From 11c92f144bf39f448f65202cccba672097a1100b Mon Sep 17 00:00:00 2001
From: John Johansen <john.johansen@canonical.com>
Date: Wed, 11 Apr 2018 02:03:26 -0700
Subject: [PATCH] apparmor: fix mediation of prlimit
Git-commit: 11c92f144bf39f448f65202cccba672097a1100b
Patch-mainline: v4.18-rc1
References: bsc#1051510
For primit apparmor requires that if target confinement does not match
the setting task's confinement, the setting task requires CAP_SYS_RESOURCE.
Unfortunately this was broken when rlimit enforcement was reworked to
support labels.
Fixes: 86b92cb782b3 ("apparmor: move resource checks to using labels")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Takashi Iwai <tiwai@suse.de>
---
security/apparmor/resource.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/apparmor/resource.c b/security/apparmor/resource.c
index d022137143b9..95fd26d09757 100644
--- a/security/apparmor/resource.c
+++ b/security/apparmor/resource.c
@@ -124,7 +124,7 @@ int aa_task_setrlimit(struct aa_label *label, struct task_struct *task,
*/
if (label != peer &&
- !aa_capable(label, CAP_SYS_RESOURCE, SECURITY_CAP_NOAUDIT))
+ aa_capable(label, CAP_SYS_RESOURCE, SECURITY_CAP_NOAUDIT) != 0)
error = fn_for_each(label, profile,
audit_resource(profile, resource,
new_rlim->rlim_max, peer,
--
2.18.0