diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2024-01-03 13:58:37 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2024-01-03 13:58:37 -0800 |
| commit | d7807d8544e56af9b5523f15eddac09ec0291b4e (patch) | |
| tree | ab480c7f6489917da3d0c8fb7d509839dd1ec28c | |
| parent | 94a502eb59775e13c9089de38c601f9f85b25750 (diff) | |
| parent | 8026e40608b4d552216d2a818ca7080a4264bb44 (diff) | |
| download | misc-d7807d8544e56af9b5523f15eddac09ec0291b4e.tar.gz | |
Merge tag 'apparmor-pr-2024-01-03' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor
Pull apparmor fix from John Johansen:
"Detect that the source mount is not in the namespace and if it isn't
don't use it as a source path match.
This prevent apparmor from applying the attach_disconnected flag to
move_mount() source which prevents detached mounts from appearing as /
when applying mount mediation, which is not only incorrect but could
result in bad policy being generated"
* tag 'apparmor-pr-2024-01-03' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor:
apparmor: Fix move_mount mediation by detecting if source is detached
| -rw-r--r-- | security/apparmor/apparmorfs.c | 1 | ||||
| -rw-r--r-- | security/apparmor/mount.c | 4 |
2 files changed, 5 insertions, 0 deletions
diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c index 38650e52ef5787..2d9f2a4b451996 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c @@ -2373,6 +2373,7 @@ static struct aa_sfs_entry aa_sfs_entry_policy[] = { static struct aa_sfs_entry aa_sfs_entry_mount[] = { AA_SFS_FILE_STRING("mask", "mount umount pivot_root"), + AA_SFS_FILE_STRING("move_mount", "detached"), { } }; diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c index fb30204c761ad9..49fe8da6fea459 100644 --- a/security/apparmor/mount.c +++ b/security/apparmor/mount.c @@ -499,6 +499,10 @@ int aa_move_mount(const struct cred *subj_cred, error = -ENOMEM; if (!to_buffer || !from_buffer) goto out; + + if (!our_mnt(from_path->mnt)) + /* moving a mount detached from the namespace */ + from_path = NULL; error = fn_for_each_confined(label, profile, match_mnt(subj_cred, profile, to_path, to_buffer, from_path, from_buffer, |