Skip to contentSkip to conversation

lsm: fix unlabeled restore case.

PATCH In review Serge E. Hallyn 2 participants 2 messages Mar 12, 2010 – Mar 15, 2010 1 message not in the archive Security (LSM)

lore
Share & tools
lore

Serge E. Hallyn

author
#0 lore raw

PATCH 1/1 lsm: fix unlabeled restore case.

If an object is being restored which was checkpointed without an LSM label, then we should return 0 BEFORE we try to ckpt_obj_fetch a -1 objref (and obviously return error).

This makes the msg cr_tests ipc testcase fail if, for instance, CONFIG_SECURITY=y but no LSM is active.

IMO this definately should be in the tree that gets sent out...

Signed-off-by Serge E. Hallyn <serue-r/[email protected]>
---
 security/security.c |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)
security/security.c +4 -4
index 2b147cf..4b3f932 100644
@@ -1528,14 +1528,14 @@ int security_restore_obj(struct ckpt_ctx *ctx, void *v, int sectype,
 		if (sectype != CKPT_SECURITY_MSG_MSG)
 			return 0;
 
-	l = ckpt_obj_fetch(ctx, secref, CKPT_OBJ_SECURITY);
-	if (IS_ERR(l))
-		return PTR_ERR(l);
-
 	/* return if checkpointed label was "Not Applicable" */
 	if (secref == SECURITY_CTX_NONE)
 		return 0;
 
+	l = ckpt_obj_fetch(ctx, secref, CKPT_OBJ_SECURITY);
+	if (IS_ERR(l))
+		return PTR_ERR(l);
+
 	/* Ask the LSM to apply a void*security to the object
 	 * based on the checkpointed context string */
 	switch (sectype) {
Signature · 1 line
1.6.1

A message that is not in the archive (sent off-list or not yet received): 20100312204706.GA408-r/[email protected]

#2 lore raw

This is already in v20-rc1.

Oren

Quoted 37 lines · Serge E. Hallyn

If an object is being restored which was checkpointed without an LSM label, then we should return 0 BEFORE we try to ckpt_obj_fetch a -1 objref (and obviously return error).

This makes the msg cr_tests ipc testcase fail if, for instance, CONFIG_SECURITY=y but no LSM is active.

IMO this definately should be in the tree that gets sent out...

Signed-off-by Serge E. Hallyn <serue-r/[email protected]>
---
 security/security.c |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)
security/security.c +4 -4
index 2b147cf..4b3f932 100644
@@ -1528,14 +1528,14 @@ int security_restore_obj(struct ckpt_ctx *ctx, void *v, int sectype,
 		if (sectype != CKPT_SECURITY_MSG_MSG)
 			return 0;
 
-	l = ckpt_obj_fetch(ctx, secref, CKPT_OBJ_SECURITY);
-	if (IS_ERR(l))
-		return PTR_ERR(l);
-
 	/* return if checkpointed label was "Not Applicable" */
 	if (secref == SECURITY_CTX_NONE)
 		return 0;
 
+	l = ckpt_obj_fetch(ctx, secref, CKPT_OBJ_SECURITY);
+	if (IS_ERR(l))
+		return PTR_ERR(l);
+
 	/* Ask the LSM to apply a void*security to the object
 	 * based on the checkpointed context string */
 	switch (sectype) {