John Johansen eb2b0bf5c4 apparmor: fix PROFILE_MEDIATES for untrusted input ... commit 23375b13f9 upstream. While commit 11c236b89d ("apparmor: add a default null dfa") ensure every profile has a policy.dfa it does not resize the policy.start[] to have entries for every possible start value. Which means PROFILE_MEDIATES is not safe to use on untrusted input. Unforunately commit b9590ad4c4 ("apparmor: remove POLICY_MEDIATES_SAFE") did not take into account the start value usage. The input string in profile_query_cb() is user controlled and is not properly checked to be within the limited start[] entries, even worse it can't be as userspace policy is allowed to make us of entries types the kernel does not know about. This mean usespace can currently cause the kernel to access memory up to 240 entries beyond the start array bounds. Cc: stable@vger.kernel.org Fixes: b9590ad4c4 ("apparmor: remove POLICY_MEDIATES_SAFE") Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-06-25 11:35:54 +08:00
..
apparmor.h	apparmor: add base infastructure for socket mediation	2018-03-13 17:25:48 -07:00
apparmorfs.h
audit.h	apparmor: Add support for audit rule filtering	2018-06-07 01:50:47 -07:00
capability.h
cred.h	apparmor: move context.h to cred.h	2018-02-09 11:30:01 -08:00
crypto.h
domain.h
file.h
ipc.h
label.h	apparmor: add support for mapping secids and using secctxes	2018-05-02 00:48:55 -07:00
lib.h
match.h	apparmor: improve overlapping domain attachment resolution	2018-02-09 11:30:02 -08:00
mount.h
net.h	apparmor: add base infastructure for socket mediation	2018-03-13 17:25:48 -07:00
path.h	apparmor: improve get_buffers macro by using get_cpu_ptr	2018-06-07 01:49:21 -07:00
perms.h	apparmor: Check buffer bounds when mapping permissions mask	2018-07-19 16:24:43 -07:00
policy_ns.h
policy_unpack.h	apparmor: split load data into management struct and data blob	2018-02-09 11:30:00 -08:00
policy.h	apparmor: fix PROFILE_MEDIATES for untrusted input	2019-06-25 11:35:54 +08:00
procattr.h
resource.h
secid.h	apparmor: fixup secid map conversion to using IDR	2018-06-07 01:50:49 -07:00
sig_names.h	apparmor: audit unknown signal numbers	2018-02-09 11:30:01 -08:00
task.h	apparmor: update domain transitions that are subsets of confinement at nnp	2018-02-09 11:30:01 -08:00