Merge tag 'apparmor-pr-2022-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git...

[sfrench/cifs-2.6.git] / security / apparmor / mount.c

diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c
index aa6fcfde30514803dbcf8d1e0c20bc5529033c1c..f6124724180333b363897e8715d866fa7058e52e 100644 (file)
--- a/security/apparmor/mount.c
+++ b/security/apparmor/mount.c
@@ -217,7 +217,6 @@ static struct aa_perms compute_mnt_perms(struct aa_dfa *dfa,
                .allow = dfa_user_allow(dfa, state),
                .audit = dfa_user_audit(dfa, state),
                .quiet = dfa_user_quiet(dfa, state),
-               .xindex = dfa_user_xindex(dfa, state),
        };
 
        return perms;
@@ -229,7 +228,8 @@ static const char * const mnt_info_table[] = {
        "failed srcname match",
        "failed type match",
        "failed flags match",
-       "failed data match"
+       "failed data match",
+       "failed perms check"
 };
 
 /*
@@ -284,8 +284,8 @@ static int do_match_mnt(struct aa_dfa *dfa, unsigned int start,
                        return 0;
        }
 
-       /* failed at end of flags match */
-       return 4;
+       /* failed at perms check, don't confuse with flags match */
+       return 6;
 }
 
 
@@ -303,7 +303,7 @@ static int path_flags(struct aa_profile *profile, const struct path *path)
  * @profile: the confining profile
  * @mntpath: for the mntpnt (NOT NULL)
  * @buffer: buffer to be used to lookup mntpath
- * @devnme: string for the devname/src_name (MAY BE NULL OR ERRPTR)
+ * @devname: string for the devname/src_name (MAY BE NULL OR ERRPTR)
  * @type: string for the dev type (MAYBE NULL)
  * @flags: mount flags to match
  * @data: fs mount data (MAYBE NULL)
@@ -358,7 +358,7 @@ audit:
 /**
  * match_mnt - handle path matching for mount
  * @profile: the confining profile
- * @mntpath: for the mntpnt (NOT NULL)
+ * @path: for the mntpnt (NOT NULL)
  * @buffer: buffer to be used to lookup mntpath
  * @devpath: path devname/src_name (MAYBE NULL)
  * @devbuffer: buffer to be used to lookup devname/src_name
@@ -718,6 +718,7 @@ int aa_pivotroot(struct aa_label *label, const struct path *old_path,
                        aa_put_label(target);
                        goto out;
                }
+               aa_put_label(target);
        } else
                /* already audited error */
                error = PTR_ERR(target);