[SRU][N][PATCH v2 1/2] UBUNTU: SAUCE: apparmor4.0.0 [94/99]: apparmor: allocate xmatch for nullpdf inside aa_alloc_null

[Ryan Lee]

BugLink: https://bugs.launchpad.net/bugs/2086210

attach->xmatch was not set when allocating a null profile, which is used in
complain mode to allocate a learning profile. This was causing downstream
failures in find_attach, which expected a valid xmatch but did not find
one under a certain sequence of profile transitions in complain mode.

This patch ensures the xmatch is set up properly for null profiles.

Signed-off-by: Ryan Lee <ryan.lee at canonical.com>
Signed-off-by: John Johansen <john.johansen at canonical.com>
Signed-off-by: Timo Aaltonen <timo.aaltonen at canonical.com>
(cherry picked from commit 2de989ae726b14b6236fdb848563d607e12287b8 oracular:linux)
Signed-off-by: Ryan Lee <ryan.lee at canonical.com>
---
 security/apparmor/policy.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index f503dcd3ac74..638b0d6753ef 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -659,6 +659,7 @@ struct aa_profile *aa_alloc_null(struct aa_profile *parent, const char *name,
 
 	/* TODO: ideally we should inherit abi from parent */
 	profile->label.flags |= FLAG_NULL;
+	profile->attach.xmatch = aa_get_pdb(nullpdb);
 	rules = list_first_entry(&profile->rules, typeof(*rules), list);
 	rules->file = aa_get_pdb(nullpdb);
 	rules->policy = aa_get_pdb(nullpdb);
-- 
2.43.0