archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-08 01:24:47 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

apparmor: move check for aa_null file to cover all cases

Browse source 
files with a dentry pointing aa_null.dentry where already rejected as
part of file_inheritance. Unfortunately the check in
common_file_perm() is insufficient to cover all cases causing
unnecessary audit messages without the original files context.

Eg.
[ 442.886474] audit: type=1400 audit(1704822661.616:329): apparmor="DENIED" operation="file_inherit" class="file" namespace="root//lxd-juju-98527a-0_<var-snap-lxd-common-lxd>" profile="snap.lxd.activate" name="/apparmor/.null" pid=9525 comm="snap-exec"

Further examples of this are in the logs of
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2120439
https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/1952084
https://bugs.launchpad.net/snapd/+bug/2049099

These messages have no value and should not be sent to the logs.
AppArmor was already filtering the out in some cases but the original
patch did not catch all cases. Fix this by push the existing check
down into two functions that should cover all cases.

Link: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2122743
Fixes: 192ca6b55a ("apparmor: revalidate files during exec")
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen 2025-09-13 02:22:21 -07:00
parent e16eee7895
commit 4a134723f9
2 changed files with 10 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

12
security/apparmor/file.c
View file

@ -155,8 +155,12 @@ static int path_name(const char *op, const struct cred *subj_cred,
const char *info = NULL;
int error;
error = aa_path_name(path, flags, buffer, name, &info,
labels_profile(label)->disconnected);
/* don't reaudit files closed during inheritance */
if (unlikely(path->dentry == aa_null.dentry))
error = -EACCES;
else
error = aa_path_name(path, flags, buffer, name, &info,
labels_profile(label)->disconnected);
if (error) {
fn_for_each_confined(label, profile,
aa_audit_file(subj_cred,
@ -617,6 +621,10 @@ int aa_file_perm(const char *op, const struct cred *subj_cred,
AA_BUG(!label);
AA_BUG(!file);
/* don't reaudit files closed during inheritance */
if (unlikely(file->f_path.dentry == aa_null.dentry))
return -EACCES;
fctx = file_ctx(file);
rcu_read_lock();

4
security/apparmor/lsm.c
View file

@ -525,10 +525,6 @@ static int common_file_perm(const char *op, struct file *file, u32 mask)
struct aa_label *label;
int error = 0;
/* don't reaudit files closed during inheritance */
if (unlikely(file->f_path.dentry == aa_null.dentry))
return -EACCES;
label = begin_current_label_crit_section();
error = aa_file_perm(op, current_cred(), label, file, mask, false);
end_current_label_crit_section(label);