diff options
| author | John Johansen <john.johansen@canonical.com> | 2017-01-16 11:42:37 +0300 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2017-01-16 12:18:30 +0300 |
| commit | abbf8734039fe57c72c999e37bd1c30d8aed1943 (patch) | |
| tree | d8df6efee365c8f70ff459f6dcf6a8a80b392f28 /security/apparmor/policy_unpack.c | |
| parent | 181f7c977680dcd86eb71ad4b37239d2a385c3ad (diff) | |
| download | linux-abbf8734039fe57c72c999e37bd1c30d8aed1943.tar.xz | |
apparmor: remove paranoid load switch
Policy should always under go a full paranoid verification.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor/policy_unpack.c')
| -rw-r--r-- | security/apparmor/policy_unpack.c | 21 |
1 files changed, 7 insertions, 14 deletions
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c index 9ddc6b2a7322..fe73117cd940 100644 --- a/security/apparmor/policy_unpack.c +++ b/security/apparmor/policy_unpack.c @@ -340,12 +340,7 @@ static struct aa_dfa *unpack_dfa(struct aa_ext *e) ((e->pos - e->start) & 7); size_t pad = ALIGN(sz, 8) - sz; int flags = TO_ACCEPT1_FLAG(YYTD_DATA32) | - TO_ACCEPT2_FLAG(YYTD_DATA32); - - - if (aa_g_paranoid_load) - flags |= DFA_FLAG_VERIFY_STATES; - + TO_ACCEPT2_FLAG(YYTD_DATA32) | DFA_FLAG_VERIFY_STATES; dfa = aa_dfa_unpack(blob + pad, size - pad, flags); if (IS_ERR(dfa)) @@ -705,14 +700,12 @@ static bool verify_dfa_xindex(struct aa_dfa *dfa, int table_size) */ static int verify_profile(struct aa_profile *profile) { - if (aa_g_paranoid_load) { - if (profile->file.dfa && - !verify_dfa_xindex(profile->file.dfa, - profile->file.trans.size)) { - audit_iface(profile, NULL, "Invalid named transition", - NULL, -EPROTO); - return -EPROTO; - } + if (profile->file.dfa && + !verify_dfa_xindex(profile->file.dfa, + profile->file.trans.size)) { + audit_iface(profile, NULL, "Invalid named transition", + NULL, -EPROTO); + return -EPROTO; } return 0; |