mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-04 08:24:42 +01:00
afe682c65c
Bug: https://bugs.launchpad.net/bugs/1322778 Between the apparmor 2.8.2 and 2.8.3, a bug was fixed in mod_apparmor (in 2.8 revno 2120) that corrected the storage location for AADefaultHatName. The incorrect storage caused the hat specified by the AADefaultHatName keyword to be the default value for AAHatName, and meant that if both an AAHatName and an AADefaultHatName entry were given in a vhost, mod_apparmor would not fall back to trying AADefaultHatName if the hat specified in AAHatName did not exist in the apache apparmor profile. However, because the value specified in AADefaultHatName was the default, if no AAHatName was specified, it would be attempted first, before a hat based on the passed URI, rather than after as the documentation stated and the code intended. By fixing the storage bug, the attempted hat ordering now matched the documentation. But a number of users came to rely on AADefaultHatName being attempted before the URI. Additionally, because the 2.8 mod_apparmor attempts each hat individually (rather than use the aa_change_hatv like trunk's mod_apparmor), each attempt with the URI-based hatname is logged by the kernel portion of apparmor, making system logs particularly noisy those same users. This patch re-adjusts the ordering so that the URI-based hat is attempted after the hat specified by AADefaultHatName is attempted, thus maintaining the actual behavior before the bug addressed in revno 2120 was fixed. Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-by: Seth Arnold <seth.arnold@canonical.com> Bug: https://launchpad.net/bugs/1322778 |
||
|---|---|---|
| .. | ||
| mod_apparmor | ||
| pam_apparmor | ||
| tomcat_apparmor | ||