Commit 6f7dac11 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'selinux-pr-20180814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux 

Pull SELinux updates from Paul Moore:
 "There are 16 patches in here but really only one that is of any
  significance. That one patch is by nixiaoming and fixes a few places
  where we were not properly cleaning up dentry and inode objects in the
  selinuxfs error handling code. The rest are either printk->pr_*
  conversions, constification tweaks, and a minor tweak to MAINTAINERS.

  Everything passes the selinux-testsuite and looks to merge cleanly
  against your master branch"

* tag 'selinux-pr-20180814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  selinux: cleanup dentry and inodes on error in selinuxfs
  selinux: constify write_op[]
  selinux: Cleanup printk logging in netnode
  selinux: Cleanup printk logging in avc
  selinux: Cleanup printk logging in netif
  selinux: Cleanup printk logging in netport
  selinux: Cleanup printk logging in sidtab
  selinux: Cleanup printk logging in netlink
  selinux: Cleanup printk logging in selinuxfs
  selinux: Cleanup printk logging in services
  selinux: Cleanup printk logging in avtab
  selinux: Cleanup printk logging in hooks
  selinux: Cleanup printk logging in policydb
  selinux: Cleanup printk logging in ebitmap
  selinux: Cleanup printk logging in conditional
  MAINTAINERS: update the LSM and SELinux subsystems
parents 92d4a036 7e4237fa

MAINTAINERS

+1 −0
Original line number Diff line number Diff line
@@ -12799,6 +12799,7 @@ T: git git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git 
W:	http://kernsec.org/

S:	Supported

F:	security/

X:	security/selinux/



SELINUX SECURITY MODULE

M:	Paul Moore <paul@paul-moore.com>

security/selinux/avc.c

+1 −1
Original line number Diff line number Diff line
@@ -650,7 +650,7 @@ static int avc_latest_notif_update(struct selinux_avc *avc, 
	spin_lock_irqsave(&notif_lock, flag);

	if (is_insert) {

		if (seqno < avc->avc_cache.latest_notif) {

			printk(KERN_WARNING "SELinux: avc:  seqno %d < latest_notif %d\n",

			pr_warn("SELinux: avc:  seqno %d < latest_notif %d\n",

			       seqno, avc->avc_cache.latest_notif);

			ret = -EAGAIN;

		}

security/selinux/hooks.c

+33 −35
Original line number Diff line number Diff line
@@ -530,7 +530,7 @@ static int sb_finish_set_opts(struct super_block *sb) 
		   the first boot of the SELinux kernel before we have

		   assigned xattr values to the filesystem. */

		if (!(root_inode->i_opflags & IOP_XATTR)) {

			printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "

			pr_warn("SELinux: (dev %s, type %s) has no "

			       "xattr support\n", sb->s_id, sb->s_type->name);

			rc = -EOPNOTSUPP;

			goto out;
@@ -539,11 +539,11 @@ static int sb_finish_set_opts(struct super_block *sb) 
		rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);

		if (rc < 0 && rc != -ENODATA) {

			if (rc == -EOPNOTSUPP)

				printk(KERN_WARNING "SELinux: (dev %s, type "

				pr_warn("SELinux: (dev %s, type "

				       "%s) has no security xattr handler\n",

				       sb->s_id, sb->s_type->name);

			else

				printk(KERN_WARNING "SELinux: (dev %s, type "

				pr_warn("SELinux: (dev %s, type "

				       "%s) getxattr errno %d\n", sb->s_id,

				       sb->s_type->name, -rc);

			goto out;
@@ -742,7 +742,7 @@ static int selinux_set_mnt_opts(struct super_block *sb, 
			goto out;

		}

		rc = -EINVAL;

		printk(KERN_WARNING "SELinux: Unable to set superblock options "

		pr_warn("SELinux: Unable to set superblock options "

			"before the security server is initialized\n");

		goto out;

	}
@@ -784,7 +784,7 @@ static int selinux_set_mnt_opts(struct super_block *sb, 
						 mount_options[i], &sid,

						 GFP_KERNEL);

		if (rc) {

			printk(KERN_WARNING "SELinux: security_context_str_to_sid"

			pr_warn("SELinux: security_context_str_to_sid"

			       "(%s) failed for (dev %s, type %s) errno=%d\n",

			       mount_options[i], sb->s_id, name, rc);

			goto out;
@@ -860,8 +860,7 @@ static int selinux_set_mnt_opts(struct super_block *sb, 
		 */

		rc = security_fs_use(&selinux_state, sb);

		if (rc) {

			printk(KERN_WARNING

				"%s: security_fs_use(%s) returned %d\n",

			pr_warn("%s: security_fs_use(%s) returned %d\n",

					__func__, sb->s_type->name, rc);

			goto out;

		}
@@ -947,7 +946,7 @@ static int selinux_set_mnt_opts(struct super_block *sb, 
		if (sbsec->behavior != SECURITY_FS_USE_XATTR &&

			sbsec->behavior != SECURITY_FS_USE_NATIVE) {

			rc = -EINVAL;

			printk(KERN_WARNING "SELinux: defcontext option is "

			pr_warn("SELinux: defcontext option is "

			       "invalid for this filesystem type\n");

			goto out;

		}
@@ -969,7 +968,7 @@ out: 
	return rc;

out_double_mount:

	rc = -EINVAL;

	printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "

	pr_warn("SELinux: mount invalid.  Same superblock, different "

	       "security settings for (dev %s, type %s)\n", sb->s_id, name);

	goto out;

}
@@ -998,7 +997,7 @@ static int selinux_cmp_sb_context(const struct super_block *oldsb, 
	}

	return 0;

mismatch:

	printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "

	pr_warn("SELinux: mount invalid.  Same superblock, "

			    "different security settings for (dev %s, "

			    "type %s)\n", newsb->s_id, newsb->s_type->name);

	return -EBUSY;
@@ -1106,7 +1105,7 @@ static int selinux_parse_opts_str(char *options, 
		case Opt_context:

			if (context || defcontext) {

				rc = -EINVAL;

				printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);

				pr_warn(SEL_MOUNT_FAIL_MSG);

				goto out_err;

			}

			context = match_strdup(&args[0]);
@@ -1119,7 +1118,7 @@ static int selinux_parse_opts_str(char *options, 
		case Opt_fscontext:

			if (fscontext) {

				rc = -EINVAL;

				printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);

				pr_warn(SEL_MOUNT_FAIL_MSG);

				goto out_err;

			}

			fscontext = match_strdup(&args[0]);
@@ -1132,7 +1131,7 @@ static int selinux_parse_opts_str(char *options, 
		case Opt_rootcontext:

			if (rootcontext) {

				rc = -EINVAL;

				printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);

				pr_warn(SEL_MOUNT_FAIL_MSG);

				goto out_err;

			}

			rootcontext = match_strdup(&args[0]);
@@ -1145,7 +1144,7 @@ static int selinux_parse_opts_str(char *options, 
		case Opt_defcontext:

			if (context || defcontext) {

				rc = -EINVAL;

				printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);

				pr_warn(SEL_MOUNT_FAIL_MSG);

				goto out_err;

			}

			defcontext = match_strdup(&args[0]);
@@ -1158,7 +1157,7 @@ static int selinux_parse_opts_str(char *options, 
			break;

		default:

			rc = -EINVAL;

			printk(KERN_WARNING "SELinux:  unknown mount option\n");

			pr_warn("SELinux:  unknown mount option\n");

			goto out_err;



		}
@@ -1623,7 +1622,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent 
		dput(dentry);

		if (rc < 0) {

			if (rc != -ENODATA) {

				printk(KERN_WARNING "SELinux: %s:  getxattr returned "

				pr_warn("SELinux: %s:  getxattr returned "

				       "%d for dev=%s ino=%ld\n", __func__,

				       -rc, inode->i_sb->s_id, inode->i_ino);

				kfree(context);
@@ -1643,11 +1642,11 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent 


				if (rc == -EINVAL) {

					if (printk_ratelimit())

						printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "

						pr_notice("SELinux: inode=%lu on dev=%s was found to have an invalid "

							"context=%s.  This indicates you may need to relabel the inode or the "

							"filesystem in question.\n", ino, dev, context);

				} else {

					printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "

					pr_warn("SELinux: %s:  context_to_sid(%s) "

					       "returned %d for dev=%s ino=%ld\n",

					       __func__, context, -rc, dev, ino);

				}
@@ -1785,8 +1784,7 @@ static int cred_has_capability(const struct cred *cred, 
		sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;

		break;

	default:

		printk(KERN_ERR

		       "SELinux:  out of range capability %d\n", cap);

		pr_err("SELinux:  out of range capability %d\n", cap);

		BUG();

		return -EINVAL;

	}
@@ -2029,7 +2027,7 @@ static int may_link(struct inode *dir, 
		av = DIR__RMDIR;

		break;

	default:

		printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",

		pr_warn("SELinux: %s:  unrecognized kind %d\n",

			__func__, kind);

		return 0;

	}
@@ -2875,7 +2873,7 @@ static int selinux_sb_remount(struct super_block *sb, void *data) 
						 mount_options[i], &sid,

						 GFP_KERNEL);

		if (rc) {

			printk(KERN_WARNING "SELinux: security_context_str_to_sid"

			pr_warn("SELinux: security_context_str_to_sid"

			       "(%s) failed for (dev %s, type %s) errno=%d\n",

			       mount_options[i], sb->s_id, sb->s_type->name, rc);

			goto out_free_opts;
@@ -2914,7 +2912,7 @@ out_free_secdata: 
	free_secdata(secdata);

	return rc;

out_bad_option:

	printk(KERN_WARNING "SELinux: unable to change security options "

	pr_warn("SELinux: unable to change security options "

	       "during remount (dev %s, type=%s)\n", sb->s_id,

	       sb->s_type->name);

	goto out_free_opts;
@@ -3357,7 +3355,7 @@ static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name, 
	rc = security_context_to_sid_force(&selinux_state, value, size,

					   &newsid);

	if (rc) {

		printk(KERN_ERR "SELinux:  unable to map context to SID"

		pr_err("SELinux:  unable to map context to SID"

		       "for (%s, %lu), rc=%d\n",

		       inode->i_sb->s_id, inode->i_ino, -rc);

		return;
@@ -4434,7 +4432,7 @@ static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad, 
	}



parse_error:

	printk(KERN_WARNING

	pr_warn(

	       "SELinux: failure in selinux_parse_skb(),"

	       " unable to parse packet\n");

	return ret;
@@ -4477,7 +4475,7 @@ static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid) 
	err = security_net_peersid_resolve(&selinux_state, nlbl_sid,

					   nlbl_type, xfrm_sid, sid);

	if (unlikely(err)) {

		printk(KERN_WARNING

		pr_warn(

		       "SELinux: failure in selinux_skb_peerlbl_sid(),"

		       " unable to determine packet's peer label\n");

		return -EACCES;
@@ -7141,11 +7139,11 @@ static __init int selinux_init(void) 
	}



	if (!selinux_enabled) {

		printk(KERN_INFO "SELinux:  Disabled at boot.\n");

		pr_info("SELinux:  Disabled at boot.\n");

		return 0;

	}



	printk(KERN_INFO "SELinux:  Initializing.\n");

	pr_info("SELinux:  Initializing.\n");



	memset(&selinux_state, 0, sizeof(selinux_state));

	enforcing_set(&selinux_state, selinux_enforcing_boot);
@@ -7181,9 +7179,9 @@ static __init int selinux_init(void) 
		panic("SELinux: Unable to register AVC LSM notifier callback\n");



	if (selinux_enforcing_boot)

		printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");

		pr_debug("SELinux:  Starting in enforcing mode\n");

	else

		printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");

		pr_debug("SELinux:  Starting in permissive mode\n");



	return 0;

}
@@ -7195,10 +7193,10 @@ static void delayed_superblock_init(struct super_block *sb, void *unused) 


void selinux_complete_init(void)

{

	printk(KERN_DEBUG "SELinux:  Completing initialization.\n");

	pr_debug("SELinux:  Completing initialization.\n");



	/* Set up any superblocks initialized prior to the policy load. */

	printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");

	pr_debug("SELinux:  Setting up existing superblocks.\n");

	iterate_supers(delayed_superblock_init, NULL);

}
@@ -7273,7 +7271,7 @@ static int __init selinux_nf_ip_init(void) 
	if (!selinux_enabled)

		return 0;



	printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");

	pr_debug("SELinux:  Registering netfilter hooks\n");



	err = register_pernet_subsys(&selinux_net_ops);

	if (err)
@@ -7286,7 +7284,7 @@ __initcall(selinux_nf_ip_init); 
#ifdef CONFIG_SECURITY_SELINUX_DISABLE

static void selinux_nf_ip_exit(void)

{

	printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");

	pr_debug("SELinux:  Unregistering netfilter hooks\n");



	unregister_pernet_subsys(&selinux_net_ops);

}
@@ -7315,7 +7313,7 @@ int selinux_disable(struct selinux_state *state) 


	state->disabled = 1;



	printk(KERN_INFO "SELinux:  Disabled at runtime.\n");

	pr_info("SELinux:  Disabled at runtime.\n");



	selinux_enabled = 0;

security/selinux/netif.c

+4 −7
Original line number Diff line number Diff line
@@ -145,9 +145,8 @@ static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid) 


	dev = dev_get_by_index(ns, ifindex);

	if (unlikely(dev == NULL)) {

		printk(KERN_WARNING

		       "SELinux: failure in sel_netif_sid_slow(),"

		       " invalid network interface (%d)\n", ifindex);

		pr_warn("SELinux: failure in %s(), invalid network interface (%d)\n",

			__func__, ifindex);

		return -ENOENT;

	}
@@ -177,10 +176,8 @@ out: 
	spin_unlock_bh(&sel_netif_lock);

	dev_put(dev);

	if (unlikely(ret)) {

		printk(KERN_WARNING

		       "SELinux: failure in sel_netif_sid_slow(),"

		       " unable to determine network interface label (%d)\n",

		       ifindex);

		pr_warn("SELinux: failure in %s(), unable to determine network interface label (%d)\n",

			__func__, ifindex);

		kfree(new);

	}

	return ret;

security/selinux/netlink.c

+1 −1
Original line number Diff line number Diff line
@@ -94,7 +94,7 @@ out: 
out_kfree_skb:

	kfree_skb(skb);

oom:

	printk(KERN_ERR "SELinux:  OOM in %s\n", __func__);

	pr_err("SELinux:  OOM in %s\n", __func__);

	goto out;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE