diff options
| author | John Johansen <john.johansen@canonical.com> | 2017-06-10 00:07:02 +0300 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2017-06-11 03:11:40 +0300 |
| commit | c70c86c421427fd8487867de66c4104b15abd772 (patch) | |
| tree | 0d742b0b9d2f2972b1f93aea3caf1a6c87b3b91b /security/apparmor/lsm.c | |
| parent | 317d9a054e1c6d5f18b02b99ce09911942f8e603 (diff) | |
| download | linux-c70c86c421427fd8487867de66c4104b15abd772.tar.xz | |
apparmor: move capability checks to using labels
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor/lsm.c')
| -rw-r--r-- | security/apparmor/lsm.c | 20 |
1 files changed, 14 insertions, 6 deletions
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index f7f82ce00d73..bcfdcdb3eae2 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -117,20 +117,28 @@ static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted) { struct aa_label *label; - struct aa_profile *profile; const struct cred *cred; rcu_read_lock(); cred = __task_cred(target); label = aa_get_newest_cred_label(cred); - profile = labels_profile(label); + /* * cap_capget is stacked ahead of this and will * initialize effective and permitted. */ - if (!profile_unconfined(profile) && !COMPLAIN_MODE(profile)) { - *effective = cap_intersect(*effective, profile->caps.allow); - *permitted = cap_intersect(*permitted, profile->caps.allow); + if (!unconfined(label)) { + struct aa_profile *profile; + struct label_it i; + + label_for_each_confined(i, label, profile) { + if (COMPLAIN_MODE(profile)) + continue; + *effective = cap_intersect(*effective, + profile->caps.allow); + *permitted = cap_intersect(*permitted, + profile->caps.allow); + } } rcu_read_unlock(); aa_put_label(label); @@ -146,7 +154,7 @@ static int apparmor_capable(const struct cred *cred, struct user_namespace *ns, label = aa_get_newest_cred_label(cred); if (!unconfined(label)) - error = aa_capable(labels_profile(label), cap, audit); + error = aa_capable(label, cap, audit); aa_put_label(label); return error; |