linux.git/security/apparmor/domain.c, branch v3.11

apparmor: localize getting the security context to a few macros

2013-04-28T07:39:35+00:00

Signed-off-by: John Johansen 
Acked-by: Seth Arnold

apparmor: use common fn to clear task_context for domain transitions

2013-04-28T07:36:20+00:00

Signed-off-by: John Johansen 
Acked-by: Steve Beattie

apparmor: add utility function to get an arbitrary tasks profile.

2013-04-28T07:35:53+00:00

Signed-off-by: John Johansen 
Acked-by: Steve Beattie

apparmor: Remove -W1 warnings

2013-04-28T07:35:18+00:00

Signed-off-by: John Johansen 
Acked-By: Steve Beattie

apparmor: fix auditing of domain transition failures due to incomplete policy

2013-04-28T07:35:04+00:00

When policy specifies a transition to a profile that is not currently
loaded, it result in exec being denied.  However the failure is not being
audited correctly because the audit code is treating this as an allowed
permission and thus not reporting it.

Signed-off-by: John Johansen 
Acked-By: Steve Beattie

new helper: file_inode(file)

2013-02-23T04:31:31+00:00

Signed-off-by: Al Viro

userns: Convert apparmor to use kuid and kgid where appropriate

2012-09-21T10:13:21+00:00

Cc: John Johansen 
Acked-by: Serge Hallyn 
Signed-off-by: Eric W. Biederman

Fix execve behavior apparmor for PR_{GET,SET}_NO_NEW_PRIVS

2012-04-14T01:13:18+00:00

Add support for AppArmor to explicitly fail requested domain transitions
if NO_NEW_PRIVS is set and the task is not unconfined.

Transitions from unconfined are still allowed because this always results
in a reduction of privileges.

Acked-by: Eric Paris 
Signed-off-by: Will Drewry 
Signed-off-by: John Johansen 
Signed-off-by: Andy Lutomirski 

v18: new acked-by, new description
Signed-off-by: James Morris

Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs

2012-04-14T01:13:18+00:00

With this change, calling
  prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)
disables privilege granting operations at execve-time.  For example, a
process will not be able to execute a setuid binary to change their uid
or gid if this bit is set.  The same is true for file capabilities.

Additionally, LSM_UNSAFE_NO_NEW_PRIVS is defined to ensure that
LSMs respect the requested behavior.

To determine if the NO_NEW_PRIVS bit is set, a task may call
  prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
It returns 1 if set and 0 if it is not set. If any of the arguments are
non-zero, it will return -1 and set errno to -EINVAL.
(PR_SET_NO_NEW_PRIVS behaves similarly.)

This functionality is desired for the proposed seccomp filter patch
series.  By using PR_SET_NO_NEW_PRIVS, it allows a task to modify the
system call behavior for itself and its child tasks without being
able to impact the behavior of a more privileged task.

Another potential use is making certain privileged operations
unprivileged.  For example, chroot may be considered "safe" if it cannot
affect privileged tasks.

Note, this patch causes execve to fail when PR_SET_NO_NEW_PRIVS is
set and AppArmor is in use.  It is fixed in a subsequent patch.

Signed-off-by: Andy Lutomirski 
Signed-off-by: Will Drewry 
Acked-by: Eric Paris 
Acked-by: Kees Cook 

v18: updated change desc
v17: using new define values as per 3.4
Signed-off-by: James Morris

apparmor: Fix change_onexec when called from a confined task

2012-03-27T14:00:05+00:00

Fix failure in aa_change_onexec api when the request is made from a confined
task.  This failure was caused by two problems

 The AA_MAY_ONEXEC perm was not being mapped correctly for this case.

 The executable name was being checked as second time instead of using the
 requested onexec profile name, which may not be the same as the exec
 profile name. This mistake can not be exploited to grant extra permission
 because of the above flaw where the ONEXEC permission was not being mapped
 so it will not be granted.

BugLink: http://bugs.launchpad.net/bugs/963756

Signed-off-by: John Johansen 
Signed-off-by: James Morris