From: John Johansen <john.johansen@canonical.com>
Date: Thu, 12 Apr 2012 21:47:51 +0000 (-0500)
Subject: Fix execve behavior apparmor for PR_{GET,SET}_NO_NEW_PRIVS
X-Git-Tag: v3.5-rc1~161^2~36
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c29bceb3967398cf2ac8bf8edf9634fdb722df7d;p=pandora-kernel.git

Fix execve behavior apparmor for PR_{GET,SET}_NO_NEW_PRIVS

Add support for AppArmor to explicitly fail requested domain transitions
if NO_NEW_PRIVS is set and the task is not unconfined.

Transitions from unconfined are still allowed because this always results
in a reduction of privileges.

Acked-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Andy Lutomirski <luto@amacapital.net>

v18: new acked-by, new description
Signed-off-by: James Morris <james.l.morris@oracle.com>
---

Reading git-diff-tree failed