Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9ad42a79 authored by Richard Guy Briggs's avatar Richard Guy Briggs Committed by Eric Paris
Browse files

selinux: call WARN_ONCE() instead of calling audit_log_start() 



Two of the conditions in selinux_audit_rule_match() should never happen and
the third indicates a race that should be retried.  Remove the calls to
audit_log() (which call audit_log_start()) and deal with the errors in the
caller, logging only once if the condition is met.  Calling audit_log_start()
in this location makes buffer allocation and locking more complicated in the
calling tree (audit_filter_user()).

Signed-off-by: default avatarRichard Guy Briggs <rgb@redhat.com>
Signed-off-by: default avatarEric Paris <eparis@redhat.com>
parent 4440e854

security/selinux/ss/services.c

+4 −8
Original line number Original line Diff line number Diff line
@@ -2938,25 +2938,21 @@ int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule, 
	struct selinux_audit_rule *rule = vrule;

	struct selinux_audit_rule *rule = vrule;

	int match = 0;

	int match = 0;





	if (!rule) {

	if (unlikely(!rule)) {

		audit_log(actx, GFP_ATOMIC, AUDIT_SELINUX_ERR,

		WARN_ONCE(1, "selinux_audit_rule_match: missing rule\n");

			  "selinux_audit_rule_match: missing rule\n");

		return -ENOENT;

		return -ENOENT;

	}

	}





	read_lock(&policy_rwlock);

	read_lock(&policy_rwlock);





	if (rule->au_seqno < latest_granting) {

	if (rule->au_seqno < latest_granting) {

		audit_log(actx, GFP_ATOMIC, AUDIT_SELINUX_ERR,

			  "selinux_audit_rule_match: stale rule\n");

		match = -ESTALE;

		match = -ESTALE;

		goto out;

		goto out;

	}

	}





	ctxt = sidtab_search(&sidtab, sid);

	ctxt = sidtab_search(&sidtab, sid);

	if (!ctxt) {

	if (unlikely(!ctxt)) {

		audit_log(actx, GFP_ATOMIC, AUDIT_SELINUX_ERR,

		WARN_ONCE(1, "selinux_audit_rule_match: unrecognized SID %d\n",

			  "selinux_audit_rule_match: unrecognized SID %d\n",

			  sid);

			  sid);

		match = -ENOENT;

		match = -ENOENT;

		goto out;

		goto out;