Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-01 02:36:02 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

apparmor: properly handle cx/px lookup failure for complain

Browse Source 
mode profiles

When a cx/px lookup fails, apparmor would deny execution of the binary
even in complain mode (where it would audit as allowing execution while
actually denying it). Instead, in complain mode, create a new learning
profile, just as would have been done if the cx/px line wasn't there.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
Ryan Lee 2024-08-23 10:14:02 -07:00 committed by John Johansen
parent 17d0d04f3c
commit db93ca15e5
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
security/apparmor/domain.c
View File

@ -680,12 +680,17 @@ static struct aa_label *profile_transition(const struct cred *subj_cred,
/* hack ix fallback - improve how this is detected */
goto audit;
} else if (!new) {
error = -EACCES;
info = "profile transition not found";
/* remove MAY_EXEC to audit as failure */
/* remove MAY_EXEC to audit as failure or complaint */
perms.allow &= ~MAY_EXEC;
if (COMPLAIN_MODE(profile)) {
/* create null profile instead of failing */
goto create_learning_profile;
}
error = -EACCES;
}
} else if (COMPLAIN_MODE(profile)) {
create_learning_profile:
/* no exec permission - learning mode */
struct aa_profile *new_profile = NULL;