lkml.org 
[lkml]   [2017]   [Jan]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.12 205/235] apparmor: exec should not be returning ENOENT when it denies
    Date
    From: John Johansen <john.johansen@canonical.com>

    3.12-stable review patch. If anyone has any objections, please let me know.

    ===============

    commit 9049a7922124d843a2cd26a02b1d00a17596ec0c upstream.

    The current behavior is confusing as it causes exec failures to report
    the executable is missing instead of identifying that apparmor
    caused the failure.

    Signed-off-by: John Johansen <john.johansen@canonical.com>
    Acked-by: Seth Arnold <seth.arnold@canonical.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    ---
    security/apparmor/domain.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
    index 0c23888b9816..a59766fe3b7a 100644
    --- a/security/apparmor/domain.c
    +++ b/security/apparmor/domain.c
    @@ -437,7 +437,7 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
    new_profile = aa_get_newest_profile(ns->unconfined);
    info = "ux fallback";
    } else {
    - error = -ENOENT;
    + error = -EACCES;
    info = "profile not found";
    /* remove MAY_EXEC to audit as failure */
    perms.allow &= ~MAY_EXEC;
    --
    2.11.0
    \
     
     \ /
      Last update: 2017-01-27 12:29    [W:4.216 / U:0.276 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site