apparmor: allow restricting unprivileged change_profile

Browse source

unprivileged unconfined can use change_profile to alter the confinement
set by the mac admin.

Allow restricting unprivileged unconfined by still allowing change_profile
but stacking the change against unconfined. This allows unconfined to
still apply system policy but allows the task to enter the new confinement.

If unprivileged unconfined is required a sysctl is provided to switch
to the previous behavior.

Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>

...

This commit is contained in:

John Johansen 2023-08-09 00:26:36 -07:00

parent e105d8079f

commit 2d9da9b188

5 changed files with 39 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

6

security/apparmor/apparmorfs.c

View file

24

security/apparmor/domain.c

View file

1

security/apparmor/include/policy.h

View file

7

security/apparmor/lsm.c

View file

1

security/apparmor/policy.c

View file