mirror of
https://gitlab.com/apparmor/apparmor
synced 2025-08-31 22:35:35 +00:00
remove comm from apparmor messages. They are only human readable hints and getting task->comm using proper locking results in a deadlock in interrupt context
This commit is contained in:
John Johansen
236
kernel-patches/for-mainline/apparmor-del-comm.diff
Normal file
236
kernel-patches/for-mainline/apparmor-del-comm.diff
Normal file
@@ -0,0 +1,236 @@
|
||||
---
|
||||
security/apparmor/apparmor.h | 8 ++++----
|
||||
security/apparmor/apparmorfs.c | 4 ++--
|
||||
security/apparmor/lsm.c | 7 ++-----
|
||||
security/apparmor/main.c | 29 ++++++++++-------------------
|
||||
security/apparmor/module_interface.c | 4 ++--
|
||||
security/apparmor/procattr.c | 24 +++++++++++-------------
|
||||
6 files changed, 31 insertions(+), 45 deletions(-)
|
||||
|
||||
--- a/security/apparmor/apparmor.h
|
||||
+++ b/security/apparmor/apparmor.h
|
||||
@@ -77,8 +77,8 @@ extern unsigned int apparmor_path_max;
|
||||
#define AA_REJECT_MSG(p, gfp, fmt, args...) \
|
||||
aa_audit_message((p), (gfp), 0, \
|
||||
"REJECTING " fmt \
|
||||
- " (%s(%d) profile %s active %s)", ##args, \
|
||||
- current->comm, current->pid, \
|
||||
+ " (%d profile %s active %s)", ##args, \
|
||||
+ current->pid, \
|
||||
(p)->parent->name, (p)->name)
|
||||
|
||||
#define AA_ERROR(fmt, args...) printk(KERN_ERR "AppArmor: " fmt, ##args)
|
||||
@@ -198,8 +198,8 @@ struct aa_audit {
|
||||
#define LOG_HINT(p, gfp, hint, fmt, args...) \
|
||||
aa_audit_message((p), (gfp), 0, \
|
||||
"LOGPROF-HINT " hint " " fmt \
|
||||
- " (%s(%d) profile %s active %s)", ##args, \
|
||||
- current->comm, current->pid, \
|
||||
+ " (%d profile %s active %s)", ##args, \
|
||||
+ current->pid, \
|
||||
(p)->parent->name, (p)->name)
|
||||
|
||||
/* Flags for the permission check functions */
|
||||
Files a/security/apparmor/apparmor.o and b/security/apparmor/apparmor.o differ
|
||||
--- a/security/apparmor/apparmorfs.c
|
||||
+++ b/security/apparmor/apparmorfs.c
|
||||
@@ -38,9 +38,9 @@ static char *aa_simple_write_to_buffer(c
|
||||
*/
|
||||
profile = aa_get_profile(current);
|
||||
if (profile) {
|
||||
- AA_WARN(GFP_KERNEL, "REJECTING access to profile %s (%s(%d) "
|
||||
+ AA_WARN(GFP_KERNEL, "REJECTING access to profile %s (%d "
|
||||
"profile %s active %s)",
|
||||
- msg, current->comm, current->pid,
|
||||
+ msg, current->pid,
|
||||
profile->parent->name, profile->name);
|
||||
aa_put_profile(profile);
|
||||
|
||||
Files a/security/apparmor/apparmorfs.o and b/security/apparmor/apparmorfs.o differ
|
||||
--- a/security/apparmor/lsm.c
|
||||
+++ b/security/apparmor/lsm.c
|
||||
@@ -623,9 +623,8 @@ static int apparmor_setprocattr(struct t
|
||||
if (profile) {
|
||||
aa_put_profile(profile);
|
||||
AA_WARN(GFP_KERNEL,
|
||||
- "Attempt by confined task %s(%d) "
|
||||
+ "Attempt by confined task %d "
|
||||
"[user %d] to assign profile to task %s(%d)",
|
||||
- current->comm,
|
||||
current->pid,
|
||||
current->uid,
|
||||
task->comm,
|
||||
@@ -635,13 +634,11 @@ static int apparmor_setprocattr(struct t
|
||||
error = aa_setprocattr_setprofile(task, args);
|
||||
} else {
|
||||
AA_ERROR("Unknown setprocattr command '%.*s' "
|
||||
- "by task %s(%d) [user %d] for task %s(%d)",
|
||||
+ "by task %d [user %d] for task %d",
|
||||
size < 16 ? (int)size : 16,
|
||||
command,
|
||||
- current->comm,
|
||||
current->pid,
|
||||
current->uid,
|
||||
- task->comm,
|
||||
task->pid);
|
||||
error = -EINVAL;
|
||||
}
|
||||
Files a/security/apparmor/lsm.o and b/security/apparmor/lsm.o differ
|
||||
--- a/security/apparmor/main.c
|
||||
+++ b/security/apparmor/main.c
|
||||
@@ -403,7 +403,6 @@ int aa_audit(struct aa_profile *profile,
|
||||
opspec_error = -EACCES;
|
||||
|
||||
const gfp_t gfp_mask = sa->gfp_mask;
|
||||
- char comm_buffer[2 * sizeof(current->comm)], *comm;
|
||||
|
||||
/*
|
||||
* sa->result: 1 success, 0 failure
|
||||
@@ -535,15 +534,8 @@ int aa_audit(struct aa_profile *profile,
|
||||
return error;
|
||||
}
|
||||
|
||||
- comm = comm_buffer + sizeof(comm_buffer) - sizeof(current->comm);
|
||||
- get_task_comm(comm, current);
|
||||
- comm = mangle(comm, comm_buffer);
|
||||
- if (!comm)
|
||||
- comm = "?";
|
||||
-
|
||||
- audit_log_format(ab, "(%s(%d) profile %s active %s)",
|
||||
- comm, current->pid,
|
||||
- profile->parent->name, profile->name);
|
||||
+ audit_log_format(ab, "(%d profile %s active %s)",
|
||||
+ current->pid, profile->parent->name, profile->name);
|
||||
|
||||
audit_log_end(ab);
|
||||
|
||||
@@ -943,10 +935,10 @@ repeat:
|
||||
default:
|
||||
AA_ERROR("Rejecting exec(2) of image '%s'. "
|
||||
"Unknown exec qualifier %x "
|
||||
- "(%s (pid %d) profile %s active %s)\n",
|
||||
+ "(%d profile %s active %s)\n",
|
||||
filename,
|
||||
exec_mode & AA_EXEC_MODIFIERS,
|
||||
- current->comm, current->pid,
|
||||
+ current->pid,
|
||||
profile->parent->name,
|
||||
profile->name);
|
||||
new_profile = ERR_PTR(-EPERM);
|
||||
@@ -1105,10 +1097,10 @@ static int do_change_hat(const char *hat
|
||||
} else {
|
||||
AA_DEBUG("%s: Unknown hatname '%s'. "
|
||||
"Changing to NULL profile "
|
||||
- "(%s(%d) profile %s active %s)\n",
|
||||
+ "(%d profile %s active %s)\n",
|
||||
__FUNCTION__,
|
||||
hat_name,
|
||||
- current->comm, current->pid,
|
||||
+ current->pid,
|
||||
profile->parent->name,
|
||||
profile->name);
|
||||
error = -EACCES;
|
||||
@@ -1203,11 +1195,10 @@ int aa_change_hat(const char *hat_name,
|
||||
cxt->hat_magic);
|
||||
}
|
||||
} else if (cxt->hat_magic) {
|
||||
- AA_ERROR("KILLING process %s(%d) "
|
||||
+ AA_ERROR("KILLING process %d "
|
||||
"Invalid change_hat() magic# 0x%llx "
|
||||
"(hatname %s profile %s active %s)\n",
|
||||
- current->comm, current->pid,
|
||||
- hat_magic,
|
||||
+ current->pid, hat_magic,
|
||||
hat_name ? hat_name : "NULL",
|
||||
profile->parent->name,
|
||||
profile->name);
|
||||
@@ -1215,10 +1206,10 @@ int aa_change_hat(const char *hat_name,
|
||||
/* terminate current process */
|
||||
(void)send_sig_info(SIGKILL, NULL, current);
|
||||
} else { /* cxt->hat_magic == 0 */
|
||||
- AA_ERROR("KILLING process %s(%d) "
|
||||
+ AA_ERROR("KILLING process %d "
|
||||
"Task was confined to current subprofile "
|
||||
"(profile %s active %s)\n",
|
||||
- current->comm, current->pid,
|
||||
+ current->pid,
|
||||
profile->parent->name,
|
||||
profile->name);
|
||||
|
||||
Files a/security/apparmor/main.o and b/security/apparmor/main.o differ
|
||||
--- a/security/apparmor/module_interface.c
|
||||
+++ b/security/apparmor/module_interface.c
|
||||
@@ -407,10 +407,10 @@ static inline void task_replace(struct t
|
||||
{
|
||||
struct aa_task_context *cxt = aa_task_context(task);
|
||||
|
||||
- AA_DEBUG("%s: replacing profile for task %s(%d) "
|
||||
+ AA_DEBUG("%s: replacing profile for task %d "
|
||||
"profile=%s (%p) hat=%s (%p)\n",
|
||||
__FUNCTION__,
|
||||
- cxt->task->comm, cxt->task->pid,
|
||||
+ cxt->task->pid,
|
||||
cxt->profile->parent->name, cxt->profile->parent,
|
||||
cxt->profile->name, cxt->profile);
|
||||
|
||||
Files a/security/apparmor/module_interface.o and b/security/apparmor/module_interface.o differ
|
||||
--- a/security/apparmor/procattr.c
|
||||
+++ b/security/apparmor/procattr.c
|
||||
@@ -82,8 +82,8 @@ int aa_setprocattr_setprofile(struct tas
|
||||
{
|
||||
struct aa_profile *old_profile, *new_profile;
|
||||
|
||||
- AA_DEBUG("%s: current %s(%d)\n",
|
||||
- __FUNCTION__, current->comm, current->pid);
|
||||
+ AA_DEBUG("%s: current %d\n",
|
||||
+ __FUNCTION__, current->pid);
|
||||
|
||||
repeat:
|
||||
if (strcmp(args, "unconfined") == 0)
|
||||
@@ -92,10 +92,9 @@ repeat:
|
||||
new_profile = aa_find_profile(args);
|
||||
if (!new_profile) {
|
||||
AA_WARN(GFP_KERNEL,
|
||||
- "Unable to switch task %s(%d) to profile"
|
||||
+ "Unable to switch task %d to profile"
|
||||
"'%s'. No such profile.",
|
||||
- task->comm, task->pid,
|
||||
- args);
|
||||
+ task->pid, args);
|
||||
|
||||
return -EINVAL;
|
||||
}
|
||||
@@ -114,9 +113,9 @@ repeat:
|
||||
|
||||
if (new_profile) {
|
||||
AA_WARN(GFP_KERNEL,
|
||||
- "Switching task %s(%d) "
|
||||
- "profile %s active %s to new profile %s",
|
||||
- task->comm, task->pid,
|
||||
+ "Switching task %d profile %s "
|
||||
+ "active %s to new profile %s",
|
||||
+ task->pid,
|
||||
old_profile ? old_profile->parent->name :
|
||||
"unconfined",
|
||||
old_profile ? old_profile->name : "unconfined",
|
||||
@@ -124,15 +123,14 @@ repeat:
|
||||
} else {
|
||||
if (old_profile) {
|
||||
AA_WARN(GFP_KERNEL,
|
||||
- "Unconfining task %s(%d) "
|
||||
- "profile %s active %s",
|
||||
- task->comm, task->pid,
|
||||
+ "Unconfining task %d profile %s active %s",
|
||||
+ task->pid,
|
||||
old_profile->parent->name,
|
||||
old_profile->name);
|
||||
} else {
|
||||
AA_WARN(GFP_KERNEL,
|
||||
- "task %s(%d) is already unconfined",
|
||||
- task->comm, task->pid);
|
||||
+ "task %d is already unconfined",
|
||||
+ task->pid);
|
||||
}
|
||||
}
|
||||
|
||||
Files a/security/apparmor/procattr.o and b/security/apparmor/procattr.o differ
|
||||
@@ -41,6 +41,7 @@ apparmor-lsm.diff
|
||||
apparmor-module_interface.diff
|
||||
apparmor-misc.diff
|
||||
apparmor-intree.diff
|
||||
apparmor-del-comm.diff
|
||||
do_path_lookup-nameidata.diff
|
||||
sys_fchdir-nameidata.diff
|
||||
file_permission-nameidata.diff
|
||||
|
||||
Reference in New Issue
Block a user