no logging with Cx|cx to non-existent subprofile

[Jamie Strandboge]

If I create the following rule:

  <path> Cx -> <subprofile>,

apparmor_parser does not complain if '<subprofile>' does not exist and the kernel doesn't log that there was a problem transitioning.

This has happened when profiling in Ubuntu when using the 'sanitized_helper' but forgetting to '#include <abstractions/ubuntu-helpers>'. Since there is no feedback, this is a usability issue for profilers when trying to do things like this:

$ cat /tmp/foo
#!/bin/sh
echo foo
/tmp/bar

$ cat /tmp/bar
#!/bin/sh
echo bar
head -1 /etc/hosts

$ cat /tmp/test.profile
#include <tunables/global>
/tmp/foo {
    #include <abstractions/base>
    #include <abstractions/bash>
    /tmp/foo r,
    /tmp/bar Cxr -> bar,
}
profile bar {
  #include <abstractions/base>
  #include <abstractions/bash>
  /bin/dash r,
  /tmp/bar r,
  /usr/bin/head ixr,
  /etc/hosts r,
}

Loading the above profile and executing /tmp/foo results in:
$ /tmp/foo
foo
bar
head: cannot open `/etc/hosts' for reading: Permission denied

This happens because 'foo' can't transition to 'bar' because 'bar' is not a subprofile of 'foo'. There is no kernel message and apparmor_parser also did not catch the profiling error. Depending on how the profiled applications are written, there may or may not be useful debugging information when profiling.

[John Johansen (jjohansen)]

There is a 64 bit quantal test kernel located at
http://people.canonical.com/~jj/linux-image-3.5.0-13-generic_3.5.0-13.14~lp1045074_amd64.deb

[John Johansen (jjohansen)]

New 64 bit quantal test kernel locatated at
http://people.canonical.com/~jj/linux-image-3.5.0-13-generic_3.5.0-13.14~lp1045074.2_amd64.deb

[Jamie Strandboge (jdstrand)]

This kernel logs the missing profile:
type=AVC msg=audit(1348594826.613:107): apparmor="DENIED" operation="exec" info="profile not found" error=-2 parent=4440 profile="/tmp/bug/start//foo" name="/tmp/bug/baz" pid=4442 comm="foo" requested_mask="x" denied_mask="x" fsuid=1000 ouid=1000

$ cat /proc/version_signature
Ubuntu 3.5.0-13.14~lp1045074-generic 3.5.3