diff options
| author | John Johansen <john.johansen@canonical.com> | 2017-11-17 18:04:37 -0800 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2017-11-21 02:17:15 -0800 |
| commit | 06d426d113fe0b3107939e81db920ca7b097e97c (patch) | |
| tree | 091eb02fcc08a49c0cdb60094403bfc4ec398186 /security | |
| parent | 844b8292b6311ecd30ae63db1471edb26e01d895 (diff) | |
| download | op-kernel-dev-06d426d113fe0b3107939e81db920ca7b097e97c.zip op-kernel-dev-06d426d113fe0b3107939e81db920ca7b097e97c.tar.gz | |
apparmor: fix profile attachment for special unconfined profiles
It used to be that unconfined would never attach. However that is not
the case anymore as some special profiles can be marked as unconfined,
that are not the namespaces unconfined profile, and may have an
attachment.
Fixes: f1bd904175e8 ("apparmor: add the base fns() for domain labels")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security')
| -rw-r--r-- | security/apparmor/domain.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c index 9527adc..ad45654 100644 --- a/security/apparmor/domain.c +++ b/security/apparmor/domain.c @@ -325,8 +325,10 @@ static struct aa_profile *__attach_match(const char *name, struct aa_profile *profile, *candidate = NULL; list_for_each_entry_rcu(profile, head, base.list) { - if (profile->label.flags & FLAG_NULL) + if (profile->label.flags & FLAG_NULL && + &profile->label == ns_unconfined(profile->ns)) continue; + if (profile->xmatch) { if (profile->xmatch_len == len) { conflict = true; |
