diff options
| author | Kees Cook <keescook@chromium.org> | 2014-05-22 00:23:46 +0200 |
|---|---|---|
| committer | Kees Cook <keescook@chromium.org> | 2014-07-18 21:13:38 +0200 |
| commit | 1d4457f99928a968767f6405b4a1f50845aa15fd (patch) | |
| tree | 522641b08f4a465035910a74a3871ad38e62df01 /security/apparmor/domain.c | |
| parent | MIPS: add seccomp syscall (diff) | |
| download | linux-1d4457f99928a968767f6405b4a1f50845aa15fd.tar.xz linux-1d4457f99928a968767f6405b4a1f50845aa15fd.zip | |
sched: move no_new_privs into new atomic flags
Since seccomp transitions between threads requires updates to the
no_new_privs flag to be atomic, the flag must be part of an atomic flag
set. This moves the nnp flag into a separate task field, and introduces
accessors.
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Andy Lutomirski <luto@amacapital.net>
Diffstat (limited to 'security/apparmor/domain.c')
| -rw-r--r-- | security/apparmor/domain.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c index 452567d3a08e..d97cba3e3849 100644 --- a/security/apparmor/domain.c +++ b/security/apparmor/domain.c @@ -621,7 +621,7 @@ int aa_change_hat(const char *hats[], int count, u64 token, bool permtest) * There is no exception for unconfined as change_hat is not * available. */ - if (current->no_new_privs) + if (task_no_new_privs(current)) return -EPERM; /* released below */ @@ -776,7 +776,7 @@ int aa_change_profile(const char *ns_name, const char *hname, bool onexec, * no_new_privs is set because this aways results in a reduction * of permissions. */ - if (current->no_new_privs && !unconfined(profile)) { + if (task_no_new_privs(current) && !unconfined(profile)) { put_cred(cred); return -EPERM; } |