Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 03 Jan 2011 17:39:25 -0600
From: Jamie Strandboge <jamie@...onical.com>
To: oss-security@...ts.openwall.com
Cc: John Johansen <john@...x.net>, "Steven M. Christey"
 <coley@...us.mitre.org>
Subject: Re: Possible CVE Request: improper AppArmor exec
 transition

On Mon, 2011-01-03 at 15:33 -0600, Jamie Strandboge wrote:
> If the policy is:
> /usr/bin/baz {
>   ...
>   /usr/bin/bar px,
>   /usr/bin/foo pux,
> }
> 
> Then when baz executes /usr/bin/bar, bar will correctly run under the
> 'bar' profile if it exists, otherwise baz will receive a failed exec.
> The problem is when baz execs /usr/bin/foo, foo will run under the 'foo'
> profile if it exists (correct), otherwise baz will receive a failed exec
> (incorrect). bar should instead run unconfined. This is a bug, but not
> security relevant as the 'foo pux' rule is treated as a more strict 'foo
> px'.

This:
"bar should instead run unconfined"

should have been:
"foo should instead run unconfined"

Sorry for any confusion.

-- 
Jamie Strandboge             | http://www.canonical.com

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.