Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

apparmor: force auditing of conflicting attachment execs from confined 

Conflicting attachment paths are an error state that result in the
binary in question executing under an unexpected ix/ux fallback. As such,
it should be audited to record the occurrence of conflicting attachments.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
Ryan Lee 2025-05-01 17:55:46 -07:00 committed by John Johansen
parent b824b5f82b
commit 16916b17b4
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
security/apparmor/domain.c
View File

@ -729,6 +729,15 @@ static struct aa_label *profile_transition(const struct cred *subj_cred,
new = x_to_label(profile, bprm, name, perms.xindex, &target,
&info);
if (new && new->proxy == profile->label.proxy && info) {
/* Force audit on conflicting attachment fallback
* Because perms is never used again after this audit
* we don't need to care about clobbering it
*/
if (info == CONFLICTING_ATTACH_STR_IX
|| info == CONFLICTING_ATTACH_STR_UX) {
perms.audit |= MAY_EXEC;
perms.allow |= MAY_EXEC;
}
/* hack ix fallback - improve how this is detected */
goto audit;
} else if (!new) {