summaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
authorTyler Hicks <tyhicks@canonical.com>2016-03-17 01:19:10 +0100
committerJohn Johansen <john.johansen@canonical.com>2017-01-16 10:18:52 +0100
commite3ea1ca59adaefa31935a6f8f06a9168ea0e57d2 (patch)
tree9ad612c96bb48331ed9203a3fe0ed4f3c6792002 /security
parentapparmor: support querying extended trusted helper extra data (diff)
downloadlinux-e3ea1ca59adaefa31935a6f8f06a9168ea0e57d2.tar.xz
linux-e3ea1ca59adaefa31935a6f8f06a9168ea0e57d2.zip
apparmor: sysctl to enable unprivileged user ns AppArmor policy loading
If this sysctl is set to non-zero and a process with CAP_MAC_ADMIN in the root namespace has created an AppArmor policy namespace, unprivileged processes will be able to change to a profile in the newly created AppArmor policy namespace and, if the profile allows CAP_MAC_ADMIN and appropriate file permissions, will be able to load policy in the respective policy namespace. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security')
-rw-r--r--security/apparmor/lsm.c47
-rw-r--r--security/apparmor/policy.c1
2 files changed, 47 insertions, 1 deletions
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index b1def70b94f1..8a887c392fdb 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -868,6 +868,46 @@ static int __init set_init_ctx(void)
return 0;
}
+#ifdef CONFIG_SYSCTL
+static int apparmor_dointvec(struct ctl_table *table, int write,
+ void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+ if (!policy_admin_capable(NULL))
+ return -EPERM;
+ if (!apparmor_enabled)
+ return -EINVAL;
+
+ return proc_dointvec(table, write, buffer, lenp, ppos);
+}
+
+static struct ctl_path apparmor_sysctl_path[] = {
+ { .procname = "kernel", },
+ { }
+};
+
+static struct ctl_table apparmor_sysctl_table[] = {
+ {
+ .procname = "unprivileged_userns_apparmor_policy",
+ .data = &unprivileged_userns_apparmor_policy,
+ .maxlen = sizeof(int),
+ .mode = 0600,
+ .proc_handler = apparmor_dointvec,
+ },
+ { }
+};
+
+static int __init apparmor_init_sysctl(void)
+{
+ return register_sysctl_paths(apparmor_sysctl_path,
+ apparmor_sysctl_table) ? 0 : -ENOMEM;
+}
+#else
+static inline int apparmor_init_sysctl(void)
+{
+ return 0;
+}
+#endif /* CONFIG_SYSCTL */
+
static int __init apparmor_init(void)
{
int error;
@@ -890,6 +930,13 @@ static int __init apparmor_init(void)
goto alloc_out;
}
+ error = apparmor_init_sysctl();
+ if (error) {
+ AA_ERROR("Unable to register sysctls\n");
+ goto alloc_out;
+
+ }
+
error = set_init_ctx();
if (error) {
AA_ERROR("Failed to set context on init task\n");
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index f2c4bb26b060..f44312a19522 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -99,7 +99,6 @@ const char *const aa_profile_mode_names[] = {
"unconfined",
};
-
/* requires profile list write lock held */
void __aa_update_proxy(struct aa_profile *orig, struct aa_profile *new)
{