mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-29 13:28:19 +00:00
Code Issues Releases Wiki Activity

libapparmor: Clean up confinement context's unconfined check

Browse Source 
Use the passed in confinement context string size to improve the
comparison by only doing the string comparison if the size matches and
removing the possibility of reading past the end of the buffer.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
This commit is contained in:
Tyler Hicks 2015-05-19 21:20:37 -05:00
parent 6d8827594a
commit f6df1c7516
1 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
libraries/libapparmor/src/kernel.c
View File

@ -43,6 +43,9 @@
#define default_symbol_version(real, name, version) \
__asm__ (".symver " #real "," #name "@@" #version)
#define UNCONFINED "unconfined"
#define UNCONFINED_SIZE strlen(UNCONFINED)
/**
* aa_find_mountpoint - find where the apparmor interface filesystem is mounted
* @mnt: returns buffer with the mountpoint string
@ -151,6 +154,19 @@ static char *procattr_path(pid_t pid, const char *attr)
return NULL;
}
/**
* parse_unconfined - check for the unconfined label
* @con: the confinement context
* @size: size of the confinement context (not including the NUL terminator)
*
* Returns: True if the con is the unconfined label or false otherwise
*/
static bool parse_unconfined(char *con, int size)
{
return size == UNCONFINED_SIZE &&
strncmp(con, UNCONFINED, UNCONFINED_SIZE) == 0;
}
/**
* parse_confinement_mode - get the mode from the confinement context
* @con: the confinement context
@ -163,8 +179,7 @@ static char *procattr_path(pid_t pid, const char *attr)
*/
static char *parse_confinement_mode(char *con, int size)
{
if (strcmp(con, "unconfined") != 0 &&
size > 3 && con[size - 1] == ')') {
if (!parse_unconfined(con, size) && size > 3 && con[size - 1] == ')') {
int pos = size - 2;
while (pos > 0 && !(con[pos] == ' ' && con[pos + 1] == '('))