apparmor: allow setting any profile into the unconfined state

Allow emulating the default profile behavior from boot, by allowing
loading of a profile in the unconfined state into a new NS.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>

1 files changed, 4 insertions, 2 deletions

diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index 7a80b0c7e0ce..2e4e2ecb25bc 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -96,6 +96,7 @@ const char *const profile_mode_names[] = {
         "enforce",
         "complain",
         "kill",
+        "unconfined",
 };
 
 /**
@@ -290,8 +291,9 @@ static struct aa_namespace *alloc_namespace(const char *prefix,
         if (!ns->unconfined)
                 goto fail_unconfined;
 
-        ns->unconfined->flags = PFLAG_UNCONFINED | PFLAG_IX_ON_NAME_ERROR |
-            PFLAG_IMMUTABLE | PFLAG_NS_COUNT;
+        ns->unconfined->flags = PFLAG_IX_ON_NAME_ERROR |
+                PFLAG_IMMUTABLE | PFLAG_NS_COUNT;
+        ns->unconfined->mode = APPARMOR_UNCONFINED;
 
         /* ns and ns->unconfined share ns->unconfined refcount */
         ns->unconfined->ns = ns;