mirror of
https://gitlab.com/apparmor/apparmor
synced 2025-08-30 22:05:27 +00:00
Merge libapparmor: fix feature matching for aa_feature_supports
The feature matching done in aa_feature_supports calls walk_one to
traverse the features string. This function is supposed to match on
the feature and return, but it matches the feature based on the length
of the feature to check. If the feature to check shorter, then it
would return as if the feature was not present - which was the case
for the following example:
feature_file contains (shortened for example purposes):
```
network_v9 {af_unix {yes
}
}
network_v8 {af_inet {yes
}
}
network {af_unix {yes
}
}
```
if the feature to be checked was simply "network", then walk_one would
return that the feature was not present.
Fix this by restarting the matching if there was not a full match at
the end of the feaure to check.
Fixes: https://bugs.launchpad.net/apparmor/+bug/2105986
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1608
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit 69355d41f7
)
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
This commit is contained in:
committed by
Georgia Garcia
parent
37f792377c
commit
b7b2fe6605
@@ -399,6 +399,10 @@ static bool walk_one(const char **str, const struct component *component,
|
||||
i = 0;
|
||||
|
||||
cur++;
|
||||
|
||||
/* Partial match, continue to search */
|
||||
if (i == component->len && !isbrace_space_or_nul(*cur))
|
||||
i = 0;
|
||||
}
|
||||
|
||||
/* Return false if a full match was not found */
|
||||
|
Reference in New Issue
Block a user