From a1bdf04b27f8f28b6e96ecd10de2a8e78d80271f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Bosdonnat?= <cbosdonnat@suse.com>
Date: Tue, 6 Oct 2015 11:12:29 +0200
Subject: [PATCH] apparmor: differentiate between error and unconfined profiles

profile_status function was not making any difference between error
cases and unconfined profiles. The problem with this approach is that
dominfo was throwing an error on unconfined domains.
---
 src/security/security_apparmor.c | 30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c
index 16b8f879d0..2cf333defc 100644
--- a/src/security/security_apparmor.c
+++ b/src/security/security_apparmor.c
@@ -66,10 +66,11 @@ struct SDPDOP {
 };
 
 /*
- * profile_status returns '-1' on error, '0' if loaded
+ * profile_status returns '-2' on error, '-1' if not loaded, '0' if loaded
  *
- * If check_enforcing is set to '1', then returns '-1' on error, '0' if
- * loaded in complain mode, and '1' if loaded in enforcing mode.
+ * If check_enforcing is set to '1', then returns '-2' on error, '-1' if
+ * not loaded, '0' if loaded in complain mode, and '1' if loaded in
+ * enforcing mode.
  */
 static int
 profile_status(const char *str, const int check_enforcing)
@@ -77,7 +78,7 @@ profile_status(const char *str, const int check_enforcing)
     char *content = NULL;
     char *tmp = NULL;
     char *etmp = NULL;
-    int rc = -1;
+    int rc = -2;
 
     /* create string that is '<str> \0' for accurate matching */
     if (virAsprintf(&tmp, "%s ", str) == -1)
@@ -100,6 +101,8 @@ profile_status(const char *str, const int check_enforcing)
 
     if (strstr(content, tmp) != NULL)
         rc = 0;
+    else
+        rc = -1; /* return -1 if not loaded */
     if (check_enforcing != 0) {
         if (rc == 0 && strstr(content, etmp) != NULL)
             rc = 1;                 /* return '1' if loaded and enforcing */
@@ -262,6 +265,9 @@ use_apparmor(void)
         goto cleanup;
 
     rc = profile_status(libvirt_daemon, 1);
+    /* Error or unconfined should all result in -1*/
+    if (rc < 0)
+        rc = -1;
 
  cleanup:
     VIR_FREE(libvirt_daemon);
@@ -517,23 +523,29 @@ AppArmorGetSecurityProcessLabel(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
                                 virSecurityLabelPtr sec)
 {
     int rc = -1;
+    int status;
     char *profile_name = NULL;
 
     if ((profile_name = get_profile_name(def)) == NULL)
         return rc;
 
-    if (virStrcpy(sec->label, profile_name,
-        VIR_SECURITY_LABEL_BUFLEN) == NULL) {
+    status = profile_status(profile_name, 1);
+    if (status < -1) {
         virReportError(VIR_ERR_INTERNAL_ERROR,
-                       "%s", _("error copying profile name"));
+                       "%s", _("error getting profile status"));
         goto cleanup;
+    } else if (status == -1) {
+        profile_name[0] = '\0';
     }
 
-    if ((sec->enforcing = profile_status(profile_name, 1)) < 0) {
+    if (virStrcpy(sec->label, profile_name,
+        VIR_SECURITY_LABEL_BUFLEN) == NULL) {
         virReportError(VIR_ERR_INTERNAL_ERROR,
-                       "%s", _("error calling profile_status()"));
+                       "%s", _("error copying profile name"));
         goto cleanup;
     }
+
+    sec->enforcing = status == 1;
     rc = 0;
 
  cleanup:
-- 
GitLab