kernel/linux.git/security/apparmor/match.c, branch v5.4.222

apparmor: ensure that dfa state tables have entries

2020-07-22T07:33:05+00:00

commit c27c6bd2c4d6b6bb779f9b722d5607993e1d5e5c upstream. Currently it is possible to specify a state machine table with 0 length, this is not valid as optional tables are specified by not defining the table as present. Further this allows by-passing the base tables range check against the next/check tables. Fixes: d901d6a298dc ("apparmor: dfa split verification of table headers") Reported-by: Mike Salvatore Signed-off-by: John Johansen Signed-off-by: Greg Kroah-Hartman

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441

2019-06-05T15:37:17+00:00

Based on 1 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation version 2 of the license extracted by the scancode license scanner the SPDX license identifier GPL-2.0-only has been chosen to replace the boilerplate/reference in 315 file(s). Signed-off-by: Thomas Gleixner Reviewed-by: Allison Randal Reviewed-by: Armijn Hemel Cc: linux-spdx@vger.kernel.org Link: https://lkml.kernel.org/r/20190531190115.503150771@linutronix.de Signed-off-by: Greg Kroah-Hartman

apparmor: fix typo "traverse"

2018-05-03T07:50:12+00:00

Signed-off-by: Zygmunt Krynicki Acked-by: Christian Boltz Signed-off-by: John Johansen

apparmor: Fix an error code in verify_table_headers()

2018-03-24T00:28:38+00:00

We accidentally return a positive EPROTO instead of a negative -EPROTO. Since 71 is not an error pointer, that means it eventually results in an Oops in the caller. Fixes: d901d6a298dc ("apparmor: dfa split verification of table headers") Signed-off-by: Dan Carpenter Signed-off-by: John Johansen

apparmor: improve overlapping domain attachment resolution

2018-02-09T19:30:02+00:00

Overlapping domain attachments using the current longest left exact match fail in some simple cases, and with the fix to ensure consistent behavior by failing unresolvable attachments it becomes important to do a better job. eg. under the current match the following are unresolvable where the alternation is clearly a better match under the most specific left match rule. /** /{bin/,}usr/ Use a counting match that detects when a loop in the state machine is enter, and return the match count to provide a better specific left match resolution. Signed-off-by: John Johansen

apparmor: dfa split verification of table headers

2018-02-09T19:30:02+00:00

separate the different types of verification so they are logically separate and can be reused separate of each other. Signed-off-by: John Johansen

apparmor: dfa add support for state differential encoding

2018-02-09T19:30:01+00:00

State differential encoding can provide better compression for apparmor policy, without having significant impact on match time. Signed-off-by: John Johansen

apparmor: dfa move character match into a macro

2018-02-09T19:30:01+00:00

Signed-off-by: John Johansen

apparmor: use the dfa to do label parse string splitting

2018-02-09T19:30:01+00:00

The current split scheme is actually wrong in that it splits ///& where that is invalid and should fail. Use the dfa to do a proper bounded split without having to worry about getting the string processing right in code. Signed-off-by: John Johansen Acked-by: Seth Arnold

apparmor: add first substr match to dfa

2018-02-09T19:30:01+00:00

Signed-off-by: John Johansen Acked-by: Seth Arnold