Re: [PATCH 3/6] apparmor: Use security_capable_lsm() for policy capabilities

[sashiko-bot@kernel.org]

> AppArmor checks CAP_MAC_ADMIN for policy management and CAP_MAC_OVERRIDE
> for unconfined stacking with cap_capable() instead of capable(), so that
> other stacked LSMs do not have to authorize them.  This also lets a
> process in a Landlock domain that denies CAP_MAC_ADMIN manage AppArmor
> policy, and one that denies CAP_MAC_OVERRIDE avoid the stacking
> restriction on unconfined profile changes.
> 
> Commit 31ec99e13346 ("apparmor: switch to apparmor to internal capable
> check for policy management") made this choice for CAP_MAC_ADMIN.
> 
> Switch these checks to security_capable_lsm(), which keeps this choice
> for LSMs that only implement the capable hook.  policy_ns_capable()
> still makes its own aa_capable() check.  Update the comments that
> described these checks.
> 
> Cc: Georgia Garcia <georgia.garcia@canonical.com>
> Cc: Günther Noack <gnoack@google.com>
> Cc: John Johansen <john.johansen@canonical.com>
> Cc: Paul Moore <paul@paul-moore.com>
> Fixes: 97c8386f1d74 ("landlock: Enforce capability restrictions")
> Signed-off-by: Mickaël Salaün <mic@digikod.net>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110203042.2410140-1-mic@digikod.net?part=3