mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-09-02 23:35:37 +00:00
Code Issues Releases Wiki Activity

Merge parser: fix encoding of unix permissions for setopt and getopt

Browse Source 
The permissions for AA_NET_OPT need to be bounded by mask so we can
make sure it matches when a policy specified only setopt or only
getopt. This was causing failures on the regression tests
unix_socket_pathname, unix_socket_abstract, unix_socket_unnamed and
unix_socket_autobind

Fixes: 44f3be091 ("parser: convert the stored audit from a bit mask to a bool")
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1079
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
This commit is contained in:
John Johansen
2023-08-02 11:13:40 +00:00
parent 93dff6a806 64c1eb9cda
commit 313366fbbc
2 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
parser/af_unix.cc
View File

@@ -413,7 +413,7 @@ int unix_rule::gen_policy_re(Profile &prof)
tmp << ".."; tmp << "..";
buf = tmp.str(); buf = tmp.str();
if (!prof.policy.rules->add_rule(buf.c_str(), rule_mode == RULE_DENY, if (!prof.policy.rules->add_rule(buf.c_str(), rule_mode == RULE_DENY,
map_perms(AA_NET_OPT), map_perms(mask & AA_NET_OPT),
map_perms(audit == AUDIT_FORCE ? AA_NET_OPT : 0), map_perms(audit == AUDIT_FORCE ? AA_NET_OPT : 0),
parseopts)) parseopts))
goto fail; goto fail;

9
tests/regression/apparmor/prologue.inc
View File

@@ -70,9 +70,14 @@ kernel_features()
# check if feature is in file # check if feature is in file
feature=$(basename "$features_dir/$f") feature=$(basename "$features_dir/$f")
file=$(dirname "$features_dir/$f") file=$(dirname "$features_dir/$f")
if [ -f $file ] && ! grep -q $feature $file; then if [ -f $file ]; then
if ! grep -q $feature $file; then
echo "Required feature '$f' not available."
return 2;
fi
else
echo "Required feature '$f' not available." echo "Required feature '$f' not available."
return 2; return 3;
fi fi
fi fi
done done