Commit 8ac2ca32 authored by Sebastian Andrzej Siewior's avatar Sebastian Andrzej Siewior Committed by John Johansen
Browse files

apparmor: Switch to GFP_KERNEL where possible 



After removing preempt_disable() from get_buffers() it is possible to
replace a few GFP_ATOMIC allocations with GFP_KERNEL.

Replace GFP_ATOMIC allocations with GFP_KERNEL where the context looks
to bee preepmtible.

Signed-off-by: default avatarSebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
parent df323337

security/apparmor/domain.c

+10 −10
Original line number Diff line number Diff line
@@ -524,7 +524,7 @@ struct aa_label *x_table_lookup(struct aa_profile *profile, u32 xindex, 
				label = &new_profile->label;

			continue;

		}

		label = aa_label_parse(&profile->label, *name, GFP_ATOMIC,

		label = aa_label_parse(&profile->label, *name, GFP_KERNEL,

				       true, false);

		if (IS_ERR(label))

			label = NULL;
@@ -604,7 +604,7 @@ static struct aa_label *x_to_label(struct aa_profile *profile, 
		/* base the stack on post domain transition */

		struct aa_label *base = new;



		new = aa_label_parse(base, stack, GFP_ATOMIC, true, false);

		new = aa_label_parse(base, stack, GFP_KERNEL, true, false);

		if (IS_ERR(new))

			new = NULL;

		aa_put_label(base);
@@ -712,7 +712,7 @@ static struct aa_label *profile_transition(struct aa_profile *profile, 
		if (DEBUG_ON) {

			dbg_printk("apparmor: scrubbing environment variables"

				   " for %s profile=", name);

			aa_label_printk(new, GFP_ATOMIC);

			aa_label_printk(new, GFP_KERNEL);

			dbg_printk("\n");

		}

		*secure_exec = true;
@@ -788,7 +788,7 @@ static int profile_onexec(struct aa_profile *profile, struct aa_label *onexec, 
		if (DEBUG_ON) {

			dbg_printk("apparmor: scrubbing environment "

				   "variables for %s label=", xname);

			aa_label_printk(onexec, GFP_ATOMIC);

			aa_label_printk(onexec, GFP_KERNEL);

			dbg_printk("\n");

		}

		*secure_exec = true;
@@ -822,7 +822,7 @@ static struct aa_label *handle_onexec(struct aa_label *label, 
					       bprm, buffer, cond, unsafe));

		if (error)

			return ERR_PTR(error);

		new = fn_label_build_in_ns(label, profile, GFP_ATOMIC,

		new = fn_label_build_in_ns(label, profile, GFP_KERNEL,

				aa_get_newest_label(onexec),

				profile_transition(profile, bprm, buffer,

						   cond, unsafe));
@@ -834,9 +834,9 @@ static struct aa_label *handle_onexec(struct aa_label *label, 
					       buffer, cond, unsafe));

		if (error)

			return ERR_PTR(error);

		new = fn_label_build_in_ns(label, profile, GFP_ATOMIC,

		new = fn_label_build_in_ns(label, profile, GFP_KERNEL,

				aa_label_merge(&profile->label, onexec,

					       GFP_ATOMIC),

					       GFP_KERNEL),

				profile_transition(profile, bprm, buffer,

						   cond, unsafe));

	}
@@ -907,7 +907,7 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm) 
		new = handle_onexec(label, ctx->onexec, ctx->token,

				    bprm, buffer, &cond, &unsafe);

	else

		new = fn_label_build(label, profile, GFP_ATOMIC,

		new = fn_label_build(label, profile, GFP_KERNEL,

				profile_transition(profile, bprm, buffer,

						   &cond, &unsafe));
@@ -951,7 +951,7 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm) 
		if (DEBUG_ON) {

			dbg_printk("scrubbing environment variables for %s "

				   "label=", bprm->filename);

			aa_label_printk(new, GFP_ATOMIC);

			aa_label_printk(new, GFP_KERNEL);

			dbg_printk("\n");

		}

		bprm->secureexec = 1;
@@ -962,7 +962,7 @@ int apparmor_bprm_set_creds(struct linux_binprm *bprm) 
		if (DEBUG_ON) {

			dbg_printk("apparmor: clearing unsafe personality "

				   "bits. %s label=", bprm->filename);

			aa_label_printk(new, GFP_ATOMIC);

			aa_label_printk(new, GFP_KERNEL);

			dbg_printk("\n");

		}

		bprm->per_clear |= PER_CLEAR_ON_SETID;

security/apparmor/file.c

+1 −1
Original line number Diff line number Diff line
@@ -80,7 +80,7 @@ static void file_audit_cb(struct audit_buffer *ab, void *va) 
	if (aad(sa)->peer) {

		audit_log_format(ab, " target=");

		aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer,

				FLAG_VIEW_SUBNS, GFP_ATOMIC);

				FLAG_VIEW_SUBNS, GFP_KERNEL);

	} else if (aad(sa)->fs.target) {

		audit_log_format(ab, " target=");

		audit_log_untrustedstring(ab, aad(sa)->fs.target);

security/apparmor/mount.c

+1 −1
Original line number Diff line number Diff line
@@ -708,7 +708,7 @@ int aa_pivotroot(struct aa_label *label, const struct path *old_path, 
	error = -ENOMEM;

	if (!old_buffer || !new_buffer)

		goto out;

	target = fn_label_build(label, profile, GFP_ATOMIC,

	target = fn_label_build(label, profile, GFP_KERNEL,

			build_pivotroot(profile, new_path, new_buffer,

					old_path, old_buffer));

	if (!target) {

CRA Git | Maintained and supported by SUSTech CRA and CCSE