diff options
| author | John Johansen <john.johansen@canonical.com> | 2018-04-11 02:03:26 -0700 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2018-04-11 13:39:16 -0700 |
| commit | a4c2746f4d4b32d8557ee17821f1101fd8474f92 (patch) | |
| tree | 721952399531d8c208ac4e0219efed4a38631652 | |
| parent | 588558eb6d0e0b6edfa65a67e906c2ffeba63ff1 (diff) | |
| download | linux-apparmor-fix-rlimit.tar.gz | |
apparmor: fix mediation of prlimitfix-rlimit
For primit apparmor requires that if target confinement does not match
the setting task's confinement, the setting task requires CAP_SYS_RESOURCE.
Unfortunately this was broken when rlimit enforcement was reworked to
support labels.
Fixes: 86b92cb782b3 ("apparmor: move resource checks to using labels")
Signed-off-by: John Johansen <john.johansen@canonical.com>
| -rw-r--r-- | security/apparmor/resource.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/security/apparmor/resource.c b/security/apparmor/resource.c index d022137143b9e..95fd26d09757f 100644 --- a/security/apparmor/resource.c +++ b/security/apparmor/resource.c @@ -124,7 +124,7 @@ int aa_task_setrlimit(struct aa_label *label, struct task_struct *task, */ if (label != peer && - !aa_capable(label, CAP_SYS_RESOURCE, SECURITY_CAP_NOAUDIT)) + aa_capable(label, CAP_SYS_RESOURCE, SECURITY_CAP_NOAUDIT) != 0) error = fn_for_each(label, profile, audit_resource(profile, resource, new_rlim->rlim_max, peer, |