mirror of
https://git.proxmox.com/git/mirror_lxc
synced 2025-08-03 13:43:07 +00:00
apparmor: do not call aa_change_profile()
We can simply write the label ourselves. There's no magic happening. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
This commit is contained in:
parent
d3ba7c9872
commit
5288a74faa
@ -25,11 +25,10 @@
|
||||
#include <sys/types.h>
|
||||
#include <sys/stat.h>
|
||||
#include <sys/mount.h>
|
||||
#include <sys/apparmor.h>
|
||||
#include <sys/vfs.h>
|
||||
|
||||
#include "log.h"
|
||||
#include "lsm/lsm.h"
|
||||
#include "lsm.h"
|
||||
#include "conf.h"
|
||||
#include "utils.h"
|
||||
|
||||
@ -174,6 +173,8 @@ static bool aa_needs_transition(char *curlabel)
|
||||
static int apparmor_process_label_set(const char *inlabel, struct lxc_conf *conf,
|
||||
bool use_default, bool on_exec)
|
||||
{
|
||||
int label_fd, ret;
|
||||
pid_t tid;
|
||||
const char *label = inlabel ? inlabel : conf->lsm_aa_profile;
|
||||
char *curlabel;
|
||||
|
||||
@ -230,12 +231,21 @@ static int apparmor_process_label_set(const char *inlabel, struct lxc_conf *conf
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (aa_change_profile(label) < 0) {
|
||||
SYSERROR("failed to change apparmor profile to %s", label);
|
||||
tid = lxc_raw_gettid();
|
||||
label_fd = lsm_process_label_fd_get(tid, on_exec);
|
||||
if (label_fd < 0) {
|
||||
SYSERROR("Failed to change apparmor profile to %s", label);
|
||||
return -1;
|
||||
}
|
||||
|
||||
INFO("changed apparmor profile to %s", label);
|
||||
ret = lsm_process_label_set_at(label_fd, label, on_exec);
|
||||
close(label_fd);
|
||||
if (ret < 0) {
|
||||
SYSERROR("Failed to change apparmor profile to %s", label);
|
||||
return -1;
|
||||
}
|
||||
|
||||
INFO("Changed apparmor profile to %s", label);
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
@ -541,4 +541,13 @@ static inline uint64_t lxc_getpagesize(void)
|
||||
*/
|
||||
extern uint64_t lxc_find_next_power2(uint64_t n);
|
||||
|
||||
static inline pid_t lxc_raw_gettid(void)
|
||||
{
|
||||
#ifdef SYS_gettid
|
||||
return syscall(SYS_gettid);
|
||||
#else
|
||||
return lxc_raw_getpid();
|
||||
#endif
|
||||
}
|
||||
|
||||
#endif /* __LXC_UTILS_H */
|
||||
|
Loading…
Reference in New Issue
Block a user