[apparmor] ENOPROTOOPT error when calling aa_getpeercon()

[John Johansen]

On 1/29/24 09:26, Sergio Costas Rodriguez wrote:
> El 29/1/24 a las 17:48, John Johansen escribió:
>> On 1/29/24 08:31, Sergio Costas Rodriguez wrote:
>>> Hi all,
>>>
>>> I'm using aa_getpeercon() to get info about a socket, but in some kernels with odd apparmor configurations it returns ENOPROTOOPT. But the manpage doesn't list that error in the possible errors of this call. Under which circumstances can that error be returned?
>>>
>>
>> to use aa_getpeercon() your kernel will need the fine grained unix mediation which hasn't land in upstream kernels yet. So current upstream kernels will return -ENOPROTOOPT because SO_PEERLABEL is not a supported protocol option.
>>
>> Additionally note that with LSM stacking, with apparmor stacked with another LSM, even if you have the fine grained af_unix mediation, that aa_getpeercon() will either return an error or the wrong LSM info (it will depend on the version aa_getpeercon() that is in use.
>>
>>
> Mmm... does that mean that Ubuntu kernels have that patch included? Do you know since which version?
> 

yes, variation iterations of it for a long time. Unfortunately the patches took some liberties that really weren't appropriate for upstream, and also had some inconsistencies around fs vs non-fs variants of unix sockets making it not suitable for upstream.

There needed to be work on the apparmor core to fix those issues, that work is now largely done and a new variant of the fine grained unix mediation patch will hopefully land soon.