diff options
| author | John Johansen <john.johansen@canonical.com> | 2013-07-10 21:12:43 -0700 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2013-08-14 11:42:07 -0700 |
| commit | 038165070aa55375d4bdd2f84b34a486feca63d6 (patch) | |
| tree | 327014e8b5120a0ccc66418159c72f769e9b174d /security/apparmor/policy.c | |
| parent | 8651e1d6572bc2c061073f05fabcd7175789259d (diff) | |
| download | op-kernel-dev-038165070aa55375d4bdd2f84b34a486feca63d6.zip op-kernel-dev-038165070aa55375d4bdd2f84b34a486feca63d6.tar.gz | |
apparmor: allow setting any profile into the unconfined state
Allow emulating the default profile behavior from boot, by allowing
loading of a profile in the unconfined state into a new NS.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Diffstat (limited to 'security/apparmor/policy.c')
| -rw-r--r-- | security/apparmor/policy.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c index 7a80b0c..2e4e2ec 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c @@ -96,6 +96,7 @@ const char *const profile_mode_names[] = { "enforce", "complain", "kill", + "unconfined", }; /** @@ -290,8 +291,9 @@ static struct aa_namespace *alloc_namespace(const char *prefix, if (!ns->unconfined) goto fail_unconfined; - ns->unconfined->flags = PFLAG_UNCONFINED | PFLAG_IX_ON_NAME_ERROR | - PFLAG_IMMUTABLE | PFLAG_NS_COUNT; + ns->unconfined->flags = PFLAG_IX_ON_NAME_ERROR | + PFLAG_IMMUTABLE | PFLAG_NS_COUNT; + ns->unconfined->mode = APPARMOR_UNCONFINED; /* ns and ns->unconfined share ns->unconfined refcount */ ns->unconfined->ns = ns; |
