diff options
| author | John Johansen <john.johansen@canonical.com> | 2025-05-23 21:04:51 -0700 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2025-07-15 22:39:07 -0700 |
| commit | aff426f35966e6e77ecfe065984344a7d834eaa9 (patch) | |
| tree | 612b60bd88d3772a2a78f03d61c518dd946db98a /security/apparmor/include | |
| parent | apparmor: Document that label must be last member in struct aa_profile (diff) | |
| download | linux-aff426f35966e6e77ecfe065984344a7d834eaa9.tar.gz linux-aff426f35966e6e77ecfe065984344a7d834eaa9.zip | |
apparmor: mitigate parser generating large xtables
Some versions of the parser are generating an xtable transition per
state in the state machine, even when the state machine isn't using
the transition table.
The parser bug is triggered by
commit 2e12c5f06017 ("apparmor: add additional flags to extended permission.")
In addition to fixing this in userspace, mitigate this in the kernel
as part of the policy verification checks by detecting this situation
and adjusting to what is actually used, or if not used at all freeing
it, so we are not wasting unneeded memory on policy.
Fixes: 2e12c5f06017 ("apparmor: add additional flags to extended permission.")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor/include')
| -rw-r--r-- | security/apparmor/include/lib.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/security/apparmor/include/lib.h b/security/apparmor/include/lib.h index e60bfa410e55..200cf36c5e0a 100644 --- a/security/apparmor/include/lib.h +++ b/security/apparmor/include/lib.h @@ -125,6 +125,7 @@ struct aa_str_table { }; void aa_free_str_table(struct aa_str_table *table); +bool aa_resize_str_table(struct aa_str_table *t, int newsize, gfp_t gfp); struct counted_str { struct kref count; |