Commit 06d426d1 authored by John Johansen's avatar John Johansen

apparmor: fix profile attachment for special unconfined profiles

It used to be that unconfined would never attach. However that is not
the case anymore as some special profiles can be marked as unconfined,
that are not the namespaces unconfined profile, and may have an
attachment.

Fixes: f1bd9041 ("apparmor: add the base fns() for domain labels")
Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
parent 844b8292
......@@ -325,8 +325,10 @@ static struct aa_profile *__attach_match(const char *name,
struct aa_profile *profile, *candidate = NULL;
list_for_each_entry_rcu(profile, head, base.list) {
if (profile->label.flags & FLAG_NULL)
if (profile->label.flags & FLAG_NULL &&
&profile->label == ns_unconfined(profile->ns))
continue;
if (profile->xmatch) {
if (profile->xmatch_len == len) {
conflict = true;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment