apparmor: fix regression in mount mediation when feature set is pinned
commitpull/10/head5b9f57cf47
upstream. When the mount code was refactored for Labels it was not correctly updated to check whether policy supported mediation of the mount class. This causes a regression when the kernel feature set is reported as supporting mount and policy is pinned to a feature set that does not support mount mediation. BugLink: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=882697#41 Fixes:2ea3ffb778
("apparmor: add mount mediation") Reported-by: Fabian Grünbichler <f.gruenbichler@proxmox.com> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
4678964180
commit
f5edee88ad
|
@ -330,6 +330,9 @@ static int match_mnt_path_str(struct aa_profile *profile,
|
|||
AA_BUG(!mntpath);
|
||||
AA_BUG(!buffer);
|
||||
|
||||
if (!PROFILE_MEDIATES(profile, AA_CLASS_MOUNT))
|
||||
return 0;
|
||||
|
||||
error = aa_path_name(mntpath, path_flags(profile, mntpath), buffer,
|
||||
&mntpnt, &info, profile->disconnected);
|
||||
if (error)
|
||||
|
@ -381,6 +384,9 @@ static int match_mnt(struct aa_profile *profile, const struct path *path,
|
|||
AA_BUG(!profile);
|
||||
AA_BUG(devpath && !devbuffer);
|
||||
|
||||
if (!PROFILE_MEDIATES(profile, AA_CLASS_MOUNT))
|
||||
return 0;
|
||||
|
||||
if (devpath) {
|
||||
error = aa_path_name(devpath, path_flags(profile, devpath),
|
||||
devbuffer, &devname, &info,
|
||||
|
@ -559,6 +565,9 @@ static int profile_umount(struct aa_profile *profile, struct path *path,
|
|||
AA_BUG(!profile);
|
||||
AA_BUG(!path);
|
||||
|
||||
if (!PROFILE_MEDIATES(profile, AA_CLASS_MOUNT))
|
||||
return 0;
|
||||
|
||||
error = aa_path_name(path, path_flags(profile, path), buffer, &name,
|
||||
&info, profile->disconnected);
|
||||
if (error)
|
||||
|
@ -614,7 +623,8 @@ static struct aa_label *build_pivotroot(struct aa_profile *profile,
|
|||
AA_BUG(!new_path);
|
||||
AA_BUG(!old_path);
|
||||
|
||||
if (profile_unconfined(profile))
|
||||
if (profile_unconfined(profile) ||
|
||||
!PROFILE_MEDIATES(profile, AA_CLASS_MOUNT))
|
||||
return aa_get_newest_label(&profile->label);
|
||||
|
||||
error = aa_path_name(old_path, path_flags(profile, old_path),
|
||||
|
|
Loading…
Reference in New Issue