From: John Johansen Date: Mon, 16 Jan 2017 08:42:59 +0000 (-0800) Subject: apparmor: fail task profile update if current_cred isn't real_cred X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=a20aa95fbe1abb4c6f333a1f55e9fd15b01c7f12;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git apparmor: fail task profile update if current_cred isn't real_cred Trying to update the task cred while the task current cred is not the real cred will result in an error at the cred layer. Avoid this by failing early and delaying the update. Signed-off-by: John Johansen --- diff --git a/security/apparmor/context.c b/security/apparmor/context.c index 3c4f534ef88c..3f32f594c999 100644 --- a/security/apparmor/context.c +++ b/security/apparmor/context.c @@ -100,6 +100,9 @@ int aa_replace_current_profile(struct aa_profile *profile) if (cxt->profile == profile) return 0; + if (current_cred() != current_real_cred()) + return -EBUSY; + new = prepare_creds(); if (!new) return -ENOMEM;