apparmor: add ns being viewed as a param to policy_admin_capable()

Prepare for a tighter pairing of user namespaces and apparmor policy
namespaces, by making the ns to be viewed available.

Signed-off-by: John Johansen <john.johansen@canonical.com>

diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
index b0b65c525bcc189ccb775639ab20cdc271694395..27f9171fa31ffd9ed3a0f32f8bff1f60b1e55188 100644 (file)
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -300,7 +300,7 @@ static inline int AUDIT_MODE(struct aa_profile *profile)
 }
 
 bool policy_view_capable(struct aa_ns *ns);
-bool policy_admin_capable(void);
+bool policy_admin_capable(struct aa_ns *ns);
 bool aa_may_manage_policy(int op);
 
 #endif /* __AA_POLICY_H */

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index f83ba33651a0350f07afdb1992002faa711241e9..09f1c407c4d87141d1a6f032513a7edf9f4b3271 100644 (file)
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -738,7 +738,7 @@ __setup("apparmor=", apparmor_enabled_setup);
 /* set global flag turning off the ability to load policy */
 static int param_set_aalockpolicy(const char *val, const struct kernel_param *kp)
 {
-       if (!policy_admin_capable())
+       if (!policy_admin_capable(NULL))
                return -EPERM;
        return param_set_bool(val, kp);
 }
@@ -752,7 +752,7 @@ static int param_get_aalockpolicy(char *buffer, const struct kernel_param *kp)
 
 static int param_set_aabool(const char *val, const struct kernel_param *kp)
 {
-       if (!policy_admin_capable())
+       if (!policy_admin_capable(NULL))
                return -EPERM;
        return param_set_bool(val, kp);
 }
@@ -766,7 +766,7 @@ static int param_get_aabool(char *buffer, const struct kernel_param *kp)
 
 static int param_set_aauint(const char *val, const struct kernel_param *kp)
 {
-       if (!policy_admin_capable())
+       if (!policy_admin_capable(NULL))
                return -EPERM;
        return param_set_uint(val, kp);
 }
@@ -792,7 +792,7 @@ static int param_get_audit(char *buffer, struct kernel_param *kp)
 static int param_set_audit(const char *val, struct kernel_param *kp)
 {
        int i;
-       if (!policy_admin_capable())
+       if (!policy_admin_capable(NULL))
                return -EPERM;
 
        if (!apparmor_enabled)
@@ -813,7 +813,7 @@ static int param_set_audit(const char *val, struct kernel_param *kp)
 
 static int param_get_mode(char *buffer, struct kernel_param *kp)
 {
-       if (!policy_admin_capable())
+       if (!policy_view_capable(NULL))
                return -EPERM;
 
        if (!apparmor_enabled)
@@ -825,7 +825,7 @@ static int param_get_mode(char *buffer, struct kernel_param *kp)
 static int param_set_mode(const char *val, struct kernel_param *kp)
 {
        int i;
-       if (!policy_admin_capable())
+       if (!policy_admin_capable(NULL))
                return -EPERM;
 
        if (!apparmor_enabled)

diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index f092c04c7c4e7dc8b29930abde6bc155f6b735e3..ef64c25b2a4568381bcc47327bf2addcfcbe0639 100644 (file)
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -637,9 +637,15 @@ bool policy_view_capable(struct aa_ns *ns)
        return response;
 }
 
-bool policy_admin_capable(void)
+bool policy_admin_capable(struct aa_ns *ns)
 {
-       return policy_view_capable(NULL) && !aa_g_lock_policy;
+       struct user_namespace *user_ns = current_user_ns();
+       bool capable = ns_capable(user_ns, CAP_MAC_ADMIN);
+
+       AA_DEBUG("cap_mac_admin? %d\n", capable);
+       AA_DEBUG("policy locked? %d\n", aa_g_lock_policy);
+
+       return policy_view_capable(ns) && capable && !aa_g_lock_policy;
 }
 
 /**
@@ -657,7 +663,7 @@ bool aa_may_manage_policy(int op)
                return 0;
        }
 
-       if (!policy_admin_capable()) {
+       if (!policy_admin_capable(NULL)) {
                audit_policy(__aa_current_profile(), op, GFP_KERNEL, NULL,
                             "not policy admin", -EACCES);
                return 0;