raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 01:49:46 +00:00
Code Issues Projects Releases Wiki Activity

selinux: don't log MAC_POLICY_LOAD record on failed policy load

Browse Source 
commit 519dad3bcd upstream.

If sel_make_policy_nodes() fails, we should jump to 'out', not 'out1',
as the latter would incorrectly log an MAC_POLICY_LOAD audit record,
even though the policy hasn't actually been reloaded. The 'out1' jump
label now becomes unused and can be removed.

Fixes: 02a52c5c8c ("selinux: move policy commit after updating selinuxfs")
Cc: stable@vger.kernel.org
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Ondrej Mosnacek
2021-03-18 22:53:01 +01:00
committed by Greg Kroah-Hartman
parent 3b87d0c583
commit 9731e08a33
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
security/selinux/selinuxfs.c
View File

@@ -651,14 +651,13 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
length = sel_make_policy_nodes(fsi, newpolicy); length = sel_make_policy_nodes(fsi, newpolicy);
if (length) { if (length) {
selinux_policy_cancel(fsi->state, newpolicy); selinux_policy_cancel(fsi->state, newpolicy);
goto out1; goto out;
} }
selinux_policy_commit(fsi->state, newpolicy); selinux_policy_commit(fsi->state, newpolicy);
length = count; length = count;
out1:
audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_POLICY_LOAD, audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_POLICY_LOAD,
"auid=%u ses=%u lsm=selinux res=1", "auid=%u ses=%u lsm=selinux res=1",
from_kuid(&init_user_ns, audit_get_loginuid(current)), from_kuid(&init_user_ns, audit_get_loginuid(current)),