Commit 06d426d1 authored Nov 17, 2017 by John Johansen

apparmor: fix profile attachment for special unconfined profiles



It used to be that unconfined would never attach. However that is not
the case anymore as some special profiles can be marked as unconfined,
that are not the namespaces unconfined profile, and may have an
attachment.

Fixes: f1bd9041 ("apparmor: add the base fns() for domain labels")
Signed-off-by: John Johansen <john.johansen@canonical.com>

parent 844b8292

security/apparmor/domain.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -325,8 +325,10 @@ static struct aa_profile __attach_match(const char name,
		struct aa_profile profile, candidate = NULL;

		list_for_each_entry_rcu(profile, head, base.list) {
		if (profile->label.flags & FLAG_NULL)
		if (profile->label.flags & FLAG_NULL &&
		&profile->label == ns_unconfined(profile->ns))
		continue;

		if (profile->xmatch) {
		if (profile->xmatch_len == len) {
		conflict = true;