[Acked] [PATCH][Quantal] apparmor: Fix quieting of audit messages for network mediation

[Andy Whitcroft]

On Tue, Apr 09, 2013 at 04:33:02AM -0700, John Johansen wrote:
> The following changes since commit e13650a092887728d555bc21e2ea9cd7aab53d9e:
> 
>   UBUNTU: Ubuntu-3.5.0-27.46 (2013-03-25 14:33:09 -0500)
> 
> are available in the git repository at:
> 
>   git://kernel.ubuntu.com/jj/ubuntu-quantal.git lp1156769
> 
> for you to fetch changes up to 35ad0a8c35a4817f4f0f34d15462c5fd11f10f40:
> 
>   UBUNTU: SAUCE: apparmor: Fix quieting of audit messages for network mediation (2013-04-09 02:50:48 -0700)
> 
> ----------------------------------------------------------------
> John Johansen (1):
>       UBUNTU: SAUCE: apparmor: Fix quieting of audit messages for network mediation
> 
>  security/apparmor/net.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> ---
> 
> From 35ad0a8c35a4817f4f0f34d15462c5fd11f10f40 Mon Sep 17 00:00:00 2001
> From: John Johansen <john.johansen at canonical.com>
> Date: Fri, 29 Jun 2012 17:34:00 -0700
> Subject: [PATCH] UBUNTU: SAUCE: apparmor: Fix quieting of audit messages for
>  network mediation
> 
> This fixes a bug in the apparmor networking patch that is not upstream
> because it is being replaced by a newer patch.
> 
> BugLink: http://bugs.launchpad.net/bugs/1163259
> 
> If a profile specified a quieting of network denials for a given rule by
> either the quiet or deny rule qualifiers, the resultant quiet mask for
> denied requests was applied incorrectly, resulting in two potential bugs.
> 1. The misapplied quiet mask would prevent denials from being correctly
>    tested against the kill mask/mode. Thus network access requests that
>    should have resulted in the application being killed did not.
> 
> 2. The actual quieting of the denied network request was not being applied.
>    This would result in network rejections always being logged even when
>    they had been specifically marked as quieted.
> 
> Signed-off-by: John Johansen <john.johansen at canonical.com>
> ---
>  security/apparmor/net.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/security/apparmor/net.c b/security/apparmor/net.c
> index 003dd18..6e6e5c9 100644
> --- a/security/apparmor/net.c
> +++ b/security/apparmor/net.c
> @@ -88,7 +88,7 @@ static int audit_net(struct aa_profile *profile, int op, u16 family, int type,
>  	} else {
>  		u16 quiet_mask = profile->net.quiet[sa.u.net->family];
>  		u16 kill_mask = 0;
> -		u16 denied = (1 << sa.aad->net.type) & ~quiet_mask;
> +		u16 denied = (1 << sa.aad->net.type);
>  
>  		if (denied & kill_mask)
>  			audit_type = AUDIT_APPARMOR_KILL;

Acked-by: Andy Whitcroft <apw at canonical.com>

-apw