apparmor: remove explicit restriction that unconfined cannot use change_hat

Browse source

There does not need to be an explicit restriction that unconfined
can't use change_hat. Traditionally unconfined doesn't have hats
so change_hat could not be used. But newer unconfined profiles have
the potential of having hats, and even system unconfined will be
able to be replaced with a profile that allows for hats.

To remain backwards compitible with expected return codes, continue
to return -EPERM if the unconfined profile does not have any hats.

Signed-off-by: John Johansen <john.johansen@canonical.com>

...

This commit is contained in:

John Johansen 2024-01-19 00:24:03 -08:00

parent cd769b05cc

commit 35fad5b462

2 changed files with 18 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

security/apparmor/apparmorfs.c

View file

20

security/apparmor/domain.c

View file