[PATCH 03/11] AppArmor: Take refcount on cxt->profile to ensure it remains a valid reference

john.johansen at canonical.com john.johansen at canonical.com
Tue Apr 13 07:09:32 UTC 2010

From: John Johansen <john.johansen at canonical.com>

OriginalAuthor: John Johansen <john.johansen at canonical.com>
OriginalLocation: git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparm$
commit: ea35fcdcec2316aa57f2d9d5c9ed9002d90b9607
BugLink: http://bugs.launchpad.net/bugs/367499

A reference for a profile is not obtained from aa_newest_version(cxt->profile)
this would normally be valid as cxt->profile will hold a reference keeping
the profile valid, however cxt->profiles reference is replaced with the
new_profile reference
	/* transfer new profile reference will be released when cxt is freed */
	cxt->profile = new_profile;

before we are done referencing profile in

so obtain a reference to profile for the duration of the function.

Signed-off-by: John Johansen <john.johansen at canonical.com>
 security/apparmor/domain.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 2721fcb..7af454f 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -350,7 +350,7 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
 	cxt = bprm->cred->security;
-	profile = aa_newest_version(cxt->profile);
+	profile = aa_get_profile(aa_newest_version(cxt->profile));
 	 * get the namespace from the replacement profile as replacement
 	 * can change the namespace
@@ -480,6 +480,7 @@ audit:
 	sa.base.error = aa_audit_file(profile, &sa);
+	aa_put_profile(profile);
 	return sa.base.error;

More information about the kernel-team mailing list