averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-07-08 18:13:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

apparmor: use target task's context in apparmor_getprocattr()

Browse Source 
commit 4afc61702b upstream.

apparmor_getprocattr() incorrectly calls task_ctx(current) instead of
task_ctx(task) when retrieving prev and exec attributes, returning the
caller's labels rather than the target's.

Fix by passing task to task_ctx().

The issue can be reproduced when a process with an onexec transition
(e.g., configured by a container runtime) is inspected via
/proc/<pid>/attr/apparmor/exec. The reader's own value is returned
instead of the target's.

Reported-by: Qualys Security Advisory <qsa@qualys.com>
Fixes: 3b529a7600 ("apparmor: move task domain change info to task security")
Cc: stable@vger.kernel.org
Co-developed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
Co-developed-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Cengiz Can
2026-02-10 11:17:14 +03:00
committed by Greg Kroah-Hartman
parent f7e062aa9d
commit 35fdfb767d
1 changed files with 7 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/apparmor/lsm.c
+7 -9
View File
@@ -823,25 +823,23 @@ static int apparmor_getprocattr(struct task_struct *task, const char *name,
char **value)
{
int error = -ENOENT;
/* released below */
const struct cred *cred = get_task_cred(task);
struct aa_task_ctx *ctx = task_ctx(current);
struct aa_label *label = NULL;
rcu_read_lock();
if (strcmp(name, "current") == 0)
label = aa_get_newest_label(cred_label(cred));
else if (strcmp(name, "prev") == 0 && ctx->previous)
label = aa_get_newest_label(ctx->previous);
else if (strcmp(name, "exec") == 0 && ctx->onexec)
label = aa_get_newest_label(ctx->onexec);
label = aa_get_newest_cred_label(__task_cred(task));
else if (strcmp(name, "prev") == 0 && task_ctx(task)->previous)
label = aa_get_newest_label(task_ctx(task)->previous);
else if (strcmp(name, "exec") == 0 && task_ctx(task)->onexec)
label = aa_get_newest_label(task_ctx(task)->onexec);
else
error = -EINVAL;
rcu_read_unlock();
if (label)
error = aa_getprocattr(label, value, true);
aa_put_label(label);
put_cred(cred);
return error;
}