apparmor: add the ability to report a sha1 hash of loaded policy

Provide userspace the ability to introspect a sha1 hash value for each
profile currently loaded.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>

1 files changed, 12 insertions, 0 deletions

diff --git a/security/apparmor/Kconfig b/security/apparmor/Kconfig
index 9b9013b2e321..d49c53960b60 100644
--- a/security/apparmor/Kconfig
+++ b/security/apparmor/Kconfig
@@ -29,3 +29,15 @@ config SECURITY_APPARMOR_BOOTPARAM_VALUE
           boot.
 
           If you are unsure how to answer this question, answer 1.
+
+config SECURITY_APPARMOR_HASH
+        bool "SHA1 hash of loaded profiles"
+        depends on SECURITY_APPARMOR
+        depends on CRYPTO
+        select CRYPTO_SHA1
+        default y
+
+        help
+          This option selects whether sha1 hashing is done against loaded
+          profiles and exported for inspection to user space via the apparmor
+          filesystem.