Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-24 13:11:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

apparmor: fix auditing of domain transition failures due to incomplete policy

Browse Source 
When policy specifies a transition to a profile that is not currently
loaded, it result in exec being denied.  However the failure is not being
audited correctly because the audit code is treating this as an allowed
permission and thus not reporting it.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
This commit is contained in:
John Johansen 2013-02-18 15:59:34 -08:00
parent b7ae9f064b
commit 17322cc3f9
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
security/apparmor/domain.c
View File

@ -443,6 +443,8 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
} else { } else {
error = -ENOENT; error = -ENOENT;
info = "profile not found"; info = "profile not found";
/* remove MAY_EXEC to audit as failure */
perms.allow &= ~MAY_EXEC;
} }
} }
} else if (COMPLAIN_MODE(profile)) { } else if (COMPLAIN_MODE(profile)) {