selinux: log errors when loading new policy (4262fb51) · Commits · 戴 / test

Adds error logging to the code paths which can fail when loading a new policy in sel_write_load(). If the policy fails to be loaded from userspace then a warning message is printed, whereas if a failure occurs after loading policy from userspace an error message will be printed with details on where policy loading failed (recreating one of /classes/, /policy_capabilities/, /booleans/ in the SELinux fs). Also, if sel_make_bools() fails to obtain an SID for an entry in /booleans/* an error will be printed indicating the path of the boolean. Signed-off-by:

Gary Tierney <gary.tierney@gmx.com> Acked-by:

Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by:

Paul Moore <paul@paul-moore.com>

security/selinux/selinuxfs.c

+16 −5

Original line number	Diff line number	Diff line
		@@ -508,20 +508,28 @@ static ssize_t sel_write_load(struct file file, const char __user buf,
		goto out;

		length = security_load_policy(data, count);
		if (length)
		if (length) {
		pr_warn_ratelimited("SELinux: failed to load policy\n");
		goto out;
		}

		length = sel_make_bools();
		if (length)
		if (length) {
		pr_err("SELinux: failed to load policy booleans\n");
		goto out1;
		}

		length = sel_make_classes();
		if (length)
		if (length) {
		pr_err("SELinux: failed to load policy classes\n");
		goto out1;
		}

		length = sel_make_policycap();
		if (length)
		if (length) {
		pr_err("SELinux: failed to load policy capabilities\n");
		goto out1;
		}

		length = count;

		@@ -1302,9 +1310,12 @@ static int sel_make_bools(void)

		isec = (struct inode_security_struct *)inode->i_security;
		ret = security_genfs_sid("selinuxfs", page, SECCLASS_FILE, &sid);
		if (ret)
		if (ret) {
		pr_err("SELinux: failed to lookup sid for %s\n", page);
		goto out;

		}

		isec->sid = sid;
		isec->initialized = LABEL_INITIALIZED;
		inode->i_fop = &sel_bool_ops;

Admin message