diff options
| author | John Johansen <john.johansen@canonical.com> | 2017-01-16 09:42:39 +0100 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2017-01-16 10:18:32 +0100 |
| commit | 474d6b75106229025ab6b7bbabf2f9c246e928e1 (patch) | |
| tree | 9f2b5a9d15a299476e0dd8408db44e01fa30e180 /security/apparmor/policy_unpack.c | |
| parent | apparmor: add support for force complain flag to support learning mode (diff) | |
| download | linux-474d6b75106229025ab6b7bbabf2f9c246e928e1.tar.xz linux-474d6b75106229025ab6b7bbabf2f9c246e928e1.zip | |
apparmor: prepare to support newer versions of policy
Newer policy encodes more than just version in the version tag,
so add masking to make sure the comparison remains correct.
Note: this is fully compatible with older policy as it will never set
the bits being masked out.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor/policy_unpack.c')
| -rw-r--r-- | security/apparmor/policy_unpack.c | 25 |
1 files changed, 17 insertions, 8 deletions
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c index c836a9c8b6ff..6ac292fec55f 100644 --- a/security/apparmor/policy_unpack.c +++ b/security/apparmor/policy_unpack.c @@ -29,7 +29,14 @@ #include "include/policy.h" #include "include/policy_unpack.h" +#define K_ABI_MASK 0x3ff #define FORCE_COMPLAIN_FLAG 0x800 +#define VERSION_LT(X, Y) (((X) & K_ABI_MASK) < ((Y) & K_ABI_MASK)) +#define VERSION_GT(X, Y) (((X) & K_ABI_MASK) > ((Y) & K_ABI_MASK)) + +#define v5 5 /* base version */ +#define v6 6 /* per entry policydb mediation check */ +#define v7 7 /* full network masking */ /* * The AppArmor interface treats data as a type byte followed by the @@ -646,19 +653,21 @@ static int verify_header(struct aa_ext *e, int required, const char **ns) /* get the interface version */ if (!unpack_u32(e, &e->version, "version")) { if (required) { - audit_iface(NULL, NULL, "invalid profile format", e, - error); - return error; - } - - /* check that the interface version is currently supported */ - if (e->version != 5) { - audit_iface(NULL, NULL, "unsupported interface version", + audit_iface(NULL, NULL, "invalid profile format", e, error); return error; } } + /* Check that the interface version is currently supported. + * if not specified use previous version + * Mask off everything that is not kernel abi version + */ + if (VERSION_LT(e->version, v5) && VERSION_GT(e->version, v7)) { + audit_iface(NULL, NULL, "unsupported interface version", + e, error); + return error; + } /* read the namespace if present */ if (unpack_str(e, &name, "namespace")) { |