tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'apparmor-pr-2024-01-03' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor

Pull apparmor fix from John Johansen:
"Detect that the source mount is not in the namespace and if it isn't
don't use it as a source path match.

This prevent apparmor from applying the attach_disconnected flag to
move_mount() source which prevents detached mounts from appearing as /
when applying mount mediation, which is not only incorrect but could
result in bad policy being generated"

* tag 'apparmor-pr-2024-01-03' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor:
apparmor: Fix move_mount mediation by detecting if source is detached

Linus Torvalds d7807d85 94a502eb

+5
+1
security/apparmor/apparmorfs.c
··· 2373 2373 2374 2374 static struct aa_sfs_entry aa_sfs_entry_mount[] = { 2375 2375 AA_SFS_FILE_STRING("mask", "mount umount pivot_root"), 2376 + AA_SFS_FILE_STRING("move_mount", "detached"), 2376 2377 { } 2377 2378 }; 2378 2379
+4
security/apparmor/mount.c
··· 499 499 error = -ENOMEM; 500 500 if (!to_buffer || !from_buffer) 501 501 goto out; 502 + 503 + if (!our_mnt(from_path->mnt)) 504 + /* moving a mount detached from the namespace */ 505 + from_path = NULL; 502 506 error = fn_for_each_confined(label, profile, 503 507 match_mnt(subj_cred, profile, to_path, to_buffer, 504 508 from_path, from_buffer,