From e3ea1ca59adaefa31935a6f8f06a9168ea0e57d2 Mon Sep 17 00:00:00 2001 From: Tyler Hicks Date: Wed, 16 Mar 2016 19:19:10 -0500 Subject: apparmor: sysctl to enable unprivileged user ns AppArmor policy loading If this sysctl is set to non-zero and a process with CAP_MAC_ADMIN in the root namespace has created an AppArmor policy namespace, unprivileged processes will be able to change to a profile in the newly created AppArmor policy namespace and, if the profile allows CAP_MAC_ADMIN and appropriate file permissions, will be able to load policy in the respective policy namespace. Signed-off-by: Tyler Hicks Signed-off-by: John Johansen --- security/apparmor/lsm.c | 47 ++++++++++++++++++++++++++++++++++++++++++++++ security/apparmor/policy.c | 1 - 2 files changed, 47 insertions(+), 1 deletion(-) (limited to 'security') diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index b1def70b94f1..8a887c392fdb 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -868,6 +868,46 @@ static int __init set_init_ctx(void) return 0; } +#ifdef CONFIG_SYSCTL +static int apparmor_dointvec(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) +{ + if (!policy_admin_capable(NULL)) + return -EPERM; + if (!apparmor_enabled) + return -EINVAL; + + return proc_dointvec(table, write, buffer, lenp, ppos); +} + +static struct ctl_path apparmor_sysctl_path[] = { + { .procname = "kernel", }, + { } +}; + +static struct ctl_table apparmor_sysctl_table[] = { + { + .procname = "unprivileged_userns_apparmor_policy", + .data = &unprivileged_userns_apparmor_policy, + .maxlen = sizeof(int), + .mode = 0600, + .proc_handler = apparmor_dointvec, + }, + { } +}; + +static int __init apparmor_init_sysctl(void) +{ + return register_sysctl_paths(apparmor_sysctl_path, + apparmor_sysctl_table) ? 0 : -ENOMEM; +} +#else +static inline int apparmor_init_sysctl(void) +{ + return 0; +} +#endif /* CONFIG_SYSCTL */ + static int __init apparmor_init(void) { int error; @@ -890,6 +930,13 @@ static int __init apparmor_init(void) goto alloc_out; } + error = apparmor_init_sysctl(); + if (error) { + AA_ERROR("Unable to register sysctls\n"); + goto alloc_out; + + } + error = set_init_ctx(); if (error) { AA_ERROR("Failed to set context on init task\n"); diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c index f2c4bb26b060..f44312a19522 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c @@ -99,7 +99,6 @@ const char *const aa_profile_mode_names[] = { "unconfined", }; - /* requires profile list write lock held */ void __aa_update_proxy(struct aa_profile *orig, struct aa_profile *new) { -- cgit v1.2.3