[PATCH] apparmor: handle diff-encoded states in leftmatch_fb()

[sashiko-bot at kernel.org]

> leftmatch_fb(), used by aa_dfa_leftmatch() and therefore by find_attach()
> to match profile attachments, open-codes the DFA transition and treats the
> default transition as final:
> 
> 	if (check[pos] == state)
> 		state = next[pos];
> 	else
> 		state = def[state];
> 
> For a state flagged MATCH_FLAG_DIFF_ENCODE the default state must instead
> be tried again with the same input character, which is what match_char()
> does for every other matcher. apparmor_parser emits differentially encoded
> DFAs by default when the kernel advertises policy/diff_encode, so larger
> attachment patterns end in a non-accepting state and the exec silently
> stays unconfined. No conflict is detected, so nothing is audited.
> [ ... ]
> Fixes: 21f606610502 ("apparmor: improve overlapping domain attachment resolution")
> Cc: stable at vger.kernel.org
> Link: https://gitlab.com/apparmor/apparmor-kernel/-/issues/8
> Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2172229
> Signed-off-by: Patrick Grössing <invarianztheorem at posteo.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261026133600.11252-1-invarianztheorem@posteo.com?part=1