summaryrefslogtreecommitdiffstats
path: root/security/apparmor
diff options
context:
space:
mode:
authorJohn Johansen <john.johansen@canonical.com>2013-02-18 16:05:34 -0800
committerJohn Johansen <john.johansen@canonical.com>2013-04-28 00:36:20 -0700
commit7a2871b566f34d980556072943295efd107eb53c (patch)
tree7f991bd472872e62780ba9119d8e3a3784008dfc /security/apparmor
parent0ca554b9fca425eb58325a36290deef698cef34b (diff)
downloadop-kernel-dev-7a2871b566f34d980556072943295efd107eb53c.zip
op-kernel-dev-7a2871b566f34d980556072943295efd107eb53c.tar.gz
apparmor: use common fn to clear task_context for domain transitions
Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Steve Beattie <sbeattie@ubuntu.com>
Diffstat (limited to 'security/apparmor')
-rw-r--r--security/apparmor/context.c17
-rw-r--r--security/apparmor/domain.c6
-rw-r--r--security/apparmor/include/context.h13
3 files changed, 20 insertions, 16 deletions
diff --git a/security/apparmor/context.c b/security/apparmor/context.c
index 611e6ce..3f911af 100644
--- a/security/apparmor/context.c
+++ b/security/apparmor/context.c
@@ -105,16 +105,12 @@ int aa_replace_current_profile(struct aa_profile *profile)
return -ENOMEM;
cxt = new->security;
- if (unconfined(profile) || (cxt->profile->ns != profile->ns)) {
+ if (unconfined(profile) || (cxt->profile->ns != profile->ns))
/* if switching to unconfined or a different profile namespace
* clear out context state
*/
- aa_put_profile(cxt->previous);
- aa_put_profile(cxt->onexec);
- cxt->previous = NULL;
- cxt->onexec = NULL;
- cxt->token = 0;
- }
+ aa_clear_task_cxt_trans(cxt);
+
/* be careful switching cxt->profile, when racing replacement it
* is possible that cxt->profile->replacedby is the reference keeping
* @profile valid, so make sure to get its reference before dropping
@@ -222,11 +218,10 @@ int aa_restore_previous_profile(u64 token)
aa_get_profile(cxt->profile);
aa_put_profile(cxt->previous);
}
- /* clear exec && prev information when restoring to previous context */
+ /* ref has been transfered so avoid putting ref in clear_task_cxt */
cxt->previous = NULL;
- cxt->token = 0;
- aa_put_profile(cxt->onexec);
- cxt->onexec = NULL;
+ /* clear exec && prev information when restoring to previous context */
+ aa_clear_task_cxt_trans(cxt);
commit_creds(new);
return 0;
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index fb47d5b..07fcb09 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -512,11 +512,7 @@ x_clear:
cxt->profile = new_profile;
/* clear out all temporary/transitional state from the context */
- aa_put_profile(cxt->previous);
- aa_put_profile(cxt->onexec);
- cxt->previous = NULL;
- cxt->onexec = NULL;
- cxt->token = 0;
+ aa_clear_task_cxt_trans(cxt);
audit:
error = aa_audit_file(profile, &perms, GFP_KERNEL, OP_EXEC, MAY_EXEC,
diff --git a/security/apparmor/include/context.h b/security/apparmor/include/context.h
index 1e9443a..4cecad3 100644
--- a/security/apparmor/include/context.h
+++ b/security/apparmor/include/context.h
@@ -160,4 +160,17 @@ static inline struct aa_profile *aa_current_profile(void)
return profile;
}
+/**
+ * aa_clear_task_cxt_trans - clear transition tracking info from the cxt
+ * @cxt: task context to clear (NOT NULL)
+ */
+static inline void aa_clear_task_cxt_trans(struct aa_task_cxt *cxt)
+{
+ aa_put_profile(cxt->previous);
+ aa_put_profile(cxt->onexec);
+ cxt->previous = NULL;
+ cxt->onexec = NULL;
+ cxt->token = 0;
+}
+
#endif /* __AA_CONTEXT_H */
OpenPOWER on IntegriCloud