diff options
| author | John Johansen <john.johansen@canonical.com> | 2023-04-17 13:27:36 +0300 |
|---|---|---|
| committer | Sasha Levin <sashal@kernel.org> | 2026-03-04 15:20:24 +0300 |
| commit | f89b657e17855c7775db36360d5e2cc1198b0b5a (patch) | |
| tree | 27c2ba8c240aa7a1dac7a062992ae4937d5341be /security | |
| parent | e78e00cf9ebae58f2e94f04a92ad5d4cbe692039 (diff) | |
| download | linux-f89b657e17855c7775db36360d5e2cc1198b0b5a.tar.xz | |
apparmor: provide separate audit messages for file and policy checks
[ Upstream commit 75c77e9e0713fddbe99a21a036aa6482402f9e34 ]
Improve policy load failure messages by identifying which dfa the
verification check failed in.
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Stable-dep-of: a4c9efa4dbad ("apparmor: make label_match return a consistent value")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'security')
| -rw-r--r-- | security/apparmor/policy_unpack.c | 16 |
1 files changed, 11 insertions, 5 deletions
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c index a1de48c2d826..cefda5e5b6ed 100644 --- a/security/apparmor/policy_unpack.c +++ b/security/apparmor/policy_unpack.c @@ -1249,12 +1249,18 @@ static int verify_profile(struct aa_profile *profile) if (!rules) return 0; - if ((rules->file.dfa && !verify_dfa_accept_index(rules->file.dfa, - rules->file.size)) || - (rules->policy.dfa && - !verify_dfa_accept_index(rules->policy.dfa, rules->policy.size))) { + if (rules->file.dfa && !verify_dfa_accept_index(rules->file.dfa, + rules->file.size)) { audit_iface(profile, NULL, NULL, - "Unpack: Invalid named transition", NULL, -EPROTO); + "Unpack: file Invalid named transition", NULL, + -EPROTO); + return -EPROTO; + } + if (rules->policy.dfa && + !verify_dfa_accept_index(rules->policy.dfa, rules->policy.size)) { + audit_iface(profile, NULL, NULL, + "Unpack: policy Invalid named transition", NULL, + -EPROTO); return -EPROTO; } |