Commit cbb13e12 authored by John Johansen's avatar John Johansen

apparmor: Fix regression in compat permissions for getattr

This fixes a regression in mediation of getattr when old policy built
under an older ABI is loaded and mapped to internal permissions.

The regression does not occur for all getattr permission requests,
only appearing if state zero is the final state in the permission
lookup.  This is because despite the first state (index 0) being
guaranteed to not have permissions in both newer and older permission
formats, it may have to carry permissions that were not mediated as
part of an older policy. These backward compat permissions are
mapped here to avoid special casing the mediation code paths.

Since the mapping code already takes into account backwards compat
permission from older formats it can be applied to state 0 to fix
the regression.

Fixes: 408d53e9 ("apparmor: compute file permissions on profile load")
Reported-by: default avatarPhilip Meulengracht <the_meulengracht@hotmail.com>
Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
parent e1c04510
...@@ -160,8 +160,7 @@ static struct aa_perms *compute_fperms(struct aa_dfa *dfa) ...@@ -160,8 +160,7 @@ static struct aa_perms *compute_fperms(struct aa_dfa *dfa)
if (!table) if (!table)
return NULL; return NULL;
/* zero init so skip the trap state (state == 0) */ for (state = 0; state < state_count; state++) {
for (state = 1; state < state_count; state++) {
table[state * 2] = compute_fperms_user(dfa, state); table[state * 2] = compute_fperms_user(dfa, state);
table[state * 2 + 1] = compute_fperms_other(dfa, state); table[state * 2 + 1] = compute_fperms_other(dfa, state);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment