diff options
| author | John Johansen <john.johansen@canonical.com> | 2017-01-16 11:42:41 +0300 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2017-01-16 12:18:33 +0300 |
| commit | 6604d4c1c1a65d3d1a6a56291d96516d1e9b7041 (patch) | |
| tree | 35db647541b41867c4031e986d510563c0cd160a /security | |
| parent | 293a4886f93f1d4f01ef2642b81c2509a5376ce5 (diff) | |
| download | linux-6604d4c1c1a65d3d1a6a56291d96516d1e9b7041.tar.xz | |
apparmor: allow policydb to be used as the file dfa
Newer policy will combine the file and policydb dfas, allowing for
better optimizations. However to support older policy we need to
keep the ability to address the "file" dfa separately. So dup
the policydb as if it is the file dfa and set the appropriate start
state.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security')
| -rw-r--r-- | security/apparmor/policy_unpack.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c index 6ac292fec55f..7160addb11be 100644 --- a/security/apparmor/policy_unpack.c +++ b/security/apparmor/policy_unpack.c @@ -611,12 +611,16 @@ static struct aa_profile *unpack_profile(struct aa_ext *e) error = PTR_ERR(profile->file.dfa); profile->file.dfa = NULL; goto fail; + } else if (profile->file.dfa) { + if (!unpack_u32(e, &profile->file.start, "dfa_start")) + /* default start state */ + profile->file.start = DFA_START; + } else if (profile->policy.dfa && + profile->policy.start[AA_CLASS_FILE]) { + profile->file.dfa = aa_get_dfa(profile->policy.dfa); + profile->file.start = profile->policy.start[AA_CLASS_FILE]; } - if (!unpack_u32(e, &profile->file.start, "dfa_start")) - /* default start state */ - profile->file.start = DFA_START; - if (!unpack_trans_table(e, profile)) goto fail; |