summaryrefslogtreecommitdiffstats
path: root/security/apparmor
diff options
context:
space:
mode:
authorJohn Johansen <john.johansen@canonical.com>2017-11-18 03:04:37 +0100
committerJohn Johansen <john.johansen@canonical.com>2017-11-21 11:17:15 +0100
commit06d426d113fe0b3107939e81db920ca7b097e97c (patch)
tree091eb02fcc08a49c0cdb60094403bfc4ec398186 /security/apparmor
parentapparmor: ensure that undecidable profile attachments fail (diff)
downloadlinux-06d426d113fe0b3107939e81db920ca7b097e97c.tar.xz
linux-06d426d113fe0b3107939e81db920ca7b097e97c.zip
apparmor: fix profile attachment for special unconfined profiles
It used to be that unconfined would never attach. However that is not the case anymore as some special profiles can be marked as unconfined, that are not the namespaces unconfined profile, and may have an attachment. Fixes: f1bd904175e8 ("apparmor: add the base fns() for domain labels") Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor')
-rw-r--r--security/apparmor/domain.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 9527adc11c6d..ad456546df5b 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -325,8 +325,10 @@ static struct aa_profile *__attach_match(const char *name,
struct aa_profile *profile, *candidate = NULL;
list_for_each_entry_rcu(profile, head, base.list) {
- if (profile->label.flags & FLAG_NULL)
+ if (profile->label.flags & FLAG_NULL &&
+ &profile->label == ns_unconfined(profile->ns))
continue;
+
if (profile->xmatch) {
if (profile->xmatch_len == len) {
conflict = true;