diff options
| author | John Johansen | 2022-05-24 02:38:12 -0700 |
|---|---|---|
| committer | John Johansen | 2022-07-13 16:37:21 -0700 |
| commit | 95c0581f9bfdfbe97126ba1c7f5650a9dd064dda (patch) | |
| tree | ed4981a6a37076e2258d868a677ddcd8a976d63a /security/apparmor/lsm.c | |
| parent | e2f76ad7d2859e333609c775fda707f205d93fd8 (diff) | |
apparmor: add a kernel label to use on kernel objects
Separate kernel objects from unconfined. This is done so we can
distinguish between the two in debugging, auditing and in preparation
for being able to replace unconfined, which is not appropriate for the
kernel.
The kernel label will continue to behave similar to unconfined.
Acked-by: Jon Tourville <jon.tourville@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor/lsm.c')
| -rw-r--r-- | security/apparmor/lsm.c | 5 |
1 files changed, 1 insertions, 4 deletions
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index 1ebcf1a6e1d0..9efb7ac60c7c 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -886,10 +886,7 @@ static int apparmor_socket_post_create(struct socket *sock, int family, struct aa_label *label; if (kern) { - struct aa_ns *ns = aa_get_current_ns(); - - label = aa_get_label(ns_unconfined(ns)); - aa_put_ns(ns); + label = aa_get_label(kernel_t); } else label = aa_get_current_label(); |