Commit 70806ee1 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'apparmor-pr-2023-07-06' of... 

Merge tag 'apparmor-pr-2023-07-06' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor

Pull apparmor updates from John Johansen:

 - fix missing error check for rhashtable_insert_fast

 - add missing failure check in compute_xmatch_perms

 - fix policy_compat permission remap with extended permissions

 - fix profile verification and enable it

 - fix kzalloc perms tables for shared dfas

 - Fix kernel-doc header for verify_dfa_accept_index

 - aa_buffer: Convert 1-element array to flexible array

 - Return directly after a failed kzalloc() in two functions

 - fix use of strcpy in policy_unpack_test

 - fix kernel-doc complaints

 - Fix some kernel-doc comments

* tag 'apparmor-pr-2023-07-06' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor:
  apparmor: Fix kernel-doc header for verify_dfa_accept_index
  apparmor: fix: kzalloc perms tables for shared dfas
  apparmor: fix profile verification and enable it
  apparmor: fix policy_compat permission remap with extended permissions
  apparmor: aa_buffer: Convert 1-element array to flexible array
  apparmor: add missing failure check in compute_xmatch_perms
  apparmor: fix missing error check for rhashtable_insert_fast
  apparmor: Return directly after a failed kzalloc() in two functions
  AppArmor: Fix some kernel-doc comments
  apparmor: fix use of strcpy in policy_unpack_test
  apparmor: fix kernel-doc complaints
parents 5133c9e5 3f069c4c

security/apparmor/crypto.c

+5 −5
Original line number Diff line number Diff line
@@ -28,15 +28,15 @@ unsigned int aa_hash_size(void) 
char *aa_calc_hash(void *data, size_t len)

{

	SHASH_DESC_ON_STACK(desc, apparmor_tfm);

	char *hash = NULL;

	int error = -ENOMEM;

	char *hash;

	int error;



	if (!apparmor_tfm)

		return NULL;



	hash = kzalloc(apparmor_hash_size, GFP_KERNEL);

	if (!hash)

		goto fail;

		return ERR_PTR(-ENOMEM);



	desc->tfm = apparmor_tfm;
@@ -62,7 +62,7 @@ int aa_calc_profile_hash(struct aa_profile *profile, u32 version, void *start, 
			 size_t len)

{

	SHASH_DESC_ON_STACK(desc, apparmor_tfm);

	int error = -ENOMEM;

	int error;

	__le32 le32_version = cpu_to_le32(version);



	if (!aa_g_hash_policy)
@@ -73,7 +73,7 @@ int aa_calc_profile_hash(struct aa_profile *profile, u32 version, void *start, 


	profile->hash = kzalloc(apparmor_hash_size, GFP_KERNEL);

	if (!profile->hash)

		goto fail;

		return -ENOMEM;



	desc->tfm = apparmor_tfm;

security/apparmor/file.c

+1 −1
Original line number Diff line number Diff line
@@ -161,6 +161,7 @@ static int path_name(const char *op, struct aa_label *label, 
	return 0;

}



struct aa_perms default_perms = {};

/**

 * aa_lookup_fperms - convert dfa compressed perms to internal perms

 * @dfa: dfa to lookup perms for   (NOT NULL)
@@ -171,7 +172,6 @@ static int path_name(const char *op, struct aa_label *label, 
 *

 * Returns: a pointer to a file permission set

 */

struct aa_perms default_perms = {};

struct aa_perms *aa_lookup_fperms(struct aa_policydb *file_rules,

				 aa_state_t state, struct path_cond *cond)

{

security/apparmor/lsm.c

+4 −4
Original line number Diff line number Diff line
@@ -46,7 +46,7 @@ int apparmor_initialized; 


union aa_buffer {

	struct list_head list;

	char buffer[1];

	DECLARE_FLEX_ARRAY(char, buffer);

};



#define RESERVE_COUNT 2
@@ -1647,7 +1647,7 @@ char *aa_get_buffer(bool in_atomic) 
		list_del(&aa_buf->list);

		buffer_count--;

		spin_unlock(&aa_buffers_lock);

		return &aa_buf->buffer[0];

		return aa_buf->buffer;

	}

	if (in_atomic) {

		/*
@@ -1670,7 +1670,7 @@ char *aa_get_buffer(bool in_atomic) 
		pr_warn_once("AppArmor: Failed to allocate a memory buffer.\n");

		return NULL;

	}

	return &aa_buf->buffer[0];

	return aa_buf->buffer;

}



void aa_put_buffer(char *buf)
@@ -1747,7 +1747,7 @@ static int __init alloc_buffers(void) 
			destroy_buffers();

			return -ENOMEM;

		}

		aa_put_buffer(&aa_buf->buffer[0]);

		aa_put_buffer(aa_buf->buffer);

	}

	return 0;

}

security/apparmor/policy.c

+15 −5
Original line number Diff line number Diff line
@@ -430,11 +430,9 @@ static struct aa_policy *__lookup_parent(struct aa_ns *ns, 
 * @hname: hierarchical profile name to find parent of (NOT NULL)

 * @gfp: type of allocation.

 *

 * Returns: NULL on error, parent profile on success

 *

 * Requires: ns mutex lock held

 *

 * Returns: unrefcounted parent policy or NULL if error creating

 * Return: unrefcounted parent policy on success or %NULL if error creating

 *          place holder profiles.

 */

static struct aa_policy *__create_missing_ancestors(struct aa_ns *ns,
@@ -591,7 +589,15 @@ struct aa_profile *aa_alloc_null(struct aa_profile *parent, const char *name, 
	profile->label.flags |= FLAG_NULL;

	rules = list_first_entry(&profile->rules, typeof(*rules), list);

	rules->file.dfa = aa_get_dfa(nulldfa);

	rules->file.perms = kcalloc(2, sizeof(struct aa_perms), GFP_KERNEL);

	if (!rules->file.perms)

		goto fail;

	rules->file.size = 2;

	rules->policy.dfa = aa_get_dfa(nulldfa);

	rules->policy.perms = kcalloc(2, sizeof(struct aa_perms), GFP_KERNEL);

	if (!rules->policy.perms)

		goto fail;

	rules->policy.size = 2;



	if (parent) {

		profile->path_flags = parent->path_flags;
@@ -602,6 +608,11 @@ struct aa_profile *aa_alloc_null(struct aa_profile *parent, const char *name, 
	}



	return profile;



fail:

	aa_free_profile(profile);



	return NULL;

}



/**
@@ -828,7 +839,7 @@ bool aa_current_policy_admin_capable(struct aa_ns *ns) 
/**

 * aa_may_manage_policy - can the current task manage policy

 * @label: label to check if it can manage policy

 * @op: the policy manipulation operation being done

 * @mask: contains the policy manipulation operation being done

 *

 * Returns: 0 if the task is allowed to manipulate policy else error

 */
@@ -883,7 +894,6 @@ static struct aa_profile *__list_lookup_parent(struct list_head *lh, 
 * __replace_profile - replace @old with @new on a list

 * @old: profile to be replaced  (NOT NULL)

 * @new: profile to replace @old with  (NOT NULL)

 * @share_proxy: transfer @old->proxy to @new

 *

 * Will duplicate and refcount elements that @new inherits from @old

 * and will inherit @old children.

security/apparmor/policy_compat.c

+14 −6
Original line number Diff line number Diff line
@@ -146,7 +146,8 @@ static struct aa_perms compute_fperms_other(struct aa_dfa *dfa, 
 *

 * Returns: remapped perm table

 */

static struct aa_perms *compute_fperms(struct aa_dfa *dfa)

static struct aa_perms *compute_fperms(struct aa_dfa *dfa,

				       u32 *size)

{

	aa_state_t state;

	unsigned int state_count;
@@ -159,6 +160,7 @@ static struct aa_perms *compute_fperms(struct aa_dfa *dfa) 
	table = kvcalloc(state_count * 2, sizeof(struct aa_perms), GFP_KERNEL);

	if (!table)

		return NULL;

	*size = state_count * 2;



	for (state = 0; state < state_count; state++) {

		table[state * 2] = compute_fperms_user(dfa, state);
@@ -168,7 +170,8 @@ static struct aa_perms *compute_fperms(struct aa_dfa *dfa) 
	return table;

}



static struct aa_perms *compute_xmatch_perms(struct aa_dfa *xmatch)

static struct aa_perms *compute_xmatch_perms(struct aa_dfa *xmatch,

				      u32 *size)

{

	struct aa_perms *perms;

	int state;
@@ -179,6 +182,9 @@ static struct aa_perms *compute_xmatch_perms(struct aa_dfa *xmatch) 
	state_count = xmatch->tables[YYTD_ID_BASE]->td_lolen;

	/* DFAs are restricted from having a state_count of less than 2 */

	perms = kvcalloc(state_count, sizeof(struct aa_perms), GFP_KERNEL);

	if (!perms)

		return NULL;

	*size = state_count;



	/* zero init so skip the trap state (state == 0) */

	for (state = 1; state < state_count; state++)
@@ -239,7 +245,8 @@ static struct aa_perms compute_perms_entry(struct aa_dfa *dfa, 
	return perms;

}



static struct aa_perms *compute_perms(struct aa_dfa *dfa, u32 version)

static struct aa_perms *compute_perms(struct aa_dfa *dfa, u32 version,

				      u32 *size)

{

	unsigned int state;

	unsigned int state_count;
@@ -252,6 +259,7 @@ static struct aa_perms *compute_perms(struct aa_dfa *dfa, u32 version) 
	table = kvcalloc(state_count, sizeof(struct aa_perms), GFP_KERNEL);

	if (!table)

		return NULL;

	*size = state_count;



	/* zero init so skip the trap state (state == 0) */

	for (state = 1; state < state_count; state++)
@@ -286,7 +294,7 @@ static void remap_dfa_accept(struct aa_dfa *dfa, unsigned int factor) 
/* TODO: merge different dfa mappings into single map_policy fn */

int aa_compat_map_xmatch(struct aa_policydb *policy)

{

	policy->perms = compute_xmatch_perms(policy->dfa);

	policy->perms = compute_xmatch_perms(policy->dfa, &policy->size);

	if (!policy->perms)

		return -ENOMEM;
@@ -297,7 +305,7 @@ int aa_compat_map_xmatch(struct aa_policydb *policy) 


int aa_compat_map_policy(struct aa_policydb *policy, u32 version)

{

	policy->perms = compute_perms(policy->dfa, version);

	policy->perms = compute_perms(policy->dfa, version, &policy->size);

	if (!policy->perms)

		return -ENOMEM;
@@ -308,7 +316,7 @@ int aa_compat_map_policy(struct aa_policydb *policy, u32 version) 


int aa_compat_map_file(struct aa_policydb *policy)

{

	policy->perms = compute_fperms(policy->dfa);

	policy->perms = compute_fperms(policy->dfa, &policy->size);

	if (!policy->perms)

		return -ENOMEM;