git/linux-cryptodev-2.6
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git synced 2026-04-04 04:37:39 -04:00
Code Issues Packages Projects Releases Wiki Activity

apparmor: userns: Add support for execpath in userns

Browse Source 
This new field allows reliable identification of the binary that
triggered a denial since the existing field (comm) only gives the name of
the binary, not its path. Thus comm doesn't work for binaries outside of
$PATH or works unreliably when two binaries have the same name.
Additionally comm can be modified by a program, for example, comm="(tor)"
or comm=4143504920506F6C6C6572 (= ACPI Poller).

Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
Maxime Bélair
2025-07-21 16:46:44 +02:00
committed by John Johansen
parent 3d28e2397a
commit 8d34e16f7f
1 changed files with 32 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
security/apparmor/task.c
View File

@@ -15,6 +15,7 @@
#include <linux/gfp.h>
#include <linux/ptrace.h>
#include "include/path.h"
#include "include/audit.h"
#include "include/cred.h"
#include "include/policy.h"
@@ -300,16 +301,47 @@ int aa_may_ptrace(const struct cred *tracer_cred, struct aa_label *tracer,
xrequest, &sa));
}
static const char *get_current_exe_path(char *buffer, int buffer_size)
{
struct file *exe_file;
struct path p;
const char *path_str;
exe_file = get_task_exe_file(current);
if (!exe_file)
return ERR_PTR(-ENOENT);
p = exe_file->f_path;
path_get(&p);
if (aa_path_name(&p, FLAG_VIEW_SUBNS, buffer, &path_str, NULL, NULL))
return ERR_PTR(-ENOMEM);
fput(exe_file);
path_put(&p);
return path_str;
}
/* call back to audit ptrace fields */
static void audit_ns_cb(struct audit_buffer *ab, void *va)
{
struct apparmor_audit_data *ad = aad_of_va(va);
char *buffer;
const char *path;
if (ad->request & AA_USERNS_CREATE)
audit_log_format(ab, " requested=\"userns_create\"");
if (ad->denied & AA_USERNS_CREATE)
audit_log_format(ab, " denied=\"userns_create\"");
buffer = aa_get_buffer(false);
if (!buffer)
return; // OOM
path = get_current_exe_path(buffer, aa_g_path_max);
if (!IS_ERR(path))
audit_log_format(ab, " execpath=\"%s\"", path);
aa_put_buffer(buffer);
}
int aa_profile_ns_perm(struct aa_profile *profile,