[PATCH 03/11] AppArmor: Take refcount on cxt->profile to ensure it remains a valid reference
john.johansen at canonical.com
john.johansen at canonical.com
Tue Apr 13 07:09:32 UTC 2010
From: John Johansen <john.johansen at canonical.com>
OriginalAuthor: John Johansen <john.johansen at canonical.com>
OriginalLocation: git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparm$
commit: ea35fcdcec2316aa57f2d9d5c9ed9002d90b9607
BugLink: http://bugs.launchpad.net/bugs/367499
A reference for a profile is not obtained from aa_newest_version(cxt->profile)
this would normally be valid as cxt->profile will hold a reference keeping
the profile valid, however cxt->profiles reference is replaced with the
new_profile reference
aa_put_profile(cxt->profile);
/* transfer new profile reference will be released when cxt is freed */
cxt->profile = new_profile;
before we are done referencing profile in
aa_audit_file(profile,
so obtain a reference to profile for the duration of the function.
Signed-off-by: John Johansen <john.johansen at canonical.com>
---
security/apparmor/domain.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 2721fcb..7af454f 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -350,7 +350,7 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm)
cxt = bprm->cred->security;
BUG_ON(!cxt);
- profile = aa_newest_version(cxt->profile);
+ profile = aa_get_profile(aa_newest_version(cxt->profile));
/*
* get the namespace from the replacement profile as replacement
* can change the namespace
@@ -480,6 +480,7 @@ audit:
sa.base.error = aa_audit_file(profile, &sa);
cleanup:
+ aa_put_profile(profile);
kfree(buffer);
return sa.base.error;
--
1.7.0
More information about the kernel-team
mailing list