Merge tag 'drm-next-2021-02-26' of git://anongit.freedesktop.org/drm/drm

[linux-2.6-microblaze.git] / security / apparmor / domain.c

diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index f919ebd..583680f 100644 (file)
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -10,12 +10,14 @@
 
 #include <linux/errno.h>
 #include <linux/fdtable.h>
+#include <linux/fs.h>
 #include <linux/file.h>
 #include <linux/mount.h>
 #include <linux/syscalls.h>
 #include <linux/tracehook.h>
 #include <linux/personality.h>
 #include <linux/xattr.h>
+#include <linux/user_namespace.h>
 
 #include "include/audit.h"
 #include "include/apparmorfs.h"
@@ -324,8 +326,8 @@ static int aa_xattrs_match(const struct linux_binprm *bprm,
        d = bprm->file->f_path.dentry;
 
        for (i = 0; i < profile->xattr_count; i++) {
-               size = vfs_getxattr_alloc(d, profile->xattrs[i], &value,
-                                         value_size, GFP_KERNEL);
+               size = vfs_getxattr_alloc(&init_user_ns, d, profile->xattrs[i],
+                                         &value, value_size, GFP_KERNEL);
                if (size >= 0) {
                        u32 perm;
 
@@ -858,8 +860,10 @@ int apparmor_bprm_creds_for_exec(struct linux_binprm *bprm)
        const char *info = NULL;
        int error = 0;
        bool unsafe = false;
+       kuid_t i_uid = i_uid_into_mnt(file_mnt_user_ns(bprm->file),
+                                     file_inode(bprm->file));
        struct path_cond cond = {
-               file_inode(bprm->file)->i_uid,
+               i_uid,
                file_inode(bprm->file)->i_mode
        };
 
@@ -967,8 +971,7 @@ audit:
        error = fn_for_each(label, profile,
                        aa_audit_file(profile, &nullperms, OP_EXEC, MAY_EXEC,
                                      bprm->filename, NULL, new,
-                                     file_inode(bprm->file)->i_uid, info,
-                                     error));
+                                     i_uid, info, error));
        aa_put_label(new);
        goto done;
 }