diff options
| author | Tyler Hicks <tyhicks@canonical.com> | 2016-03-17 01:19:10 +0100 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2017-01-16 10:18:52 +0100 |
| commit | e3ea1ca59adaefa31935a6f8f06a9168ea0e57d2 (patch) | |
| tree | 9ad612c96bb48331ed9203a3fe0ed4f3c6792002 /security/apparmor/include | |
| parent | apparmor: support querying extended trusted helper extra data (diff) | |
| download | linux-e3ea1ca59adaefa31935a6f8f06a9168ea0e57d2.tar.xz linux-e3ea1ca59adaefa31935a6f8f06a9168ea0e57d2.zip | |
apparmor: sysctl to enable unprivileged user ns AppArmor policy loading
If this sysctl is set to non-zero and a process with CAP_MAC_ADMIN in
the root namespace has created an AppArmor policy namespace,
unprivileged processes will be able to change to a profile in the
newly created AppArmor policy namespace and, if the profile allows
CAP_MAC_ADMIN and appropriate file permissions, will be able to load
policy in the respective policy namespace.
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor/include')
0 files changed, 0 insertions, 0 deletions