2019-04-08 07:22:18

by David Rheinsberg

Subject: [REGRESSION] AppArmor module parameter layout changed with c5459b829b716

Hi

A recent commit changed how `/sys/module/apparmor/parameters/enabled`
looks. It was "Y"/"N" before, now it is an integer. I *think* the
commit that changed this was:

commit c5459b829b716dafd226ad270f25c9a3050f7586
Author: Kees Cook <[email protected]>
Date: Thu Sep 13 22:28:48 2018 -0700

LSM: Plumb visibility into optional "enabled" state

I haven't recompiled with a revert, but changing the module-parameter
type looks like the obvious culprit. I don't see how this change can
be safe?

This breaks the AppArmor detection of `dbus-broker`. Can the commit be reverted?

Thanks
David

2019-04-08 15:13:27

by Kees Cook

Subject: Re: [REGRESSION] AppArmor module parameter layout changed with c5459b829b716

On Mon, Apr 8, 2019 at 12:21 AM David Rheinsberg
<[email protected]> wrote:
>
> Hi
>
> A recent commit changed how `/sys/module/apparmor/parameters/enabled`
> looks. It was "Y"/"N" before, now it is an integer. I *think* the
> commit that changed this was:

Oooh... the _output_ appears differently based on the type. Argh. Let
me work something up...

> commit c5459b829b716dafd226ad270f25c9a3050f7586
> Author: Kees Cook <[email protected]>
> Date: Thu Sep 13 22:28:48 2018 -0700
>
> LSM: Plumb visibility into optional "enabled" state
>
> I haven't recompiled with a revert, but changing the module-parameter
> type looks like the obvious culprit. I don't see how this change can
> be safe?
>
> This breaks the AppArmor detection of `dbus-broker`. Can the commit be reverted?

Thanks for catching this!

--
Kees Cook