diff options
Diffstat (limited to 'security/apparmor/file.c')
-rw-r--r-- | security/apparmor/file.c | 21 |
1 files changed, 8 insertions, 13 deletions
diff --git a/security/apparmor/file.c b/security/apparmor/file.c index 7312db741219..3022c0f4f0db 100644 --- a/security/apparmor/file.c +++ b/security/apparmor/file.c | |||
@@ -173,8 +173,6 @@ static u32 map_old_perms(u32 old) | |||
173 | if (old & 0x40) /* AA_EXEC_MMAP */ | 173 | if (old & 0x40) /* AA_EXEC_MMAP */ |
174 | new |= AA_EXEC_MMAP; | 174 | new |= AA_EXEC_MMAP; |
175 | 175 | ||
176 | new |= AA_MAY_META_READ; | ||
177 | |||
178 | return new; | 176 | return new; |
179 | } | 177 | } |
180 | 178 | ||
@@ -212,6 +210,7 @@ static struct file_perms compute_perms(struct aa_dfa *dfa, unsigned int state, | |||
212 | perms.quiet = map_old_perms(dfa_other_quiet(dfa, state)); | 210 | perms.quiet = map_old_perms(dfa_other_quiet(dfa, state)); |
213 | perms.xindex = dfa_other_xindex(dfa, state); | 211 | perms.xindex = dfa_other_xindex(dfa, state); |
214 | } | 212 | } |
213 | perms.allow |= AA_MAY_META_READ; | ||
215 | 214 | ||
216 | /* change_profile wasn't determined by ownership in old mapping */ | 215 | /* change_profile wasn't determined by ownership in old mapping */ |
217 | if (ACCEPT_TABLE(dfa)[state] & 0x80000000) | 216 | if (ACCEPT_TABLE(dfa)[state] & 0x80000000) |
@@ -279,22 +278,16 @@ int aa_path_perm(int op, struct aa_profile *profile, struct path *path, | |||
279 | int error; | 278 | int error; |
280 | 279 | ||
281 | flags |= profile->path_flags | (S_ISDIR(cond->mode) ? PATH_IS_DIR : 0); | 280 | flags |= profile->path_flags | (S_ISDIR(cond->mode) ? PATH_IS_DIR : 0); |
282 | error = aa_get_name(path, flags, &buffer, &name); | 281 | error = aa_path_name(path, flags, &buffer, &name, &info); |
283 | if (error) { | 282 | if (error) { |
284 | if (error == -ENOENT && is_deleted(path->dentry)) { | 283 | if (error == -ENOENT && is_deleted(path->dentry)) { |
285 | /* Access to open files that are deleted are | 284 | /* Access to open files that are deleted are |
286 | * give a pass (implicit delegation) | 285 | * give a pass (implicit delegation) |
287 | */ | 286 | */ |
288 | error = 0; | 287 | error = 0; |
288 | info = NULL; | ||
289 | perms.allow = request; | 289 | perms.allow = request; |
290 | } else if (error == -ENOENT) | 290 | } |
291 | info = "Failed name lookup - deleted entry"; | ||
292 | else if (error == -ESTALE) | ||
293 | info = "Failed name lookup - disconnected path"; | ||
294 | else if (error == -ENAMETOOLONG) | ||
295 | info = "Failed name lookup - name too long"; | ||
296 | else | ||
297 | info = "Failed name lookup"; | ||
298 | } else { | 291 | } else { |
299 | aa_str_perms(profile->file.dfa, profile->file.start, name, cond, | 292 | aa_str_perms(profile->file.dfa, profile->file.start, name, cond, |
300 | &perms); | 293 | &perms); |
@@ -365,12 +358,14 @@ int aa_path_link(struct aa_profile *profile, struct dentry *old_dentry, | |||
365 | lperms = nullperms; | 358 | lperms = nullperms; |
366 | 359 | ||
367 | /* buffer freed below, lname is pointer in buffer */ | 360 | /* buffer freed below, lname is pointer in buffer */ |
368 | error = aa_get_name(&link, profile->path_flags, &buffer, &lname); | 361 | error = aa_path_name(&link, profile->path_flags, &buffer, &lname, |
362 | &info); | ||
369 | if (error) | 363 | if (error) |
370 | goto audit; | 364 | goto audit; |
371 | 365 | ||
372 | /* buffer2 freed below, tname is pointer in buffer2 */ | 366 | /* buffer2 freed below, tname is pointer in buffer2 */ |
373 | error = aa_get_name(&target, profile->path_flags, &buffer2, &tname); | 367 | error = aa_path_name(&target, profile->path_flags, &buffer2, &tname, |
368 | &info); | ||
374 | if (error) | 369 | if (error) |
375 | goto audit; | 370 | goto audit; |
376 | 371 | ||