tree df76653f50579f989c36eab7139919523f50d561
parent 5f20fdfed16bc599a325a145bf0123a8e1c9beea
author John Johansen <john.johansen@canonical.com> 1466643668 -0700
committer John Johansen <john.johansen@canonical.com> 1468338190 -0700

apparmor: fix module parameters can be changed after policy is locked

the policy_lock parameter is a one way switch that prevents policy
from being further modified. Unfortunately some of the module parameters
can effectively modify policy by turning off enforcement.

split policy_admin_capable into a view check and a full admin check,
and update the admin check to test the policy_lock parameter.

Signed-off-by: John Johansen <john.johansen@canonical.com>