mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity

apparmor: fix policy_compat permission remap with extended permissions 

[ Upstream commit 0bac2002b3 ]

If the extended permission table is present we should not be attempting
to do a compat_permission remap as the compat_permissions are not
stored in the dfa accept states.

Fixes: fd1b2b95a2 ("apparmor: add the ability for policy to specify a permission table")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Reviewed-by: Jon Tourville <jontourville@me.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
John Johansen 2023-03-10 15:59:45 -08:00 committed by Greg Kroah-Hartman
parent 33b1fe578f
commit 6108e25cfe
1 changed files with 19 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
security/apparmor/policy_unpack.c
View File

@ -860,10 +860,12 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
}
profile->attach.xmatch_len = tmp;
profile->attach.xmatch.start[AA_CLASS_XMATCH] = DFA_START;
error = aa_compat_map_xmatch(&profile->attach.xmatch);
if (error) {
info = "failed to convert xmatch permission table";
goto fail;
if (!profile->attach.xmatch.perms) {
error = aa_compat_map_xmatch(&profile->attach.xmatch);
if (error) {
info = "failed to convert xmatch permission table";
goto fail;
}
}
}
@ -983,10 +985,13 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
AA_CLASS_FILE);
if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL))
goto fail;
error = aa_compat_map_policy(&rules->policy, e->version);
if (error) {
info = "failed to remap policydb permission table";
goto fail;
if (!rules->policy.perms) {
error = aa_compat_map_policy(&rules->policy,
e->version);
if (error) {
info = "failed to remap policydb permission table";
goto fail;
}
}
} else {
rules->policy.dfa = aa_get_dfa(nulldfa);
@ -1001,10 +1006,12 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
if (error) {
goto fail;
} else if (rules->file.dfa) {
error = aa_compat_map_file(&rules->file);
if (error) {
info = "failed to remap file permission table";
goto fail;
if (!rules->file.perms) {
error = aa_compat_map_file(&rules->file);
if (error) {
info = "failed to remap file permission table";
goto fail;
}
}
} else if (rules->policy.dfa &&
rules->policy.start[AA_CLASS_FILE]) {