diff options
| author | Casey Schaufler <casey@schaufler-ca.com> | 2024-10-24 00:21:58 +0300 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2024-12-04 22:59:57 +0300 |
| commit | a4626e978677e3d3e816fdc217d8416c8b9462ae (patch) | |
| tree | 485d2f1f276cb40d726168ee7d2b3ec15b2c9fda /security/apparmor | |
| parent | b530104f50e86db6f187d39fed5821b3cca755ee (diff) | |
| download | linux-a4626e978677e3d3e816fdc217d8416c8b9462ae.tar.xz | |
lsm: secctx provider check on release
Verify that the LSM releasing the secctx is the LSM that
allocated it. This was not necessary when only one LSM could
create a secctx, but once there can be more than one it is.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
[PM: subject tweak]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security/apparmor')
| -rw-r--r-- | security/apparmor/secid.c | 13 |
1 files changed, 5 insertions, 8 deletions
diff --git a/security/apparmor/secid.c b/security/apparmor/secid.c index b08969ec34b7..28caf66b9033 100644 --- a/security/apparmor/secid.c +++ b/security/apparmor/secid.c @@ -108,14 +108,11 @@ int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) void apparmor_release_secctx(struct lsm_context *cp) { - /* - * stacking scaffolding: - * When it is possible for more than one LSM to provide a - * release hook, do this check: - * if (cp->id == LSM_ID_APPARMOR || cp->id == LSM_ID_UNDEF) - */ - - kfree(cp->context); + if (cp->id == LSM_ID_APPARMOR) { + kfree(cp->context); + cp->context = NULL; + cp->id = LSM_ID_UNDEF; + } } /** |