Messages in this thread | | | Date | Tue, 28 Jun 2011 11:12:15 -0700 | From | Greg KH <> | Subject | Re: [PATCH 2/2] AppArmor: Fix masking of capabilities in complain mode |
| |
On Tue, Jun 28, 2011 at 04:56:05PM +0100, John Johansen wrote: > AppArmor is masking the capabilities returned by capget against the > capabilities mask in the profile. This is wrong, in complain mode the > profile has effectively all capabilities, as the profile restrictions are > not being enforced, merely tested against to determine is an access is > known by the profile. > > This can result in the wrong behavior of security conscience applications > like sshd which examine their capability set, and change their behavior > accordingly. In this case because of the masked capability set being > returned sshd fails due to DAC checks, even when the profile is complain > mode. > > Kernels affected: 2.6.36 - 3.0 > > Signed-off-by: John Johansen <john.johansen@canonical.com>
As this should probably go to the stable tree, next time care to add a simple: Cc: stable <stable@kernel.org> to the signed-off-by: area of the patch so it gets automagically included in the stable and longterm kernels as needed when it hits Linus's tree?
thanks,
greg k-h
| |