mirror of
https://gitlab.com/apparmor/apparmor
synced 2025-08-22 18:17:09 +00:00
Merge libapparmor: fix feature matching for aa_feature_supports
The feature matching done in aa_feature_supports calls walk_one to traverse the features string. This function is supposed to match on the feature and return, but it matches the feature based on the length of the feature to check. If the feature to check shorter, then it would return as if the feature was not present - which was the case for the following example: feature_file contains (shortened for example purposes): ``` network_v9 {af_unix {yes } } network_v8 {af_inet {yes } } network {af_unix {yes } } ``` if the feature to be checked was simply "network", then walk_one would return that the feature was not present. Fix this by restarting the matching if there was not a full match at the end of the feaure to check. Fixes: https://bugs.launchpad.net/apparmor/+bug/2105986 Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com> MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1608 Approved-by: Ryan Lee <rlee287@yahoo.com> Merged-by: John Johansen <john@jjmx.net>
This commit is contained in:
commit
69355d41f7
@ -399,6 +399,10 @@ static bool walk_one(const char **str, const struct component *component,
|
|||||||
i = 0;
|
i = 0;
|
||||||
|
|
||||||
cur++;
|
cur++;
|
||||||
|
|
||||||
|
/* Partial match, continue to search */
|
||||||
|
if (i == component->len && !isbrace_space_or_nul(*cur))
|
||||||
|
i = 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* Return false if a full match was not found */
|
/* Return false if a full match was not found */
|
||||||
|
Loading…
x
Reference in New Issue
Block a user