mirror of
https://gitlab.com/apparmor/apparmor
synced 2025-09-05 16:55:32 +00:00
40 lines
1.2 KiB
Diff
40 lines
1.2 KiB
Diff
|
---
|
||
|
|
security/apparmor/apparmor.h | 5 +++--
|
||
|
|
security/apparmor/main.c | 9 +++++++++
|
||
|
|
2 files changed, 12 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
--- a/security/apparmor/apparmor.h
|
||
|
|
+++ b/security/apparmor/apparmor.h
|
||
|
|
@@ -68,10 +68,11 @@
|
||
|
|
#define AA_ALL_EXEC_MODS (AA_USER_EXEC_MODS | \
|
||
|
|
AA_OTHER_EXEC_MODS)
|
||
|
|
|
||
|
|
-/* shared permissions that are not duplicated in user:group:other */
|
||
|
|
+/* shared permissions that are not duplicated in user::other */
|
||
|
|
+#define AA_CHANGE_HAT 0x20000000
|
||
|
|
#define AA_CHANGE_PROFILE 0x40000000
|
||
|
|
|
||
|
|
-#define AA_SHARED_PERMS (AA_CHANGE_PROFILE)
|
||
|
|
+#define AA_SHARED_PERMS (AA_CHANGE_HAT | AA_CHANGE_PROFILE)
|
||
|
|
|
||
|
|
#define AA_VALID_PERM_MASK (AA_FILE_PERMS | AA_SHARED_PERMS)
|
||
|
|
|
||
|
|
--- a/security/apparmor/main.c
|
||
|
|
+++ b/security/apparmor/main.c
|
||
|
|
@@ -1300,6 +1300,15 @@ repeat:
|
||
|
|
|
||
|
|
if (hat_name) {
|
||
|
|
char *name, *profile_name;
|
||
|
|
+ /* Not Yet. This perm check is currently done by searching
|
||
|
|
+ for the hat profile. When hat style profile names
|
||
|
|
+ become more generic then this will be needed.
|
||
|
|
+ if (!(aa_match(profile->file_rules, hat_name) &
|
||
|
|
+ AA_CHANGE_PROFILE)) {
|
||
|
|
+ error = -EACCES;
|
||
|
|
+ goto out;
|
||
|
|
+ }
|
||
|
|
+ */
|
||
|
|
if (previous_profile)
|
||
|
|
profile_name = previous_profile->name;
|
||
|
|
else
|