mirror of
https://github.com/torvalds/linux
synced 2024-07-21 18:51:47 +00:00
8026e40608
Prevent move_mount from applying the attach_disconnected flag
to move_mount(). This prevents detached mounts from appearing
as / when applying mount mediation, which is not only incorrect
but could result in bad policy being generated.
Basic mount rules like
allow mount,
allow mount options=(move) -> /target/,
will allow detached mounts, allowing older policy to continue
to function. New policy gains the ability to specify `detached` as
a source option
allow mount detached -> /target/,
In addition make sure support of move_mount is advertised as
a feature to userspace so that applications that generate policy
can respond to the addition.
Note: this fixes mediation of move_mount when a detached mount is used,
it does not fix the broader regression of apparmor mediation of
mounts under the new mount api.
Link: https://lore.kernel.org/all/68c166b8-5b4d-4612-8042-1dee3334385b@leemhuis.info/T/#mb35fdde37f999f08f0b02d58dc1bf4e6b65b8da2
Fixes:
|
||
---|---|---|
.. | ||
include | ||
.gitignore | ||
apparmorfs.c | ||
audit.c | ||
capability.c | ||
crypto.c | ||
domain.c | ||
file.c | ||
ipc.c | ||
Kconfig | ||
label.c | ||
lib.c | ||
lsm.c | ||
Makefile | ||
match.c | ||
mount.c | ||
net.c | ||
nulldfa.in | ||
path.c | ||
policy.c | ||
policy_compat.c | ||
policy_ns.c | ||
policy_unpack.c | ||
policy_unpack_test.c | ||
procattr.c | ||
resource.c | ||
secid.c | ||
stacksplitdfa.in | ||
task.c |