diff options
| author | John Johansen <john.johansen@canonical.com> | 2010-08-27 18:33:29 -0700 |
|---|---|---|
| committer | James Morris <jmorris@namei.org> | 2010-09-08 09:19:34 +1000 |
| commit | 999b4f0aa2314b76857775334cb94bafa053db64 (patch) | |
| tree | 0b2b9e6d54415d0d6f6ff59526c68108c09d1fd7 /security | |
| parent | 04ccd53f09741c4bc54ab36db000bc1383e4812e (diff) | |
| download | lwn-999b4f0aa2314b76857775334cb94bafa053db64.tar.gz lwn-999b4f0aa2314b76857775334cb94bafa053db64.zip | |
AppArmor: Fix locking from removal of profile namespace
The locking for profile namespace removal is wrong, when removing a
profile namespace, it needs to be removed from its parent's list.
Lock the parent of namespace list instead of the namespace being removed.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security')
| -rw-r--r-- | security/apparmor/policy.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c index 3cdc1ad0787e..52cc865f1464 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c @@ -1151,12 +1151,14 @@ ssize_t aa_remove_profiles(char *fqname, size_t size) /* released below */ ns = aa_get_namespace(root); - write_lock(&ns->lock); if (!name) { /* remove namespace - can only happen if fqname[0] == ':' */ + write_lock(&ns->parent->lock); __remove_namespace(ns); + write_unlock(&ns->parent->lock); } else { /* remove profile */ + write_lock(&ns->lock); profile = aa_get_profile(__lookup_profile(&ns->base, name)); if (!profile) { error = -ENOENT; @@ -1165,8 +1167,8 @@ ssize_t aa_remove_profiles(char *fqname, size_t size) } name = profile->base.hname; __remove_profile(profile); + write_unlock(&ns->lock); } - write_unlock(&ns->lock); /* don't fail removal if audit fails */ (void) audit_policy(OP_PROF_RM, GFP_KERNEL, name, info, error); |