Bug#676515: linux-2.6: AppArmor totally broken

[intrigeri <intrigeri@boum.org>]

Hi John, Ben and all other involved ones,

I'd like to see this moving forward, since the Wheezy freeze is coming
soon. See bellow explicit questions.

John Johansen wrote (07 Jun 2012 16:45:36 GMT) :
> On 06/07/2012 07:34 AM, Ben Hutchings wrote:

>> If we don't want to restrict sockets used by the kernel, don't we need
>> to store the kern flag for later use by aa_revalidate_sk()?
>> 
> For how apparmor is generally deployed it can get away with this, the
> kernel bits generally bail out earlier on the check for unconfined.

> That is not to say it isn't a good idea, or that it shouldn't be done.
> The fact is this patch is going to be replaced with completely rewritten
> controls, that do store info on the socket, it just hasn't happened yet
> due to resources and priorities (not my priorities).

Ben, is this a blocker?

>> Since denied has already been masked with ~quiet_mask, this condition
>> can never be true.
>> 
> indeed

Ben, is this a blocker?

>>> +	/* aa_revalidate_sk should not be called from interrupt context
>>> +	 * don't mediate these calls as they are not task related
>>> +	 */
>>> +	if (in_interrupt())
>>> +		return 0;
>> 
>> I wonder why this is being checked at all.
>> 
> Good question, I will have to dig into it.

John, have you had a chance to?

Cheers,
--
  intrigeri
  | GnuPG key @ https://gaffer.ptitcanardnoir.org/intrigeri/intrigeri.asc
  | OTR fingerprint @ https://gaffer.ptitcanardnoir.org/intrigeri/otr.asc