apparmor: fix blob compression when ns is forced on a policy load

When blob compression is turned on, if the policy namespace is forced
onto a policy load, the policy load will fail as the namespace name
being referenced is inside the compressed policy blob, resulting in
invalid or names that are too long. So duplicate the name before the
blob is compressed.

Fixes: 876dd866c084 ("apparmor: Initial implementation of raw policy blob compression")
Signed-off-by: John Johansen <john.johansen@canonical.com>

diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index df9c5890a87891dc1707fc51171148d01d952ea5..71a3e6291478b161d8fa21ee7bc09d41c8f58f2a 100644 (file)
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -861,7 +861,7 @@ static struct aa_profile *update_to_newest_parent(struct aa_profile *new)
 ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
                            u32 mask, struct aa_loaddata *udata)
 {
-       const char *ns_name, *info = NULL;
+       const char *ns_name = NULL, *info = NULL;
        struct aa_ns *ns = NULL;
        struct aa_load_ent *ent, *tmp;
        struct aa_loaddata *rawdata_ent;
@@ -1048,6 +1048,7 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
 out:
        aa_put_ns(ns);
        aa_put_loaddata(udata);
+       kfree(ns_name);
 
        if (error)
                return error;

diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index c421801409e331ff10947a11f2494510cb9d9a55..20f07f62959884dc832c0fcf149dfeb28634bc57 100644 (file)
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -944,11 +944,14 @@ static int verify_header(struct aa_ext *e, int required, const char **ns)
                                    e, error);
                        return error;
                }
-               if (*ns && strcmp(*ns, name))
+               if (*ns && strcmp(*ns, name)) {
                        audit_iface(NULL, NULL, NULL, "invalid ns change", e,
                                    error);
-               else if (!*ns)
-                       *ns = name;
+               } else if (!*ns) {
+                       *ns = kstrdup(name, GFP_KERNEL);
+                       if (!*ns)
+                               return -ENOMEM;
+               }
        }
 
        return 0;