apparmor: Fix regression in stacking due to label flags

The unconfined label flag is not being computed correctly. It
should only be set if all the profiles in the vector are set, which
is different than what is required for the debug and stale flag
that are set if any on the profile flags are set.

Fixes: c1ed5da19765 ("apparmor: allow label to carry debug flags")
Signed-off-by: John Johansen <john.johansen@canonical.com>

diff --git a/security/apparmor/label.c b/security/apparmor/label.c
index 98dadd96097726cdd19fc0aabfcf39a2709763c6..aa4031628af5569495db0bc7a0f64f803179a133 100644 (file)
--- a/security/apparmor/label.c
+++ b/security/apparmor/label.c
@@ -197,15 +197,18 @@ static bool vec_is_stale(struct aa_profile **vec, int n)
        return false;
 }
 
-static long union_vec_flags(struct aa_profile **vec, int n, long mask)
+static long accum_vec_flags(struct aa_profile **vec, int n)
 {
-       long u = 0;
+       long u = FLAG_UNCONFINED;
        int i;
 
        AA_BUG(!vec);
 
        for (i = 0; i < n; i++) {
-               u |= vec[i]->label.flags & mask;
+               u |= vec[i]->label.flags & (FLAG_DEBUG1 | FLAG_DEBUG2 |
+                                           FLAG_STALE);
+               if (!(u & vec[i]->label.flags & FLAG_UNCONFINED))
+                       u &= ~FLAG_UNCONFINED;
        }
 
        return u;
@@ -1097,8 +1100,7 @@ static struct aa_label *label_merge_insert(struct aa_label *new,
                else if (k == b->size)
                        return aa_get_label(b);
        }
-       new->flags |= union_vec_flags(new->vec, new->size, FLAG_UNCONFINED |
-                                             FLAG_DEBUG1 | FLAG_DEBUG2);
+       new->flags |= accum_vec_flags(new->vec, new->size);
        ls = labels_set(new);
        write_lock_irqsave(&ls->lock, flags);
        label = __label_insert(labels_set(new), new, false);