diff mbox series

[SRU,N,1/2] UBUNTU: SAUCE: apparmor4.0.0 [94/99]: apparmor: allocate xmatch for nullpdf inside aa_alloc_null

Message ID 20241101110514.523356-2-ryan.lee@canonical.com
State New
Headers show
Series Backport some AppArmor complain-mode profile bugfixes from Oracular to Noble | expand

Commit Message

Ryan Lee Nov. 1, 2024, 11:05 a.m. UTC 
BugLink: https://bugs.launchpad.net/bugs/2086210

attach->xmatch was not set when allocating a null profile, which is used in
complain mode to allocate a learning profile. This was causing downstream
failures in find_attach, which expected a valid xmatch but did not find
one under a certain sequence of profile transitions in complain mode.

This patch ensures the xmatch is set up properly for null profiles.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Timo Aaltonen <timo.aaltonen@canonical.com>
(cherry picked from commit 2de989ae726b14b6236fdb848563d607e12287b8)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
---
 security/apparmor/policy.c | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index f503dcd3ac74..638b0d6753ef 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -659,6 +659,7 @@  struct aa_profile *aa_alloc_null(struct aa_profile *parent, const char *name,
 
 	/* TODO: ideally we should inherit abi from parent */
 	profile->label.flags |= FLAG_NULL;
+	profile->attach.xmatch = aa_get_pdb(nullpdb);
 	rules = list_first_entry(&profile->rules, typeof(*rules), list);
 	rules->file = aa_get_pdb(nullpdb);
 	rules->policy = aa_get_pdb(nullpdb);