From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:35674 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726844AbeIRCov (ORCPT ); Mon, 17 Sep 2018 22:44:51 -0400 Date: Mon, 17 Sep 2018 23:15:42 +0200 From: Greg KH To: Loic Cc: stable@vger.kernel.org, arnd@arndb.de, john.johansen@canonical.com, james.l.morris@oracle.com Subject: Re: [PATCH] apparmor: fix SECURITY_APPARMOR_HASH_DEFAULT parameter handling Message-ID: <20180917211542.GA17153@kroah.com> References: <77adc4c42d68501927b5a9150f9f0d62@search.opensec.fr> <20180917135856.GB28797@kroah.com> <20180917214547.d9ba29425cf87881179c27ef@opensec.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20180917214547.d9ba29425cf87881179c27ef@opensec.fr> Sender: stable-owner@vger.kernel.org List-ID: On Mon, Sep 17, 2018 at 09:45:47PM +0200, Loic wrote: > On Mon, 17 Sep 2018 15:58:56 +0200 > Greg KH wrote: > > > On Sun, Sep 09, 2018 at 04:04:18PM +0200, Loic wrote: > > > Hello, > > > > > > Tested without any problem so please picked up this for 4.4 to fix the > > > problem. > > > The patch below is slightly modified to adapt to this version. > > > > > > [ Upstream commit 7616ac70d1bb4f2e9d25c1a82d283f3368a7b632 ] > > > > > > The newly added Kconfig option could never work and just causes a build > > > error > > > when disabled: > > > > > > security/apparmor/lsm.c:675:25: error: > > > 'CONFIG_SECURITY_APPARMOR_HASH_DEFAULT' undeclared here (not in a function) > > > bool aa_g_hash_policy = CONFIG_SECURITY_APPARMOR_HASH_DEFAULT; > > > > > > The problem is that the macro undefined in this case, and we need to use the > > > IS_ENABLED() > > > helper to turn it into a boolean constant. > > > > > > Another minor problem with the original patch is that the option is even > > > offered > > > in sysfs when SECURITY_APPARMOR_HASH is not enabled, so this also hides the > > > option > > > in that case. > > > > > > Signed-off-by: Arnd Bergmann > > > Fixes: 6059f71f1e94 ("apparmor: add parameter to control whether policy > > > hashing is used") > > > Signed-off-by: John Johansen > > > Signed-off-by: James Morris > > > --- > > > diff -Nurp a/security/apparmor/crypto.c b/security/apparmor/crypto.c > > > --- a/security/apparmor/crypto.c > > > +++ b/security/apparmor/crypto.c > > > @@ -39,6 +39,9 @@ int aa_calc_profile_hash(struct aa_profi > > > int error = -ENOMEM; > > > u32 le32_version = cpu_to_le32(version); > > > > > > + if (!aa_g_hash_policy) > > > + return 0; > > > + > > > if (!apparmor_tfm) > > > return 0; > > > > > > diff -Nurp a/security/apparmor/lsm.c b/security/apparmor/lsm.c > > > --- a/security/apparmor/lsm.c > > > +++ b/security/apparmor/lsm.c > > > @@ -692,6 +692,12 @@ enum profile_mode aa_g_profile_mode = AP > > > module_param_call(mode, param_set_mode, param_get_mode, > > > &aa_g_profile_mode, S_IRUSR | S_IWUSR); > > > > > > +#ifdef CONFIG_SECURITY_APPARMOR_HASH > > > +/* whether policy verification hashing is enabled */ > > > +bool aa_g_hash_policy = IS_ENABLED(CONFIG_SECURITY_APPARMOR_HASH_DEFAULT); > > > +module_param_named(hash_policy, aa_g_hash_policy, aabool, S_IRUSR | > > > S_IWUSR); > > > +#endif > > > + > > > /* Debug mode */ > > > bool aa_g_debug; > > > module_param_named(debug, aa_g_debug, aabool, S_IRUSR | S_IWUSR); > > > --- > > > > The patch is whitespace corrupted and can not be applied :( > > Sorry, I noticed the problem afterwards. I opened a bug report to try to fix my mail client: > https://github.com/roundcube/roundcubemail/issues/6438 > > > > > Can you fix that up and resend it so that I can apply it? > > No problem. Thanks for all. > > Signed-off-by: Arnd Bergmann > Fixes: 6059f71f1e94 ("apparmor: add parameter to control whether policy hashing is used") > Signed-off-by: John Johansen > Signed-off-by: James Morris > --- > diff -Nurp a/security/apparmor/crypto.c b/security/apparmor/crypto.c > --- a/security/apparmor/crypto.c > +++ b/security/apparmor/crypto.c > @@ -39,6 +39,9 @@ int aa_calc_profile_hash(struct aa_profi > int error = -ENOMEM; > u32 le32_version = cpu_to_le32(version); > > + if (!aa_g_hash_policy) > + return 0; > + > if (!apparmor_tfm) > return 0; > > diff -Nurp a/security/apparmor/lsm.c b/security/apparmor/lsm.c > --- a/security/apparmor/lsm.c > +++ b/security/apparmor/lsm.c > @@ -692,6 +694,12 @@ enum profile_mode aa_g_profile_mode = AP > module_param_call(mode, param_set_mode, param_get_mode, > &aa_g_profile_mode, S_IRUSR | S_IWUSR); > > +#ifdef CONFIG_SECURITY_APPARMOR_HASH > +/* whether policy verification hashing is enabled */ > +bool aa_g_hash_policy = IS_ENABLED(CONFIG_SECURITY_APPARMOR_HASH_DEFAULT); > +module_param_named(hash_policy, aa_g_hash_policy, aabool, S_IRUSR | S_IWUSR); > +#endif > + > /* Debug mode */ > bool aa_g_debug; > module_param_named(debug, aa_g_debug, aabool, S_IRUSR | S_IWUSR); THanks, that worked, now queued up. greg k-h