Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1533169

[PATCH 4.4 12/21] apparmor: fix change_hat not finding hat after policy replacement

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: John Johansen <john.johansen@canonical.com>

commit 3d40658c977769ce2138f286cf131537bf68bdfe upstream.

After a policy replacement, the task cred may be out of date and need
to be updated. However change_hat is using the stale profiles from
the out of date cred resulting in either: a stale profile being applied
or, incorrect failure when searching for a hat profile as it has been
migrated to the new parent profile.

Fixes: 01e2b670aa898a39259bc85c78e3d74820f4d3b6 (failure to find hat)
Fixes: 898127c34ec03291c86f4ff3856d79e9e18952bc (stale policy being applied)
Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1000287
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 security/apparmor/domain.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -623,8 +623,8 @@ int aa_change_hat(const char *hats[], in
 	/* released below */
 	cred = get_current_cred();
 	cxt = cred_cxt(cred);
-	profile = aa_cred_profile(cred);
-	previous_profile = cxt->previous;
+	profile = aa_get_newest_profile(aa_cred_profile(cred));
+	previous_profile = aa_get_newest_profile(cxt->previous);
 
 	if (unconfined(profile)) {
 		info = "unconfined";
@@ -720,6 +720,8 @@ audit:
 out:
 	aa_put_profile(hat);
 	kfree(name);
+	aa_put_profile(profile);
+	aa_put_profile(previous_profile);
 	put_cred(cred);
 
 	return error;

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.4 00/21] 4.4.36-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-30 10:30 +0100
  [PATCH 4.4 07/21] USB: serial: ftdi_sio: add support for TI CC3200 LaunchPad Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-30 10:30 +0100
  [PATCH 4.4 15/21] parisc: Fix race in pci-dma.c Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-30 10:40 +0100
  [PATCH 4.4 06/21] USB: serial: cp210x: add ID for the Zone DPMX Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-30 10:40 +0100
  [PATCH 4.4 21/21] mei: fix return value on disconnection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-30 10:40 +0100
  [PATCH 4.4 17/21] mpi: Fix NULL ptr dereference in mpi_powm() [ver #3] Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-30 10:40 +0100
  [PATCH 4.4 20/21] mei: me: fix place for kaby point device ids. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-30 10:40 +0100
  [PATCH 4.4 05/21] usb: chipidea: move the lock initialization to core file Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-30 10:40 +0100
  [PATCH 4.4 19/21] mei: me: disable driver on SPT SPS firmware Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-30 11:00 +0100
  [PATCH 4.4 08/21] Fix USB CB/CBI storage devices with CONFIG_VMAP_STACK=y Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-30 11:00 +0100
  [PATCH 4.4 16/21] parisc: Also flush data TLB in flush_icache_page_asm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-30 11:00 +0100
  [PATCH 4.4 12/21] apparmor: fix change_hat not finding hat after policy replacement Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-30 11:10 +0100
  [PATCH 4.4 09/21] scsi: mpt3sas: Fix secure erase premature termination Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-30 11:10 +0100
  [PATCH 4.4 10/21] tile: avoid using clocksource_cyc2ns with absolute cycle count Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-30 11:10 +0100
  [PATCH 4.4 14/21] parisc: Fix races in parisc_setup_cache_timing() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-30 11:10 +0100
  [PATCH 4.4 13/21] NFSv4.x: hide array-bounds warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-30 11:10 +0100
  [PATCH 4.4 11/21] cfg80211: limit scan results cache size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-30 11:10 +0100
  Re: [PATCH 4.4 00/21] 4.4.36-stable review Andre Noll <maan@tuebingen.mpg.de> - 2016-11-30 14:50 +0100
    Re: [PATCH 4.4 00/21] 4.4.36-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-30 15:00 +0100
      Re: [PATCH 4.4 00/21] 4.4.36-stable review Andre Noll <maan@tuebingen.mpg.de> - 2016-11-30 15:10 +0100
        Re: [PATCH 4.4 00/21] 4.4.36-stable review Eric Dumazet <edumazet@google.com> - 2016-11-30 15:30 +0100
          Re: [PATCH 4.4 00/21] 4.4.36-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-11-30 15:40 +0100
        Re: [PATCH 4.4 00/21] 4.4.36-stable review David Miller <davem@davemloft.net> - 2016-11-30 16:00 +0100
          Re: [PATCH 4.4 00/21] 4.4.36-stable review Andre Noll <maan@tuebingen.mpg.de> - 2016-11-30 16:20 +0100
      Re: [PATCH 4.4 00/21] 4.4.36-stable review David Miller <davem@davemloft.net> - 2016-11-30 16:00 +0100
        Re: [PATCH 4.4 00/21] 4.4.36-stable review Greg KH <gregkh@linuxfoundation.org> - 2016-11-30 16:40 +0100
  Re: [PATCH 4.4 00/21] 4.4.36-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-11-30 17:10 +0100
  Re: [PATCH 4.4 00/21] 4.4.36-stable review Guenter Roeck <linux@roeck-us.net> - 2016-12-01 00:30 +0100

csiph-web