Skip to content

[3.1] ask_exec(): no longer skip exec events in hats

Christian Boltz requested to merge cboltz/apparmor:cboltz-more-x-3.1 into apparmor-3.1

Instead of ignoring all exec events that happen in a hat/child profile, only disallow child exec. ix and px are valid options inside a hat and are now offered to the user.

(When the tools support nested child profiles one day, we can even allow child exec again.)

Backported from dfb6f90a / !1133 (merged) to match the 3.1 branch

Merge request reports