<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>
On 11/3/18, <i>John Johansen</i> wrote:<i>Â </i></p>
<p>> A task invoking the no_new_privs prct
<a
href="https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt">>
https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt</a>
</p>
<p>Okay, so I just did a strace on 'man' and see that it calls that
function with the nnp parameter before attempting to execve the
child processes that fail to execute.</p>
<p>Okay -- I get it now:Â While nnp normally works fine if the
executable is unconstrained, once apparmor assigns a security
label to the executable, it's game over because the LSM system
asks apparmor to do something it cannot -- prove the future
profile transition has the same permissions. I thought the child
processes were asking for additional security, but that's not the
case.<br>
</p>
<p>This means that since all non-kernel processes have a label with
the FullSystemPolicy setup, this is an unavoidable problem --
there is no way to remove a label once assigned. It's ironic that
a function designed to help secure a system is what is responsible
for preventing whitelisting.<br>
</p>
<p>I assume I'll run into a similar issue with selinux since this is
a LSM label transition thing then? Man, this linux whitelisting
search is turning out to be the holy grail.</p>
</body>
</html>