summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJohn Johansen <john.johansen@canonical.com>2012-02-22 00:42:08 -0800
committerJohn Johansen <john.johansen@canonical.com>2012-02-27 11:38:22 -0800
commit38305a4bab4be5d278443b057f7f5e97afb07f26 (patch)
tree06122a0380bc06de07c2b462bfa2f306ab12af87
parent8b964eae204d791421677ec56b94a7b18cf8740d (diff)
downloadlinux-38305a4bab4be5d278443b057f7f5e97afb07f26.tar.bz2
AppArmor: fix mapping of META_READ to audit and quiet flags
The mapping of AA_MAY_META_READ for the allow mask was also being mapped to the audit and quiet masks. This would result in some operations being audited when the should not. This flaw was hidden by the previous audit bug which would drop some messages that where supposed to be audited. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Kees Cook <kees@ubuntu.com>
-rw-r--r--security/apparmor/file.c3
1 files changed, 1 insertions, 2 deletions
diff --git a/security/apparmor/file.c b/security/apparmor/file.c
index 7312db741219..bba875c4d068 100644
--- a/security/apparmor/file.c
+++ b/security/apparmor/file.c
@@ -173,8 +173,6 @@ static u32 map_old_perms(u32 old)
if (old & 0x40) /* AA_EXEC_MMAP */
new |= AA_EXEC_MMAP;
- new |= AA_MAY_META_READ;
-
return new;
}
@@ -212,6 +210,7 @@ static struct file_perms compute_perms(struct aa_dfa *dfa, unsigned int state,
perms.quiet = map_old_perms(dfa_other_quiet(dfa, state));
perms.xindex = dfa_other_xindex(dfa, state);
}
+ perms.allow |= AA_MAY_META_READ;
/* change_profile wasn't determined by ownership in old mapping */
if (ACCEPT_TABLE(dfa)[state] & 0x80000000)