apparmor/kernel-patches/for-mainline/fix-link-subset.diff

---
 security/apparmor/main.c |   37 ++++++++++++++++++++-----------------
 1 file changed, 20 insertions(+), 17 deletions(-)

--- a/security/apparmor/main.c
+++ b/security/apparmor/main.c
@@ -68,7 +68,7 @@ static int aa_link_denied(struct aa_prof
 			  int *request_mask)
 {
 	unsigned int state;
-	int l_mode, t_mode, denied_mask = 0;
+	int l_mode, t_mode, l_subset, denied_mask = 0;
 	int link_mask = AA_MAY_LINK << target_mode;
 
 	*request_mask = link_mask;
@@ -83,31 +83,35 @@ static int aa_link_denied(struct aa_prof
 
 		if (!(mode & link_mask))
 			denied_mask |= link_mask;
+		/* return if link subset test is not required */
 		if (!(mode & (AA_LINK_SUBSET_TEST << target_mode)))
 			return denied_mask;
 	}
 
-	/* do link perm subset test */
-	t_mode = aa_match(profile->file_rules, target);
-
-	/* Ignore valid-profile-transition flags. */
-	l_mode &= ~AA_SHARED_PERMS;
-	t_mode &= ~AA_SHARED_PERMS;
-
-	*request_mask = l_mode | link_mask;
-
-	/* Link always requires 'l' on the link for both parts of the pair.
+	/* Do link perm subset test
 	 * If a subset test is required a permission subset test of the
 	 * perms for the link are done against the user:group:other of the
 	 * target's 'r', 'w', 'x', 'a', 'k', and 'm' permissions.
 	 *
 	 * If the link has 'x', an exact match of all the execute flags
-	 * ('i', 'u', 'p').  safe exec is treated as a subset of unsafe exec
+	 * must match.
  	 */
-#define SUBSET_PERMS (AA_FILE_PERMS & ~AA_LINK_BITS)
 	denied_mask |= ~l_mode & link_mask;
-	if (l_mode & SUBSET_PERMS) {
-		denied_mask |= (l_mode & SUBSET_PERMS) & ~t_mode;
+
+	t_mode = aa_match(profile->file_rules, target);
+
+
+	/* For actual subset test ignore valid-profile-transition flags,
+	 * and link bits
+	 */
+	l_mode &= ~(AA_SHARED_PERMS | AA_LINK_BITS);
+	t_mode &= ~(AA_SHARED_PERMS | AA_LINK_BITS);
+	l_subset = l_mode & AA_FILE_PERMS;
+
+	*request_mask = l_mode | link_mask;
+
+	if (l_subset) {
+		denied_mask |= (l_subset) & ~t_mode;
 		if (denied_mask & AA_EXEC_BITS)
 			denied_mask |= l_mode & AA_ALL_EXEC_MODS;
 		else if (l_mode & AA_EXEC_BITS) {
@@ -126,9 +130,8 @@ static int aa_link_denied(struct aa_prof
 				denied_mask |= AA_OTHER_EXEC |
 					(l_mode & AA_OTHER_EXEC_MODS);
 		}
-	} else
+	} else if (t_mode & AA_FILE_PERMS)
 		denied_mask |= t_mode | link_mask;
-#undef SUBSET_PERMS
 
 	return denied_mask;
 }