apparmor: add a default null dfa
Instead of testing whether a given dfa exists in every code path, have
a default null dfa that is used when loaded policy doesn't provide a
dfa.
This will let us get rid of special casing and avoid dereference bugs
when special casing is missed.
Signed-off-by: John Johansen <john.johansen@canonical.com>
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index e40eecb..f852cd6 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -878,6 +878,12 @@ static int __init apparmor_init(void)
return 0;
}
+ error = aa_setup_dfa_engine();
+ if (error) {
+ AA_ERROR("Unable to setup dfa engine\n");
+ goto alloc_out;
+ }
+
error = aa_alloc_root_ns();
if (error) {
AA_ERROR("Unable to allocate default profile namespace\n");
@@ -905,6 +911,7 @@ static int __init apparmor_init(void)
alloc_out:
aa_destroy_aafs();
+ aa_teardown_dfa_engine();
apparmor_enabled = 0;
return error;