apparmor: add ns being viewed as a param to policy_admin_capable()

Prepare for a tighter pairing of user namespaces and apparmor policy
namespaces, by making the ns to be viewed available.

Signed-off-by: John Johansen <john.johansen@canonical.com>

1 files changed, 9 insertions, 3 deletions

diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index f092c04c7c4e..ef64c25b2a45 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -637,9 +637,15 @@ bool policy_view_capable(struct aa_ns *ns)
 	return response;
 }
 
-bool policy_admin_capable(void)
+bool policy_admin_capable(struct aa_ns *ns)
 {
-	return policy_view_capable(NULL) && !aa_g_lock_policy;
+	struct user_namespace *user_ns = current_user_ns();
+	bool capable = ns_capable(user_ns, CAP_MAC_ADMIN);
+
+	AA_DEBUG("cap_mac_admin? %d\n", capable);
+	AA_DEBUG("policy locked? %d\n", aa_g_lock_policy);
+
+	return policy_view_capable(ns) && capable && !aa_g_lock_policy;
 }
 
 /**
@@ -657,7 +663,7 @@ bool aa_may_manage_policy(int op)
 		return 0;
 	}
 
-	if (!policy_admin_capable()) {
+	if (!policy_admin_capable(NULL)) {
 		audit_policy(__aa_current_profile(), op, GFP_KERNEL, NULL,
 			     "not policy admin", -EACCES);
 		return 0;