5 files changed, 42 insertions, 31 deletions

diff --git a/security/apparmor/.gitignore b/security/apparmor/.gitignore
index 4d995aeaebc..9cdec70d72b 100644
--- a/security/apparmor/.gitignore
+++ b/security/apparmor/.gitignore
@@ -1,6 +1,5 @@
 #
 # Generated include files
 #
-af_names.h
 capability_names.h
 rlim_names.h
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index c825c6e0b63..c1e18ba5bdc 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -67,13 +67,12 @@ static int may_change_ptraced_domain(struct task_struct *task,
         int error = 0;
 
         rcu_read_lock();
-        tracer = tracehook_tracer_task(task);
+        tracer = ptrace_parent(task);
         if (tracer) {
                 /* released below */
                 cred = get_task_cred(tracer);
                 tracerp = aa_cred_profile(cred);
         }
-        rcu_read_unlock();
 
         /* not ptraced */
         if (!tracer || unconfined(tracerp))
@@ -82,6 +81,7 @@ static int may_change_ptraced_domain(struct task_struct *task,
         error = aa_may_ptrace(tracer, tracerp, to_profile, PTRACE_MODE_ATTACH);
 
 out:
+        rcu_read_unlock();
         if (cred)
                 put_cred(cred);
 
diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c
index 506d2baf614..b82e383beb7 100644
--- a/security/apparmor/lib.c
+++ b/security/apparmor/lib.c
@@ -12,6 +12,7 @@
  * License.
  */
 
+#include <linux/mm.h>
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/vmalloc.h>
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 3d2fd141dff..37832026e58 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -127,7 +127,7 @@ static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective,
         *inheritable = cred->cap_inheritable;
         *permitted = cred->cap_permitted;
 
-        if (!unconfined(profile)) {
+        if (!unconfined(profile) && !COMPLAIN_MODE(profile)) {
                 *effective = cap_intersect(*effective, profile->caps.allow);
                 *permitted = cap_intersect(*permitted, profile->caps.allow);
         }
diff --git a/security/apparmor/path.c b/security/apparmor/path.c
index 36cc0cc39e7..b566eba4a65 100644
--- a/security/apparmor/path.c
+++ b/security/apparmor/path.c
@@ -57,23 +57,44 @@ static int prepend(char **buffer, int buflen, const char *str, int namelen)
 static int d_namespace_path(struct path *path, char *buf, int buflen,
                             char **name, int flags)
 {
-        struct path root, tmp;
         char *res;
-        int connected, error = 0;
+        int error = 0;
+        int connected = 1;
+
+        if (path->mnt->mnt_flags & MNT_INTERNAL) {
+                /* it's not mounted anywhere */
+                res = dentry_path(path->dentry, buf, buflen);
+                *name = res;
+                if (IS_ERR(res)) {
+                        *name = buf;
+                        return PTR_ERR(res);
+                }
+                if (path->dentry->d_sb->s_magic == PROC_SUPER_MAGIC &&
+                    strncmp(*name, "/sys/", 5) == 0) {
+                        /* TODO: convert over to using a per namespace
+                         * control instead of hard coded /proc
+                         */
+                        return prepend(name, *name - buf, "/proc", 5);
+                }
+                return 0;
+        }
 
-        /* Get the root we want to resolve too, released below */
+        /* resolve paths relative to chroot?*/
         if (flags & PATH_CHROOT_REL) {
-                /* resolve paths relative to chroot */
+                struct path root;
                 get_fs_root(current->fs, &root);
-        } else {
-                /* resolve paths relative to namespace */
-                root.mnt = current->nsproxy->mnt_ns->root;
-                root.dentry = root.mnt->mnt_root;
-                path_get(&root);
+                res = __d_path(path, &root, buf, buflen);
+                if (res && !IS_ERR(res)) {
+                        /* everything's fine */
+                        *name = res;
+                        path_put(&root);
+                        goto ok;
+                }
+                path_put(&root);
+                connected = 0;
         }
 
-        tmp = root;
-        res = __d_path(path, &tmp, buf, buflen);
+        res = d_absolute_path(path, buf, buflen);
 
         *name = res;
         /* handle error conditions - and still allow a partial path to
@@ -84,7 +105,10 @@ static int d_namespace_path(struct path *path, char *buf, int buflen,
                 *name = buf;
                 goto out;
         }
+        if (!our_mnt(path->mnt))
+                connected = 0;
 
+ok:
         /* Handle two cases:
          * 1. A deleted dentry && profile is not allowing mediation of deleted
          * 2. On some filesystems, newly allocated dentries appear to the
@@ -97,10 +121,7 @@ static int d_namespace_path(struct path *path, char *buf, int buflen,
                         goto out;
         }
 
-        /* Determine if the path is connected to the expected root */
-        connected = tmp.dentry == root.dentry && tmp.mnt == root.mnt;
-
-        /* If the path is not connected,
+        /* If the path is not connected to the expected root,
          * check if it is a sysctl and handle specially else remove any
          * leading / that __d_path may have returned.
          * Unless
@@ -112,17 +133,9 @@ static int d_namespace_path(struct path *path, char *buf, int buflen,
          *     namespace root.
          */
         if (!connected) {
-                /* is the disconnect path a sysctl? */
-                if (tmp.dentry->d_sb->s_magic == PROC_SUPER_MAGIC &&
-                    strncmp(*name, "/sys/", 5) == 0) {
-                        /* TODO: convert over to using a per namespace
-                         * control instead of hard coded /proc
-                         */
-                        error = prepend(name, *name - buf, "/proc", 5);
-                } else if (!(flags & PATH_CONNECT_PATH) &&
+                if (!(flags & PATH_CONNECT_PATH) &&
                            !(((flags & CHROOT_NSCONNECT) == CHROOT_NSCONNECT) &&
-                             (tmp.mnt == current->nsproxy->mnt_ns->root &&
-                              tmp.dentry == tmp.mnt->mnt_root))) {
+                             our_mnt(path->mnt))) {
                         /* disconnected path, don't return pathname starting
                          * with '/'
                          */
@@ -133,8 +146,6 @@ static int d_namespace_path(struct path *path, char *buf, int buflen,
         }
 
 out:
-        path_put(&root);
-
         return error;
 }