diff options
| author | John Johansen | 2017-01-16 09:42:36 +0100 |
|---|---|---|
| committer | John Johansen | 2017-01-16 10:18:30 +0100 |
| commit | 181f7c977680dcd86eb71ad4b37239d2a385c3ad (patch) | |
| tree | 300234ca9b4afe6b23f462570a7ababcdc8ffd2a /security/apparmor/domain.c | |
| parent | apparmor: pass gfp_t parameter into profile allocation (diff) | |
| download | kernel-qcow2-linux-181f7c977680dcd86eb71ad4b37239d2a385c3ad.tar.gz kernel-qcow2-linux-181f7c977680dcd86eb71ad4b37239d2a385c3ad.tar.xz kernel-qcow2-linux-181f7c977680dcd86eb71ad4b37239d2a385c3ad.zip | |
apparmor: name null-XXX profiles after the executable
When possible its better to name a learning profile after the missing
profile in question. This allows for both more informative names and
for profile reuse.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor/domain.c')
| -rw-r--r-- | security/apparmor/domain.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c index 503cb2c54447..1a8ffc577009 100644 --- a/security/apparmor/domain.c +++ b/security/apparmor/domain.c @@ -442,7 +442,8 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm) } } else if (COMPLAIN_MODE(profile)) { /* no exec permission - are we in learning mode */ - new_profile = aa_new_null_profile(profile, 0); + new_profile = aa_new_null_profile(profile, false, name, + GFP_ATOMIC); if (!new_profile) { error = -ENOMEM; info = "could not create null profile"; @@ -667,7 +668,8 @@ int aa_change_hat(const char *hats[], int count, u64 token, bool permtest) aa_put_profile(root); target = name; /* released below */ - hat = aa_new_null_profile(profile, 1); + hat = aa_new_null_profile(profile, true, hats[0], + GFP_KERNEL); if (!hat) { info = "failed null profile create"; error = -ENOMEM; @@ -815,7 +817,7 @@ int aa_change_profile(const char *ns_name, const char *hname, bool onexec, if (permtest || !COMPLAIN_MODE(profile)) goto audit; /* released below */ - target = aa_new_null_profile(profile, 0); + target = aa_new_null_profile(profile, false, hname, GFP_KERNEL); if (!target) { info = "failed null profile create"; error = -ENOMEM; |