diff options
| author | John Johansen <john.johansen@canonical.com> | 2013-07-11 06:07:43 +0200 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2013-08-14 20:42:06 +0200 |
| commit | 77b071b34045a0c65d0e1f85f3d47fd2b8b7a8a1 (patch) | |
| tree | b0b2c38b79969ac7b9439389888f6a1ac14a32a7 /security/apparmor/lsm.c | |
| parent | apparmor: convert profile lists to RCU based locking (diff) | |
| download | linux-77b071b34045a0c65d0e1f85f3d47fd2b8b7a8a1.tar.xz linux-77b071b34045a0c65d0e1f85f3d47fd2b8b7a8a1.zip | |
apparmor: change how profile replacement update is done
remove the use of replaced by chaining and move to profile invalidation
and lookup to handle task replacement.
Replacement chaining can result in large chains of profiles being pinned
in memory when one profile in the chain is use. With implicit labeling
this will be even more of a problem, so move to a direct lookup method.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor/lsm.c')
| -rw-r--r-- | security/apparmor/lsm.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index 96506dfe51ec..c8c148a738f7 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -508,19 +508,21 @@ static int apparmor_getprocattr(struct task_struct *task, char *name, /* released below */ const struct cred *cred = get_task_cred(task); struct aa_task_cxt *cxt = cred_cxt(cred); + struct aa_profile *profile = NULL; if (strcmp(name, "current") == 0) - error = aa_getprocattr(aa_newest_version(cxt->profile), - value); + profile = aa_get_newest_profile(cxt->profile); else if (strcmp(name, "prev") == 0 && cxt->previous) - error = aa_getprocattr(aa_newest_version(cxt->previous), - value); + profile = aa_get_newest_profile(cxt->previous); else if (strcmp(name, "exec") == 0 && cxt->onexec) - error = aa_getprocattr(aa_newest_version(cxt->onexec), - value); + profile = aa_get_newest_profile(cxt->onexec); else error = -EINVAL; + if (profile) + error = aa_getprocattr(profile, value); + + aa_put_profile(profile); put_cred(cred); return error; |