The AppArmor kernel ABI v7 requires that a 'unix create,' rule be granted to confined processes that call socket(AF_UNIX, type, 0). This is true for pathname, abstract, and unnamed UNIX domain sockets since the address type of a socket is not yet known when socket(2) is called.
Signed-off-by: Tyler Hicks <[email protected]> --- tests/regression/apparmor/unix_socket.sh | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/tests/regression/apparmor/unix_socket.sh b/tests/regression/apparmor/unix_socket.sh index 10fa59d..8fd70dd 100755 --- a/tests/regression/apparmor/unix_socket.sh +++ b/tests/regression/apparmor/unix_socket.sh @@ -61,10 +61,17 @@ testsocktype() local okclients=("$sockpath:rw") local badclients=("" "$sockpath:r" "$sockpath:w") - # v6 requires 'w' and v7 requires 'rw' if [ "$(have_features policy/versions/v7)" == "true" ] ; then - okservers=("$sockpath:rw") - badservers+=("$sockpath:w") + # v7 requires 'unix create' to call socket() + # v7 requires 'rw' for the server + okservers=("$sockpath:rw unix:create") + badservers=("" \ + "$sockpath:r unix:create" \ + "$sockpath:w unix:create" \ + "unix:create" \ + ) + okclients=("${okservers[@]}") + badclients=("${badservers[@]}") fi removesocket $sockpath -- 2.1.0 -- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
