lkml.org 
[lkml]   [2012]   [Jan]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v3 2/4] Fix apparmor for PR_{GET,SET}_NO_NEW_PRIVS
    Date
    From: John Johansen <john.johansen@canonical.com>

    Signed-off-by: John Johansen <john.johansen@canonical.com>
    Signed-off-by: Andy Lutomirski <luto@amacapital.net>
    ---
    security/apparmor/domain.c | 39 +++++++++++++++++++++++++++++++++++----
    1 files changed, 35 insertions(+), 4 deletions(-)

    diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
    index fcfb610..7316d77 100644
    --- a/security/apparmor/domain.c
    +++ b/security/apparmor/domain.c
    @@ -360,10 +360,6 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
    if (bprm->cred_prepared)
    return 0;

    - /* XXX: no_new_privs is not usable with AppArmor yet */
    - if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
    - return -EPERM;
    -
    cxt = bprm->cred->security;
    BUG_ON(!cxt);

    @@ -399,6 +395,11 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
    new_profile = find_attach(ns, &ns->base.profiles, name);
    if (!new_profile)
    goto cleanup;
    + /*
    + * NOTE: Domain transitions from unconfined are allowed
    + * even when no_new_privs is set because this aways results
    + * in a further reduction of permissions.
    + */
    goto apply;
    }

    @@ -459,6 +460,16 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
    /* fail exec */
    error = -EACCES;

    + /*
    + * Policy has specified a domain transition, if no_new_privs then
    + * fail the exec.
    + */
    + if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS) {
    + aa_put_profile(new_profile);
    + error = -EPERM;
    + goto cleanup;
    + }
    +
    if (!new_profile)
    goto audit;

    @@ -613,6 +624,14 @@ int aa_change_hat(const char *hats[], int count, u64 token, bool permtest)
    const char *target = NULL, *info = NULL;
    int error = 0;

    + /*
    + * Fail explicitly requested domain transitions if no_new_privs.
    + * There is no exception for unconfined as change_hat is not
    + * available.
    + */
    + if (current->no_new_privs)
    + return -EPERM;
    +
    /* released below */
    cred = get_current_cred();
    cxt = cred->security;
    @@ -754,6 +773,18 @@ int aa_change_profile(const char *ns_name, const char *hname, bool onexec,
    cxt = cred->security;
    profile = aa_cred_profile(cred);

    + /*
    + * Fail explicitly requested domain transitions if no_new_privs
    + * and not unconfined.
    + * Domain transitions from unconfined are allowed even when
    + * no_new_privs is set because this aways results in a reduction
    + * of permissions.
    + */
    + if (current->no_new_privs && !unconfined(profile)) {
    + put_cred(cred);
    + return -EPERM;
    + }
    +
    if (ns_name) {
    /* released below */
    ns = aa_find_namespace(profile->ns, ns_name);
    --
    1.7.7.6


    \
     
     \ /
      Last update: 2012-01-30 17:21    [W:0.027 / U:0.592 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site