unix_socket_pathname.sh confined server stream/seqpacket missing getopt test fails
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| AppArmor |
Fix Released
|
Medium
|
Tyler Hicks | ||
| linux (Ubuntu) |
Fix Released
|
High
|
Unassigned | ||
Bug Description
The AF_UNIX pathname stream and seqpacket tests are not failing when the server program is missing the getopt unix permission. Note that the dgram version of this test fails as expected. This suggests some type of difference in the mediation of getsockopt() between connected and connectionless sockets.
Note that you need a branch of lp:apparmor at r2715 or newer to reproduce this failure.
* The test failures:
Error: unix_socket passed. Test 'AF_UNIX pathname socket (stream); confined server w/ a missing af_unix access (getopt)' was expected to 'fail'
Error: unix_socket passed. Test 'AF_UNIX pathname socket (seqpacket); confined server w/ a missing af_unix access (getopt)' was expected to 'fail'
* The profile (note the missing getopt permission):
/home/tyhicks/
/etc/ld.so.cache r,
/proc/
/dev/urandom r,
/home/
/lib/
/lib/
/lib/
/tmp/
/tmp/
unix (create,,setopt),
/home/
}
I've attached the strace output of the test run to show that the unix_socket program does successfully call getsockopt().
| Tyler Hicks (tyhicks) wrote | #2 |
| description: | updated |
| description: | updated |
| Tyler Hicks (tyhicks) wrote | #3 |
| Changed in linux (Ubuntu): | |
| assignee: | John Johansen (jjohansen) → nobody |
| status: | Confirmed → Invalid |
| Changed in apparmor: | |
| status: | New → In Progress |
| importance: | Undecided → Medium |
| assignee: | nobody → Tyler Hicks (tyhicks) |
| milestone: | none → 2.9.0 |
| Tyler Hicks (tyhicks) wrote | #4 |
| Tyler Hicks (tyhicks) wrote | #5 |
| Changed in apparmor: | |
| status: | In Progress → Fix Committed |
| Steve Beattie (sbeattie) wrote | #6 |
| Changed in apparmor: | |
| status: | Fix Committed → Fix Released |
| Changed in linux (Ubuntu): | |
| status: | Invalid → Fix Released |
Since this issue affects stream/seqpacket but not dgram, it seems likely that it is a kernel issue and not a parser issue. But to be sure, I've verified that the perms that the parser outputs for setopt, getopt, and the combination of the two does look sane:
$ for p in getopt setopt getopt,setopt; do echo "/t { unix ($p), }" | ./apparmor_parser -qQD dfa-states 2>&1 | head -n7; done
{1} <== (allow/
{2} (0x 4/0/0/0)
{3} (0x 4/0/0/0)
{17} (0x 100000/0/0/0)
{18} (0x 100000/0/0/0)
{19} (0x 100000/0/0/0)
{1} <== (allow/
{2} (0x 4/0/0/0)
{3} (0x 4/0/0/0)
{17} (0x 80000/0/0/0)
{18} (0x 80000/0/0/0)
{19} (0x 80000/0/0/0)
{1} <== (allow/
{2} (0x 4/0/0/0)
{3} (0x 4/0/0/0)
{17} (0x 180000/0/0/0)
{18} (0x 180000/0/0/0)
{19} (0x 180000/0/0/0)