diff options
| author |   Pablo Neira Ayuso <pablo@netfilter.org> | 2011-01-06 11:25:00 -0800 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2011-01-06 11:25:00 -0800 |
| commit | cba85b532e4aabdb97f44c18987d45141fd93faa (patch) | |
| tree | 785e2a715a922c36b15e1929473498e3b3aae724 /net/netfilter/nf_conntrack_standalone.c | |
| parent | netfilter: fix the race when initializing nf_ct_expect_hash_rnd (diff) | |
| download | linux-dev-cba85b532e4aabdb97f44c18987d45141fd93faa.tar.xz linux-dev-cba85b532e4aabdb97f44c18987d45141fd93faa.zip | |
netfilter: fix export secctx error handling
In 1ae4de0cdf855305765592647025bde55e85e451, the secctx was exported
via the /proc/net/netfilter/nf_conntrack and ctnetlink interfaces
instead of the secmark.
That patch introduced the use of security_secid_to_secctx() which may
return a non-zero value on error.
In one of my setups, I have NF_CONNTRACK_SECMARK enabled but no
security modules. Thus, security_secid_to_secctx() returns a negative
value that results in the breakage of the /proc and `conntrack -L'
outputs. To fix this, we skip the inclusion of secctx if the
aforementioned function fails.
This patch also fixes the dynamic netlink message size calculation
if security_secid_to_secctx() returns an error, since its logic is
also wrong.
This problem exists in Linux kernel >= 2.6.37.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/netfilter/nf_conntrack_standalone.c')
| -rw-r--r-- | net/netfilter/nf_conntrack_standalone.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c index 0fb65705b44b..b4d7f0f24b27 100644 --- a/net/netfilter/nf_conntrack_standalone.c +++ b/net/netfilter/nf_conntrack_standalone.c @@ -118,7 +118,7 @@ static int ct_show_secctx(struct seq_file *s, const struct nf_conn *ct) ret = security_secid_to_secctx(ct->secmark, &secctx, &len); if (ret) - return ret; + return 0; ret = seq_printf(s, "secctx=%s ", secctx); |