To clarify "necessary to open up". 1. the old behavior was wrong. It allowed introspection of policy in situation that it should not have. 2. In order to open up the profiles file so that more than the system root could introspect it, DAC restrictions needed to be removed and the permission checking of what is allowed needed to be moved fully into apparmor. Since there was not time for fine grained mediation in the first iteration, the tightest restriction with original intent was used.
That is that only the policy admin is allowed fully view of loaded policy. This can be opened up with further development but is the original intent of how policy introspection was supposed to work (hence #1 noting that implementation was flawed and wrong). -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1560583 Title: reading /sys/kernel/security/apparmor/profiles requires CAP_MAC_ADMIN To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1560583/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
