iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

apparmor: fix setting unconfined mode on a loaded profile

Browse Source 
When loading a profile that is set to unconfined mode, that label
flag is not set when it should be. Ensure it is set so that when
used in a label the unconfined check will be applied correctly.

Fixes: 038165070a ("apparmor: allow setting any profile into the unconfined state")
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen 2022-03-26 01:52:06 -07:00
parent f378973698
commit 3bbb7b2e9b
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
security/apparmor/policy_unpack.c
View File

@ -750,16 +750,18 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
profile->label.flags |= FLAG_HAT;
if (!unpack_u32(e, &tmp, NULL))
goto fail;
if (tmp == PACKED_MODE_COMPLAIN || (e->version & FORCE_COMPLAIN_FLAG))
if (tmp == PACKED_MODE_COMPLAIN || (e->version & FORCE_COMPLAIN_FLAG)) {
profile->mode = APPARMOR_COMPLAIN;
else if (tmp == PACKED_MODE_ENFORCE)
} else if (tmp == PACKED_MODE_ENFORCE) {
profile->mode = APPARMOR_ENFORCE;
else if (tmp == PACKED_MODE_KILL)
} else if (tmp == PACKED_MODE_KILL) {
profile->mode = APPARMOR_KILL;
else if (tmp == PACKED_MODE_UNCONFINED)
} else if (tmp == PACKED_MODE_UNCONFINED) {
profile->mode = APPARMOR_UNCONFINED;
else
profile->label.flags |= FLAG_UNCONFINED;
} else {
goto fail;
}
if (!unpack_u32(e, &tmp, NULL))
goto fail;
if (tmp)