From 75c77e9e0713fddbe99a21a036aa6482402f9e34 Mon Sep 17 00:00:00 2001 From: John Johansen Date: Mon, 17 Apr 2023 03:27:36 -0700 Subject: [PATCH] apparmor: provide separate audit messages for file and policy checks Improve policy load failure messages by identifying which dfa the verification check failed in. Reviewed-by: Georgia Garcia Signed-off-by: John Johansen --- security/apparmor/policy_unpack.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c index cb8b5c497812..1eb98d6994e8 100644 --- a/security/apparmor/policy_unpack.c +++ b/security/apparmor/policy_unpack.c @@ -1240,12 +1240,18 @@ static int verify_profile(struct aa_profile *profile) if (!rules) return 0; - if ((rules->file.dfa && !verify_dfa_accept_index(rules->file.dfa, - rules->file.size)) || - (rules->policy.dfa && - !verify_dfa_accept_index(rules->policy.dfa, rules->policy.size))) { + if (rules->file.dfa && !verify_dfa_accept_index(rules->file.dfa, + rules->file.size)) { audit_iface(profile, NULL, NULL, - "Unpack: Invalid named transition", NULL, -EPROTO); + "Unpack: file Invalid named transition", NULL, + -EPROTO); + return -EPROTO; + } + if (rules->policy.dfa && + !verify_dfa_accept_index(rules->policy.dfa, rules->policy.size)) { + audit_iface(profile, NULL, NULL, + "Unpack: policy Invalid named transition", NULL, + -EPROTO); return -EPROTO; } -- 2.20.1