Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751571AbdHAAWe (ORCPT ); Mon, 31 Jul 2017 20:22:34 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:47782 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751106AbdHAAWd (ORCPT ); Mon, 31 Jul 2017 20:22:33 -0400 Subject: Re: [PATCH] apparmor: Fix logical error in verify_header() To: Christos Gkekas , James Morris , "Serge E. Hallyn" , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org References: <1499543421-5544-1-git-send-email-chris.gekas@gmail.com> From: John Johansen Organization: Canonical Message-ID: <2ea41bda-6a90-4d11-bb85-e56073b64274@canonical.com> Date: Mon, 31 Jul 2017 17:22:29 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1 MIME-Version: 1.0 In-Reply-To: <1499543421-5544-1-git-send-email-chris.gekas@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1236 Lines: 32 On 07/08/2017 12:50 PM, Christos Gkekas wrote: > verify_header() is currently checking whether interface version is less > than 5 *and* greater than 7, which always evaluates to false. Instead it > should check whether it is less than 5 *or* greater than 7. > > Signed-off-by: Christos Gkekas sigh, yes. sorry for the delay this ended up in the wrong bucket. I've pulled it in for the next pull Acked-by: John Johansen > --- > security/apparmor/policy_unpack.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c > index c600f4d..f273c61 100644 > --- a/security/apparmor/policy_unpack.c > +++ b/security/apparmor/policy_unpack.c > @@ -832,7 +832,7 @@ static int verify_header(struct aa_ext *e, int required, const char **ns) > * if not specified use previous version > * Mask off everything that is not kernel abi version > */ > - if (VERSION_LT(e->version, v5) && VERSION_GT(e->version, v7)) { > + if (VERSION_LT(e->version, v5) || VERSION_GT(e->version, v7)) { > audit_iface(NULL, NULL, NULL, "unsupported interface version", > e, error); > return error; >