tree 9feaa5a8b78812e48fa9b4e9b8b939f06390bee8
parent 259e5e6c75a910f3b5e656151dc602f53f9d7548
author John Johansen <john.johansen@canonical.com> 1334267271 -0500
committer James Morris <james.l.morris@oracle.com> 1334365998 +1000

Fix execve behavior apparmor for PR_{GET,SET}_NO_NEW_PRIVS

Add support for AppArmor to explicitly fail requested domain transitions
if NO_NEW_PRIVS is set and the task is not unconfined.

Transitions from unconfined are still allowed because this always results
in a reduction of privileges.

Acked-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Andy Lutomirski <luto@amacapital.net>

v18: new acked-by, new description
Signed-off-by: James Morris <james.l.morris@oracle.com>