diff options
| author | John Johansen <john.johansen@canonical.com> | 2010-09-17 09:02:35 -0700 |
|---|---|---|
| committer | Leann Ogasawara <leann.ogasawara@canonical.com> | 2010-09-17 13:39:27 -0700 |
| commit | cd7e6fb6f5d289ef1fdc4a5a0e41092a9e60cd92 (patch) | |
| tree | 51e33315dfca179fc6ac77af2cd2d065b4dc5dff | |
| parent | 0d0849abb4174f189c6b937c2c9d3c9c034870d2 (diff) | |
UBUNTU: SAUCE: AppArmor: allow newer tools to load policy on older kernels
BugLink: http://bugs.launchpad.net/bugs/639758
Remove an unnecessary restriction from the AppArmor network capability patch
When a newer version of the tools is used with an older kernel, it may build
in extra rules for newer networking protocols that the older kernel does
not know about.
The older kernel can safely discard the extra rules as it should never
create sockets using the newer protocols, and the LSM hooks will
never pass requests matching these rules.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Leann Ogasawara <leann.ogasawara@canonical.com>
| -rw-r--r-- | security/apparmor/policy_unpack.c | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c index 6b0637b7dc6..9c51b031ffa 100644 --- a/security/apparmor/policy_unpack.c +++ b/security/apparmor/policy_unpack.c @@ -575,10 +575,18 @@ static struct aa_profile *unpack_profile(struct aa_ext *e) size = unpack_array(e, "net_allowed_af"); if (size) { - if (size > AF_MAX) - goto fail; - for (i = 0; i < size; i++) { + /* discard extraneous rules that this kernel will + * never request + */ + if (size > AF_MAX) { + u16 tmp; + if (!unpack_u16(e, &tmp, NULL) || + !unpack_u16(e, &tmp, NULL) || + !unpack_u16(e, &tmp, NULL)) + goto fail; + continue; + } if (!unpack_u16(e, &profile->net.allow[i], NULL)) goto fail; if (!unpack_u16(e, &profile->net.audit[i], NULL)) |