lkml.org 
[lkml]   [2020]   [Jun]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.19 045/172] apparmor: fix introspection of of task mode for unconfined tasks
    Date
    From: John Johansen <john.johansen@canonical.com>

    [ Upstream commit dd2569fbb053719f7df7ef8fdbb45cf47156a701 ]

    Fix two issues with introspecting the task mode.

    1. If a task is attached to a unconfined profile that is not the
    ns->unconfined profile then. Mode the mode is always reported
    as -

    $ ps -Z
    LABEL PID TTY TIME CMD
    unconfined 1287 pts/0 00:00:01 bash
    test (-) 1892 pts/0 00:00:00 ps

    instead of the correct value of (unconfined) as shown below

    $ ps -Z
    LABEL PID TTY TIME CMD
    unconfined 2483 pts/0 00:00:01 bash
    test (unconfined) 3591 pts/0 00:00:00 ps

    2. if a task is confined by a stack of profiles that are unconfined
    the output of label mode is again the incorrect value of (-) like
    above, instead of (unconfined). This is because the visibile
    profile count increment is skipped by the special casing of
    unconfined.

    Fixes: f1bd904175e8 ("apparmor: add the base fns() for domain labels")
    Signed-off-by: John Johansen <john.johansen@canonical.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    security/apparmor/label.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    diff --git a/security/apparmor/label.c b/security/apparmor/label.c
    index 2469549842d2..6e7aa2ef8ee0 100644
    --- a/security/apparmor/label.c
    +++ b/security/apparmor/label.c
    @@ -1535,13 +1535,13 @@ static const char *label_modename(struct aa_ns *ns, struct aa_label *label,

    label_for_each(i, label, profile) {
    if (aa_ns_visible(ns, profile->ns, flags & FLAG_VIEW_SUBNS)) {
    - if (profile->mode == APPARMOR_UNCONFINED)
    + count++;
    + if (profile == profile->ns->unconfined)
    /* special case unconfined so stacks with
    * unconfined don't report as mixed. ie.
    * profile_foo//&:ns1:unconfined (mixed)
    */
    continue;
    - count++;
    if (mode == -1)
    mode = profile->mode;
    else if (mode != profile->mode)
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-06-18 03:28    [W:4.084 / U:0.572 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site