apparmor ChangeProfile Bypass

Vulnerability analysis

AppArmor normally prevents unprivileged unconfined tasks from performing one-way profile transitions, forcing them to stack instead so they cannot bypass admin-set policy. When a task was already confined by a stack of profiles, the original code only checked this restriction at the outermost level, missing an unconfined component buried inside the stack. An unprivileged user could exploit this by performing two transitions through an unconfined profile to bypass the restriction entirely. The fix now checks each profile individually when building the confinement label, so any unconfined component inside a stack is properly restricted. This vulnerability is reachable by any unprivileged local user on systems where AppArmor is enabled and the unprivileged unconfined restriction is active.