tmakin/tegra-linux-noble
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

UBUNTU: SAUCE: apparmor4.0.0 [74/90]: apparmor: cleanup attachment perm lookup to use lookup_perms()

Browse Source 
BugLink: http://bugs.launchpad.net/bugs/2028253

Another step towards unifying the permission lookups, and reducing
code duplication.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 99c19bcc8b4264843406c9d25beb4a47943c9c58
https://git.launchpad.net/~apparmor-dev/ubuntu-kernel-next)
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
This commit is contained in:
John Johansen
2022-11-16 22:17:09 -08:00
committed by Paolo Pisati
parent ed083e888d
commit 0cebc3cce5
1 changed files with 6 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/apparmor/domain.c
+6 -8
View File
@@ -324,7 +324,7 @@ static int aa_xattrs_match(const struct linux_binprm *bprm,
size = vfs_getxattr_alloc(&nop_mnt_idmap, d, attach->xattrs[i],
&value, value_size, GFP_KERNEL);
if (size >= 0) {
u32 index, perm;
struct aa_perms *perms;
/*
* Check the xattr presence before value. This ensure
@@ -336,9 +336,8 @@ static int aa_xattrs_match(const struct linux_binprm *bprm,
/* Check xattr value */
state = aa_dfa_match_len(attach->xmatch->dfa, state,
value, size);
index = ACCEPT_TABLE(attach->xmatch->dfa)[state];
perm = attach->xmatch->perms[index].allow;
if (!(perm & MAY_EXEC)) {
perms = aa_lookup_perms(attach->xmatch, state);
if (!(perms->allow & MAY_EXEC)) {
ret = -EINVAL;
goto out;
}
@@ -416,15 +415,14 @@ restart:
if (attach->xmatch->dfa) {
unsigned int count;
aa_state_t state;
u32 index, perm;
struct aa_perms *perms;
state = aa_dfa_leftmatch(attach->xmatch->dfa,
attach->xmatch->start[AA_CLASS_XMATCH],
name, &count);
index = ACCEPT_TABLE(attach->xmatch->dfa)[state];
perm = attach->xmatch->perms[index].allow;
perms = aa_lookup_perms(attach->xmatch, state);
/* any accepting state means a valid match. */
if (perm & MAY_EXEC) {
if (perms->allow & MAY_EXEC) {
int ret = 0;
if (count < candidate_len)