From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1759026AbcEFXEg (ORCPT <rfc822;w@1wt.eu>);
	Fri, 6 May 2016 19:04:36 -0400
Received: from youngberry.canonical.com ([91.189.89.112]:47055 "EHLO
	youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1758823AbcEFXEe (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Fri, 6 May 2016 19:04:34 -0400
From: Tyler Hicks <tyhicks@canonical.com>
To: linux-security-module@vger.kernel.org, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org
Cc: Serge Hallyn <serge.hallyn@canonical.com>,
        "David S . Miller" <davem@davemloft.net>
Subject: [PATCH 0/2] Quiet noisy LSM denial when accessing net sysctl
Date: Fri,  6 May 2016 18:04:12 -0500
Message-Id: <1462575854-4301-1-git-send-email-tyhicks@canonical.com>
X-Mailer: git-send-email 2.7.4
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

This pair of patches does away with what I believe is a useless denial
audit message when a privileged process initially accesses a net sysctl.

The bug was first discovered when running Go applications under AppArmor
confinement. It can be triggered like so:

  $ echo "profile test { file, }" | sudo apparmor_parser -rq

Once the profile is loaded, invoke Go as root under confinement:

  $ sudo aa-exec -p test -- go version
  go version go1.6.1 linux/amd64

Here's the denial:

  audit: type=1400 audit(1462575436.832:29): apparmor="DENIED" operation="capable" profile="test" pid=1157 comm="go" capability=12  capname="net_admin"

The reproducer in minimal form is:

  $ sudo aa-exec -p test -- cat /proc/sys/net/core/somaxconn
  128

The denial:

  audit: type=1400 audit(1462575670.000:29): apparmor="DENIED" operation="capable" profile="test" pid=1161 comm="cat" capability=12  capname="net_admin"

Thanks!

Tyler