Given a label with a profile stack of
A//&B or A//&C ...
A ptrace rule should be able to specify a generic trace pattern with
a rule like
ptrace trace A//&**,
however this is failing because while the correct label match routine
is called, it is being done post label decomposition so it is always
being done against a profile instead of the stacked label.
To fix this refactor the cross check to pass the full peer label in to
the label_match.
Fixes:
|
||
---|---|---|
.. | ||
apparmor.h | ||
apparmorfs.h | ||
audit.h | ||
capability.h | ||
context.h | ||
crypto.h | ||
domain.h | ||
file.h | ||
ipc.h | ||
label.h | ||
lib.h | ||
match.h | ||
mount.h | ||
path.h | ||
perms.h | ||
policy.h | ||
policy_ns.h | ||
policy_unpack.h | ||
procattr.h | ||
resource.h | ||
secid.h | ||
sig_names.h |