GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-06-26 16:41:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix execve behavior apparmor for PR_{GET,SET}_NO_NEW_PRIVS

Browse source 
Add support for AppArmor to explicitly fail requested domain transitions
if NO_NEW_PRIVS is set and the task is not unconfined.

Transitions from unconfined are still allowed because this always results
in a reduction of privileges.

Acked-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Andy Lutomirski <luto@amacapital.net>

v18: new acked-by, new description
Signed-off-by: James Morris <james.l.morris@oracle.com>
This commit is contained in:
John Johansen 2012-04-12 16:47:51 -05:00 • committed by James Morris
parent 259e5e6c75
commit c29bceb396
1 changed files with 35 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

39
security/apparmor/domain.c
View file

@ -360,10 +360,6 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
if (bprm->cred_prepared) if (bprm->cred_prepared)
return 0; return 0;
/* XXX: no_new_privs is not usable with AppArmor yet */
if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
return -EPERM;
cxt = bprm->cred->security; cxt = bprm->cred->security;
BUG_ON(!cxt); BUG_ON(!cxt);
@ -398,6 +394,11 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
new_profile = find_attach(ns, &ns->base.profiles, name); new_profile = find_attach(ns, &ns->base.profiles, name);
if (!new_profile) if (!new_profile)
goto cleanup; goto cleanup;
/*
* NOTE: Domain transitions from unconfined are allowed
* even when no_new_privs is set because this aways results
* in a further reduction of permissions.
*/
goto apply; goto apply;
} }
@ -459,6 +460,16 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
/* fail exec */ /* fail exec */
error = -EACCES; error = -EACCES;
/*
* Policy has specified a domain transition, if no_new_privs then
* fail the exec.
*/
if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS) {
aa_put_profile(new_profile);
error = -EPERM;
goto cleanup;
}
if (!new_profile) if (!new_profile)
goto audit; goto audit;
@ -613,6 +624,14 @@ int aa_change_hat(const char *hats[], int count, u64 token, bool permtest)
const char *target = NULL, *info = NULL; const char *target = NULL, *info = NULL;
int error = 0; int error = 0;
/*
* Fail explicitly requested domain transitions if no_new_privs.
* There is no exception for unconfined as change_hat is not
* available.
*/
if (current->no_new_privs)
return -EPERM;
/* released below */ /* released below */
cred = get_current_cred(); cred = get_current_cred();
cxt = cred->security; cxt = cred->security;
@ -754,6 +773,18 @@ int aa_change_profile(const char *ns_name, const char *hname, bool onexec,
cxt = cred->security; cxt = cred->security;
profile = aa_cred_profile(cred); profile = aa_cred_profile(cred);
/*
* Fail explicitly requested domain transitions if no_new_privs
* and not unconfined.
* Domain transitions from unconfined are allowed even when
* no_new_privs is set because this aways results in a reduction
* of permissions.
*/
if (current->no_new_privs && !unconfined(profile)) {
put_cred(cred);
return -EPERM;
}
if (ns_name) { if (ns_name) {
/* released below */ /* released below */
ns = aa_find_namespace(profile->ns, ns_name); ns = aa_find_namespace(profile->ns, ns_name);