apparmor: fix ptrace read check

338d0be4 · John Johansen <[email protected]> · 2018-06-07 00:45:30 -07:00

The ptrace read check is incorrect resulting in policy that is
broader than it needs to be. Fix the check so that read access
permission can be properly detected when other ptrace flags are
set.

Fixes: b2d09ae449ce ("apparmor: move ptrace checks to using labels")
Signed-off-by: John Johansen <[email protected]>

Commit: 338d0be437ef10e247a35aed83dbab182cf406a2
Parents: 3ddae987

Changes

1 files changed · +2 −1

File	Status	Add	Del	Content
security/apparmor/lsm.c	modified	+2	−1	View file

security/apparmor/lsm.c

View file

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index e35d128..74f1737 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -117,7 +117,8 @@ static int apparmor_ptrace_access_check(struct task_struct *child,
 	tracer = begin_current_label_crit_section();
 	tracee = aa_get_task_label(child);
 	error = aa_may_ptrace(tracer, tracee,
-		  mode == PTRACE_MODE_READ ? AA_PTRACE_READ : AA_PTRACE_TRACE);
+			(mode & PTRACE_MODE_READ) ? AA_PTRACE_READ
+						  : AA_PTRACE_TRACE);
 	aa_put_label(tracee);
 	end_current_label_crit_section(tracer);
 