From patchwork Wed Sep 15 17:16:05 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Johansen X-Patchwork-Id: 64855 X-Patchwork-Delegate: leann.ogasawara@canonical.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id 4D10EB6EEF for ; Thu, 16 Sep 2010 03:16:42 +1000 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.69) (envelope-from ) id 1Ovvb3-0001mi-6D; Wed, 15 Sep 2010 18:16:37 +0100 Received: from adelie.canonical.com ([91.189.90.139]) by chlorine.canonical.com with esmtp (Exim 4.69) (envelope-from ) id 1Ovvap-0001e1-4A for kernel-team@lists.ubuntu.com; Wed, 15 Sep 2010 18:16:23 +0100 Received: from hutte.canonical.com ([91.189.90.181]) by adelie.canonical.com with esmtp (Exim 4.69 #1 (Debian)) id 1Ovvam-0006v7-W2 for ; Wed, 15 Sep 2010 18:16:21 +0100 Received: from pool-96-225-211-211.ptldor.fios.verizon.net ([96.225.211.211] helo=canonical.com) by hutte.canonical.com with esmtpsa (TLS-1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.69) (envelope-from ) id 1Ovvam-00077D-Ki for kernel-team@lists.ubuntu.com; Wed, 15 Sep 2010 18:16:20 +0100 From: John Johansen To: kernel-team@lists.ubuntu.com Subject: [PATCH 2/3] UBUNTU: [Upstream] AppArmor: Fix locking from removal of profile namespace Date: Wed, 15 Sep 2010 10:16:05 -0700 Message-Id: <1284570966-6603-3-git-send-email-john.johansen@canonical.com> X-Mailer: git-send-email 1.7.1 In-Reply-To: <1284570966-6603-1-git-send-email-john.johansen@canonical.com> References: <1284570966-6603-1-git-send-email-john.johansen@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.9 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com BugLink: http://bugs.launchpad.net/bugs/615947 upstream commit: 74b1f2cea78bcb3dc084148cbcdff63de8fafd6e The locking for profile namespace removal is wrong, when removing a profile namespace, it needs to be removed from its parent's list. Lock the parent of namespace list instead of the namespace being removed. Signed-off-by: John Johansen Signed-off-by: James Morris --- security/apparmor/policy.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c index e3020ed..3b5da44 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c @@ -1152,12 +1152,14 @@ ssize_t aa_remove_profiles(char *fqname, size_t size) /* released below */ ns = aa_get_namespace(root); - write_lock(&ns->lock); if (!name) { /* remove namespace - can only happen if fqname[0] == ':' */ + write_lock(&ns->parent->lock); __remove_namespace(ns); + write_unlock(&ns->parent->lock); } else { /* remove profile */ + write_lock(&ns->lock); profile = aa_get_profile(__lookup_profile(&ns->base, name)); if (!profile) { error = -ENOENT; @@ -1166,8 +1168,8 @@ ssize_t aa_remove_profiles(char *fqname, size_t size) } name = profile->base.hname; __remove_profile(profile); + write_unlock(&ns->lock); } - write_unlock(&ns->lock); /* don't fail removal if audit fails */ (void) audit_policy(OP_PROF_RM, GFP_KERNEL, name, info, error);