[PATCH 1/2] apparmor: rename the data start flag inside verify_header
Fedor Pchelkin
pchelkin at ispras.ru
Sat Jan 13 12:15:51 UTC 2024
The current `required` flag indicates the packed data start thus requiring
the header to be unpacked at this position.
For the purposes of verify_header() refinement, rename that flag to
`start` so that it can be used with this meaning in other part of the
function.
Found by Linux Verification Center (linuxtesting.org).
Signed-off-by: Fedor Pchelkin <pchelkin at ispras.ru>
---
security/apparmor/policy_unpack.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index a91b30100b77..54f7b4346506 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -1111,12 +1111,12 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
/**
* verify_header - unpack serialized stream header
* @e: serialized data read head (NOT NULL)
- * @required: whether the header is required or optional
+ * @start: whether the header is located at the start of data
* @ns: Returns - namespace if one is specified else NULL (NOT NULL)
*
* Returns: error or 0 if header is good
*/
-static int verify_header(struct aa_ext *e, int required, const char **ns)
+static int verify_header(struct aa_ext *e, int start, const char **ns)
{
int error = -EPROTONOSUPPORT;
const char *name = NULL;
@@ -1124,7 +1124,8 @@ static int verify_header(struct aa_ext *e, int required, const char **ns)
/* get the interface version */
if (!aa_unpack_u32(e, &e->version, "version")) {
- if (required) {
+ /* the header is required at the start of data */
+ if (start) {
audit_iface(NULL, NULL, NULL, "invalid profile format",
e, error);
return error;
--
2.43.0
More information about the Linux-security-module-archive
mailing list