diff options
| author | John Johansen <john.johansen@canonical.com> | 2026-02-02 15:12:02 +0300 |
|---|---|---|
| committer | Sasha Levin <sashal@kernel.org> | 2026-03-04 15:20:25 +0300 |
| commit | 8dc6beca70f04205b0543115f3ec5455c06a81fc (patch) | |
| tree | da55634648778c34d0278b17d90eae3641985173 /security | |
| parent | b25298e89a297c42eb4c4d6f081d60375b820abb (diff) | |
| download | linux-8dc6beca70f04205b0543115f3ec5455c06a81fc.tar.xz | |
apparmor: fix aa_label to return state from compount and component match
[ Upstream commit 9058798652c8bc0584ed1fb0766a1015046c06e8 ]
aa-label_match is not correctly returning the state in all cases.
The only reason this didn't cause a error is that all callers currently
ignore the return value.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202602020631.wXgZosyU-lkp@intel.com/
Fixes: a4c9efa4dbad6 ("apparmor: make label_match return a consistent value")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'security')
| -rw-r--r-- | security/apparmor/label.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/security/apparmor/label.c b/security/apparmor/label.c index 7289712df241..d64c838f5d84 100644 --- a/security/apparmor/label.c +++ b/security/apparmor/label.c @@ -1344,7 +1344,7 @@ fail: * @request: permissions to request * @perms: an initialized perms struct to add accumulation to * - * Returns: 0 on success else ERROR + * Returns: the state the match finished in, may be the none matching state * * For the label A//&B//&C this does the perm match for each of A and B and C * @perms should be preinitialized with allperms OR a previous permission @@ -1372,7 +1372,7 @@ static int label_components_match(struct aa_profile *profile, } /* no subcomponents visible - no change in perms */ - return 0; + return state; next: tmp = *aa_lookup_perms(rules->policy, state); @@ -1388,13 +1388,13 @@ next: } if ((perms->allow & request) != request) - return -EACCES; + return DFA_NOMATCH; - return 0; + return state; fail: *perms = nullperms; - return -EACCES; + return DFA_NOMATCH; } /** @@ -1416,7 +1416,7 @@ int aa_label_match(struct aa_profile *profile, struct aa_ruleset *rules, aa_state_t tmp = label_compound_match(profile, rules, label, state, subns, request, perms); if ((perms->allow & request) == request) - return 0; + return tmp; /* failed compound_match try component matches */ *perms = allperms; |