kernel.git/security/apparmor/domain.c, branch linux-3.12.y

apparmor: ensure the target profile name is always audited

2017-01-27T10:16:11Z

commit f7da2de01127b58d93cebeab165136d0998e7b1a upstream. The target profile name was not being correctly audited in a few cases because the target variable was not being set and gotos passed the code to set it at apply: Since it is always based on new_profile just drop the target var and conditionally report based on new_profile. Signed-off-by: John Johansen Acked-by: Seth Arnold Acked-by: Jeff Mahoney Signed-off-by: Jiri Slaby

apparmor: exec should not be returning ENOENT when it denies

2017-01-27T10:16:06Z

commit 9049a7922124d843a2cd26a02b1d00a17596ec0c upstream. The current behavior is confusing as it causes exec failures to report the executable is missing instead of identifying that apparmor caused the failure. Signed-off-by: John Johansen Acked-by: Seth Arnold Signed-off-by: Jiri Slaby

apparmor: fix change_hat not finding hat after policy replacement

2016-12-12T12:55:53Z

commit 3d40658c977769ce2138f286cf131537bf68bdfe upstream. After a policy replacement, the task cred may be out of date and need to be updated. However change_hat is using the stale profiles from the out of date cred resulting in either: a stale profile being applied or, incorrect failure when searching for a hat profile as it has been migrated to the new parent profile. Fixes: 01e2b670aa898a39259bc85c78e3d74820f4d3b6 (failure to find hat) Fixes: 898127c34ec03291c86f4ff3856d79e9e18952bc (stale policy being applied) Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1000287 Signed-off-by: John Johansen Signed-off-by: James Morris Signed-off-by: Jiri Slaby

apparmor: allow setting any profile into the unconfined state

2013-08-14T18:42:07Z

Allow emulating the default profile behavior from boot, by allowing loading of a profile in the unconfined state into a new NS. Signed-off-by: John Johansen Acked-by: Seth Arnold

apparmor: update how unconfined is handled

2013-08-14T18:42:06Z

ns->unconfined is being used read side without locking, nor rcu but is being updated when a namespace is removed. This works for the root ns which is never removed but has a race window and can cause failures when children namespaces are removed. Also ns and ns->unconfined have a circular refcounting dependency that is problematic and must be broken. Currently this is done incorrectly when the namespace is destroyed. Fix this by forward referencing unconfined via the replacedby infrastructure instead of directly updating the ns->unconfined pointer. Remove the circular refcount dependency by making the ns and its unconfined profile share the same refcount. Signed-off-by: John Johansen Acked-by: Seth Arnold

apparmor: change how profile replacement update is done

2013-08-14T18:42:06Z

remove the use of replaced by chaining and move to profile invalidation and lookup to handle task replacement. Replacement chaining can result in large chains of profiles being pinned in memory when one profile in the chain is use. With implicit labeling this will be even more of a problem, so move to a direct lookup method. Signed-off-by: John Johansen

apparmor: convert profile lists to RCU based locking

2013-08-14T18:42:06Z

Signed-off-by: John Johansen

apparmor: localize getting the security context to a few macros

2013-04-28T07:39:35Z

Signed-off-by: John Johansen Acked-by: Seth Arnold

apparmor: use common fn to clear task_context for domain transitions

2013-04-28T07:36:20Z

Signed-off-by: John Johansen Acked-by: Steve Beattie

apparmor: add utility function to get an arbitrary tasks profile.

2013-04-28T07:35:53Z

Signed-off-by: John Johansen Acked-by: Steve Beattie