linux-brain/security/apparmor
Chris Coulson 01dbfb2c74 apparmor: delete the dentry in aafs_remove() to avoid a leak
[ Upstream commit 201218e4d3 ]

Although the apparmorfs dentries are always dropped from the dentry cache
when the usage count drops to zero, there is no guarantee that this will
happen in aafs_remove(), as another thread might still be using it. In
this scenario, this means that the dentry will temporarily continue to
appear in the results of lookups, even after the call to aafs_remove().

In the case of removal of a profile - it also causes simple_rmdir()
on the profile directory to fail, as the directory won't be empty until
the usage counts of all child dentries have decreased to zero. This
results in the dentry for the profile directory leaking and appearing
empty in the file system tree forever.

Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-12-05 15:38:01 +01:00
..
include apparmor: fix resource audit messages when auditing peer 2018-04-19 08:56:18 +02:00
.gitignore Revert "apparmor: add base infastructure for socket mediation" 2017-10-26 19:35:35 +02:00
apparmorfs.c apparmor: delete the dentry in aafs_remove() to avoid a leak 2019-12-05 15:38:01 +01:00
audit.c apparmor: switch from profiles to using labels on contexts 2017-06-10 17:11:38 -07:00
capability.c apparmor: move capability checks to using labels 2017-06-10 17:11:40 -07:00
context.c apparmor: switch from profiles to using labels on contexts 2017-06-10 17:11:38 -07:00
crypto.c apparmor: use SHASH_DESC_ON_STACK 2017-04-07 08:58:35 +10:00
domain.c apparmor: Fix aa_label_build() error handling for failed merges 2019-03-13 14:03:16 -07:00
file.c Revert "apparmor: add base infastructure for socket mediation" 2017-10-26 19:35:35 +02:00
ipc.c apparmor: fix logging of the existence test for signals 2018-04-19 08:56:18 +02:00
Kconfig apparmor: add debug assert AA_BUG and Kconfig to control debug info 2017-01-16 01:18:24 -08:00
label.c apparmor: fix incorrect type assignment when freeing proxies 2017-09-22 13:00:58 -07:00
lib.c apparmor: Fix uninitialized value in aa_split_fqname 2018-11-27 16:10:47 +01:00
lsm.c Revert "apparmor: add base infastructure for socket mediation" 2017-10-26 19:35:35 +02:00
Makefile License cleanup: add SPDX license identifiers to some files 2017-11-02 10:04:46 -07:00
match.c doc: ReSTify apparmor.txt 2017-05-18 10:32:38 -06:00
mount.c apparmor: fix regression in mount mediation when feature set is pinned 2018-01-10 09:31:22 +01:00
nulldfa.in apparmor: add a default null dfa 2017-01-16 01:18:34 -08:00
path.c apparmor: Move path lookup to using preallocated buffers 2017-06-08 11:29:34 -07:00
policy_ns.c apparmor: ensure unconfined profiles have dfas initialized 2017-09-22 13:00:58 -07:00
policy_unpack.c apparmor: enforce nullbyte at end of tag string 2019-06-25 11:36:51 +08:00
policy.c apparmor: fix leak of null profile name if profile allocation fails 2017-12-14 09:53:06 +01:00
procattr.c apparmor: switch getprocattr to using label_print fns() 2017-06-10 17:11:39 -07:00
resource.c apparmor: move resource checks to using labels 2017-06-10 17:11:40 -07:00
secid.c apparmor: rename sid to secid 2017-01-16 00:42:17 -08:00