apparmor: fix overlapping attachment computation

commit c5f52baadd793f52a85a15212000ee239222d7aa upstream.

When finding the profile via patterned attachments, the longest left
match is being set to the static compile time value and not using the
runtime computed value.

Fix this by setting the candidate value to the greater of the
precomputed value or runtime computed value.

Fixes: 5569639da4a1 ("apparmor: improve overlapping domain attachment resolution")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 1a33f490e6670721af707f178d89fd95ea7932d7..2f61b4cc2fc0ddc80ea1d2971b3339fd3e0021a7 100644 (file)
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -460,7 +460,7 @@ restart:
                                 * xattrs, or a longer match
                                 */
                                candidate = profile;
-                               candidate_len = profile->xmatch_len;
+                               candidate_len = max(count, profile->xmatch_len);
                                candidate_xattrs = ret;
                                conflict = false;
                        }

diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
index b5b4b8190e654ef77c88d0e752944c08595061db..b5aa4231af682a5412b4641c72ef21d49f769f6c 100644 (file)
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -135,7 +135,7 @@ struct aa_profile {
 
        const char *attach;
        struct aa_dfa *xmatch;
-       int xmatch_len;
+       unsigned int xmatch_len;
        enum audit_mode audit;
        long mode;
        u32 path_flags;