Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

apparmor: ensure labels with more than one entry have correct flags 

labels containing more than one entry need to accumulate flag info
from profiles that the label is constructed from. This is done
correctly for labels created by a merge but is not being done for
labels created by an update or directly created via a parse.

This technically is a bug fix, however the effect in current code is
to cause early unconfined bail out to not happen (ie. without the fix
it is slower) on labels that were created via update or a parse.

Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen 2024-01-19 00:12:16 -08:00
parent 0bc8c6862f
commit cd769b05cc
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
security/apparmor/label.c
View File

@ -645,6 +645,7 @@ static bool __label_replace(struct aa_label *old, struct aa_label *new)
rb_replace_node(&old->node, &new->node, &ls->root); rb_replace_node(&old->node, &new->node, &ls->root);
old->flags &= ~FLAG_IN_TREE; old->flags &= ~FLAG_IN_TREE;
new->flags |= FLAG_IN_TREE; new->flags |= FLAG_IN_TREE;
new->flags |= accum_vec_flags(new->vec, new->size);
return true; return true;
} }
@ -705,6 +706,7 @@ static struct aa_label *__label_insert(struct aa_labelset *ls,
rb_link_node(&label->node, parent, new); rb_link_node(&label->node, parent, new);
rb_insert_color(&label->node, &ls->root); rb_insert_color(&label->node, &ls->root);
label->flags |= FLAG_IN_TREE; label->flags |= FLAG_IN_TREE;
label->flags |= accum_vec_flags(label->vec, label->size);
return aa_get_label(label); return aa_get_label(label);
} }
@ -1085,7 +1087,6 @@ static struct aa_label *label_merge_insert(struct aa_label *new,
else if (k == b->size) else if (k == b->size)
return aa_get_label(b); return aa_get_label(b);
} }
new->flags |= accum_vec_flags(new->vec, new->size);
ls = labels_set(new); ls = labels_set(new);
write_lock_irqsave(&ls->lock, flags); write_lock_irqsave(&ls->lock, flags);
label = __label_insert(labels_set(new), new, false); label = __label_insert(labels_set(new), new, false);