Commit 11c92f14 authored by John Johansen's avatar John Johansen
Browse files

apparmor: fix mediation of prlimit 



For primit apparmor requires that if target confinement does not match
the setting task's confinement, the setting task requires CAP_SYS_RESOURCE.

Unfortunately this was broken when rlimit enforcement was reworked to
support labels.

Fixes: 86b92cb7 ("apparmor: move resource checks to using labels")
Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
parent a4c3f89c

security/apparmor/resource.c

+1 −1
Original line number Diff line number Diff line
@@ -124,7 +124,7 @@ int aa_task_setrlimit(struct aa_label *label, struct task_struct *task, 
	 */



	if (label != peer &&

	    !aa_capable(label, CAP_SYS_RESOURCE, SECURITY_CAP_NOAUDIT))

	    aa_capable(label, CAP_SYS_RESOURCE, SECURITY_CAP_NOAUDIT) != 0)

		error = fn_for_each(label, profile,

				audit_resource(profile, resource,

					       new_rlim->rlim_max, peer,