diff options
| author | John Johansen <john.johansen@canonical.com> | 2017-01-16 11:42:51 +0300 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2017-01-16 12:18:40 +0300 |
| commit | fd2a80438d736012129977bec779db093979057e (patch) | |
| tree | e3d544c4617f91a39b953f7ffa93f7fda662bc3b /security/apparmor/policy.c | |
| parent | 2bd8dbbf22fe9eb2a99273436f815d49ceb23a8f (diff) | |
| download | linux-fd2a80438d736012129977bec779db093979057e.tar.xz | |
apparmor: add ns being viewed as a param to policy_admin_capable()
Prepare for a tighter pairing of user namespaces and apparmor policy
namespaces, by making the ns to be viewed available.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor/policy.c')
| -rw-r--r-- | security/apparmor/policy.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c index f092c04c7c4e..ef64c25b2a45 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c @@ -637,9 +637,15 @@ bool policy_view_capable(struct aa_ns *ns) return response; } -bool policy_admin_capable(void) +bool policy_admin_capable(struct aa_ns *ns) { - return policy_view_capable(NULL) && !aa_g_lock_policy; + struct user_namespace *user_ns = current_user_ns(); + bool capable = ns_capable(user_ns, CAP_MAC_ADMIN); + + AA_DEBUG("cap_mac_admin? %d\n", capable); + AA_DEBUG("policy locked? %d\n", aa_g_lock_policy); + + return policy_view_capable(ns) && capable && !aa_g_lock_policy; } /** @@ -657,7 +663,7 @@ bool aa_may_manage_policy(int op) return 0; } - if (!policy_admin_capable()) { + if (!policy_admin_capable(NULL)) { audit_policy(__aa_current_profile(), op, GFP_KERNEL, NULL, "not policy admin", -EACCES); return 0; |