archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-08 04:04:43 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

apparmor: remove redundant perms.allow MAY_EXEC bitflag set

Browse source 
This section of profile_transition that occurs after x_to_label only
happens if perms.allow already has the MAY_EXEC bit set, so we don't need
to set it again.

Fixes: 16916b17b4 ("apparmor: force auditing of conflicting attachment execs from confined")
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
Ryan Lee 2025-06-23 14:58:00 -07:00 • committed by John Johansen
parent da0edababa
commit 4ce7d3cf5a
1 changed files with 1 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
security/apparmor/domain.c
View file

@ -734,10 +734,8 @@ static struct aa_label *profile_transition(const struct cred *subj_cred,
* we don't need to care about clobbering it
*/
if (info == CONFLICTING_ATTACH_STR_IX
|| info == CONFLICTING_ATTACH_STR_UX) {
|| info == CONFLICTING_ATTACH_STR_UX)
perms.audit |= MAY_EXEC;
perms.allow |= MAY_EXEC;
}
/* hack ix fallback - improve how this is detected */
goto audit;
} else if (!new) {