]> git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/commit
UBUNTU: SAUCE: apparmor: fix cross ns perm of unix domain sockets
authorJohn Johansen <john.johansen@canonical.com>
Fri, 31 Mar 2017 13:25:26 +0000 (06:25 -0700)
committerThadeu Lima de Souza Cascardo <cascardo@canonical.com>
Thu, 6 Apr 2017 08:26:15 +0000 (09:26 +0100)
commitae9b0d4a3b3b9afbafba59fbb7d64aab2b0b3bcf
treee0429d5644de5ba0ecc74d56847a4346ed09e529
parente6a366c0b66f065901bc486af46b06401415efd5
UBUNTU: SAUCE: apparmor: fix cross ns perm of unix domain sockets

When using nested namespaces policy within the nested namespace is trying
to cross validate with policy outside of the namespace that is not
visible to it. This results the access being denied and with no way to
add a rule to policy that would allow it.

The check should only be done again policy that is visible.

BugLink: http://bugs.launchpad.net/bugs/1660832
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Tim Gardner <tim.gardner@canonical.com>
Acked-by: Brad Figg <brad.figg@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
security/apparmor/af_unix.c