Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1618029 > unrolled thread

[GIT PULL] AppArmor fixes for 4.12

Back to article view | Back to linux.kernel

Contents

  [GIT PULL] AppArmor fixes for 4.12 John Johansen <john.johansen@canonical.com> - 2017-04-06 16:00 +0200
    [PATCH 3/6] apparmor: use SHASH_DESC_ON_STACK John Johansen <john.johansen@canonical.com> - 2017-04-06 16:00 +0200
    [PATCH 1/6] apparmor: fix boolreturn.cocci warnings John Johansen <john.johansen@canonical.com> - 2017-04-06 16:00 +0200
    [PATCH 2/6] security/apparmor/lsm.c: set debug messages John Johansen <john.johansen@canonical.com> - 2017-04-06 16:00 +0200
    Re: [GIT PULL] AppArmor fixes for 4.12 James Morris <jmorris@namei.org> - 2017-04-07 01:00 +0200

#1618029 — [GIT PULL] AppArmor fixes for 4.12

Hi James,

Here is the pull request for 4.12

There are no new features here, just a small set of bug fixes since
the 4.11 pull request.

Thanks,
-John

---

The following changes since commit ef933e87785f42868980f0e3af91fec313612868:

  selinux: fix kernel BUG on prlimit(..., NULL, NULL) (2017-03-01 13:11:17 +1100)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor for-security

for you to fetch changes up to 6ebcd4c271332ca4f4dd958219f2ff1b7db1ed59:

  apparmor: Make path_max parameter readonly (2017-04-06 05:14:20 -0700)

----------------------------------------------------------------
John Johansen (3):
      apparmor: fix invalid reference to index variable of iterator line 836
      apparmor: fix parameters so that the permission test is bypassed at boot
      apparmor: Make path_max parameter readonly

Nicolas Iooss (1):
      apparmor: use SHASH_DESC_ON_STACK

Valentin Rothberg (1):
      security/apparmor/lsm.c: set debug messages

kbuild test robot (1):
      apparmor: fix boolreturn.cocci warnings

 security/apparmor/crypto.c      | 32 +++++++++++---------------
 security/apparmor/include/lib.h |  2 +-
 security/apparmor/lib.c         |  4 ++--
 security/apparmor/lsm.c         | 51 +++++++++++++++++++----------------------
 security/apparmor/policy.c      |  6 +++--
5 files changed, 44 insertions(+), 51 deletions(-)
      

[toc] | [next] | [standalone]

#1618033 — [PATCH 3/6] apparmor: use SHASH_DESC_ON_STACK

From: Nicolas Iooss <nicolas.iooss_linux@m4x.org>

When building the kernel with clang, the compiler fails to build
security/apparmor/crypto.c with the following error:

    security/apparmor/crypto.c:36:8: error: fields must have a constant
    size: 'variable length array in structure' extension will never be
    supported
                    char ctx[crypto_shash_descsize(apparmor_tfm)];
                         ^

Since commit a0a77af14117 ("crypto: LLVMLinux: Add macro to remove use
of VLAIS in crypto code"), include/crypto/hash.h defines
SHASH_DESC_ON_STACK to work around this issue. Use it in aa_calc_hash()
and aa_calc_profile_hash().

Signed-off-by: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
Signed-off-by: John Johansen <john.johansen@canonical.com>
---
 security/apparmor/crypto.c | 32 +++++++++++++-------------------
 1 file changed, 13 insertions(+), 19 deletions(-)

diff --git a/security/apparmor/crypto.c b/security/apparmor/crypto.c
index de8dc78..136f2a0 100644
--- a/security/apparmor/crypto.c
+++ b/security/apparmor/crypto.c
@@ -31,10 +31,7 @@ unsigned int aa_hash_size(void)
 
 char *aa_calc_hash(void *data, size_t len)
 {
-	struct {
-		struct shash_desc shash;
-		char ctx[crypto_shash_descsize(apparmor_tfm)];
-	} desc;
+	SHASH_DESC_ON_STACK(desc, apparmor_tfm);
 	char *hash = NULL;
 	int error = -ENOMEM;
 
@@ -45,16 +42,16 @@ char *aa_calc_hash(void *data, size_t len)
 	if (!hash)
 		goto fail;
 
-	desc.shash.tfm = apparmor_tfm;
-	desc.shash.flags = 0;
+	desc->tfm = apparmor_tfm;
+	desc->flags = 0;
 
-	error = crypto_shash_init(&desc.shash);
+	error = crypto_shash_init(desc);
 	if (error)
 		goto fail;
-	error = crypto_shash_update(&desc.shash, (u8 *) data, len);
+	error = crypto_shash_update(desc, (u8 *) data, len);
 	if (error)
 		goto fail;
-	error = crypto_shash_final(&desc.shash, hash);
+	error = crypto_shash_final(desc, hash);
 	if (error)
 		goto fail;
 
@@ -69,10 +66,7 @@ char *aa_calc_hash(void *data, size_t len)
 int aa_calc_profile_hash(struct aa_profile *profile, u32 version, void *start,
 			 size_t len)
 {
-	struct {
-		struct shash_desc shash;
-		char ctx[crypto_shash_descsize(apparmor_tfm)];
-	} desc;
+	SHASH_DESC_ON_STACK(desc, apparmor_tfm);
 	int error = -ENOMEM;
 	__le32 le32_version = cpu_to_le32(version);
 
@@ -86,19 +80,19 @@ int aa_calc_profile_hash(struct aa_profile *profile, u32 version, void *start,
 	if (!profile->hash)
 		goto fail;
 
-	desc.shash.tfm = apparmor_tfm;
-	desc.shash.flags = 0;
+	desc->tfm = apparmor_tfm;
+	desc->flags = 0;
 
-	error = crypto_shash_init(&desc.shash);
+	error = crypto_shash_init(desc);
 	if (error)
 		goto fail;
-	error = crypto_shash_update(&desc.shash, (u8 *) &le32_version, 4);
+	error = crypto_shash_update(desc, (u8 *) &le32_version, 4);
 	if (error)
 		goto fail;
-	error = crypto_shash_update(&desc.shash, (u8 *) start, len);
+	error = crypto_shash_update(desc, (u8 *) start, len);
 	if (error)
 		goto fail;
-	error = crypto_shash_final(&desc.shash, profile->hash);
+	error = crypto_shash_final(desc, profile->hash);
 	if (error)
 		goto fail;
 
-- 
2.9.3

[toc] | [prev] | [next] | [standalone]

#1618038 — [PATCH 1/6] apparmor: fix boolreturn.cocci warnings

From: kbuild test robot <fengguang.wu@intel.com>

security/apparmor/lib.c:132:9-10: WARNING: return of 0/1 in function 'aa_policy_init' with return type bool

 Return statements in functions returning bool should use
 true/false instead of 1/0.
Generated by: scripts/coccinelle/misc/boolreturn.cocci

Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
---
 security/apparmor/lib.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c
index 66475bd..32cafc1 100644
--- a/security/apparmor/lib.c
+++ b/security/apparmor/lib.c
@@ -180,13 +180,13 @@ bool aa_policy_init(struct aa_policy *policy, const char *prefix,
 	} else
 		policy->hname = kstrdup(name, gfp);
 	if (!policy->hname)
-		return 0;
+		return false;
 	/* base.name is a substring of fqname */
 	policy->name = basename(policy->hname);
 	INIT_LIST_HEAD(&policy->list);
 	INIT_LIST_HEAD(&policy->profiles);
 
-	return 1;
+	return true;
 }
 
 /**
-- 
2.9.3

[toc] | [prev] | [next] | [standalone]

#1618040 — [PATCH 2/6] security/apparmor/lsm.c: set debug messages

From: Valentin Rothberg <valentinrothberg@gmail.com>

Add the _APPARMOR substring to reference the intended Kconfig option.

Signed-off-by: Valentin Rothberg <valentinrothberg@gmail.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
---
 security/apparmor/lsm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 709eacd..5f7d4dd 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -681,7 +681,7 @@ module_param_named(hash_policy, aa_g_hash_policy, aabool, S_IRUSR | S_IWUSR);
 #endif
 
 /* Debug mode */
-bool aa_g_debug = IS_ENABLED(CONFIG_SECURITY_DEBUG_MESSAGES);
+bool aa_g_debug = IS_ENABLED(CONFIG_SECURITY_APPARMOR_DEBUG_MESSAGES);
 module_param_named(debug, aa_g_debug, aabool, S_IRUSR | S_IWUSR);
 
 /* Audit mode */
-- 
2.9.3

[toc] | [prev] | [next] | [standalone]

#1618384

On Thu, 6 Apr 2017, John Johansen wrote:

> Hi James,
> 
> Here is the pull request for 4.12
> 
> There are no new features here, just a small set of bug fixes since
> the 4.11 pull request.

All applied to:
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next


-- 
James Morris
<jmorris@namei.org>

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web