From a4c3f89c9b5a9fab5a8e4ea05399acd6e23072df Mon Sep 17 00:00:00 2001 From: John Johansen Date: Mon, 4 Jun 2018 19:44:59 -0700 Subject: [PATCH] apparmor: fixup secid map conversion to using IDR The IDR conversion did not handle an error case for when allocating a mapping fails, and it did not ensure that mappings did not allocate or use a 0 value, which is used as an invalid secid. Which is used when a mapping fails. Fixes: 3ae7eb49a2be ("apparmor: Use an IDR to allocate apparmor secids") Signed-off-by: John Johansen --- security/apparmor/include/secid.h | 4 +++- security/apparmor/label.c | 3 +-- security/apparmor/lsm.c | 2 ++ security/apparmor/secid.c | 28 +++++++++++++++++++++++----- 4 files changed, 29 insertions(+), 8 deletions(-) diff --git a/security/apparmor/include/secid.h b/security/apparmor/include/secid.h index 686de8e50a79..dee6fa3b6081 100644 --- a/security/apparmor/include/secid.h +++ b/security/apparmor/include/secid.h @@ -28,8 +28,10 @@ int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid); void apparmor_release_secctx(char *secdata, u32 seclen); -u32 aa_alloc_secid(struct aa_label *label, gfp_t gfp); +int aa_alloc_secid(struct aa_label *label, gfp_t gfp); void aa_free_secid(u32 secid); void aa_secid_update(u32 secid, struct aa_label *label); +void aa_secids_init(void); + #endif /* __AA_SECID_H */ diff --git a/security/apparmor/label.c b/security/apparmor/label.c index a17574df611b..ba11bdf9043a 100644 --- a/security/apparmor/label.c +++ b/security/apparmor/label.c @@ -407,8 +407,7 @@ bool aa_label_init(struct aa_label *label, int size, gfp_t gfp) AA_BUG(!label); AA_BUG(size < 1); - label->secid = aa_alloc_secid(label, gfp); - if (label->secid == AA_SECID_INVALID) + if (aa_alloc_secid(label, gfp) < 0) return false; label->size = size; /* doesn't include null */ diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index 10bf36aa477d..e35d12883990 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -1547,6 +1547,8 @@ static int __init apparmor_init(void) return 0; } + aa_secids_init(); + error = aa_setup_dfa_engine(); if (error) { AA_ERROR("Unable to setup dfa engine\n"); diff --git a/security/apparmor/secid.c b/security/apparmor/secid.c index 3ad94b2ffbb2..f2f22d00db18 100644 --- a/security/apparmor/secid.c +++ b/security/apparmor/secid.c @@ -33,6 +33,8 @@ * properly updating/freeing them */ +#define AA_FIRST_SECID 1 + static DEFINE_IDR(aa_secids); static DEFINE_SPINLOCK(secid_lock); @@ -120,20 +122,31 @@ void apparmor_release_secctx(char *secdata, u32 seclen) /** * aa_alloc_secid - allocate a new secid for a profile + * @label: the label to allocate a secid for + * @gfp: memory allocation flags + * + * Returns: 0 with @label->secid initialized + * <0 returns error with @label->secid set to AA_SECID_INVALID */ -u32 aa_alloc_secid(struct aa_label *label, gfp_t gfp) +int aa_alloc_secid(struct aa_label *label, gfp_t gfp) { unsigned long flags; - u32 secid; + int ret; idr_preload(gfp); spin_lock_irqsave(&secid_lock, flags); - secid = idr_alloc(&aa_secids, label, 0, 0, GFP_ATOMIC); - /* XXX: Can return -ENOMEM */ + ret = idr_alloc(&aa_secids, label, AA_FIRST_SECID, 0, GFP_ATOMIC); spin_unlock_irqrestore(&secid_lock, flags); idr_preload_end(); - return secid; + if (ret < 0) { + label->secid = AA_SECID_INVALID; + return ret; + } + + AA_BUG(ret == AA_SECID_INVALID); + label->secid = ret; + return 0; } /** @@ -148,3 +161,8 @@ void aa_free_secid(u32 secid) idr_remove(&aa_secids, secid); spin_unlock_irqrestore(&secid_lock, flags); } + +void aa_secids_init(void) +{ + idr_init_base(&aa_secids, AA_FIRST_SECID); +}