From: John Johansen <john.johansen@canonical.com>
Date: Fri, 29 Jun 2012 17:34:00 -0700
Subject: apparmor: Fix quieting of audit messages for network mediation

Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor.git
Git-commit: f5c5644745201b5b7d398e841e5045d0a5d14b18
Patch-mainline: Queued in subsystem maintainer repo
References: FATE#300516

If a profile specified a quieting of network denials for a given rule by
either the quiet or deny rule qualifiers, the resultant quiet mask for
denied requests was applied incorrectly, resulting in two potential bugs.
1. The misapplied quiet mask would prevent denials from being correctly
   tested against the kill mask/mode. Thus network access requests that
   should have resulted in the application being killed did not.

2. The actual quieting of the denied network request was not being applied.
   This would result in network rejections always being logged even when
   they had been specifically marked as quieted.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Jeff Mahoney <jeffm@suse.com>
---
 security/apparmor/net.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/apparmor/net.c b/security/apparmor/net.c
index 913456ba79b0..48e66a61b9c6 100644
--- a/security/apparmor/net.c
+++ b/security/apparmor/net.c
@@ -90,7 +90,7 @@ static int audit_net(struct aa_profile *profile, const char *op,
 	} else {
 		u16 quiet_mask = profile->net.quiet[sa.u.net->family];
 		u16 kill_mask = 0;
-		u16 denied = (1 << sa.aad->net.type) & ~quiet_mask;
+		u16 denied = (1 << sa.aad->net.type);
 
 		if (denied & kill_mask)
 			audit_type = AUDIT_APPARMOR_KILL;
-- 
2.14.2