From a6b70277799f03c326721a79dbc72e60e022932b Mon Sep 17 00:00:00 2001 From: John Johansen Date: Fri, 17 Nov 2017 18:04:37 -0800 Subject: [PATCH] apparmor: fix profile attachment for special unconfined profiles It used to be that unconfined would never attach. However that is not the case anymore as some special profiles can be marked as unconfined, that are not the namespaces unconfined profile, and may have an attachment. Fixes: 12b3105b2fcf ("apparmor: add the base fns() for domain labels") Signed-off-by: John Johansen --- security/apparmor/domain.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c index 9527adc11c6d1..ad456546df5bf 100644 --- a/security/apparmor/domain.c +++ b/security/apparmor/domain.c @@ -325,8 +325,10 @@ static struct aa_profile *__attach_match(const char *name, struct aa_profile *profile, *candidate = NULL; list_for_each_entry_rcu(profile, head, base.list) { - if (profile->label.flags & FLAG_NULL) + if (profile->label.flags & FLAG_NULL && + &profile->label == ns_unconfined(profile->ns)) continue; + if (profile->xmatch) { if (profile->xmatch_len == len) { conflict = true; -- 2.39.5