archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-08 08:24:47 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

apparmor: force auditing of conflicting attachment execs from confined

Browse source 
Conflicting attachment paths are an error state that result in the
binary in question executing under an unexpected ix/ux fallback. As such,
it should be audited to record the occurrence of conflicting attachments.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
Ryan Lee 2025-05-01 17:55:46 -07:00 • committed by John Johansen
parent b824b5f82b
commit 16916b17b4
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
security/apparmor/domain.c
View file

@ -729,6 +729,15 @@ static struct aa_label *profile_transition(const struct cred *subj_cred,
new = x_to_label(profile, bprm, name, perms.xindex, &target,
&info);
if (new && new->proxy == profile->label.proxy && info) {
/* Force audit on conflicting attachment fallback
* Because perms is never used again after this audit
* we don't need to care about clobbering it
*/
if (info == CONFLICTING_ATTACH_STR_IX
|| info == CONFLICTING_ATTACH_STR_UX) {
perms.audit |= MAY_EXEC;
perms.allow |= MAY_EXEC;
}
/* hack ix fallback - improve how this is detected */
goto audit;
} else if (!new) {