Messages in this thread | | | Date | Thu, 11 May 2023 14:55:05 -0700 | From | Kees Cook <> | Subject | Re: [PATCH] apparmor: aa_buffer: Convert 1-element array to flexible array |
| |
On Thu, May 11, 2023 at 02:48:29PM -0700, John Johansen wrote: > On 5/11/23 14:34, Kees Cook wrote: > > In the ongoing effort to convert all fake flexible arrays to proper > > flexible arrays, replace aa_buffer's 1-element "buffer" member with a > > flexible array. > > > > Cc: John Johansen <john.johansen@canonical.com> > > Cc: Gustavo A. R. Silva <gustavoars@kernel.org> > > Cc: Paul Moore <paul@paul-moore.com> > > Cc: James Morris <jmorris@namei.org> > > Cc: "Serge E. Hallyn" <serge@hallyn.com> > > Cc: apparmor@lists.ubuntu.com > > Cc: linux-security-module@vger.kernel.org > > Signed-off-by: Kees Cook <keescook@chromium.org> > > Acked-by: John Johansen <john.johansen@canonical.com> > > I have pulled this into my tree.
Thanks!
> > > --- > > One thing I notice here is that it may be rare for "buffer" to ever change > > for a given kernel. Could this just be made PATH_MAX * 2 directly and > > remove the module parameter, etc, etc? > > possibly. Currently the only use case I know of is for some stress testing > where we drop the buffer size down really small to try and break things. > This isn't part of the regular regression runs and could be handle with a > config/compile time to a buffer size constant.
Okay, cool. I figured the conversion to fixed-size is sort of nice, but it probably won't be of much use as-is since it's the buffer, not the aa_buffer, is passed around. The compiler would still not have any idea what the bounds are. :)
-- Kees Cook
| |