proxmox-mirrors/mirror_lxc
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_lxc synced 2025-08-14 01:39:59 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

apparmor: do not call aa_change_profile()

Browse Source 
We can simply write the label ourselves. There's no magic happening.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
This commit is contained in:
Christian Brauner 2018-01-22 12:02:44 +01:00
parent d3ba7c9872
commit 5288a74faa
No known key found for this signature in database
GPG Key ID: 8EB056D53EECB12D
2 changed files with 24 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
src/lxc/lsm/apparmor.c
View File

@ -25,11 +25,10 @@
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/mount.h>
#include <sys/apparmor.h>
#include <sys/vfs.h>
#include "log.h"
#include "lsm/lsm.h"
#include "lsm.h"
#include "conf.h"
#include "utils.h"
@ -174,6 +173,8 @@ static bool aa_needs_transition(char *curlabel)
static int apparmor_process_label_set(const char *inlabel, struct lxc_conf *conf,
bool use_default, bool on_exec)
{
int label_fd, ret;
pid_t tid;
const char *label = inlabel ? inlabel : conf->lsm_aa_profile;
char *curlabel;
@ -230,12 +231,21 @@ static int apparmor_process_label_set(const char *inlabel, struct lxc_conf *conf
return 0;
}
if (aa_change_profile(label) < 0) {
SYSERROR("failed to change apparmor profile to %s", label);
tid = lxc_raw_gettid();
label_fd = lsm_process_label_fd_get(tid, on_exec);
if (label_fd < 0) {
SYSERROR("Failed to change apparmor profile to %s", label);
return -1;
}
INFO("changed apparmor profile to %s", label);
ret = lsm_process_label_set_at(label_fd, label, on_exec);
close(label_fd);
if (ret < 0) {
SYSERROR("Failed to change apparmor profile to %s", label);
return -1;
}
INFO("Changed apparmor profile to %s", label);
return 0;
}

9
src/lxc/utils.h
View File

@ -541,4 +541,13 @@ static inline uint64_t lxc_getpagesize(void)
*/
extern uint64_t lxc_find_next_power2(uint64_t n);
static inline pid_t lxc_raw_gettid(void)
{
#ifdef SYS_gettid
return syscall(SYS_gettid);
#else
return lxc_raw_getpid();
#endif
}
#endif /* __LXC_UTILS_H */