apparmor: fix regression in mount mediation when feature set is pinned
authorJohn Johansen <john.johansen@canonical.com>
Thu, 7 Dec 2017 08:28:27 +0000 (00:28 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 10 Jan 2018 08:31:22 +0000 (09:31 +0100)
commitf5edee88ad430356e5c6b1c309782cce3f736272
tree42b45a295ae4b163b57372b1625cc0d1356a660e
parent46789641800ca2077acb66c6cbe8e2ce7575113c
apparmor: fix regression in mount mediation when feature set is pinned

commit 5b9f57cf47b87f07210875d6a24776b4496b818d upstream.

When the mount code was refactored for Labels it was not correctly
updated to check whether policy supported mediation of the mount
class.  This causes a regression when the kernel feature set is
reported as supporting mount and policy is pinned to a feature set
that does not support mount mediation.

BugLink: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=882697#41
Fixes: 2ea3ffb7782a ("apparmor: add mount mediation")
Reported-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
security/apparmor/mount.c