On 2014-09-17 23:32:10, Steve Beattie wrote: > The new af_unix apparmor kernel patches include the first step towards > implicit labeling. As a result, when a file descriptor is inherited > across one profile boundary to another, both labels' policies are > checked for valid access to the file descriptor. However, due to a quirk > in the linux kernel, when a socket is opened, the file descriptor is > marked as having read and write (aka send and receive) access. When the > crosscheck revalidation occurs, this means that the policy being > inherited from requires read/write access to the socket descriptor, even > if the process never reads or writes to it. This resulted in a few > failures in the socketpair tests. > > The following patch adjusts the failing tests to include the neccessary > send and receive permissions, as well as adding additional tests that > are expected to fail when they are not present, to try to ensure that > if our crosscheck behavior changes, we catch it. > > Signed-off-by: Steve Beattie <[email protected]>
Acked-by: Tyler Hicks <[email protected]> Thanks! > --- > tests/regression/apparmor/socketpair.sh | 27 ++++++++++++++++++++++++--- > 1 file changed, 24 insertions(+), 3 deletions(-) > > Index: b/tests/regression/apparmor/socketpair.sh > =================================================================== > --- a/tests/regression/apparmor/socketpair.sh > +++ b/tests/regression/apparmor/socketpair.sh > @@ -31,12 +31,14 @@ exec="/proc/*/attr/exec:w" > np1="new_profile_1" > np2="new_profile_2" > af_unix_create="" > +af_unix_create_label="" > af_unix_inherit="" > > if [ "$(have_features network/af_unix)" == "true" ]; then > # AppArmor requires that the process inheriting the sock file > # descriptors have send,receive perms in its profile > af_unix_create="unix:(create,getopt)" > + af_unix_create_label="unix:(send,receive)" > af_unix_inherit="unix:(getopt,send,receive)" > fi > > @@ -68,9 +70,19 @@ genprofile flag:audit $af_unix_create > do_test "complain" pass "$test" "enforce" > > # Ensure correct labeling after passing fd pair across exec > -genprofile $af_unix_create $exec 'change_profile->':$np1 -- image=$np1 > addimage:$test $af_unix_inherit > +# NOTE: due to label crosscheck, parent needs 'rw' access > +genprofile $af_unix_create ${af_unix_create_label} $exec > 'change_profile->':$np1 -- image=$np1 addimage:$test $af_unix_inherit > do_test "confined exec transition" pass "$test" "enforce" "$np1" > > +# af_unix_create is set to non-null at the top of the test script if > +# the kernel advertises supporting unix sockets > +if [ -n "${af_unix_create}" ] ; then > + # Ensure label crosscheck still requires parent needs' rw' access > + # after passing fd pair across exec > + genprofile $af_unix_create $exec 'change_profile->':$np1 -- image=$np1 > addimage:$test $af_unix_inherit > + do_test "confined exec transition, crosscheck rejection" fail "$test" > "enforce" "$np1" > +fi > + > # Ensure correct labeling after passing fd pair across a no-transition exec > # NOTE: The test still calls aa_change_onexec(), so change_profile -> $test > # is still needed > @@ -83,12 +95,21 @@ genprofile flag:complain $af_unix_create > do_test "confined exec transition from complain" pass "$test" "complain" > "$np1" > > # Ensure correct enforce mode after passing fd pair across exec > -genprofile $af_unix_create $exec 'change_profile->':$np1 -- \ > +genprofile $af_unix_create ${af_unix_create_label} $exec > 'change_profile->':$np1 -- \ > image=$np1 addimage:$test flag:complain $af_unix_inherit > do_test "confined exec transition to complain" pass "$test" "enforce" "$np1" > > +# af_unix_create is set to non-null at the top of the test script if > +# the kernel advertises supporting unix sockets > +if [ -n "${af_unix_create}" ] ; then > + # Ensure label crosscheck enforced in complain mode after passing fd > pair across exec > + genprofile $af_unix_create $exec 'change_profile->':$np1 -- \ > + image=$np1 addimage:$test flag:complain $af_unix_inherit > + do_test "confined exec transition to complain, crosscheck rejection" > fail "$test" "enforce" "$np1" > +fi > + > # Ensure correct labeling after passing fd pair across 2 execs > -gp_args="$af_unix_create $exec change_profile->:$np1 -- \ > +gp_args="$af_unix_create ${af_unix_create_label} $exec change_profile->:$np1 > -- \ > image=$np1 addimage:$test $af_unix_inherit $exec change_profile->:$np2 > -- \ > image=$np2 addimage:$test $af_unix_inherit" > genprofile $gp_args > -- > Steve Beattie > <[email protected]> > http://NxNW.org/~steve/ > -- > AppArmor mailing list > [email protected] > Modify settings or unsubscribe at: > https://lists.ubuntu.com/mailman/listinfo/apparmor
signature.asc
Description: Digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
