[apparmor] [PATCH -next] apparmor: fix invalid reference on profile->disconnected

[Georgia Garcia]

On Tue, 2023-08-22 at 10:13 -0700, John Johansen wrote:
> On 8/21/23 11:37, Georgia Garcia wrote:
> > profile->disconnected was storing an invalid reference to the
> > disconnected path. Fix it by duplicating the string using
> > aa_unpack_strdup and freeing accordingly.
> > 
> This is going to need the Fixes tag
> 
> Fixes: 72c8a768641d ("apparmor: allow profiles to provide info to disconnected paths")

Thanks!

> 
> > Signed-off-by: Georgia Garcia <georgia.garcia at canonical.com>
> 
> the patch certainly addresses the issue, and I can add the Fixes tag, but unless
> there is something I am missing I think we should avoid the intermediate variable
> as noted below
> 
> > ---
> >   security/apparmor/policy.c        | 1 +
> >   security/apparmor/policy_unpack.c | 5 +++--
> >   2 files changed, 4 insertions(+), 2 deletions(-)
> > 
> > diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
> > index 4817c1b30105..d7525f228c43 100644
> > --- a/security/apparmor/policy.c
> > +++ b/security/apparmor/policy.c
> > @@ -255,6 +255,7 @@ void aa_free_profile(struct aa_profile *profile)
> >   
> >   	aa_put_ns(profile->ns);
> >   	kfree_sensitive(profile->rename);
> > +	kfree_sensitive(profile->disconnected);
> >   
> >   	free_attachment(&profile->attach);
> >   
> > diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
> > index d2d740bb5618..8b2ad42c80ba 100644
> > --- a/security/apparmor/policy_unpack.c
> > +++ b/security/apparmor/policy_unpack.c
> > @@ -804,7 +804,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
> >   	const char *info = "failed to unpack profile";
> >   	size_t ns_len;
> >   	struct rhashtable_params params = { 0 };
> > -	char *key = NULL;
> > +	char *key = NULL, *disconnected = NULL;
> >   	struct aa_data *data;
> >   	int error = -EPROTO;
> >   	kernel_cap_t tmpcap;
> > @@ -870,7 +870,8 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
> >   	}
> >   
> >   	/* disconnected attachment string is optional */
> > -	(void) aa_unpack_str(e, &profile->disconnected, "disconnected");
> > +	(void) aa_unpack_strdup(e, &disconnected, "disconnected");
> > +	profile->disconnected = disconnected;
> 
> is there any reason you added the intermediate step of unpacking to &disconnected instead of just directly to the value as before?

profile->disconnected is const and but the second argument of
aa_unpack_strdup is not, so the compiler throws an error saying
"incompatible pointer type".

> >   
> >   	/* per profile debug flags (complain, audit) */
> >   	if (!aa_unpack_nameX(e, AA_STRUCT, "flags")) {
>