~ubuntu-branches/ubuntu/raring/apparmor/raring

« back to all changes in this revision

Viewing changes to kernel-patches/for-mainline/apparmor-inode_symlink.diff

• browse files at revision 1
• compare with another revision
• download diff
• download tarball
• view history from revision 1

Show diffs side-by-side

added

removed

kernel-patches/for-mainline/apparmor-inode_symlink.diff

 

1

Add missing inode_symlink hook

 

2

 

 

3

The lsm is missing the inode_symlink hook. Symlinks should be

 

4

treated like file creates, i.e., check for profile write access.

 

5

 

 

6

Index: b/security/apparmor/lsm.c

 

7

===================================================================

 

8

--- a/security/apparmor/lsm.c

 

9

+++ b/security/apparmor/lsm.c

 

10

@@ -341,6 +341,26 @@ out:

 

11

        return error;

 

12

 }

 

13

 

 

14

+static int apparmor_inode_symlink(struct inode *dir, struct dentry *dentry,

 

15

+                                 struct vfsmount *mnt, const char *old_name)

 

16

+{

 

17

+       struct aa_profile *active;

 

18

+       int error = 0;

 

19

+

 

20

+       if (!mnt || !mediated_filesystem(dir))

 

21

+               goto out;

 

22

+

 

23

+       active = get_active_aa_profile();

 

24

+

 

25

+       if (active)

 

26

+               error = aa_perm(active, dentry, mnt, MAY_WRITE);

 

27

+

 

28

+       put_aa_profile(active);

 

29

+

 

30

+out:

 

31

+       return error;

 

32

+}

 

33

+

 

34

 static int apparmor_inode_mknod(struct inode *dir, struct dentry *dentry,

 

35

                                struct vfsmount *mnt, int mode, dev_t dev)

 

36

 {

 

37

@@ -791,6 +811,7 @@ struct security_operations apparmor_ops 

 

38

        .inode_create =                 apparmor_inode_create,

 

39

        .inode_link =                   apparmor_inode_link,

 

40

        .inode_unlink =                 apparmor_inode_unlink,

 

41

+       .inode_symlink =                apparmor_inode_symlink,

 

42

        .inode_mknod =                  apparmor_inode_mknod,

 

43

        .inode_rename =                 apparmor_inode_rename,

 

44

        .inode_permission =             apparmor_inode_permission,

• Older »

Loggerhead is a web-based interface for Breezy
Version: 2.0.1