diff options
| author | John Johansen <john.johansen@canonical.com> | 2024-04-10 14:49:43 -0700 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2025-01-18 06:47:12 -0800 |
| commit | 6cc6a0523dde5b1f001d559d0e034494bc8b0db0 (patch) | |
| tree | 2ecf0ed90930501ca77937b684062a707705be49 | |
| parent | 9045aa25d17cf1d13a1c31fc45ed1f9ca725e30e (diff) | |
apparmor: lift kernel socket check out of critical section
There is no need for the kern check to be in the critical section,
it only complicates the code and slows down the case where the
socket is being created by the kernel.
Lifting it out will also allow socket_create to share common template
code, with other socket_permission checks.
Signed-off-by: John Johansen <john.johansen@canonical.com>
| -rw-r--r-- | security/apparmor/lsm.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index 1246115b7435..f7b2d4bb1d97 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -1095,10 +1095,14 @@ static int apparmor_socket_create(int family, int type, int protocol, int kern) AA_BUG(in_interrupt()); + if (kern) + return 0; + label = begin_current_label_crit_section(); - if (!(kern || unconfined(label))) + if (!unconfined(label)) { error = aa_af_perm(current_cred(), label, OP_CREATE, AA_MAY_CREATE, family, type, protocol); + } end_current_label_crit_section(label); return error; |