12 files changed, 62 insertions, 13 deletions

diff --git a/security/apparmor/audit.c b/security/apparmor/audit.c
index cc3520d39a78..3ae28db5a64f 100644
--- a/security/apparmor/audit.c
+++ b/security/apparmor/audit.c
@@ -111,7 +111,7 @@ static const char *const aa_audit_type[] = {
 static void audit_pre(struct audit_buffer *ab, void *ca)
 {
         struct common_audit_data *sa = ca;
-        struct task_struct *tsk = sa->tsk ? sa->tsk : current;
+        struct task_struct *tsk = sa->aad->tsk ? sa->aad->tsk : current;
 
         if (aa_g_audit_header) {
                 audit_log_format(ab, "apparmor=");
@@ -149,6 +149,12 @@ static void audit_pre(struct audit_buffer *ab, void *ca)
                 audit_log_format(ab, " name=");
                 audit_log_untrustedstring(ab, sa->aad->name);
         }
+
+        if (sa->aad->tsk) {
+                audit_log_format(ab, " pid=%d comm=", tsk->pid);
+                audit_log_untrustedstring(ab, tsk->comm);
+        }
+
 }
 
 /**
@@ -205,7 +211,8 @@ int aa_audit(int type, struct aa_profile *profile, gfp_t gfp,
         aa_audit_msg(type, sa, cb);
 
         if (sa->aad->type == AUDIT_APPARMOR_KILL)
-                (void)send_sig_info(SIGKILL, NULL, sa->tsk ? sa->tsk : current);
+                (void)send_sig_info(SIGKILL, NULL,
+                                    sa->aad->tsk ?  sa->aad->tsk : current);
 
         if (sa->aad->type == AUDIT_APPARMOR_ALLOWED)
                 return complain_error(sa->aad->error);
diff --git a/security/apparmor/capability.c b/security/apparmor/capability.c
index 088dba3bf7dc..887a5e948945 100644
--- a/security/apparmor/capability.c
+++ b/security/apparmor/capability.c
@@ -65,10 +65,10 @@ static int audit_caps(struct aa_profile *profile, struct task_struct *task,
         int type = AUDIT_APPARMOR_AUTO;
         struct common_audit_data sa;
         struct apparmor_audit_data aad = {0,};
-        COMMON_AUDIT_DATA_INIT(&sa, CAP);
+        sa.type = LSM_AUDIT_DATA_CAP;
         sa.aad = &aad;
-        sa.tsk = task;
         sa.u.cap = cap;
+        sa.aad->tsk = task;
         sa.aad->op = OP_CAPABLE;
         sa.aad->error = error;
 
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 6327685c101e..b81ea10a17a3 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -394,6 +394,11 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
                         new_profile = find_attach(ns, &ns->base.profiles, name);
                 if (!new_profile)
                         goto cleanup;
+                /*
+                 * NOTE: Domain transitions from unconfined are allowed
+                 * even when no_new_privs is set because this aways results
+                 * in a further reduction of permissions.
+                 */
                 goto apply;
         }
 
@@ -455,6 +460,16 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
                 /* fail exec */
                 error = -EACCES;
 
+        /*
+         * Policy has specified a domain transition, if no_new_privs then
+         * fail the exec.
+         */
+        if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS) {
+                aa_put_profile(new_profile);
+                error = -EPERM;
+                goto cleanup;
+        }
+
         if (!new_profile)
                 goto audit;
 
@@ -609,6 +624,14 @@ int aa_change_hat(const char *hats[], int count, u64 token, bool permtest)
         const char *target = NULL, *info = NULL;
         int error = 0;
 
+        /*
+         * Fail explicitly requested domain transitions if no_new_privs.
+         * There is no exception for unconfined as change_hat is not
+         * available.
+         */
+        if (current->no_new_privs)
+                return -EPERM;
+
         /* released below */
         cred = get_current_cred();
         cxt = cred->security;
@@ -750,6 +773,18 @@ int aa_change_profile(const char *ns_name, const char *hname, bool onexec,
         cxt = cred->security;
         profile = aa_cred_profile(cred);
 
+        /*
+         * Fail explicitly requested domain transitions if no_new_privs
+         * and not unconfined.
+         * Domain transitions from unconfined are allowed even when
+         * no_new_privs is set because this aways results in a reduction
+         * of permissions.
+         */
+        if (current->no_new_privs && !unconfined(profile)) {
+                put_cred(cred);
+                return -EPERM;
+        }
+
         if (ns_name) {
                 /* released below */
                 ns = aa_find_namespace(profile->ns, ns_name);
diff --git a/security/apparmor/file.c b/security/apparmor/file.c
index 2f8fcba9ce4b..cf19d4093ca4 100644
--- a/security/apparmor/file.c
+++ b/security/apparmor/file.c
@@ -108,7 +108,7 @@ int aa_audit_file(struct aa_profile *profile, struct file_perms *perms,
         int type = AUDIT_APPARMOR_AUTO;
         struct common_audit_data sa;
         struct apparmor_audit_data aad = {0,};
-        COMMON_AUDIT_DATA_INIT(&sa, NONE);
+        sa.type = LSM_AUDIT_DATA_NONE;
         sa.aad = &aad;
         aad.op = op,
         aad.fs.request = request;
diff --git a/security/apparmor/include/audit.h b/security/apparmor/include/audit.h
index 3868b1e5d5ba..4b7e18951aea 100644
--- a/security/apparmor/include/audit.h
+++ b/security/apparmor/include/audit.h
@@ -110,6 +110,7 @@ struct apparmor_audit_data {
         void *profile;
         const char *name;
         const char *info;
+        struct task_struct *tsk;
         union {
                 void *target;
                 struct {
diff --git a/security/apparmor/ipc.c b/security/apparmor/ipc.c
index c3da93a5150d..cf1071b14232 100644
--- a/security/apparmor/ipc.c
+++ b/security/apparmor/ipc.c
@@ -42,7 +42,7 @@ static int aa_audit_ptrace(struct aa_profile *profile,
 {
         struct common_audit_data sa;
         struct apparmor_audit_data aad = {0,};
-        COMMON_AUDIT_DATA_INIT(&sa, NONE);
+        sa.type = LSM_AUDIT_DATA_NONE;
         sa.aad = &aad;
         aad.op = OP_PTRACE;
         aad.target = target;
diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c
index e75829ba0ff9..7430298116d6 100644
--- a/security/apparmor/lib.c
+++ b/security/apparmor/lib.c
@@ -66,7 +66,7 @@ void aa_info_message(const char *str)
         if (audit_enabled) {
                 struct common_audit_data sa;
                 struct apparmor_audit_data aad = {0,};
-                COMMON_AUDIT_DATA_INIT(&sa, NONE);
+                sa.type = LSM_AUDIT_DATA_NONE;
                 sa.aad = &aad;
                 aad.info = str;
                 aa_audit_msg(AUDIT_APPARMOR_STATUS, &sa, NULL);
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index ad05d391974d..032daab449b0 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -373,7 +373,7 @@ static int apparmor_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
                                       AA_MAY_META_READ);
 }
 
-static int apparmor_dentry_open(struct file *file, const struct cred *cred)
+static int apparmor_file_open(struct file *file, const struct cred *cred)
 {
         struct aa_file_cxt *fcxt = file->f_security;
         struct aa_profile *profile;
@@ -589,7 +589,7 @@ static int apparmor_setprocattr(struct task_struct *task, char *name,
                 } else {
                         struct common_audit_data sa;
                         struct apparmor_audit_data aad = {0,};
-                        COMMON_AUDIT_DATA_INIT(&sa, NONE);
+                        sa.type = LSM_AUDIT_DATA_NONE;
                         sa.aad = &aad;
                         aad.op = OP_SETPROCATTR;
                         aad.info = name;
@@ -640,9 +640,9 @@ static struct security_operations apparmor_ops = {
         .path_chmod =                   apparmor_path_chmod,
         .path_chown =                   apparmor_path_chown,
         .path_truncate =                apparmor_path_truncate,
-        .dentry_open =                  apparmor_dentry_open,
         .inode_getattr =                apparmor_inode_getattr,
 
+        .file_open =                    apparmor_file_open,
         .file_permission =              apparmor_file_permission,
         .file_alloc_security =          apparmor_file_alloc_security,
         .file_free_security =           apparmor_file_free_security,
diff --git a/security/apparmor/path.c b/security/apparmor/path.c
index 2daeea4f9266..e91ffee80162 100644
--- a/security/apparmor/path.c
+++ b/security/apparmor/path.c
@@ -94,6 +94,8 @@ static int d_namespace_path(struct path *path, char *buf, int buflen,
          * be returned.
          */
         if (!res || IS_ERR(res)) {
+                if (PTR_ERR(res) == -ENAMETOOLONG)
+                        return -ENAMETOOLONG;
                 connected = 0;
                 res = dentry_path_raw(path->dentry, buf, buflen);
                 if (IS_ERR(res)) {
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index f1f7506a464d..cf5fd220309b 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -903,6 +903,10 @@ struct aa_profile *aa_lookup_profile(struct aa_namespace *ns, const char *hname)
         profile = aa_get_profile(__lookup_profile(&ns->base, hname));
         read_unlock(&ns->lock);
 
+        /* the unconfined profile is not in the regular profile list */
+        if (!profile && strcmp(hname, "unconfined") == 0)
+                profile = aa_get_profile(ns->unconfined);
+
         /* refcount released by caller */
         return profile;
 }
@@ -965,7 +969,7 @@ static int audit_policy(int op, gfp_t gfp, const char *name, const char *info,
 {
         struct common_audit_data sa;
         struct apparmor_audit_data aad = {0,};
-        COMMON_AUDIT_DATA_INIT(&sa, NONE);
+        sa.type = LSM_AUDIT_DATA_NONE;
         sa.aad = &aad;
         aad.op = op;
         aad.name = name;
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index deab7c7e8dc0..329b1fd30749 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -95,7 +95,7 @@ static int audit_iface(struct aa_profile *new, const char *name,
         struct aa_profile *profile = __aa_current_profile();
         struct common_audit_data sa;
         struct apparmor_audit_data aad = {0,};
-        COMMON_AUDIT_DATA_INIT(&sa, NONE);
+        sa.type = LSM_AUDIT_DATA_NONE;
         sa.aad = &aad;
         if (e)
                 aad.iface.pos = e->pos - e->start;
diff --git a/security/apparmor/resource.c b/security/apparmor/resource.c
index 2fe8613efe33..e1f3d7ef2c54 100644
--- a/security/apparmor/resource.c
+++ b/security/apparmor/resource.c
@@ -52,7 +52,7 @@ static int audit_resource(struct aa_profile *profile, unsigned int resource,
         struct common_audit_data sa;
         struct apparmor_audit_data aad = {0,};
 
-        COMMON_AUDIT_DATA_INIT(&sa, NONE);
+        sa.type = LSM_AUDIT_DATA_NONE;
         sa.aad = &aad;
         aad.op = OP_SETRLIMIT,
         aad.rlim.rlim = resource;