When defining an AADefaultHatName entry, it was being stored in the passed mconfig location, which is not the module specific server config, but instead the top level (i.e. no path defined) default directory/location config. This would be superceded by a more specific directory config if it applied to the request. Thus, if an AAHatName was defined that applied, but the named hat was not defined in the apparmor policy, mod_apparmor would not attempt to fall back to the defined AADefaultHatName, but instead jump directly to trying the DEFAULT_URI hat.
This patch fixes it by storing the defined AADefaultHatName correctly in the module specific storage in the related server data structure. It also adds a bit of developer debugging statements. This patch (perhaps without the debugging info) would also be a good candidate for the 2.8 branch. Signed-off-by: Steve Beattie <[email protected]> --- changehat/mod_apparmor/mod_apparmor.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) Index: b/changehat/mod_apparmor/mod_apparmor.c =================================================================== --- a/changehat/mod_apparmor/mod_apparmor.c +++ b/changehat/mod_apparmor/mod_apparmor.c @@ -168,6 +168,13 @@ immunix_enter_hat (request_rec *r) return OK; } + if (scfg) { + ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "Dumping scfg info: " + "scfg='0x%lx' scfg->hat_name='%s'", + (unsigned long) scfg, scfg->hat_name); + } else { + ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "scfg is null"); + } if (scfg != NULL && scfg->hat_name != NULL) { ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "calling change_hat [scfg] %s", scfg->hat_name); sd_ret = aa_change_hat(scfg->hat_name, magic_token); @@ -240,7 +247,8 @@ aa_cmd_ch_srv (cmd_parms * cmd, void * m { ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, ap_server_conf, "server config change hat %s", parm1 ? parm1 : "DEFAULT"); - immunix_srv_cfg * scfg = mconfig; + immunix_srv_cfg * scfg = (immunix_srv_cfg *) + ap_get_module_config(cmd->server->module_config, &apparmor_module); if (parm1 != NULL) { scfg->hat_name = parm1; } else { -- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
