From e3ea1ca59adaefa31935a6f8f06a9168ea0e57d2 Mon Sep 17 00:00:00 2001 From: Tyler Hicks Date: Wed, 16 Mar 2016 19:19:10 -0500 Subject: apparmor: sysctl to enable unprivileged user ns AppArmor policy loading If this sysctl is set to non-zero and a process with CAP_MAC_ADMIN in the root namespace has created an AppArmor policy namespace, unprivileged processes will be able to change to a profile in the newly created AppArmor policy namespace and, if the profile allows CAP_MAC_ADMIN and appropriate file permissions, will be able to load policy in the respective policy namespace. Signed-off-by: Tyler Hicks Signed-off-by: John Johansen --- security/apparmor/policy.c | 1 - 1 file changed, 1 deletion(-) (limited to 'security/apparmor/policy.c') diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c index f2c4bb26b060..f44312a19522 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c @@ -99,7 +99,6 @@ const char *const aa_profile_mode_names[] = { "unconfined", }; - /* requires profile list write lock held */ void __aa_update_proxy(struct aa_profile *orig, struct aa_profile *new) { -- cgit v1.2.3