summaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
authorJohn Johansen <john.johansen@canonical.com>2012-02-22 00:20:26 -0800
committerJohn Johansen <john.johansen@canonical.com>2012-02-27 11:38:21 -0800
commitade3ddc01e2e426cc24c744be85dcaad4e8f8aba (patch)
tree1e395ce7487cf31c9dccf4d0e3ded0c055980ab2 /security
parentcdbd2884df8ad026143bb482a96d38e616947b17 (diff)
downloadop-kernel-dev-ade3ddc01e2e426cc24c744be85dcaad4e8f8aba.zip
op-kernel-dev-ade3ddc01e2e426cc24c744be85dcaad4e8f8aba.tar.gz
AppArmor: Fix dropping of allowed operations that are force audited
The audit permission flag, that specifies an audit message should be provided when an operation is allowed, was being ignored in some cases. This is because the auto audit mode (which determines the audit mode from system flags) was incorrectly assigned the same value as audit mode. The shared value would result in messages that should be audited going through a second evaluation as to whether they should be audited based on the auto audit, resulting in some messages being dropped. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Kees Cook <kees@ubuntu.com>
Diffstat (limited to 'security')
-rw-r--r--security/apparmor/audit.c1
-rw-r--r--security/apparmor/include/audit.h5
2 files changed, 3 insertions, 3 deletions
diff --git a/security/apparmor/audit.c b/security/apparmor/audit.c
index f3fafed..61344b5 100644
--- a/security/apparmor/audit.c
+++ b/security/apparmor/audit.c
@@ -89,6 +89,7 @@ static char *aa_audit_type[] = {
"STATUS",
"ERROR",
"KILLED"
+ "AUTO"
};
/*
diff --git a/security/apparmor/include/audit.h b/security/apparmor/include/audit.h
index 1951786..9317cd8 100644
--- a/security/apparmor/include/audit.h
+++ b/security/apparmor/include/audit.h
@@ -28,8 +28,6 @@ struct aa_profile;
extern const char *audit_mode_names[];
#define AUDIT_MAX_INDEX 5
-#define AUDIT_APPARMOR_AUTO 0 /* auto choose audit message type */
-
enum audit_mode {
AUDIT_NORMAL, /* follow normal auditing of accesses */
AUDIT_QUIET_DENIED, /* quiet all denied access messages */
@@ -45,7 +43,8 @@ enum audit_type {
AUDIT_APPARMOR_HINT,
AUDIT_APPARMOR_STATUS,
AUDIT_APPARMOR_ERROR,
- AUDIT_APPARMOR_KILL
+ AUDIT_APPARMOR_KILL,
+ AUDIT_APPARMOR_AUTO
};
extern const char *op_table[];
OpenPOWER on IntegriCloud