[GIT PULL] apparmor: Final fix for v6.7-rc8

[John Johansen]

Linus,

Please pull the following fix for the apparmor move_mount regression

- detect that the source mount is not in the namespace and if it
  isn't don't use it as a source path match. This prevent apparmor
  from applying the attach_disconnected flag to move_mount() source
  which prevents detached mounts from appearing as / when applying
  mount mediation, which is not only incorrect but could result in
  bad policy being generated.


The following changes since commit 610a9b8f49fbcf1100716370d3b5f6f884a2835a:

  Linux 6.7-rc8 (2023-12-31 12:51:25 -0800)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor tags/apparmor-pr-2024-01-03

for you to fetch changes up to 8026e40608b4d552216d2a818ca7080a4264bb44:

  apparmor: Fix move_mount mediation by detecting if source is detached (2024-01-03 12:10:29 -0800)

----------------------------------------------------------------
+ Bug Fix
  - Fix move_mount mediation regression when source is detached

----------------------------------------------------------------
John Johansen (1):
      apparmor: Fix move_mount mediation by detecting if source is detached

 security/apparmor/apparmorfs.c | 1 +
 security/apparmor/mount.c      | 4 ++++
 2 files changed, 5 insertions(+)
---------------------------
diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index 38650e52ef57..2d9f2a4b4519 100644
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -2373,6 +2373,7 @@ static struct aa_sfs_entry aa_sfs_entry_policy[] = {
 
 static struct aa_sfs_entry aa_sfs_entry_mount[] = {
 	AA_SFS_FILE_STRING("mask", "mount umount pivot_root"),
+	AA_SFS_FILE_STRING("move_mount", "detached"),
 	{ }
 };
 
diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c
index fb30204c761a..49fe8da6fea4 100644
--- a/security/apparmor/mount.c
+++ b/security/apparmor/mount.c
@@ -499,6 +499,10 @@ int aa_move_mount(const struct cred *subj_cred,
 	error = -ENOMEM;
 	if (!to_buffer || !from_buffer)
 		goto out;
+
+	if (!our_mnt(from_path->mnt))
+		/* moving a mount detached from the namespace */
+		from_path = NULL;
 	error = fn_for_each_confined(label, profile,
 			match_mnt(subj_cred, profile, to_path, to_buffer,
 				  from_path, from_buffer,