> +		if (aa_g_hash_policy)
> +			error = aa_calc_profile_hash(profile, e.version, start,
> +						     e.pos - start);
>  		if (error)
>  			goto fail_profile;
>  
> -- 
> 2.1.0
> 
> 
> -- 
> AppArmor mailing list
> AppArmor at lists.ubuntu.com
> Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/apparmor/attachments/20141023/b0536035/attachment.pgp>