Commit 3bbb7b2e authored by John Johansen's avatar John Johansen
Browse files

apparmor: fix setting unconfined mode on a loaded profile 



When loading a profile that is set to unconfined mode, that label
flag is not set when it should be. Ensure it is set so that when
used in a label the unconfined check will be applied correctly.

Fixes: 03816507 ("apparmor: allow setting any profile into the unconfined state")
Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
parent f3789736

security/apparmor/policy_unpack.c

+7 −5
Original line number Diff line number Diff line
@@ -750,16 +750,18 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name) 
		profile->label.flags |= FLAG_HAT;

	if (!unpack_u32(e, &tmp, NULL))

		goto fail;

	if (tmp == PACKED_MODE_COMPLAIN || (e->version & FORCE_COMPLAIN_FLAG))

	if (tmp == PACKED_MODE_COMPLAIN || (e->version & FORCE_COMPLAIN_FLAG)) {

		profile->mode = APPARMOR_COMPLAIN;

	else if (tmp == PACKED_MODE_ENFORCE)

	} else if (tmp == PACKED_MODE_ENFORCE) {

		profile->mode = APPARMOR_ENFORCE;

	else if (tmp == PACKED_MODE_KILL)

	} else if (tmp == PACKED_MODE_KILL) {

		profile->mode = APPARMOR_KILL;

	else if (tmp == PACKED_MODE_UNCONFINED)

	} else if (tmp == PACKED_MODE_UNCONFINED) {

		profile->mode = APPARMOR_UNCONFINED;

	else

		profile->label.flags |= FLAG_UNCONFINED;

	} else {

		goto fail;

	}

	if (!unpack_u32(e, &tmp, NULL))

		goto fail;

	if (tmp)