[lkml]   [2011]   [Jun]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH 2/2] AppArmor: Fix masking of capabilities in complain mode
    AppArmor is masking the capabilities returned by capget against the
    capabilities mask in the profile. This is wrong, in complain mode the
    profile has effectively all capabilities, as the profile restrictions are
    not being enforced, merely tested against to determine is an access is
    known by the profile.

    This can result in the wrong behavior of security conscience applications
    like sshd which examine their capability set, and change their behavior
    accordingly. In this case because of the masked capability set being
    returned sshd fails due to DAC checks, even when the profile is complain

    Kernels affected: 2.6.36 - 3.0

    Signed-off-by: John Johansen <>
    security/apparmor/lsm.c | 2 +-
    1 files changed, 1 insertions(+), 1 deletions(-)

    diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
    index 3d2fd14..3783202 100644
    --- a/security/apparmor/lsm.c
    +++ b/security/apparmor/lsm.c
    @@ -127,7 +127,7 @@ static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective,
    *inheritable = cred->cap_inheritable;
    *permitted = cred->cap_permitted;

    - if (!unconfined(profile)) {
    + if (!unconfined(profile) && !COMPLAIN_MODE(profile)) {
    *effective = cap_intersect(*effective, profile->caps.allow);
    *permitted = cap_intersect(*permitted, profile->caps.allow);

     \ /
      Last update: 2011-06-28 18:45    [W:0.030 / U:28.868 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site