← Back to branch summary

~ubuntu-branches/ubuntu/oneiric/apparmor/oneiric-security

« back to all changes in this revision

Viewing changes to kernel-patches/2.6.36.2/0003-AppArmor-Allow-dfa-backward-compatibility-with-broke.patch

  • Committer: Bazaar Package Importer
  • Author(s): Kees Cook
  • Date: 2011-04-27 10:38:07 UTC
  • mfrom: (5.1.118 natty)
  • Revision ID: james.westby@ubuntu.com-20110427103807-ym3rhwys6o84ith0
Tags: 2.6.1-2
debian/copyright: clarify for some full organization names.

Show diffs side-by-side

added added

removed removed

Lines of Context:
kernel-patches/2.6.36.2/0003-AppArmor-Allow-dfa-backward-compatibility-with-broke.patch
 
1
From 484d99eaaa89c3bfd707128b4c508d4a70a18eea Mon Sep 17 00:00:00 2001
 
2
From: John Johansen <john.johansen@canonical.com>
 
3
Date: Tue, 20 Jul 2010 06:57:08 -0700
 
4
Subject: [PATCH 3/3] AppArmor: Allow dfa backward compatibility with broken userspace
 
5
 
 
6
The apparmor_parser when compiling policy could generate invalid dfas
 
7
that did not have sufficient padding to avoid invalid references, when
 
8
used by the kernel.  The kernels check to verify the next/check table
 
9
size was broken meaning invalid dfas were being created by userspace
 
10
and not caught.
 
11
 
 
12
To remain compatible with old tools that are not fixed, pad the loaded
 
13
dfas next/check table.  The dfa's themselves are valid except for the
 
14
high padding for potentially invalid transitions (high bounds error),
 
15
which have a maximimum is 256 entries.  So just allocate an extra null filled
 
16
256 entries for the next/check tables.  This will guarentee all bounds
 
17
are good and invalid transitions go to the null (0) state.
 
18
 
 
19
Signed-off-by: John Johansen <john.johansen@canonical.com>
 
20
---
 
21
 security/apparmor/match.c |   17 +++++++++++++++++
 
22
 1 files changed, 17 insertions(+), 0 deletions(-)
 
23
 
 
24
diff --git a/security/apparmor/match.c b/security/apparmor/match.c
 
25
index 5cb4dc1..0248bb3 100644
 
26
--- a/security/apparmor/match.c
 
27
+++ b/security/apparmor/match.c
 
28
@@ -57,8 +57,17 @@ static struct table_header *unpack_table(char *blob, size_t bsize)
 
29
        if (bsize < tsize)
 
30
                goto out;
 
31
 
 
32
+       /* Pad table allocation for next/check by 256 entries to remain
 
33
+        * backwards compatible with old (buggy) tools and remain safe without
 
34
+        * run time checks
 
35
+        */
 
36
+       if (th.td_id == YYTD_ID_NXT || th.td_id == YYTD_ID_CHK)
 
37
+               tsize += 256 * th.td_flags;
 
38
+
 
39
        table = kvmalloc(tsize);
 
40
        if (table) {
 
41
+               /* ensure the pad is clear, else there will be errors */
 
42
+               memset(table, 0, tsize);
 
43
                *table = th;
 
44
                if (th.td_flags == YYTD_DATA8)
 
45
                        UNPACK_ARRAY(table->td_data, blob, th.td_lolen,
 
46
@@ -134,11 +143,19 @@ static int verify_dfa(struct aa_dfa *dfa, int flags)
 
47
                goto out;
 
48
 
 
49
        if (flags & DFA_FLAG_VERIFY_STATES) {
 
50
+               int warning = 0;
 
51
                for (i = 0; i < state_count; i++) {
 
52
                        if (DEFAULT_TABLE(dfa)[i] >= state_count)
 
53
                                goto out;
 
54
                        /* TODO: do check that DEF state recursion terminates */
 
55
                        if (BASE_TABLE(dfa)[i] + 255 >= trans_count) {
 
56
+                               if (warning)
 
57
+                                       continue;
 
58
+                               printk(KERN_WARNING "AppArmor DFA next/check "
 
59
+                                      "upper bounds error fixed, upgrade "
 
60
+                                      "user space tools \n");
 
61
+                               warning = 1;
 
62
+                       } else if (BASE_TABLE(dfa)[i] >= trans_count) {
 
63
                                printk(KERN_ERR "AppArmor DFA next/check upper "
 
64
                                       "bounds error\n");
 
65
                                goto out;
 
66
-- 
 
67
1.7.1
 
68