apparmor: differentiate between error and unconfined profiles

profile_status function was not making any difference between error
cases and unconfined profiles. The problem with this approach is that
dominfo was throwing an error on unconfined domains.

(cherry picked from commit a1bdf04b27f8f28b6e96ecd10de2a8e78d80271f)

diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c
index 16b8f879d095899493e4f80dafd87c8215d47eb3..2cf333defc46ee40e867c88b6383d3a2f9d79bdd 100644 (file)
--- a/src/security/security_apparmor.c
+++ b/src/security/security_apparmor.c
@@ -66,10 +66,11 @@ struct SDPDOP {
 };
 
 /*
- * profile_status returns '-1' on error, '0' if loaded
+ * profile_status returns '-2' on error, '-1' if not loaded, '0' if loaded
  *
- * If check_enforcing is set to '1', then returns '-1' on error, '0' if
- * loaded in complain mode, and '1' if loaded in enforcing mode.
+ * If check_enforcing is set to '1', then returns '-2' on error, '-1' if
+ * not loaded, '0' if loaded in complain mode, and '1' if loaded in
+ * enforcing mode.
  */
 static int
 profile_status(const char *str, const int check_enforcing)
@@ -77,7 +78,7 @@ profile_status(const char *str, const int check_enforcing)
     char *content = NULL;
     char *tmp = NULL;
     char *etmp = NULL;
-    int rc = -1;
+    int rc = -2;
 
     /* create string that is '<str> \0' for accurate matching */
     if (virAsprintf(&tmp, "%s ", str) == -1)
@@ -100,6 +101,8 @@ profile_status(const char *str, const int check_enforcing)
 
     if (strstr(content, tmp) != NULL)
         rc = 0;
+    else
+        rc = -1; /* return -1 if not loaded */
     if (check_enforcing != 0) {
         if (rc == 0 && strstr(content, etmp) != NULL)
             rc = 1;                 /* return '1' if loaded and enforcing */
@@ -262,6 +265,9 @@ use_apparmor(void)
         goto cleanup;
 
     rc = profile_status(libvirt_daemon, 1);
+    /* Error or unconfined should all result in -1*/
+    if (rc < 0)
+        rc = -1;
 
  cleanup:
     VIR_FREE(libvirt_daemon);
@@ -517,23 +523,29 @@ AppArmorGetSecurityProcessLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
                                 virSecurityLabelPtr sec)
 {
     int rc = -1;
+    int status;
     char *profile_name = NULL;
 
     if ((profile_name = get_profile_name(def)) == NULL)
         return rc;
 
-    if (virStrcpy(sec->label, profile_name,
-        VIR_SECURITY_LABEL_BUFLEN) == NULL) {
+    status = profile_status(profile_name, 1);
+    if (status < -1) {
         virReportError(VIR_ERR_INTERNAL_ERROR,
-                       "%s", _("error copying profile name"));
+                       "%s", _("error getting profile status"));
         goto cleanup;
+    } else if (status == -1) {
+        profile_name[0] = '\0';
     }
 
-    if ((sec->enforcing = profile_status(profile_name, 1)) < 0) {
+    if (virStrcpy(sec->label, profile_name,
+        VIR_SECURITY_LABEL_BUFLEN) == NULL) {
         virReportError(VIR_ERR_INTERNAL_ERROR,
-                       "%s", _("error calling profile_status()"));
+                       "%s", _("error copying profile name"));
         goto cleanup;
     }
+
+    sec->enforcing = status == 1;
     rc = 0;
 
  cleanup: