From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757350AbcGZQ4O (ORCPT ); Tue, 26 Jul 2016 12:56:14 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:38565 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752785AbcGZQ4M (ORCPT ); Tue, 26 Jul 2016 12:56:12 -0400 Subject: Re: [PATCH] apparmor: fix SECURITY_APPARMOR_HASH_DEFAULT parameter handling To: James Morris References: <1469469547-8336-1-git-send-email-john.johansen@canonical.com> <1469469547-8336-2-git-send-email-john.johansen@canonical.com> Cc: linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, Arnd Bergmann From: John Johansen Organization: Canonical Message-ID: <29fb1317-8b89-dcf1-960e-269f035a2b32@canonical.com> Date: Tue, 26 Jul 2016 09:56:07 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 07/26/2016 04:38 AM, James Morris wrote: > On Mon, 25 Jul 2016, John Johansen wrote: > >> From: Arnd Bergmann >> >> The newly added Kconfig option could never work and just causes a build error >> when disabled: >> >> security/apparmor/lsm.c:675:25: error: 'CONFIG_SECURITY_APPARMOR_HASH_DEFAULT' undeclared here (not in a function) >> bool aa_g_hash_policy = CONFIG_SECURITY_APPARMOR_HASH_DEFAULT; >> >> The problem is that the macro undefined in this case, and we need to use the IS_ENABLED() >> helper to turn it into a boolean constant. >> >> Another minor problem with the original patch is that the option is even offered >> in sysfs when SECURITY_APPARMOR_HASH is not enabled, so this also hides the option >> in that case. >> >> Signed-off-by: Arnd Bergmann >> Fixes: 6059f71f1e94 ("apparmor: add parameter to control whether policy hashing is used") >> Signed-off-by: John Johansen > > Please rebase this against current Linus. > Well this is a fix for a patch in the security next queue, so linus doesn't have it yet. I can wait for your 4.8 pull request and rebase then