mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-12-27 11:06:41 -05:00
Code Issues Packages Projects Releases Wiki Activity

apparmor: force audit on unconfined exec if info is set by find_attach

Browse Source 
find_attach may set info if something unusual happens during that process
(currently only used to signal conflicting attachments, but this could be
expanded in the future). This is information that should be propagated to
userspace via an audit message.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
Ryan Lee
2025-05-01 17:55:43 -07:00
committed by John Johansen
parent 95ff118958
commit 89a3561e69
1 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
security/apparmor/domain.c
View File

@@ -670,6 +670,22 @@ static struct aa_label *profile_transition(const struct cred *subj_cred,
if (profile_unconfined(profile)) {
new = find_attach(bprm, profile->ns,
&profile->ns->base.profiles, name, &info);
/* info set -> something unusual that we should report
* Currently this is only conflicting attachments, but other
* infos added in the future should also be logged by default
* and only excluded on a case-by-case basis
*/
if (info) {
/* Because perms is never used again after this audit
* we don't need to care about clobbering it
*/
perms.audit |= MAY_EXEC;
perms.allow |= MAY_EXEC;
/* Don't cause error if auditing fails */
(void) aa_audit_file(subj_cred, profile, &perms,
OP_EXEC, MAY_EXEC, name, target, new, cond->uid,
info, error);
}
if (new) {
AA_DEBUG(DEBUG_DOMAIN, "unconfined attached to new label");
return new;