John Johansen 25e75dff51 AppArmor: Fix masking of capabilities in complain mode ... AppArmor is masking the capabilities returned by capget against the capabilities mask in the profile. This is wrong, in complain mode the profile has effectively all capabilities, as the profile restrictions are not being enforced, merely tested against to determine if an access is known by the profile. This can result in the wrong behavior of security conscience applications like sshd which examine their capability set, and change their behavior accordingly. In this case because of the masked capability set being returned sshd fails due to DAC checks, even when the profile is in complain mode. Kernels affected: 2.6.36 - 3.0. Signed-off-by: John Johansen <john.johansen@canonical.com>		2011-06-29 02:04:44 +01:00
..
include	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2011-01-13 10:05:56 -08:00
.gitignore
apparmorfs.c
audit.c
capability.c
context.c
domain.c	AppArmor: Fix reference to rcu protected pointer outside of rcu_read_lock	2011-06-29 02:02:03 +01:00
file.c
ipc.c
Kconfig
lib.c
lsm.c	AppArmor: Fix masking of capabilities in complain mode	2011-06-29 02:04:44 +01:00
Makefile	AppArmor: cleanup generated files correctly	2011-03-08 17:03:53 -08:00
match.c	Create Documentation/security/,	2011-05-19 15:59:38 -07:00
path.c
policy.c
policy_unpack.c	Create Documentation/security/,	2011-05-19 15:59:38 -07:00
procattr.c
resource.c
sid.c