Re: [PATCH 2/2] AppArmor: Fix masking of capabilities in complainmode

[John Johansen]

On 06/29/2011 05:24 AM, Greg KH wrote:
> On Wed, Jun 29, 2011 at 02:44:34AM +0100, John Johansen wrote:
>> AppArmor is masking the capabilities returned by capget against the
>> capabilities mask in the profile.  This is wrong, in complain mode the
>> profile has effectively all capabilities, as the profile restrictions are
>> not being enforced, merely tested against to determine if an access is
>> known by the profile.
>>
>> This can result in the wrong behavior of security conscience applications
>> like sshd which examine their capability set, and change their behavior
>> accordingly.  In this case because of the masked capability set being
>> returned sshd fails due to DAC checks, even when the profile is in complain
>> mode.
>>
>> Kernels affected: 2.6.36 - 3.0.
>>
>> Signed-off-by: John Johansen <john.johansen@xxxxxxxxxxxxx>
>> ---
> 
> You say that multiple kernels are affected, then why not also include
> stable@xxxxxxxxxx here as well?
> 
> confused,
> 
Sorry I should have elaborated, I think its a borderline case for stable
release, and was as much a note to my self as anything.

The bug doesn't affect the enforcement of policy, only learning mode used
for generating policy, and it is something we can work around in userspace.
for already released kernels.

I can resend with a Cc: stable if you would like



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/