diff options
| author | John Johansen <john.johansen@canonical.com> | 2013-07-10 21:07:43 -0700 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2013-08-14 11:42:06 -0700 |
| commit | 77b071b34045a0c65d0e1f85f3d47fd2b8b7a8a1 (patch) | |
| tree | b0b2c38b79969ac7b9439389888f6a1ac14a32a7 /security/apparmor/domain.c | |
| parent | 01e2b670aa898a39259bc85c78e3d74820f4d3b6 (diff) | |
| download | op-kernel-dev-77b071b34045a0c65d0e1f85f3d47fd2b8b7a8a1.zip op-kernel-dev-77b071b34045a0c65d0e1f85f3d47fd2b8b7a8a1.tar.gz | |
apparmor: change how profile replacement update is done
remove the use of replaced by chaining and move to profile invalidation
and lookup to handle task replacement.
Replacement chaining can result in large chains of profiles being pinned
in memory when one profile in the chain is use. With implicit labeling
this will be even more of a problem, so move to a direct lookup method.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor/domain.c')
| -rw-r--r-- | security/apparmor/domain.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c index 454bcd7..5488d09 100644 --- a/security/apparmor/domain.c +++ b/security/apparmor/domain.c @@ -359,7 +359,7 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm) cxt = cred_cxt(bprm->cred); BUG_ON(!cxt); - profile = aa_get_profile(aa_newest_version(cxt->profile)); + profile = aa_get_newest_profile(cxt->profile); /* * get the namespace from the replacement profile as replacement * can change the namespace @@ -417,7 +417,7 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm) if (!(cp.allow & AA_MAY_ONEXEC)) goto audit; - new_profile = aa_get_profile(aa_newest_version(cxt->onexec)); + new_profile = aa_get_newest_profile(cxt->onexec); goto apply; } |
