Skip to content

ask_exec(): no longer skip exec events in hats

Christian Boltz requested to merge cboltz/apparmor:cboltz-more-x into master

Instead of ignoring all exec events that happen in a hat/child profile, only disallow child exec. ix and px are valid options inside a hat and are now offered to the user.

(When the tools support nested child profiles one day, we can even allow child exec again.)

[This MR is for master only. I opened separate MRs for 3.1 and 3.0]

Edited by Christian Boltz

Merge request reports