mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-31 14:25:52 +00:00
Code Issues Releases Wiki Activity

Allow capability to stack under AppArmor. This is a fake stacking

Browse Source 
however in that the capability hooks never get called.  This shouldn't
be a big problem since AppArmor already composes capability through
use of common cap.

This just prevents the user from having to deal with/understand the
error message that occurs when the capability module fails to stack
with AppArmor.
This commit is contained in:
John Johansen
2007-03-23 16:41:43 +00:00
parent 399561b10d
commit 4d9fde38db
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
module/apparmor/lsm.c
View File

@@ -797,7 +797,13 @@ int apparmor_register_subsecurity(const char *name,
if (mutex_lock_interruptible(&aa_secondary_lock))
return -ERESTARTSYS;
if (strcmp(name, "dazuko") == 0 && !aa_secondary_ops) {
/* allow dazuko and capability to stack. The stacking with
* capability is fake however in that non of capabilities hooks
* get called, since apparmor already composes capability using
* common cap.
*/
if (!aa_secondary_ops && (strcmp(name, "dazuko") == 0 ||
strcmp(name, "capability") == 0)){
/* The apparmor module needs to be pinned while a secondary is
* registered
*/