Fix tested and sent upstream:
https://lore.kernel.org/all/[email protected]/
leftmatch_fb() now uses match_char() in both branches. On a kernel built from
Ubuntu linux 7.0.0-38.38 with this patch:
- aa-repro.sh: the diff-encoded profile attaches (enc -> repro_enc (unconfined))
- the stock /etc/apparmor.d/firefox profile attaches to
/usr/lib/firefox/firefox-bin: all processes "firefox (unconfined)",
no unprivileged_userns denials
The patch applies to apparmor-next and carries
Fixes: 21f606610502 ("apparmor: improve overlapping domain attachment
resolution")
and Cc: stable.
** Patch added: "apparmor: handle diff-encoded states in leftmatch_fb()
(tested, sent upstream)"
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2172229/+attachment/6012855/+files/0001-apparmor-handle-diff-encoded-states-in-leftmatch_fb.patch
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172229
Title:
AppArmor: profile attachment fails for diff-encoded xmatch DFAs
(leftmatch_fb ignores MATCH_FLAG_DIFF_ENCODE) - firefox profile never
attaches
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2172229/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
