diff options
| author | Ingo Molnar <mingo@elte.hu> | 2010-10-07 09:43:11 +0200 |
|---|---|---|
| committer | Ingo Molnar <mingo@elte.hu> | 2010-10-07 09:43:11 +0200 |
| commit | d4f8f217b8a5d5bd02af979650418dca4caec472 (patch) | |
| tree | af047bfa9729c975e24cb7624107574e884d3a57 /security/apparmor/resource.c | |
| parent | 2dfbf4dfbe47a484bae20456c12b40763b9b6af7 (diff) | |
| parent | 773e3f93577ffb493fb7c39b1a6ecf39b5748e87 (diff) | |
| download | kernel_samsung_smdk4412-d4f8f217b8a5d5bd02af979650418dca4caec472.zip kernel_samsung_smdk4412-d4f8f217b8a5d5bd02af979650418dca4caec472.tar.gz kernel_samsung_smdk4412-d4f8f217b8a5d5bd02af979650418dca4caec472.tar.bz2 | |
Merge branch 'rcu/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-2.6-rcu into core/rcu
Diffstat (limited to 'security/apparmor/resource.c')
| -rw-r--r-- | security/apparmor/resource.c | 20 |
1 files changed, 12 insertions, 8 deletions
diff --git a/security/apparmor/resource.c b/security/apparmor/resource.c index 4a368f1..a4136c1 100644 --- a/security/apparmor/resource.c +++ b/security/apparmor/resource.c @@ -72,6 +72,7 @@ int aa_map_resource(int resource) /** * aa_task_setrlimit - test permission to set an rlimit * @profile - profile confining the task (NOT NULL) + * @task - task the resource is being set on * @resource - the resource being set * @new_rlim - the new resource limit (NOT NULL) * @@ -79,18 +80,21 @@ int aa_map_resource(int resource) * * Returns: 0 or error code if setting resource failed */ -int aa_task_setrlimit(struct aa_profile *profile, unsigned int resource, - struct rlimit *new_rlim) +int aa_task_setrlimit(struct aa_profile *profile, struct task_struct *task, + unsigned int resource, struct rlimit *new_rlim) { int error = 0; - if (profile->rlimits.mask & (1 << resource) && - new_rlim->rlim_max > profile->rlimits.limits[resource].rlim_max) - - error = audit_resource(profile, resource, new_rlim->rlim_max, - -EACCES); + /* TODO: extend resource control to handle other (non current) + * processes. AppArmor rules currently have the implicit assumption + * that the task is setting the resource of the current process + */ + if ((task != current->group_leader) || + (profile->rlimits.mask & (1 << resource) && + new_rlim->rlim_max > profile->rlimits.limits[resource].rlim_max)) + error = -EACCES; - return error; + return audit_resource(profile, resource, new_rlim->rlim_max, error); } /** |