On Sun, Sep 09, 2018 at 04:04:18PM +0200, Loic wrote: > Hello, > > Tested without any problem so please picked up this for 4.4 to fix the > problem. > The patch below is slightly modified to adapt to this version. > > [ Upstream commit 7616ac70d1bb4f2e9d25c1a82d283f3368a7b632 ] > > The newly added Kconfig option could never work and just causes a build > error > when disabled: > > security/apparmor/lsm.c:675:25: error: > 'CONFIG_SECURITY_APPARMOR_HASH_DEFAULT' undeclared here (not in a function) > bool aa_g_hash_policy = CONFIG_SECURITY_APPARMOR_HASH_DEFAULT; > > The problem is that the macro undefined in this case, and we need to use the > IS_ENABLED() > helper to turn it into a boolean constant. > > Another minor problem with the original patch is that the option is even > offered > in sysfs when SECURITY_APPARMOR_HASH is not enabled, so this also hides the > option > in that case. > > Signed-off-by: Arnd Bergmann <arnd@xxxxxxxx> > Fixes: 6059f71f1e94 ("apparmor: add parameter to control whether policy > hashing is used") > Signed-off-by: John Johansen <john.johansen@xxxxxxxxxxxxx> > Signed-off-by: James Morris <james.l.morris@xxxxxxxxxx> > --- > diff -Nurp a/security/apparmor/crypto.c b/security/apparmor/crypto.c > --- a/security/apparmor/crypto.c > +++ b/security/apparmor/crypto.c > @@ -39,6 +39,9 @@ int aa_calc_profile_hash(struct aa_profi > int error = -ENOMEM; > u32 le32_version = cpu_to_le32(version); > > + if (!aa_g_hash_policy) > + return 0; > + > if (!apparmor_tfm) > return 0; > > diff -Nurp a/security/apparmor/lsm.c b/security/apparmor/lsm.c > --- a/security/apparmor/lsm.c > +++ b/security/apparmor/lsm.c > @@ -692,6 +692,12 @@ enum profile_mode aa_g_profile_mode = AP > module_param_call(mode, param_set_mode, param_get_mode, > &aa_g_profile_mode, S_IRUSR | S_IWUSR); > > +#ifdef CONFIG_SECURITY_APPARMOR_HASH > +/* whether policy verification hashing is enabled */ > +bool aa_g_hash_policy = IS_ENABLED(CONFIG_SECURITY_APPARMOR_HASH_DEFAULT); > +module_param_named(hash_policy, aa_g_hash_policy, aabool, S_IRUSR | > S_IWUSR); > +#endif > + > /* Debug mode */ > bool aa_g_debug; > module_param_named(debug, aa_g_debug, aabool, S_IRUSR | S_IWUSR); > --- The patch is whitespace corrupted and can not be applied :( Can you fix that up and resend it so that I can apply it? thanks, greg k-h