diff options
| author | John Johansen <john.johansen@canonical.com> | 2019-03-10 03:58:10 +0300 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2019-04-12 00:56:37 +0300 |
| commit | 145a0ef21c8e944957f58e2c8ffcd8a10f46266a (patch) | |
| tree | f548d4abe768b6efca29607e46df719dd12ef02c /security/apparmor/policy_unpack.c | |
| parent | fe166a9f2868839a1e2f7bd950164d05e86eb154 (diff) | |
| download | linux-145a0ef21c8e944957f58e2c8ffcd8a10f46266a.tar.xz | |
apparmor: fix blob compression when ns is forced on a policy load
When blob compression is turned on, if the policy namespace is forced
onto a policy load, the policy load will fail as the namespace name
being referenced is inside the compressed policy blob, resulting in
invalid or names that are too long. So duplicate the name before the
blob is compressed.
Fixes: 876dd866c084 ("apparmor: Initial implementation of raw policy blob compression")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor/policy_unpack.c')
| -rw-r--r-- | security/apparmor/policy_unpack.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c index c421801409e3..20f07f629598 100644 --- a/security/apparmor/policy_unpack.c +++ b/security/apparmor/policy_unpack.c @@ -944,11 +944,14 @@ static int verify_header(struct aa_ext *e, int required, const char **ns) e, error); return error; } - if (*ns && strcmp(*ns, name)) + if (*ns && strcmp(*ns, name)) { audit_iface(NULL, NULL, NULL, "invalid ns change", e, error); - else if (!*ns) - *ns = name; + } else if (!*ns) { + *ns = kstrdup(name, GFP_KERNEL); + if (!*ns) + return -ENOMEM; + } } return 0; |