tmakin/tegra-linux-noble
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

apparmor: Fix regression in mount mediation

Browse Source 
commit 2db154b3ea ("vfs: syscall: Add move_mount(2) to move mounts around")

introduced a new move_mount(2) system call and a corresponding new LSM
security_move_mount hook but did not implement this hook for any
existing LSM. This creates a regression for AppArmor mediation of
mount. This patch provides a base mapping of the move_mount syscall to
the existing mount mediation. In the future we may introduce
additional mediations around the new mount calls.

Fixes: 2db154b3ea ("vfs: syscall: Add move_mount(2) to move mounts around")
CC: stable@vger.kernel.org
Reported-by: Andreas Steinmetz <anstein99@googlemail.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen
2023-09-10 03:35:22 -07:00
parent ea9bae12d0
commit 157a3537d6
3 changed files with 51 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/apparmor/include/mount.h
+5 -2
View File
@@ -38,9 +38,12 @@ int aa_mount_change_type(const struct cred *subj_cred,
struct aa_label *label, const struct path *path,
unsigned long flags);
int aa_move_mount_old(const struct cred *subj_cred,
struct aa_label *label, const struct path *path,
const char *old_name);
int aa_move_mount(const struct cred *subj_cred,
struct aa_label *label, const struct path *path,
const char *old_name);
struct aa_label *label, const struct path *from_path,
const struct path *to_path);
int aa_new_mount(const struct cred *subj_cred,
struct aa_label *label, const char *dev_name,