child Cx transition to grandchild transition silently fails, and child Px to sibling transition silently fails

[Jamie Strandboge]

I noticed that apparmor does not transition from a child to a grandchild. Eg:

/tmp/foo {
  /tmp/bar Cx -> bar, # works

  profile bar {
    /tmp/baz Cx -> baz, # does not work

    profile baz {
    }
  }
}

The following child to a sibling also fails:
/tmp/foo {
  /tmp/bar Cx -> bar, # works

  profile bar {
    /tmp/baz Px -> baz, # does not work
  }
  profile baz {
  }
}

Attached is a tarball that shows how transitions work for ix, px, px to an uncle, px to a sibling, and cx to a grandchild. Run it with:
$ tar -zxf ./apparmor.tar.gz
$ cd ./apparmor
$ ./poc.sh
= profile-ix =
start
foo
bar
baz
pass

= profile-px =
start
foo
bar
baz
pass

= profile-px-sibling =
start
foo
/tmp/bug/bar: /tmp/bug/baz: /bin/sh: bad interpreter: No such file or directory
FAIL

= profile-px-uncle =
start
foo
bar
baz
pass

= profile-cx-grandchild =
apparmor_parser: Unable to replace "baz". Profile doesn't exist
start
foo
/tmp/bug/bar: /tmp/bug/baz: /bin/sh: bad interpreter: No such file or directory
FAIL

Cleaning up
  removing profile-cx-grandchild
  removing profile-ix
  removing profile-px
  removing profile-px-sibling
  removing profile-px-uncle
[1]
$

Also, these transitions fail silently (both at compile and runtime), which might be related to bug #1045074

[Jamie Strandboge (jdstrand)]

1042771 might be related.

[John Johansen (jjohansen)]

There is a 64 bit quantal test kernel is located at
http://people.canonical.com/~jj/linux-image-3.5.0-13-generic_3.5.0-13.14~lp1045074_amd64.deb

[Jamie Strandboge (jdstrand)]

Per IRC, sibling profiles are not yet supported (though one can use /tmp/baz Px -> /tmp/foo//baz). Grand children are only supported in the kernel.

[John Johansen (jjohansen)]

The apparmor userspace does not currently properly support grand children profiles and sibling transitions
  px is a namespace relative transition
  cx is a child transition

  a sibling transition can be currently be done manually by providing the fully quallified profile path, for the bug example that would require being reworked as

  /tmp/foo {
      /tmp/bar Cx -> bar, # works

      profile bar {
          /tmp/baz Px -> /tmp/foo//baz, # does not work
      }
      profile baz {
      }
  }

this example failed because Px -> baz was trying to transition to a sibling of /tmp/foo (namespace relative) not a sibling of profile bar. Changing the Px to use /tmp/foo//baz clarifies that baz is a child of /tmp/foo

The compiler should be warning when transitions to non-existent profiles are used.

Marking this a wish list bug because it is going to require extension to support siblings transitions, grand children, and interprofile analysis none of which are currently supported. Note: the language has been speced to support these but the user space tools do not yet.

The failure to log the failed transition is covered by Bug #1045074