Do not output local permissions for rules that have peer_conditionals while it is not possible to specify a rule with local conditionals with peer conditionals eg. unix listen peer=(addr=@foo),
a rule such as unix peer=(addr=@foo), is possible, and was setting all permissions for local as well as the peer condition permissions. Currently this means the create permission must be specified in a separate rule from a rule with a peer= condition, if create is to be allowed. This isn't too much of an issue but it does mean rule such as unix connect peer=(addr=@foo), Can not imply the ability to create a socket. Which may indeed be the behavior if we wish to enforce that the socket was created in another process and passed in. Is this what we want to do? Signed-off-by: John Johansen <[email protected]> --- === modified file 'parser/af_unix.cc' --- parser/af_unix.cc 2014-09-05 15:49:33 +0000 +++ parser/af_unix.cc 2014-09-05 16:13:04 +0000 @@ -334,7 +334,7 @@ } write_to_prot(buffer); - if (mask & AA_NET_CREATE) { + if ((mask & AA_NET_CREATE) && !has_peer_conds()) { buf = buffer.str(); if (!prof.policy.rules->add_rule(buf.c_str(), deny, map_perms(AA_NET_CREATE), @@ -355,7 +355,8 @@ buffer << "\\x00"; /* create already masked off */ - if (mask & AA_LOCAL_NET_PERMS & ~AA_LOCAL_NET_CMD) { + if ((mask & AA_LOCAL_NET_PERMS & ~AA_LOCAL_NET_CMD) && + !has_peer_conds()) { buf = buffer.str(); if (!prof.policy.rules->add_rule(buf.c_str(), deny, map_perms(mask & AA_LOCAL_NET_PERMS & ~AA_LOCAL_NET_CMD), @@ -364,7 +365,7 @@ goto fail; } - if (mask & AA_NET_LISTEN) { + if ((mask & AA_NET_LISTEN) && !has_peer_conds()) { std::ostringstream tmp(buffer.str()); tmp.seekp(0, ios_base::end); tmp << "\\x" << std::setfill('0') << std::setw(2) << std::hex << CMD_LISTEN; @@ -377,7 +378,7 @@ dfaflags)) goto fail; } - if (mask & AA_NET_OPT) { + if ((mask & AA_NET_OPT) && !has_peer_conds()) { std::ostringstream tmp(buffer.str()); tmp.seekp(0, ios_base::end); tmp << "\\x" << std::setfill('0') << std::setw(2) << std::hex << CMD_OPT; -- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
