~ubuntu-branches/ubuntu/oneiric/apparmor/oneiric-security

« back to all changes in this revision

Viewing changes to kernel-patches/for-mainline/apparmor-inode_symlink.diff

• browse files at revision 6
• compare with another revision
• download diff
• download tarball
• view history from revision 6

Show diffs side-by-side

added

removed

kernel-patches/for-mainline/apparmor-inode_symlink.diff

1

 

Add missing inode_symlink hook

2

 

 

3

 

The lsm is missing the inode_symlink hook. Symlinks should be

4

 

treated like file creates, i.e., check for profile write access.

5

 

 

6

 

Index: b/security/apparmor/lsm.c

7

 

===================================================================

8

 

--- a/security/apparmor/lsm.c

9

 

+++ b/security/apparmor/lsm.c

10

 

@@ -341,6 +341,26 @@ out:

11

 

        return error;

12

 

 }

13

 

 

14

 

+static int apparmor_inode_symlink(struct inode *dir, struct dentry *dentry,

15

 

+                                 struct vfsmount *mnt, const char *old_name)

16

 

+{

17

 

+       struct aa_profile *active;

18

 

+       int error = 0;

19

 

+

20

 

+       if (!mnt || !mediated_filesystem(dir))

21

 

+               goto out;

22

 

+

23

 

+       active = get_active_aa_profile();

24

 

+

25

 

+       if (active)

26

 

+               error = aa_perm(active, dentry, mnt, MAY_WRITE);

27

 

+

28

 

+       put_aa_profile(active);

29

 

+

30

 

+out:

31

 

+       return error;

32

 

+}

33

 

+

34

 

 static int apparmor_inode_mknod(struct inode *dir, struct dentry *dentry,

35

 

                                struct vfsmount *mnt, int mode, dev_t dev)

36

 

 {

37

 

@@ -791,6 +811,7 @@ struct security_operations apparmor_ops 

38

 

        .inode_create =                 apparmor_inode_create,

39

 

        .inode_link =                   apparmor_inode_link,

40

 

        .inode_unlink =                 apparmor_inode_unlink,

41

 

+       .inode_symlink =                apparmor_inode_symlink,

42

 

        .inode_mknod =                  apparmor_inode_mknod,

43

 

        .inode_rename =                 apparmor_inode_rename,

44

 

        .inode_permission =             apparmor_inode_permission,

• Older »

Loggerhead is a web-based interface for Breezy
Version: 2.0.1