Re: [apparmor] [PATCH v5 3/3] AppArmor: add support for lsm_config_self_policy and lsm_config_system_policy

[Tetsuo Handa]

On 2025/07/09 17:00, Maxime Bélair wrote:
> +static int apparmor_lsm_config_self_policy(u32 lsm_id, u32 op, void __user 
> *buf,
> +                                   size_t size, u32 flags)
> +{
> +     char *name;
> +     long name_size;
> +     int ret;
> +
> +     if (op != LSM_POLICY_LOAD || flags)
> +             return -EOPNOTSUPP;
> +     if (size == 0)
> +             return -EINVAL;
> +     if (size > AA_PROFILE_NAME_MAX_SIZE)
> +             return -E2BIG;
> +
> +     name = kmalloc(size, GFP_KERNEL);
> +     if (!name)
> +             return -ENOMEM;
> +
> +
> +     name_size = strncpy_from_user(name, buf, size);
> +     if (name_size < 0) {
> +             kfree(name);
> +             return name_size;
> +     }

name is not '\0'-terminated when name_size == size && 0 < size && size <= 
AA_PROFILE_NAME_MAX_SIZE.
Please check boundary conditions by writing userspace programs for testing.

> +
> +     ret = aa_change_profile(name, AA_CHANGE_STACK);
> +
> +     kfree(name);
> +
> +     return ret;
> +}