commit c70c86c421427fd8487867de66c4104b15abd772
author John Johansen <john.johansen@canonical.com> Fri Jun 09 14:07:02 2017 -0700
committer John Johansen <john.johansen@canonical.com> Sat Jun 10 17:11:40 2017 -0700
tree 0d742b0b9d2f2972b1f93aea3caf1a6c87b3b91b
parent 317d9a054e1c6d5f18b02b99ce09911942f8e603

apparmor: move capability checks to using labels

Signed-off-by: John Johansen <john.johansen@canonical.com>

security/apparmor/lsm.c

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index f7f82ce..bcfdcdb 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -117,20 +117,28 @@ static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective,
 			   kernel_cap_t *inheritable, kernel_cap_t *permitted)
 {
 	struct aa_label *label;
-	struct aa_profile *profile;
 	const struct cred *cred;
 
 	rcu_read_lock();
 	cred = __task_cred(target);
 	label = aa_get_newest_cred_label(cred);
-	profile = labels_profile(label);
+
 	/*
 	 * cap_capget is stacked ahead of this and will
 	 * initialize effective and permitted.
 	 */
-	if (!profile_unconfined(profile) && !COMPLAIN_MODE(profile)) {
-		*effective = cap_intersect(*effective, profile->caps.allow);
-		*permitted = cap_intersect(*permitted, profile->caps.allow);
+	if (!unconfined(label)) {
+		struct aa_profile *profile;
+		struct label_it i;
+
+		label_for_each_confined(i, label, profile) {
+			if (COMPLAIN_MODE(profile))
+				continue;
+			*effective = cap_intersect(*effective,
+						   profile->caps.allow);
+			*permitted = cap_intersect(*permitted,
+						   profile->caps.allow);
+		}
 	}
 	rcu_read_unlock();
 	aa_put_label(label);
@@ -146,7 +154,7 @@ static int apparmor_capable(const struct cred *cred, struct user_namespace *ns,
 
 	label = aa_get_newest_cred_label(cred);
 	if (!unconfined(label))
-		error = aa_capable(labels_profile(label), cap, audit);
+		error = aa_capable(label, cap, audit);
 	aa_put_label(label);
 
 	return error;