Re: Pidgin, 4.14 and App Armor Oops.

Zephaniah E. Loss-Cutler-Hull wrote: It seems to me that audit_signal_cb() is reading a pointer value rather than signal number, for the address of aad(sa)->peer and aad(&sa)->signal are the same due to use of "union" inside "struct apparmor_audit_data". Thus, I think that this is an AppArmor side problem. struct apparmor_audit_data { int error; int type; const char *op; struct aa_label *label; const char *name; const char *info; u32 request; u32 denied; union { /* these entries require a custom callback fn */ struct { struct aa_label *peer; struct { const char *target; kuid_t ouid; } fs; }; struct { struct aa_profile *profile; const char *ns; long pos; } iface; int signal; struct { int rlim; unsigned long max; } rlim; struct { const char *src_name; const char *type; const char *trans; const char *data; unsigned long flags; } mnt; }; }; static int profile_signal_perm(struct aa_profile *profile, struct aa_profile *peer, u32 request, struct common_audit_data *sa) { struct aa_perms perms; if (profile_unconfined(profile) || !PROFILE_MEDIATES(profile, AA_CLASS_SIGNAL)) return 0; aad(sa)->peer = &peer->label; // Overwrites aad(sa)->signal value. profile_match_signal(profile, peer->base.hname, aad(sa)->signal, &perms); aa_apply_modes_to_perms(profile, &perms); return aa_check_perms(profile, &perms, request, sa, audit_signal_cb); // Oops } static int aa_signal_cross_perm(struct aa_profile *sender, struct aa_profile *target, struct common_audit_data *sa) { return xcheck(profile_signal_perm(sender, target, MAY_WRITE, sa), profile_signal_perm(target, sender, MAY_READ, sa)); } int aa_may_signal(struct aa_label *sender, struct aa_label *target, int sig) { DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, OP_SIGNAL); aad(&sa)->signal = map_signal_num(sig); // Writes aad(sa)->signal value. return xcheck_labels_profiles(sender, target, aa_signal_cross_perm, &sa); }