]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
apparmor: fix oops, validate buffer size in apparmor_setprocattr()
authorVegard Nossum <vegard.nossum@oracle.com>
Thu, 7 Jul 2016 20:41:11 +0000 (13:41 -0700)
committerJames Morris <james.l.morris@oracle.com>
Fri, 8 Jul 2016 00:26:25 +0000 (10:26 +1000)
commit30a46a4647fd1df9cf52e43bf467f0d9265096ca
tree2cec69fc7fc82731f7a1845eba336aeb5d867cc8
parentac904ae6e6f0a56be7b9a1cf66fbd50dd025fb06
apparmor: fix oops, validate buffer size in apparmor_setprocattr()

When proc_pid_attr_write() was changed to use memdup_user apparmor's
(interface violating) assumption that the setprocattr buffer was always
a single page was violated.

The size test is not strictly speaking needed as proc_pid_attr_write()
will reject anything larger, but for the sake of robustness we can keep
it in.

SMACK and SELinux look safe to me, but somebody else should probably
have a look just in case.

Based on original patch from Vegard Nossum <vegard.nossum@oracle.com>
modified for the case that apparmor provides null termination.

Fixes: bb646cdb12e75d82258c2f2e7746d5952d3e321a
Reported-by: Vegard Nossum <vegard.nossum@oracle.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: John Johansen <john.johansen@canonical.com>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Eric Paris <eparis@parisplace.org>
Cc: Casey Schaufler <casey@schaufler-ca.com>
Cc: stable@kernel.org
Signed-off-by: John Johansen <john.johansen@canonical.com>
Reviewed-by: Tyler Hicks <tyhicks@canonical.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
security/apparmor/lsm.c