Skip to content

[3.0] ask_exec(): no longer skip exec events in hats

Christian Boltz requested to merge cboltz/apparmor:cboltz-more-x-3.0 into apparmor-3.0

Instead of ignoring all exec events that happen in a hat/child profile, only disallow child exec. ix and px are valid options inside a hat and are now offered to the user.

(When the tools support nested child profiles one day, we can even allow child exec again.)

Backported from dfb6f90a / !1133 (merged) to match the 3.1 branch

For 3.0, this also needed backporting another commit:

Fix crash caused by ask_exec()

ask_exec still uses aa[profile][hat], therefore

  • use full_profile when accessing hashlog
  • correctly split the merged profile name to profile and hat
  • avoid accidently initializing non-existing aa[profile][hat]

This fixes a regression from converting lots of code to use flat profile//hat array keys.

(cherry picked from commit 755b5d11)

Merge request reports