Commit dc155617 authored by John Johansen's avatar John Johansen
Browse files

apparmor: Fix internal policy capable check for policy management 



The check was incorrectly treating a returned error as a boolean.

Fixes: 31ec99e1 ("apparmor: switch to apparmor to internal capable check for policy management")
Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
parent d108370c

security/apparmor/policy.c

+1 −1
Original line number Diff line number Diff line
@@ -678,7 +678,7 @@ bool aa_policy_view_capable(struct aa_label *label, struct aa_ns *ns) 
bool aa_policy_admin_capable(struct aa_label *label, struct aa_ns *ns)

{

	struct user_namespace *user_ns = current_user_ns();

	bool capable = policy_ns_capable(label, user_ns, CAP_MAC_ADMIN);

	bool capable = policy_ns_capable(label, user_ns, CAP_MAC_ADMIN) == 0;



	AA_DEBUG("cap_mac_admin? %d\n", capable);

	AA_DEBUG("policy locked? %d\n", aa_g_lock_policy);