kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/security
History
John Johansen d05549029e apparmor: remove no-op permission check in policy_unpack 
commit c037bd6158 upstream.

The patch 736ec752d9: "AppArmor: policy routines for loading and
unpacking policy" from Jul 29, 2010, leads to the following static
checker warning:

    security/apparmor/policy_unpack.c:410 verify_accept()
    warn: bitwise AND condition is false here

    security/apparmor/policy_unpack.c:413 verify_accept()
    warn: bitwise AND condition is false here

security/apparmor/policy_unpack.c
   392  #define DFA_VALID_PERM_MASK             0xffffffff
   393  #define DFA_VALID_PERM2_MASK            0xffffffff
   394
   395  /**
   396   * verify_accept - verify the accept tables of a dfa
   397   * @dfa: dfa to verify accept tables of (NOT NULL)
   398   * @flags: flags governing dfa
   399   *
   400   * Returns: 1 if valid accept tables else 0 if error
   401   */
   402  static bool verify_accept(struct aa_dfa *dfa, int flags)
   403  {
   404          int i;
   405
   406          /* verify accept permissions */
   407          for (i = 0; i < dfa->tables[YYTD_ID_ACCEPT]->td_lolen; i++) {
   408                  int mode = ACCEPT_TABLE(dfa)[i];
   409
   410                  if (mode & ~DFA_VALID_PERM_MASK)
   411                          return 0;
   412
   413                  if (ACCEPT_TABLE2(dfa)[i] & ~DFA_VALID_PERM2_MASK)
   414                          return 0;

fixes: 736ec752d9 ("AppArmor: policy routines for loading and unpacking policy")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-12-16 22:08:51 +00:00
..
apparmor apparmor: remove no-op permission check in policy_unpack 2018-12-16 22:08:51 +00:00
integrity ima: relax requiring a file signature for new files with zero length 2018-06-16 22:21:43 +01:00
keys KEYS: add missing permission check for request_key() destination 2018-01-01 20:52:12 +00:00
selinux selinux: KASAN: slab-out-of-bounds in xattr_getsecurity 2018-10-21 08:46:21 +01:00
smack security: let security modules use PTRACE_MODE_* with bitmasks 2018-01-01 20:52:10 +00:00
tomoyo get rid of pointless checks for NULL ->i_op 2014-04-01 23:19:16 -04:00
yama security: let security modules use PTRACE_MODE_* with bitmasks 2018-01-01 20:52:10 +00:00
capability.c Merge tag 'keys-20140314' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs into next 2014-04-14 11:42:49 +10:00
commoncap.c ptrace: use fsuid, fsgid, effective creds for fs access checks 2017-09-15 18:30:17 +01:00
device_cgroup.c device_cgroup: use css_has_online_children() instead of has_children() 2014-05-16 13:22:52 -04:00
inode.c sysfs: Create mountpoints with sysfs_create_mount_point 2015-08-20 18:24:03 +01:00
Kconfig KPTI: Rename to PAGE_TABLE_ISOLATION 2018-01-09 00:35:20 +00:00
lsm_audit.c audit: anchor all pid references in the initial pid namespace 2014-03-20 10:11:55 -04:00
Makefile security: cleanup Makefiles to use standard syntax for specifying sub-directories 2014-02-17 11:08:04 +11:00
min_addr.c mmap_min_addr check CAP_SYS_RAWIO only for write 2010-04-23 08:56:31 +10:00
security.c vfs: Commit to never having exectuables on proc and sysfs. 2017-04-04 22:21:56 +01:00