kernel.git/security/apparmor/policy.c, branch linux-4.14.y

apparmor: fix leak of null profile name if profile allocation fails

2017-12-14T08:53:06Z

[ Upstream commit 4633307e5ed6128975595df43f796a10c41d11c1 ] Fixes: d07881d2edb0 ("apparmor: move new_null_profile to after profile lookup fns()") Reported-by: Seth Arnold Signed-off-by: John Johansen Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

apparmor: fix race condition in null profile creation

2017-09-22T20:00:58Z

There is a race when null- profile is being created between the initial lookup/creation of the profile and lock/addition of the profile. This could result in multiple version of a profile being added to the list which need to be removed/replaced. Since these are learning profile their is no affect on mediation. Signed-off-by: John Johansen

apparmor: move new_null_profile to after profile lookup fns()

2017-09-22T20:00:58Z

new_null_profile will need to use some of the profile lookup fns() so move instead of doing forward fn declarations. Signed-off-by: John Johansen

apparmor: switch from profiles to using labels on contexts

2017-06-11T00:11:38Z

Begin the actual switch to using domain labels by storing them on the context and converting the label to a singular profile where possible. Signed-off-by: John Johansen

apparmor: cleanup remove unused and not fully implemented profile rename

2017-06-11T00:11:36Z

Remove the partially implemented code, until this can be properly implemented. Signed-off-by: John Johansen

apparmor: refactor updating profiles to the newest parent

2017-06-11T00:11:35Z

Signed-off-by: John Johansen

apparmor: share profile name on replacement

2017-06-11T00:11:35Z

The profile names are the same, leverage this. Signed-off-by: John Johansen

apparmor: fix policy load/remove semantics

2017-06-11T00:11:32Z

The namespace being passed into the replace/remove profiles fns() is not the view, but the namespace specified by the inode from the file hook (if present) or the loading tasks ns, if accessing the top level virtualized load/replace file interface. Signed-off-by: John Johansen

apparmor: add namespace lookup fns()

2017-06-11T00:11:32Z

Currently lookups are restricted to a single ns component in the path. However when namespaces are allowed to have separate views, and scopes this will not be sufficient, as it will be possible to have a multiple component ns path in scope. Add some ns lookup fns() to allow this and use them. Signed-off-by: John Johansen

apparmor: cleanup __find_child()

2017-06-11T00:11:31Z

Signed-off-by: John Johansen