apparmor: support v7 transition format compatible with label_parse

Signed-off-by: John Johansen <john.johansen@canonical.com>

diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index d1a6ce4997769bf7e26745e9e69ada679669b8ea..e460f2d8337d191413f7dcd3f740edcaaa1f379f 100644 (file)
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -2103,6 +2103,8 @@ static struct aa_sfs_entry aa_sfs_entry_domain[] = {
 
 static struct aa_sfs_entry aa_sfs_entry_versions[] = {
        AA_SFS_FILE_BOOLEAN("v5",       1),
+       AA_SFS_FILE_BOOLEAN("v6",       1),
+       AA_SFS_FILE_BOOLEAN("v7",       1),
        { }
 };
 

diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index f42bb9575cb5381aef344547419ce8c7c2872f20..6e6f8c1a10a9532077da74923537b562023c3fec 100644 (file)
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -466,7 +466,7 @@ static bool unpack_trans_table(struct aa_ext *e, struct aa_profile *profile)
                profile->file.trans.size = size;
                for (i = 0; i < size; i++) {
                        char *str;
-                       int c, j, size2 = unpack_strdup(e, &str, NULL);
+                       int c, j, pos, size2 = unpack_strdup(e, &str, NULL);
                        /* unpack_strdup verifies that the last character is
                         * null termination byte.
                         */
@@ -478,19 +478,25 @@ static bool unpack_trans_table(struct aa_ext *e, struct aa_profile *profile)
                                goto fail;
 
                        /* count internal #  of internal \0 */
-                       for (c = j = 0; j < size2 - 2; j++) {
-                               if (!str[j])
+                       for (c = j = 0; j < size2 - 1; j++) {
+                               if (!str[j]) {
+                                       pos = j;
                                        c++;
+                               }
                        }
                        if (*str == ':') {
+                               /* first character after : must be valid */
+                               if (!str[1])
+                                       goto fail;
                                /* beginning with : requires an embedded \0,
                                 * verify that exactly 1 internal \0 exists
                                 * trailing \0 already verified by unpack_strdup
+                                *
+                                * convert \0 back to : for label_parse
                                 */
-                               if (c != 1)
-                                       goto fail;
-                               /* first character after : must be valid */
-                               if (!str[1])
+                               if (c == 1)
+                                       str[pos] = ':';
+                               else if (c > 1)
                                        goto fail;
                        } else if (c)
                                /* fail - all other cases with embedded \0 */