github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

apparmor: remove unconfined_profile() check in inet socket mediation

Browse Source 
When a stacked label is used the early bailout !unconfined(label)
fails, and the individual profile components of the label are checked.
This can lead to aa_profile_af_perm() being called which results in

  WARNING: security/apparmor/net.c:263 at aa_profile_af_perm+0x228/0x3b0

on any inet socket using basic socket mediation.

Remove the AA_BUG(profile_unconfined(profile)) check, it is not needed
as the code already handles the unconfined_profile() case. In addition
also a comment to indicate that this case is covered.

Fixes: 89ac6aa752 ("apparmor: push inet mediation into profile callbacks, and improve auditing")
Reported-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen 2026-10-20 12:23:13 -07:00
parent 33ed507162
commit 1f5428b9f9
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
security/apparmor/net.c
View File

@ -260,7 +260,6 @@ int aa_profile_af_perm(struct aa_profile *profile,
AA_BUG(family >= AF_MAX);
AA_BUG(type < 0 || type >= SOCK_MAX);
AA_BUG(profile_unconfined(profile));
state = RULE_MEDIATES_NET(rules);
if (state) {
@ -268,7 +267,7 @@ int aa_profile_af_perm(struct aa_profile *profile,
type, protocol, &p, &ad->info);
return aa_do_perms(profile, rules->policy, state, request, p,
ad);
} /* else */
} /* else - not mediated this covers the profile_unconfined() case */
return 0;
}