From bf83208e0b7f5938f5a7f6d9dfa9960bf04692fa Mon Sep 17 00:00:00 2001 From: John Johansen Date: Wed, 16 May 2012 11:00:05 -0700 Subject: apparmor: fix profile lookup for unconfined BugLink: http://bugs.launchpad.net/bugs/978038 also affects apparmor portion of BugLink: http://bugs.launchpad.net/bugs/987371 The unconfined profile is not stored in the regular profile list, but change_profile and exec transitions may want access to it when setting up specialized transitions like switch to the unconfined profile of a new policy namespace. Signed-off-by: John Johansen --- security/apparmor/policy.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'security/apparmor') diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c index f1f7506a464d..7f3f455d8eab 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c @@ -903,6 +903,10 @@ struct aa_profile *aa_lookup_profile(struct aa_namespace *ns, const char *hname) profile = aa_get_profile(__lookup_profile(&ns->base, hname)); read_unlock(&ns->lock); + /* the unconfined profile is not in the regular profile list */ + if (!profile && strcmp(hname, "unconfined") == 0) + profile = aa_get_profile(ns->unconfined); + /* refcount released by caller */ return profile; } -- cgit v1.2.3