iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2d9da9b188
linux/security/apparmor
History
John Johansen 2d9da9b188 apparmor: allow restricting unprivileged change_profile 
unprivileged unconfined can use change_profile to alter the confinement
set by the mac admin.

Allow restricting unprivileged unconfined by still allowing change_profile
but stacking the change against unconfined. This allows unconfined to
still apply system policy but allows the task to enter the new confinement.

If unprivileged unconfined is required a sysctl is provided to switch
to the previous behavior.

Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
2023-10-18 15:48:44 -07:00
..
include apparmor: allow restricting unprivileged change_profile 2023-10-18 15:48:44 -07:00
.gitignore .gitignore: add SPDX License Identifier 2020-03-25 11:50:48 +01:00
apparmorfs.c apparmor: allow restricting unprivileged change_profile 2023-10-18 15:48:44 -07:00
audit.c apparmor: rename audit_data->label to audit_data->subj_label 2023-10-18 15:30:34 -07:00
capability.c apparmor: pass cred through to audit info. 2023-10-18 15:30:38 -07:00
crypto.c apparmor: Return directly after a failed kzalloc() in two functions 2023-07-06 10:58:49 -07:00
domain.c apparmor: allow restricting unprivileged change_profile 2023-10-18 15:48:44 -07:00
file.c apparmor: refcount the pdb 2023-10-18 15:30:47 -07:00
ipc.c apparmor: refcount the pdb 2023-10-18 15:30:47 -07:00
Kconfig + Features 2022-12-14 13:42:09 -08:00
label.c apparmor: refcount the pdb 2023-10-18 15:30:47 -07:00
lib.c apparmor: refcount the pdb 2023-10-18 15:30:47 -07:00
lsm.c apparmor: allow restricting unprivileged change_profile 2023-10-18 15:48:44 -07:00
Makefile + Features 2022-12-14 13:42:09 -08:00
match.c apparmor: refcount the pdb 2023-10-18 15:30:47 -07:00
mount.c apparmor: refcount the pdb 2023-10-18 15:30:47 -07:00
net.c apparmor: refcount the pdb 2023-10-18 15:30:47 -07:00
nulldfa.in apparmor: cleanup add proper line wrapping to nulldfa.in 2018-02-09 11:30:01 -08:00
path.c security: apparmor: delete repeated words in comments 2021-02-07 04:15:46 -08:00
policy_compat.c apparmor: fixup return comments for kernel doc cleanups by Gaosheng Cui 2023-08-08 13:12:19 -07:00
policy_ns.c apparmor: remove unused functions in policy_ns.c/.h 2023-10-15 21:44:31 -07:00
policy_unpack_test.c apparmor: fix use of strcpy in policy_unpack_test 2023-07-06 10:58:49 -07:00
policy_unpack.c apparmor: refcount the pdb 2023-10-18 15:30:47 -07:00
policy.c apparmor: allow restricting unprivileged change_profile 2023-10-18 15:48:44 -07:00
procattr.c apparmor: fix obsoleted comments for aa_getprocattr() and audit_resource() 2022-10-24 22:35:23 -07:00
resource.c apparmor: pass cred through to audit info. 2023-10-18 15:30:38 -07:00
secid.c apparmor: fix kernel-doc complaints 2023-01-10 10:04:35 -08:00
stacksplitdfa.in apparmor: use the dfa to do label parse string splitting 2018-02-09 11:30:01 -08:00
task.c apparmor: pass cred through to audit info. 2023-10-18 15:30:38 -07:00