On 10/16/26 13:25, Georgia Garcia wrote:
aa_inet_create_perm() and label_sk_has_perm2() iterate the label with fn_for_each(), which also visits unconfined profiles. A stacked label such as the one used by LXD containers (host profile stacked with the container ns's unconfined profile) is not unconfined as a whole, so it passes the !unconfined(label) check in the LSM hooks, and the ns's unconfined profile then reaches aa_profile_af_perm()/ aa_profile_af_sk_perm(), triggeringWARNING: security/apparmor/net.c:263 at aa_profile_af_perm+0x228/0x3b0 on any inet socket created inside the container. Use fn_for_each_confined(), as aa_af_perm() and the unix socket mediation do, so unconfined profiles in a stack do not mediate. Fixes: 89ac6aa752ec ("apparmor: push inet mediation into profile callbacks, and improve auditing") Signed-off-by: Georgia Garcia <[email protected]>
NAK unconfined being passed into the callback at this point is deliberate, in fact label_for_each_confined(), and fn_for_each_confined() are going to be going away. we are going to need a different fix.
--- security/apparmor/af_inet.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/security/apparmor/af_inet.c b/security/apparmor/af_inet.c index 68e4b1449c40..924212e1f231 100644 --- a/security/apparmor/af_inet.c +++ b/security/apparmor/af_inet.c @@ -338,7 +338,7 @@ static int profile_opt_perm(struct aa_profile *profile, u32 request, if (__EERROR == 0) { \ __EERROR = (YYYY); \ if (__EERROR == 0) { \ - __EERROR = fn_for_each(LABEL, PROFILE, \ + __EERROR = fn_for_each_confined(LABEL, PROFILE, \ (CALLBACKFN)); \ } \ } \ @@ -396,7 +396,7 @@ int aa_inet_create_perm(struct aa_label *label, int family, int type,ad.subj_cred = current_cred();set_ad_create(&ad, family, type, protocol); - error = fn_for_each(label, profile, + error = fn_for_each_confined(label, profile, profile_create_perm(profile, family, type, protocol, &ad));
