apparmor: Fix regression in compat permissions for getattr

This fixes a regression in mediation of getattr when old policy built
under an older ABI is loaded and mapped to internal permissions.

The regression does not occur for all getattr permission requests,
only appearing if state zero is the final state in the permission
lookup.  This is because despite the first state (index 0) being
guaranteed to not have permissions in both newer and older permission
formats, it may have to carry permissions that were not mediated as
part of an older policy. These backward compat permissions are
mapped here to avoid special casing the mediation code paths.

Since the mapping code already takes into account backwards compat
permission from older formats it can be applied to state 0 to fix
the regression.

Fixes: 408d53e923bd ("apparmor: compute file permissions on profile load")
Reported-by: Philip Meulengracht <the_meulengracht@hotmail.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>

diff --git a/security/apparmor/policy_compat.c b/security/apparmor/policy_compat.c
index 9e52e218bf308161c7fcc0d190a2bacea7b0e3b0..cc89d1e88fb745993d54941782a5e8089f5ccaa9 100644 (file)
--- a/security/apparmor/policy_compat.c
+++ b/security/apparmor/policy_compat.c
@@ -160,8 +160,7 @@ static struct aa_perms *compute_fperms(struct aa_dfa *dfa)
        if (!table)
                return NULL;
 
-       /* zero init so skip the trap state (state == 0) */
-       for (state = 1; state < state_count; state++) {
+       for (state = 0; state < state_count; state++) {
                table[state * 2] = compute_fperms_user(dfa, state);
                table[state * 2 + 1] = compute_fperms_other(dfa, state);
        }