apparmor: fixup secid map conversion to using IDR

The IDR conversion did not handle an error case for when allocating a
mapping fails, and it did not ensure that mappings did not allocate or
use a 0 value, which is used as an invalid secid. Which is used when a
mapping fails.

Fixes: 3ae7eb49a2be ("apparmor: Use an IDR to allocate apparmor secids")
Signed-off-by: John Johansen <john.johansen@canonical.com>

diff --git a/security/apparmor/include/secid.h b/security/apparmor/include/secid.h
index 686de8e50a799facd6f6494d903f61af44f28de4..dee6fa3b6081e1342bfa3e0c4077ea960ca7bfff 100644 (file)
--- a/security/apparmor/include/secid.h
+++ b/security/apparmor/include/secid.h
@@ -28,8 +28,10 @@ int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
 void apparmor_release_secctx(char *secdata, u32 seclen);
 
 
-u32 aa_alloc_secid(struct aa_label *label, gfp_t gfp);
+int aa_alloc_secid(struct aa_label *label, gfp_t gfp);
 void aa_free_secid(u32 secid);
 void aa_secid_update(u32 secid, struct aa_label *label);
 
+void aa_secids_init(void);
+
 #endif /* __AA_SECID_H */

diff --git a/security/apparmor/label.c b/security/apparmor/label.c
index a17574df611b60c2c91aa10ffda49c17099241cd..ba11bdf9043aacd26acf7119873c212240e3cb3f 100644 (file)
--- a/security/apparmor/label.c
+++ b/security/apparmor/label.c
@@ -407,8 +407,7 @@ bool aa_label_init(struct aa_label *label, int size, gfp_t gfp)
        AA_BUG(!label);
        AA_BUG(size < 1);
 
-       label->secid = aa_alloc_secid(label, gfp);
-       if (label->secid == AA_SECID_INVALID)
+       if (aa_alloc_secid(label, gfp) < 0)
                return false;
 
        label->size = size;                     /* doesn't include null */

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 10bf36aa477d560da99837c5e3037d0eb221a610..e35d12883990fe3cabac161f1672fe2b2f234427 100644 (file)
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -1547,6 +1547,8 @@ static int __init apparmor_init(void)
                return 0;
        }
 
+       aa_secids_init();
+
        error = aa_setup_dfa_engine();
        if (error) {
                AA_ERROR("Unable to setup dfa engine\n");

diff --git a/security/apparmor/secid.c b/security/apparmor/secid.c
index 3ad94b2ffbb2f8957809377c3d525c0684d5ed90..f2f22d00db18893a917006794c5a09e341aae2b0 100644 (file)
--- a/security/apparmor/secid.c
+++ b/security/apparmor/secid.c
@@ -33,6 +33,8 @@
  * properly updating/freeing them
  */
 
+#define AA_FIRST_SECID 1
+
 static DEFINE_IDR(aa_secids);
 static DEFINE_SPINLOCK(secid_lock);
 
@@ -120,20 +122,31 @@ void apparmor_release_secctx(char *secdata, u32 seclen)
 
 /**
  * aa_alloc_secid - allocate a new secid for a profile
+ * @label: the label to allocate a secid for
+ * @gfp: memory allocation flags
+ *
+ * Returns: 0 with @label->secid initialized
+ *          <0 returns error with @label->secid set to AA_SECID_INVALID
  */
-u32 aa_alloc_secid(struct aa_label *label, gfp_t gfp)
+int aa_alloc_secid(struct aa_label *label, gfp_t gfp)
 {
        unsigned long flags;
-       u32 secid;
+       int ret;
 
        idr_preload(gfp);
        spin_lock_irqsave(&secid_lock, flags);
-       secid = idr_alloc(&aa_secids, label, 0, 0, GFP_ATOMIC);
-       /* XXX: Can return -ENOMEM */
+       ret = idr_alloc(&aa_secids, label, AA_FIRST_SECID, 0, GFP_ATOMIC);
        spin_unlock_irqrestore(&secid_lock, flags);
        idr_preload_end();
 
-       return secid;
+       if (ret < 0) {
+               label->secid = AA_SECID_INVALID;
+               return ret;
+       }
+
+       AA_BUG(ret == AA_SECID_INVALID);
+       label->secid = ret;
+       return 0;
 }
 
 /**
@@ -148,3 +161,8 @@ void aa_free_secid(u32 secid)
        idr_remove(&aa_secids, secid);
        spin_unlock_irqrestore(&secid_lock, flags);
 }
+
+void aa_secids_init(void)
+{
+       idr_init_base(&aa_secids, AA_FIRST_SECID);
+}