From: Ryan Lee Date: Mon, 23 Jun 2025 21:58:00 +0000 (-0700) Subject: apparmor: remove redundant perms.allow MAY_EXEC bitflag set X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=4ce7d3cf5ad846a8843f8afc78de2a8309f74f12;p=users%2Fjedix%2Flinux-maple.git apparmor: remove redundant perms.allow MAY_EXEC bitflag set This section of profile_transition that occurs after x_to_label only happens if perms.allow already has the MAY_EXEC bit set, so we don't need to set it again. Fixes: 16916b17b4f8 ("apparmor: force auditing of conflicting attachment execs from confined") Signed-off-by: Ryan Lee Signed-off-by: John Johansen --- diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c index f9370a63a83c0..d689597f253b4 100644 --- a/security/apparmor/domain.c +++ b/security/apparmor/domain.c @@ -734,10 +734,8 @@ static struct aa_label *profile_transition(const struct cred *subj_cred, * we don't need to care about clobbering it */ if (info == CONFLICTING_ATTACH_STR_IX - || info == CONFLICTING_ATTACH_STR_UX) { + || info == CONFLICTING_ATTACH_STR_UX) perms.audit |= MAY_EXEC; - perms.allow |= MAY_EXEC; - } /* hack ix fallback - improve how this is detected */ goto audit; } else if (!new) {