aa_inet_create_perm() and label_sk_has_perm2() iterate the label with
fn_for_each(), which also visits unconfined profiles. A stacked label
such as the one used by LXD containers (host profile stacked with the
container ns's unconfined profile) is not unconfined as a whole, so it
passes the !unconfined(label) check in the LSM hooks, and the ns's
unconfined profile then reaches aa_profile_af_perm()/
aa_profile_af_sk_perm(), triggering
WARNING: security/apparmor/net.c:263 at aa_profile_af_perm+0x228/0x3b0
on any inet socket created inside the container.
Use fn_for_each_confined(), as aa_af_perm() and the unix socket
mediation do, so unconfined profiles in a stack do not mediate.
Fixes: 89ac6aa752ec ("apparmor: push inet mediation into profile callbacks, and
improve auditing")
Signed-off-by: Georgia Garcia <[email protected]>
---
security/apparmor/af_inet.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/security/apparmor/af_inet.c b/security/apparmor/af_inet.c
index 68e4b1449c40..924212e1f231 100644
--- a/security/apparmor/af_inet.c
+++ b/security/apparmor/af_inet.c
@@ -338,7 +338,7 @@ static int profile_opt_perm(struct aa_profile *profile, u32
request,
if (__EERROR == 0) { \
__EERROR = (YYYY); \
if (__EERROR == 0) { \
- __EERROR = fn_for_each(LABEL, PROFILE, \
+ __EERROR = fn_for_each_confined(LABEL, PROFILE,
\
(CALLBACKFN)); \
} \
} \
@@ -396,7 +396,7 @@ int aa_inet_create_perm(struct aa_label *label, int family,
int type,
ad.subj_cred = current_cred();
set_ad_create(&ad, family, type, protocol);
- error = fn_for_each(label, profile,
+ error = fn_for_each_confined(label, profile,
profile_create_perm(profile, family, type,
protocol, &ad));
--
2.43.0
