• John Johansen's avatar
    apparmor: update domain transitions that are subsets of confinement at nnp · 9fcf78cc
    John Johansen authored
    Domain transition so far have been largely blocked by no new privs,
    unless the transition has been provably a subset of the previous
    confinement. There was a couple problems with the previous
    implementations,
    
    - transitions that weren't explicitly a stack but resulted in a subset
      of confinement were disallowed
    
    - confinement subsets were only calculated from the previous
      confinement instead of the confinement being enforced at the time of
      no new privs, so transitions would have to get progressively
      tighter.
    
    Fix this by detecting and storing a reference to the task's
    confinement at the "time" no new privs is set. This reference is then
    used to determine whether a transition is a subsystem of the
    confinement at the time no new privs was set.
    
    Unfortunately the implementation is less than ideal in that we have to
    detect no new privs after the fact when a task attempts a domain
    transition. This is adequate for the currently but will not work in a
    stacking situation where no new privs could be conceivably be set in
    both the "host" and in the container.
    Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
    9fcf78cc
domain.c 35.4 KB