mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-31 22:35:35 +00:00
Code Issues Releases Wiki Activity

parser: add special casing for detached move mounts

Browse Source 
upsteam move_mount mediation now allows for a detached (disconnected)
mount to be move mounted into a namespace.

Add support for this by detecting 'detached' as a keyword for the
source/device and using it to create a null match. Because existing
mount encoding using a null separator between the mount terms null
match followed by the null seperator will separate detached mounts
within the existing encoding.

Eg.
  mount detached -> /destination,
  mount options=(ro) fstype=ext4 detached -> /destination,

This is functionally equivalent to using

  mount "" -> /destination,

However using "" does not provide any context that about what the rule is allowing or why so the 'detached' form is preferred.

This is not a perfect solution, but is what can be currently supported
by the kernel without more LSM hooks.

On kernels that don't support detached mount detection, rules using
the detached souce conditional will be ignored (never matched).

This encoding also allows the existing

  mount,
  mount options=(move),
  mount options=(move) -> /destination,

to continue to work with both detached and regular mounts on kernels
that support the move_mount() syscall.

Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen
2023-12-29 13:01:01 -08:00
parent e4943576d5
commit fa0746f2e2
4 changed files with 35 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
parser/parser.h
View File

@@ -321,6 +321,7 @@ extern int features_supports_inet;
extern int kernel_supports_policydb;
extern int kernel_supports_diff_encode;
extern int features_supports_mount;
extern bool features_supports_detached_mount;
extern int features_supports_dbus;
extern int features_supports_signal;
extern int features_supports_ptrace;