NACK: [PATCH][SRU][xenial] UBUNTU: SAUCE: apparmor: fix audit failures when performing onexec
Tyler Hicks
tyhicks at canonical.com
Thu Aug 1 14:47:30 UTC 2019
On 2019-08-01 04:29:21, John Johansen wrote:
>
> There are 2 cases where a denial in onexec profile transitions can
> occur that results in an apparmor WARN traceback. The first occurs if
> onexec is denied by policy, the second if onexec fails due to
> no-new-privs.
>
> [1140910.816457] ------------[ cut here ]------------
> [1140910.816466] WARNING: CPU: 4 PID: 32497 at /build/linux-UdetSb/linux-4.4.0/security/apparmor/file.c:136 aa_audit_file+0x16e/0x180()
> [1140910.816467] AppArmor WARN aa_audit_file: ((!(&sa)->apparmor_audit_data->request)):
> [1140910.816469] Modules linked in:
> [1140910.816470] xt_mark xt_comment ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs xt_REDIRECT nf_nat_redirect xt_nat veth btrfs xor raid6_pq ufs qnx4 hfsplus hfs minix ntfs msdos jfs xfs libcrc32c msr nf_conntrack_netlink nfnetlink xfrm_user xfrm_algo xt_addrtype br_netfilter pci_stub vboxpci(OE) vboxnetadp(OE) vboxnetflt(OE) vboxdrv(OE) xt_CHECKSUM iptable_mangle rfcomm ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables xt_multiport iptable_filter ip_tables x_tables aufs overlay bnep uvcvideo videobuf2_vmalloc btusb videobuf2_memops videobuf2_v4l2 btrtl btbcm videobuf2_core btintel v4l2_common bluetooth videodev media binfmt_misc arc4
> [1140910.816508] iwlmvm mac80211 intel_rapl snd_hda_codec_hdmi x86_pkg_temp_thermal intel_powerclamp snd_hda_codec_realtek snd_hda_codec_generic iwlwifi joydev input_leds serio_raw cfg80211 snd_hda_intel snd_hda_codec snd_hda_core lpc_ich snd_hwdep thinkpad_acpi nvram snd_pcm snd_seq_midi mei_me snd_seq_midi_event shpchp ie31200_edac mei snd_rawmidi edac_core snd_seq wmi snd_seq_device snd_timer snd soundcore kvm_intel mac_hid kvm irqbypass coretemp parport_pc ppdev lp parport autofs4 drbg ansi_cprng algif_skcipher af_alg dm_crypt hid_generic hid_logitech_hidpp hid_logitech_dj usbhid hid uas usb_storage crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel i915 aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd i2c_algo_bit drm_kms_helper psmouse syscopyarea sysfillrect ahci sysimgblt e1000e
> [1140910.816544] fb_sys_fops libahci sdhci_pci drm sdhci ptp pps_core fjes video
> [1140910.816549] CPU: 4 PID: 32497 Comm: runc:[2:INIT] Tainted: G W OE 4.4.0-151-generic #178-Ubuntu
> [1140910.816551] Hardware name: LENOVO 20EFCTO1WW/20EFCTO1WW, BIOS GNET82WW (2.30 ) 03/21/2017
> [1140910.816552] 0000000000000286 312c35d8d7e796cb ffff880637cef9d0 ffffffff8140b481
> [1140910.816554] ffff880637cefa18 ffffffff81d02fe8 ffff880637cefa08 ffffffff81085432
> [1140910.816555] ffff880108206400 ffff880637cefb6c ffff880825129b88 ffff880637cefd88
> [1140910.816557] Call Trace:
> [1140910.816563] [<ffffffff8140b481>] dump_stack+0x63/0x82
> [1140910.816567] [<ffffffff81085432>] warn_slowpath_common+0x82/0xc0
> [1140910.816569] [<ffffffff810854cc>] warn_slowpath_fmt+0x5c/0x80
> [1140910.816571] [<ffffffff81397ebc>] ? label_match.constprop.9+0x3dc/0x6c0
> [1140910.816573] [<ffffffff813a696e>] aa_audit_file+0x16e/0x180
> [1140910.816575] [<ffffffff813982dd>] profile_onexec+0x13d/0x3d0
> [1140910.816577] [<ffffffff8139a33e>] handle_onexec+0x10e/0x10d0
> [1140910.816581] [<ffffffff81242957>] ? vfs_getxattr_alloc+0x67/0x100
> [1140910.816584] [<ffffffff81355395>] ? cap_inode_getsecurity+0x95/0x220
> [1140910.816588] [<ffffffff8135965d>] ? security_inode_getsecurity+0x5d/0x70
> [1140910.816590] [<ffffffff8139b417>] apparmor_bprm_set_creds+0x117/0xa60
> [1140910.816591] [<ffffffff81242a8e>] ? vfs_getxattr+0x9e/0xb0
> [1140910.816595] [<ffffffffc05be712>] ? ovl_getxattr+0x52/0xb0 [overlay]
> [1140910.816597] [<ffffffff8135619d>] ? get_vfs_caps_from_disk+0x7d/0x180
> [1140910.816599] [<ffffffff81356343>] ? cap_bprm_set_creds+0xa3/0x5f0
> [1140910.816601] [<ffffffff81358909>] security_bprm_set_creds+0x39/0x50
> [1140910.816605] [<ffffffff812229d5>] prepare_binprm+0x85/0x190
> [1140910.816607] [<ffffffff812240f4>] do_execveat_common.isra.31+0x4b4/0x770
> [1140910.816610] [<ffffffff8122460a>] SyS_execve+0x3a/0x50
> [1140910.816613] [<ffffffff81863ed5>] stub_execve+0x5/0x5
> [1140910.816615] [<ffffffff81863b5b>] ? entry_SYSCALL_64_fastpath+0x22/0xcb
> [1140910.816616] ---[ end trace cf4320c1d43eedd8 ]---
>
> This is because the error is being audited as if onexec was not denied
> this triggering the AA_BUG check.
>
> BugLink: http://bugs.launchpad.net/bugs/1838627
> Signed-off-by: John Johansen <john.johansen at canonical.com>
> ---
> security/apparmor/domain.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
> index 576d51194eae..86e2908f805d 100644
> --- a/security/apparmor/domain.c
> +++ b/security/apparmor/domain.c
> @@ -647,8 +647,10 @@ static int profile_onexec(struct aa_profile *profile, struct aa_label *onexec,
> state = aa_dfa_null_transition(profile->file.dfa, state);
> error = change_profile_perms(profile, onexec, stack, AA_MAY_ONEXEC,
> state, &perms);
> - if (error)
> + if (error) {
> + perms.allow &= ~AA_MAY_ONEXEC;
> goto audit;
> + }
>
> /* Policy has specified a domain transitions. if no_new_privs and
> * confined and not transitioning to the current domain fail.
> @@ -662,6 +664,7 @@ static int profile_onexec(struct aa_profile *profile, struct aa_label *onexec,
> !aa_label_is_subset(onexec, &profile->label)) {
> error = -EPERM;
> info = "no new privs";
> + perms.allow &= ~AA_MAY_ONEXEC;
A similar change also needs to be added to the NNP check in
change_profile_perms_wrapper(). I can trigger the AA_WARN() from that
error path, as well:
[ 14.721337] WARNING: CPU: 0 PID: 1453 at /tmp/kernel-tyhicks-a20f622-EAUF/build/security/apparmor/file.c:136 aa_audit_file+0x16e/0x180()
[ 14.721339] AppArmor WARN aa_audit_file: ((!(&sa)->apparmor_audit_data->request)):
[ 14.721340] Modules linked in:
[ 14.721342] snd_hda_codec_generic kvm_intel snd_hda_intel snd_hda_codec kvm irqbypass snd_hda_core snd_hwdep snd_pcm input_leds joydev serio_raw snd_timer snd soundcore i2c_piix4 8250_fintek mac_hid ib
_iser rdma_cm iw_cm ib_cm ib_sa ib_mad ib_core ib_addr iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi autofs4 btrfs raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6
_pq libcrc32c raid1 raid0 multipath linear hid_generic usbhid crct10dif_pclmul hid crc32_pclmul ghash_clmulni_intel aesni_intel qxl aes_x86_64 ttm lrw gf128mul glue_helper ablk_helper cryptd drm_kms_helper
syscopyarea sysfillrect sysimgblt psmouse fb_sys_fops drm pata_acpi floppy
[ 14.721387] CPU: 0 PID: 1453 Comm: transition Tainted: G W 4.4.0-158-generic #186~aa.1
[ 14.721389] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
[ 14.721391] 0000000000000286 f4807cdf06cc1e28 ffff88003808fae8 ffffffff8140c9b1
[ 14.721394] ffff88003808fb30 ffffffff81d04208 ffff88003808fb20 ffffffff810864d2
[ 14.721397] ffff880038036800 ffff88003808fc9c ffff88003808fc9c ffff88003808fd88
[ 14.721400] Call Trace:
[ 14.721407] [<ffffffff8140c9b1>] dump_stack+0x63/0x82
[ 14.721412] [<ffffffff810864d2>] warn_slowpath_common+0x82/0xc0
[ 14.721415] [<ffffffff8108656c>] warn_slowpath_fmt+0x5c/0x80
[ 14.721419] [<ffffffff813a7dfe>] aa_audit_file+0x16e/0x180
[ 14.721423] [<ffffffff8139ae57>] profile_transition+0x3e7/0xc80
[ 14.721426] [<ffffffff8139d136>] apparmor_bprm_set_creds+0x956/0xa60
[ 14.721431] [<ffffffff812f9d1c>] ? ext4_xattr_security_get+0x1c/0x30
[ 14.721435] [<ffffffff81243911>] ? generic_getxattr+0x51/0x70
[ 14.721439] [<ffffffff8135778d>] ? get_vfs_caps_from_disk+0x7d/0x180
[ 14.721442] [<ffffffff81357933>] ? cap_bprm_set_creds+0xa3/0x5f0
[ 14.721447] [<ffffffff81359ef9>] security_bprm_set_creds+0x39/0x50
[ 14.721451] [<ffffffff81223da5>] prepare_binprm+0x85/0x190
[ 14.721453] [<ffffffff812254ca>] do_execveat_common.isra.31+0x4ba/0x780
[ 14.721456] [<ffffffff812259ea>] SyS_execve+0x3a/0x50
[ 14.721460] [<ffffffff81865295>] stub_execve+0x5/0x5
[ 14.721464] [<ffffffff81864f1b>] ? entry_SYSCALL_64_fastpath+0x22/0xcb
[ 14.721466] ---[ end trace f0bc5f47039c8348 ]---
I've written a set of automated regression tests for NNP and AppArmor which
trigger this WARNING as well as the original one. I'll reply here once I've got
a public PR available on the AppArmor gitlab page.
Tyler
> goto audit;
> }
>
> --
> 2.17.1
>
More information about the kernel-team
mailing list