Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4262fb51 authored by Gary Tierney's avatar Gary Tierney Committed by Paul Moore
Browse files

selinux: log errors when loading new policy 



Adds error logging to the code paths which can fail when loading a new
policy in sel_write_load().  If the policy fails to be loaded from
userspace then a warning message is printed, whereas if a failure occurs
after loading policy from userspace an error message will be printed
with details on where policy loading failed (recreating one of /classes/,
/policy_capabilities/, /booleans/ in the SELinux fs).

Also, if sel_make_bools() fails to obtain an SID for an entry in
/booleans/* an error will be printed indicating the path of the
boolean.

Signed-off-by: default avatarGary Tierney <gary.tierney@gmx.com>
Acked-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent b21507e2

security/selinux/selinuxfs.c

+16 −5
Original line number Diff line number Diff line
@@ -508,20 +508,28 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf, 
		goto out;



	length = security_load_policy(data, count);

	if (length)

	if (length) {

		pr_warn_ratelimited("SELinux: failed to load policy\n");

		goto out;

	}



	length = sel_make_bools();

	if (length)

	if (length) {

		pr_err("SELinux: failed to load policy booleans\n");

		goto out1;

	}



	length = sel_make_classes();

	if (length)

	if (length) {

		pr_err("SELinux: failed to load policy classes\n");

		goto out1;

	}



	length = sel_make_policycap();

	if (length)

	if (length) {

		pr_err("SELinux: failed to load policy capabilities\n");

		goto out1;

	}



	length = count;
@@ -1302,9 +1310,12 @@ static int sel_make_bools(void) 


		isec = (struct inode_security_struct *)inode->i_security;

		ret = security_genfs_sid("selinuxfs", page, SECCLASS_FILE, &sid);

		if (ret)

		if (ret) {

			pr_err("SELinux: failed to lookup sid for %s\n", page);

			goto out;



		}



		isec->sid = sid;

		isec->initialized = LABEL_INITIALIZED;

		inode->i_fop = &sel_bool_ops;