xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

apparmor: add ns being viewed as a param to policy_admin_capable()

Browse Source 
Prepare for a tighter pairing of user namespaces and apparmor policy
namespaces, by making the ns to be viewed available.

Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen
2017-01-16 00:42:51 -08:00
parent 2bd8dbbf22
commit fd2a80438d
3 changed files with 16 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
security/apparmor/lsm.c
View File

@@ -738,7 +738,7 @@ __setup("apparmor=", apparmor_enabled_setup);
/* set global flag turning off the ability to load policy */
static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp)
{
if (!policy_admin_capable())
if (!policy_admin_capable(NULL))
return -EPERM;
return param_set_bool(val, kp);
}
@@ -752,7 +752,7 @@ static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp)
static int param_set_aabool(const char *val, const struct kernel_param *kp)
{
if (!policy_admin_capable())
if (!policy_admin_capable(NULL))
return -EPERM;
return param_set_bool(val, kp);
}
@@ -766,7 +766,7 @@ static int param_get_aabool(char *buffer, const struct kernel_param *kp)
static int param_set_aauint(const char *val, const struct kernel_param *kp)
{
if (!policy_admin_capable())
if (!policy_admin_capable(NULL))
return -EPERM;
return param_set_uint(val, kp);
}
@@ -792,7 +792,7 @@ static int param_get_audit(char *buffer, struct kernel_param *kp)
static int param_set_audit(const char *val, struct kernel_param *kp)
{
int i;
if (!policy_admin_capable())
if (!policy_admin_capable(NULL))
return -EPERM;
if (!apparmor_enabled)
@@ -813,7 +813,7 @@ static int param_set_audit(const char *val, struct kernel_param *kp)
static int param_get_mode(char *buffer, struct kernel_param *kp)
{
if (!policy_admin_capable())
if (!policy_view_capable(NULL))
return -EPERM;
if (!apparmor_enabled)
@@ -825,7 +825,7 @@ static int param_get_mode(char *buffer, struct kernel_param *kp)
static int param_set_mode(const char *val, struct kernel_param *kp)
{
int i;
if (!policy_admin_capable())
if (!policy_admin_capable(NULL))
return -EPERM;
if (!apparmor_enabled)