From fa9b63adabcfa9b724120ef3352cf6fb82b4b9a5 Mon Sep 17 00:00:00 2001 From: John Johansen Date: Fri, 9 Sep 2022 16:00:09 -0700 Subject: apparmor: add user namespace creation mediation Unprivileged user namespace creation is often used as a first step in privilege escalation attacks. Instead of disabling it at the sysrq level, which blocks its legitimate use as for setting up a sandbox, allow control on a per domain basis. This allows an admin to quickly lock down a system while also still allowing legitimate use. Reviewed-by: Georgia Garcia Signed-off-by: John Johansen --- security/apparmor/include/task.h | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'security/apparmor/include/task.h') diff --git a/security/apparmor/include/task.h b/security/apparmor/include/task.h index 13945e2495f0..b1aaaf60fa8b 100644 --- a/security/apparmor/include/task.h +++ b/security/apparmor/include/task.h @@ -96,4 +96,10 @@ int aa_may_ptrace(const struct cred *tracer_cred, struct aa_label *tracer, u32 request); + +#define AA_USERNS_CREATE 8 + +int aa_profile_ns_perm(struct aa_profile *profile, + struct apparmor_audit_data *ad, u32 request); + #endif /* __AA_TASK_H */ -- cgit v1.2.3