mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-31 06:16:03 +00:00
Code Issues Releases Wiki Activity

parser: ensure mqueue obeys abi

Browse Source 
The abi is not being respected by mqueue rules in many cases. If policy
does ot specify an mqueue rule the abi is correctly applied but if
an mqueue rule is specified explicitly or implicitly (eg. allow all).
without setting the mqueue type OR setting the mqueue type to sysv.
The abi will be ignored and mqueue will be enforced for policy regadless.

Known good mqueue rule that respects abi
  mqueue type=posix,

  # and all variations that keep type=posix

Known bad mqueue rules that do not respect abi

  mqueue,
  # and all variants that do not specify the type= option

  mqueue type=sysv,
  # and all variants that specify the type=sysv option

Issue: https://gitlab.com/apparmor/apparmor/-/issues/412
Fixes: d98c5c4cf ("parser: add parser support for message queue mediation")

Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen
2024-07-19 03:17:08 -07:00
parent 0d9d548694
commit 30d57a6bf0
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
parser/mqueue.cc
View File

@@ -192,14 +192,14 @@ int mqueue_rule::gen_policy_re(Profile &prof)
return RULE_NOT_SUPPORTED;
} else if (qtype == mqueue_sysv && !features_supports_sysv_mqueue) {
warn_once(prof.name);
// return RULE_NOT_SUPPORTED;
return RULE_NOT_SUPPORTED;
} else if (qtype == mqueue_unspecified &&
!(features_supports_posix_mqueue ||
features_supports_sysv_mqueue)) {
warn_once(prof.name);
// should split into warning where posix and sysv can
// be separated from nothing being enforced
// return RULE_NOT_SUPPORTED;
return RULE_NOT_SUPPORTED;
}
/* always generate a label and mqueue entry */