From eef65bf3ee6f73afa4a5de23ae3a794a279f30c0 Mon Sep 17 00:00:00 2001 From: Michael Scherer Date: Thu, 20 Feb 2014 16:19:44 +0100 Subject: core: Add AppArmor profile switching This permit to switch to a specific apparmor profile when starting a daemon. This will result in a non operation if apparmor is disabled. It also add a new build requirement on libapparmor for using this feature. --- src/core/execute.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) (limited to 'src/core/execute.c') diff --git a/src/core/execute.c b/src/core/execute.c index f8b7521ff9..a328fc265f 100644 --- a/src/core/execute.c +++ b/src/core/execute.c @@ -55,6 +55,10 @@ #include #endif +#ifdef HAVE_APPARMOR +#include +#endif + #include "execute.h" #include "strv.h" #include "macro.h" @@ -77,6 +81,7 @@ #include "async.h" #include "selinux-util.h" #include "errno-list.h" +#include "apparmor-util.h" #ifdef HAVE_SECCOMP #include "seccomp-util.h" @@ -1597,6 +1602,16 @@ int exec_spawn(ExecCommand *command, } } #endif + +#ifdef HAVE_APPARMOR + if (context->apparmor_profile && use_apparmor()) { + err = aa_change_onexec(context->apparmor_profile); + if (err < 0 && !context->apparmor_profile_ignore) { + r = EXIT_APPARMOR_PROFILE; + goto fail_child; + } + } +#endif } err = build_environment(context, n_fds, watchdog_usec, home, username, shell, &our_env); @@ -1759,6 +1774,9 @@ void exec_context_done(ExecContext *c) { free(c->selinux_context); c->selinux_context = NULL; + free(c->apparmor_profile); + c->apparmor_profile = NULL; + #ifdef HAVE_SECCOMP set_free(c->syscall_filter); c->syscall_filter = NULL; @@ -2188,6 +2206,11 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) { fprintf(f, "%sSystemCallErrorNumber: %s\n", prefix, strna(errno_to_name(c->syscall_errno))); + + if (c->apparmor_profile) + fprintf(f, + "%sAppArmorProfile: %s%s\n", + prefix, c->apparmor_profile_ignore ? "-" : "", c->apparmor_profile); } void exec_status_start(ExecStatus *s, pid_t pid) { -- cgit v1.2.3-54-g00ecf