aa_compute_profile_mediates ORs the mediation marker at the hardcoded
AA_CLASS_NS bit for every class listed in unconfined_mediates[], so an
unconfined profile whose rules mediate only AA_CLASS_IO_URING advertises
NS mediation in label.mediates but never advertises IO_URING mediation.
Set the bit of the class being iterated.
Fixes: de4754c801f4 ("apparmor: carry mediation check on label")
Signed-off-by: Maxime Bélair <[email protected]>
---
security/apparmor/policy.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index f6f1b72d7c3d..e9236e538b98 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -444,7 +444,7 @@ void aa_compute_profile_mediates(struct aa_profile *profile)
for (pos = unconfined_mediates; *pos; pos++) {
if (ANY_RULE_MEDIATES(profile, *pos))
- profile->label.mediates |= ((u64) 1) <<
AA_CLASS_NS;
+ profile->label.mediates |= ((u64) 1) << *pos;
}
return;
}
base-commit: c431011ab65fd4ef205e3ce8cfc4b031c67768d9
--
2.51.0
