Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ca3fde52 authored by Jann Horn's avatar Jann Horn Committed by John Johansen
Browse files

apparmor: don't try to replace stale label in ptraceme check 



begin_current_label_crit_section() must run in sleepable context because
when label_is_stale() is true, aa_replace_current_label() runs, which uses
prepare_creds(), which can sleep.

Until now, the ptraceme access check (which runs with tasklist_lock held)
violated this rule.

Fixes: b2d09ae4 ("apparmor: move ptrace checks to using labels")
Reported-by: default avatarCyrill Gorcunov <gorcunov@gmail.com>
Reported-by: default avatarkernel test robot <rong.a.chen@intel.com>
Signed-off-by: default avatarJann Horn <jannh@google.com>
Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
parent 0fb871cc

security/apparmor/lsm.c

+2 −2
Original line number Diff line number Diff line
@@ -132,11 +132,11 @@ static int apparmor_ptrace_traceme(struct task_struct *parent) 
	struct aa_label *tracer, *tracee;

	int error;



	tracee = begin_current_label_crit_section();

	tracee = __begin_current_label_crit_section();

	tracer = aa_get_task_label(parent);

	error = aa_may_ptrace(tracer, tracee, AA_PTRACE_TRACE);

	aa_put_label(tracer);

	end_current_label_crit_section(tracee);

	__end_current_label_crit_section(tracee);



	return error;

}