summaryrefslogtreecommitdiffstats
path: root/security/apparmor
diff options
context:
space:
mode:
authorKees Cook <keescook@chromium.org>2014-05-21 15:23:46 -0700
committerKees Cook <keescook@chromium.org>2014-07-18 12:13:38 -0700
commit1d4457f99928a968767f6405b4a1f50845aa15fd (patch)
tree522641b08f4a465035910a74a3871ad38e62df01 /security/apparmor
parent8855d608c145c1ca0e26f4da00741080bb49d80d (diff)
downloadlinux-1d4457f99928a968767f6405b4a1f50845aa15fd.tar.gz
linux-1d4457f99928a968767f6405b4a1f50845aa15fd.tar.bz2
linux-1d4457f99928a968767f6405b4a1f50845aa15fd.zip
sched: move no_new_privs into new atomic flags
Since seccomp transitions between threads requires updates to the no_new_privs flag to be atomic, the flag must be part of an atomic flag set. This moves the nnp flag into a separate task field, and introduces accessors. Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Oleg Nesterov <oleg@redhat.com> Reviewed-by: Andy Lutomirski <luto@amacapital.net>
Diffstat (limited to 'security/apparmor')
-rw-r--r--security/apparmor/domain.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 452567d3a08e..d97cba3e3849 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -621,7 +621,7 @@ int aa_change_hat(const char *hats[], int count, u64 token, bool permtest)
* There is no exception for unconfined as change_hat is not
* available.
*/
- if (current->no_new_privs)
+ if (task_no_new_privs(current))
return -EPERM;
/* released below */
@@ -776,7 +776,7 @@ int aa_change_profile(const char *ns_name, const char *hname, bool onexec,
* no_new_privs is set because this aways results in a reduction
* of permissions.
*/
- if (current->no_new_privs && !unconfined(profile)) {
+ if (task_no_new_privs(current) && !unconfined(profile)) {
put_cred(cred);
return -EPERM;
}