apparmor: fix profile verification and enable it
authorJohn Johansen <john.johansen@canonical.com>
Mon, 17 Apr 2023 09:57:55 +0000 (02:57 -0700)
committerJohn Johansen <john.johansen@canonical.com>
Thu, 6 Jul 2023 17:59:55 +0000 (10:59 -0700)
commit6f442d42c0d89876994a4a135eadf82b0e6ff6e4
tree9727fec43e82830f9a32b50b02f7c01c919ae0ba
parent0bac2002b397fda7c9ea81ee0b06a02242958107
apparmor: fix profile verification and enable it

The transition table size was not being set by compat mappings
resulting in the profile verification code not being run. Unfortunately
the checks were also buggy not being correctly updated from the old
accept perms, to the new layout.

Also indicate to userspace that the kernel has the permstable verification
fixes.

BugLink: http://bugs.launchpad.net/bugs/2017903
Fixes: 670f31774ab6 ("apparmor: verify permission table indexes")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Reviewed-by: Jon Tourville <jontourville@me.com>
security/apparmor/policy_compat.c
security/apparmor/policy_unpack.c