[prev in list] [next in list] [prev in thread] [next in thread] 

List:       apparmor-dev
Subject:    Re: [apparmor] [PATCH 03/16] apparmor: fix uninitialized lsm_audit member
From:       John Johansen <john.johansen () canonical ! com>
Date:       2016-06-07 16:02:42
Message-ID: 5756F022.6000909 () canonical ! com
[Download RAW message or body]

On 05/02/2016 11:04 AM, Goldwyn Rodrigues wrote:
> John,
> 
> Sorry, I read this late.
> 
> I sent an alternate patch initializing the common_audit_data to zero as opposed to \
> initializing individual fields.

sorry, I missed this email. I will be sending out a slightly revised version of this \
patchset today. The revision is around the inconsistency Seth caught and I am looking \
at whether a couple of other bug fixes backport to this tree. The goal is to push \
this set up this week.

> 
> On 04/21/2016 01:52 AM, John Johansen wrote:
> > BugLink: http://bugs.launchpad.net/bugs/1268727
> > 
> > The task field in the lsm_audit struct needs to be initialized if
> > a change_hat fails, otherwise the following oops will occur
> > 
> > BUG: unable to handle kernel paging request at 0000002fbead7d08
> > IP: [<ffffffff8171153e>] _raw_spin_lock+0xe/0x50
> > PGD 1e3f35067 PUD 0
> > Oops: 0002 [#1] SMP
> > Modules linked in: pppox crc_ccitt p8023 p8022 psnap llc ax25 btrfs raid6_pq xor \
> > xfs libcrc32c dm_multipath scsi_dh kvm_amd dcdbas kvm microcode amd64_edac_mod \
> > joydev edac_core psmouse edac_mce_amd serio_raw k10temp sp5100_tco i2c_piix4 \
> > ipmi_si ipmi_msghandler acpi_power_meter mac_hid lp parport hid_generic usbhid \
> > hid pata_acpi mpt2sas ahci raid_class pata_atiixp bnx2 libahci scsi_transport_sas \
> >                 [last unloaded: tipc]
> > CPU: 2 PID: 699 Comm: changehat_twice Tainted: GF          O 3.13.0-7-generic \
> > #25-Ubuntu Hardware name: Dell Inc. PowerEdge R415/08WNM9, BIOS 1.8.6 12/06/2011
> > task: ffff8802135c6000 ti: ffff880212986000 task.ti: ffff880212986000
> > RIP: 0010:[<ffffffff8171153e>]  [<ffffffff8171153e>] _raw_spin_lock+0xe/0x50
> > RSP: 0018:ffff880212987b68  EFLAGS: 00010006
> > RAX: 0000000000020000 RBX: 0000002fbead7500 RCX: 0000000000000000
> > RDX: 0000000000000292 RSI: ffff880212987ba8 RDI: 0000002fbead7d08
> > RBP: ffff880212987b68 R08: 0000000000000246 R09: ffff880216e572a0
> > R10: ffffffff815fd677 R11: ffffea0008469580 R12: ffffffff8130966f
> > R13: ffff880212987ba8 R14: 0000002fbead7d08 R15: ffff8800d8c6b830
> > FS:  00002b5e6c84e7c0(0000) GS:ffff880216e40000(0000) knlGS:0000000055731700
> > CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > CR2: 0000002fbead7d08 CR3: 000000021270f000 CR4: 00000000000006e0
> > Stack:
> > ffff880212987b98 ffffffff81075f17 ffffffff8130966f 0000000000000009
> > 0000000000000000 0000000000000000 ffff880212987bd0 ffffffff81075f7c
> > 0000000000000292 ffff880212987c08 ffff8800d8c6b800 0000000000000026
> > Call Trace:
> > [<ffffffff81075f17>] __lock_task_sighand+0x47/0x80
> > [<ffffffff8130966f>] ? apparmor_cred_prepare+0x2f/0x50
> > [<ffffffff81075f7c>] do_send_sig_info+0x2c/0x80
> > [<ffffffff81075fee>] send_sig_info+0x1e/0x30
> > [<ffffffff8130242d>] aa_audit+0x13d/0x190
> > [<ffffffff8130c1dc>] aa_audit_file+0xbc/0x130
> > [<ffffffff8130966f>] ? apparmor_cred_prepare+0x2f/0x50
> > [<ffffffff81304cc2>] aa_change_hat+0x202/0x530
> > [<ffffffff81308fc6>] aa_setprocattr_changehat+0x116/0x1d0
> > [<ffffffff8130a11d>] apparmor_setprocattr+0x25d/0x300
> > [<ffffffff812cee56>] security_setprocattr+0x16/0x20
> > [<ffffffff8121fc87>] proc_pid_attr_write+0x107/0x130
> > [<ffffffff811b7604>] vfs_write+0xb4/0x1f0
> > [<ffffffff811b8039>] SyS_write+0x49/0xa0
> > [<ffffffff8171a1bf>] tracesys+0xe1/0xe6
> > 
> > Signed-off-by: John Johansen <john.johansen@canonical.com>
> > ---
> > security/apparmor/audit.c | 3 ++-
> > security/apparmor/file.c  | 3 ++-
> > 2 files changed, 4 insertions(+), 2 deletions(-)
> > 
> > diff --git a/security/apparmor/audit.c b/security/apparmor/audit.c
> > index 89c7865..3a7f1da 100644
> > --- a/security/apparmor/audit.c
> > +++ b/security/apparmor/audit.c
> > @@ -200,7 +200,8 @@ int aa_audit(int type, struct aa_profile *profile, gfp_t gfp,
> > 
> > if (sa->aad->type == AUDIT_APPARMOR_KILL)
> > (void)send_sig_info(SIGKILL, NULL,
> > -                    sa->u.tsk ?  sa->u.tsk : current);
> > +            sa->type == LSM_AUDIT_DATA_TASK && sa->u.tsk ?
> > +                    sa->u.tsk : current);
> > 
> > if (sa->aad->type == AUDIT_APPARMOR_ALLOWED)
> > return complain_error(sa->aad->error);
> > diff --git a/security/apparmor/file.c b/security/apparmor/file.c
> > index 913f377..43d6ae7 100644
> > --- a/security/apparmor/file.c
> > +++ b/security/apparmor/file.c
> > @@ -110,7 +110,8 @@ int aa_audit_file(struct aa_profile *profile, struct \
> > file_perms *perms, int type = AUDIT_APPARMOR_AUTO;
> > struct common_audit_data sa;
> > struct apparmor_audit_data aad = {0,};
> > -    sa.type = LSM_AUDIT_DATA_NONE;
> > +    sa.type = LSM_AUDIT_DATA_TASK;
> > +    sa.u.tsk = NULL;
> > sa.aad = &aad;
> > aad.op = op,
> > aad.fs.request = request;
> > 
> 


-- 
AppArmor mailing list
AppArmor@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor


[prev in list] [next in list] [prev in thread] [next in thread]