tmakin/tegra-linux-noble
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

UBUNTU: SAUCE: apparmor4.0.0 [95/99]: apparmor: properly handle cx/px lookup failure for complain mode profiles

Browse Source 
BugLink: https://bugs.launchpad.net/bugs/2086210

When a cx/px lookup fails, apparmor would deny execution of the binary
even in complain mode (where it would audit as allowing execution while
actually denying it). Instead, in complain mode, create a new learning
profile, just as would have been done if the cx/px line wasn't there.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Timo Aaltonen <timo.aaltonen@canonical.com>
(cherry picked from commit 62bd5d5f21495c300939475bc491af545755bf10 oracular:linux)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Guoqing Jiang <guoqing.jiang@canonical.com>
Signed-off-by: Roxana Nicolescu <roxana.nicolescu@canonical.com>
This commit is contained in:
Ryan Lee
2024-11-07 17:38:26 -08:00
committed by Mehmet Basaran
parent 40dbd78758
commit 40c3d5fba3
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/apparmor/domain.c
+7 -2
View File
@@ -686,12 +686,17 @@ static struct aa_label *profile_transition(const struct cred *subj_cred,
/* hack ix fallback - improve how this is detected */
goto audit;
} else if (!new) {
error = -EACCES;
info = "profile transition not found";
/* remove MAY_EXEC to audit as failure */
/* remove MAY_EXEC to audit as failure or complaint */
perms.allow &= ~MAY_EXEC;
if (COMPLAIN_MODE(profile)) {
/* create null profile instead of failing */
goto create_learning_profile;
}
error = -EACCES;
}
} else if (COMPLAIN_MODE(profile)) {
create_learning_profile:
/* no exec permission - learning mode */
struct aa_profile *new_profile = NULL;