diff options
| author |   John Johansen <john.johansen@canonical.com> | 2019-12-19 15:55:39 -0800 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2020-01-21 05:58:53 -0800 |
| commit | f05841a940df995b784b5e3ec6f76141e8337245 (patch) | |
| tree | 6abf96d8d019b1d5692b8533c604b1c4aaa590ab /security/apparmor/policy_unpack.c | |
| parent | apparmor: fix nnp subset test for unconfined (diff) | |
| download | linux-dev-f05841a940df995b784b5e3ec6f76141e8337245.tar.xz linux-dev-f05841a940df995b784b5e3ec6f76141e8337245.zip | |
apparmor: fail unpack if profile mode is unknown
Profile unpack should fail if the profile mode is not a mode that the
kernel understands.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor/policy_unpack.c')
| -rw-r--r-- | security/apparmor/policy_unpack.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c index 80364310fb1e..e4e329d69527 100644 --- a/security/apparmor/policy_unpack.c +++ b/security/apparmor/policy_unpack.c @@ -748,10 +748,14 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name) goto fail; if (tmp == PACKED_MODE_COMPLAIN || (e->version & FORCE_COMPLAIN_FLAG)) profile->mode = APPARMOR_COMPLAIN; + else if (tmp == PACKED_MODE_ENFORCE) + profile->mode = APPARMOR_ENFORCE; else if (tmp == PACKED_MODE_KILL) profile->mode = APPARMOR_KILL; else if (tmp == PACKED_MODE_UNCONFINED) profile->mode = APPARMOR_UNCONFINED; + else + goto fail; if (!unpack_u32(e, &tmp, NULL)) goto fail; if (tmp) |