summaryrefslogtreecommitdiff
path: root/security/apparmor
diff options
context:
space:
mode:
authorJohn Johansen <john.johansen@canonical.com>2017-01-16 11:42:38 +0300
committerJohn Johansen <john.johansen@canonical.com>2017-01-16 12:18:31 +0300
commit5ebfb12822656beec5c56b362d44e4db81c8e1eb (patch)
treed6463534c1949ff04b31b64086c3e705fb6bbb8d /security/apparmor
parentabbf8734039fe57c72c999e37bd1c30d8aed1943 (diff)
downloadlinux-5ebfb12822656beec5c56b362d44e4db81c8e1eb.tar.xz
apparmor: add support for force complain flag to support learning mode
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor')
-rw-r--r--security/apparmor/policy_unpack.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index fe73117cd940..c836a9c8b6ff 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -29,6 +29,8 @@
#include "include/policy.h"
#include "include/policy_unpack.h"
+#define FORCE_COMPLAIN_FLAG 0x800
+
/*
* The AppArmor interface treats data as a type byte followed by the
* actual data. The interface has the notion of a a named entry
@@ -514,7 +516,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e)
profile->flags |= PFLAG_HAT;
if (!unpack_u32(e, &tmp, NULL))
goto fail;
- if (tmp == PACKED_MODE_COMPLAIN)
+ if (tmp == PACKED_MODE_COMPLAIN || (e->version & FORCE_COMPLAIN_FLAG))
profile->mode = APPARMOR_COMPLAIN;
else if (tmp == PACKED_MODE_KILL)
profile->mode = APPARMOR_KILL;