diff options
| author | John Johansen <john.johansen@canonical.com> | 2012-05-16 11:00:05 -0700 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2012-05-18 11:09:28 -0700 |
| commit | bf83208e0b7f5938f5a7f6d9dfa9960bf04692fa (patch) | |
| tree | 6c3d31ea4f48a684c87504c229c7db474119437a /security | |
| parent | fbbb456347b21279a379b42eeb31151c33d8dd49 (diff) | |
apparmor: fix profile lookup for unconfined
BugLink: http://bugs.launchpad.net/bugs/978038
also affects apparmor portion of
BugLink: http://bugs.launchpad.net/bugs/987371
The unconfined profile is not stored in the regular profile list, but
change_profile and exec transitions may want access to it when setting
up specialized transitions like switch to the unconfined profile of a
new policy namespace.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security')
| -rw-r--r-- | security/apparmor/policy.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c index f1f7506a464d..7f3f455d8eab 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c @@ -903,6 +903,10 @@ struct aa_profile *aa_lookup_profile(struct aa_namespace *ns, const char *hname) profile = aa_get_profile(__lookup_profile(&ns->base, hname)); read_unlock(&ns->lock); + /* the unconfined profile is not in the regular profile list */ + if (!profile && strcmp(hname, "unconfined") == 0) + profile = aa_get_profile(ns->unconfined); + /* refcount released by caller */ return profile; } |