GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-06-30 19:06:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

apparmor: fix setting unconfined mode on a loaded profile

Browse source 
commit 3bbb7b2e9b upstream.

When loading a profile that is set to unconfined mode, that label
flag is not set when it should be. Ensure it is set so that when
used in a label the unconfined check will be applied correctly.

Fixes: 038165070a ("apparmor: allow setting any profile into the unconfined state")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
John Johansen 2022-03-26 01:52:06 -07:00 • committed by Justin Hammond
parent d60850d155
commit fd0953c285
1 changed files with 7 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

12
security/apparmor/policy_unpack.c
View file

@ -746,16 +746,18 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
profile->label.flags |= FLAG_HAT; profile->label.flags |= FLAG_HAT;
if (!unpack_u32(e, &tmp, NULL)) if (!unpack_u32(e, &tmp, NULL))
goto fail; goto fail;
if (tmp == PACKED_MODE_COMPLAIN || (e->version & FORCE_COMPLAIN_FLAG)) if (tmp == PACKED_MODE_COMPLAIN || (e->version & FORCE_COMPLAIN_FLAG)) {
profile->mode = APPARMOR_COMPLAIN; profile->mode = APPARMOR_COMPLAIN;
else if (tmp == PACKED_MODE_ENFORCE) } else if (tmp == PACKED_MODE_ENFORCE) {
profile->mode = APPARMOR_ENFORCE; profile->mode = APPARMOR_ENFORCE;
else if (tmp == PACKED_MODE_KILL) } else if (tmp == PACKED_MODE_KILL) {
profile->mode = APPARMOR_KILL; profile->mode = APPARMOR_KILL;
else if (tmp == PACKED_MODE_UNCONFINED) } else if (tmp == PACKED_MODE_UNCONFINED) {
profile->mode = APPARMOR_UNCONFINED; profile->mode = APPARMOR_UNCONFINED;
else profile->label.flags |= FLAG_UNCONFINED;
} else {
goto fail; goto fail;
}
if (!unpack_u32(e, &tmp, NULL)) if (!unpack_u32(e, &tmp, NULL))
goto fail; goto fail;
if (tmp) if (tmp)