apparmor: remove paranoid load switch

Policy should always under go a full paranoid verification.

Signed-off-by: John Johansen <john.johansen@canonical.com>

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index a757c16..e40eecb 100644 (file)
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -714,10 +714,11 @@ module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR | S_IWUSR);
 
 /* Determines how paranoid loading of policy is and how much verification
  * on the loaded policy is done.
+ * DEPRECATED: read only as strict checking of load is always done now
+ * that none root users (user namespaces) can load policy.
  */
 bool aa_g_paranoid_load = 1;
-module_param_named(paranoid_load, aa_g_paranoid_load, aabool,
-                  S_IRUSR | S_IWUSR);
+module_param_named(paranoid_load, aa_g_paranoid_load, aabool, S_IRUGO);
 
 /* Boot time disable flag */
 static bool apparmor_enabled = CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE;

diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 9ddc6b2..fe73117 100644 (file)
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -340,12 +340,7 @@ static struct aa_dfa *unpack_dfa(struct aa_ext *e)
                        ((e->pos - e->start) & 7);
                size_t pad = ALIGN(sz, 8) - sz;
                int flags = TO_ACCEPT1_FLAG(YYTD_DATA32) |
-                       TO_ACCEPT2_FLAG(YYTD_DATA32);
-
-
-               if (aa_g_paranoid_load)
-                       flags |= DFA_FLAG_VERIFY_STATES;
-
+                       TO_ACCEPT2_FLAG(YYTD_DATA32) | DFA_FLAG_VERIFY_STATES;
                dfa = aa_dfa_unpack(blob + pad, size - pad, flags);
 
                if (IS_ERR(dfa))
@@ -705,14 +700,12 @@ static bool verify_dfa_xindex(struct aa_dfa *dfa, int table_size)
  */
 static int verify_profile(struct aa_profile *profile)
 {
-       if (aa_g_paranoid_load) {
-               if (profile->file.dfa &&
-                   !verify_dfa_xindex(profile->file.dfa,
-                                      profile->file.trans.size)) {
-                       audit_iface(profile, NULL, "Invalid named transition",
-                                   NULL, -EPROTO);
-                       return -EPROTO;
-               }
+       if (profile->file.dfa &&
+           !verify_dfa_xindex(profile->file.dfa,
+                              profile->file.trans.size)) {
+               audit_iface(profile, NULL, "Invalid named transition",
+                           NULL, -EPROTO);
+               return -EPROTO;
        }
 
        return 0;