summaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
authorJohn Johansen <john.johansen@canonical.com>2019-12-19 15:55:39 -0800
committerJohn Johansen <john.johansen@canonical.com>2020-01-21 05:58:53 -0800
commitf05841a940df995b784b5e3ec6f76141e8337245 (patch)
tree6abf96d8d019b1d5692b8533c604b1c4aaa590ab /security
parent3ed4aaa94fc07db3cd0c91be95e3e1b9782a2710 (diff)
downloadlinux-f05841a940df995b784b5e3ec6f76141e8337245.tar.gz
linux-f05841a940df995b784b5e3ec6f76141e8337245.tar.bz2
linux-f05841a940df995b784b5e3ec6f76141e8337245.zip
apparmor: fail unpack if profile mode is unknown
Profile unpack should fail if the profile mode is not a mode that the kernel understands. Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security')
-rw-r--r--security/apparmor/policy_unpack.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 80364310fb1e..e4e329d69527 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -748,10 +748,14 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
goto fail;
if (tmp == PACKED_MODE_COMPLAIN || (e->version & FORCE_COMPLAIN_FLAG))
profile->mode = APPARMOR_COMPLAIN;
+ else if (tmp == PACKED_MODE_ENFORCE)
+ profile->mode = APPARMOR_ENFORCE;
else if (tmp == PACKED_MODE_KILL)
profile->mode = APPARMOR_KILL;
else if (tmp == PACKED_MODE_UNCONFINED)
profile->mode = APPARMOR_UNCONFINED;
+ else
+ goto fail;
if (!unpack_u32(e, &tmp, NULL))
goto fail;
if (tmp)