diff options
| author |   Paul Moore <paul@paul-moore.com> | 2020-11-03 11:49:38 -0500 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2020-11-05 22:47:31 -0500 |
| commit | 200ea5a2292dc444a818b096ae6a32ba3caa51b9 (patch) | |
| tree | 399427f050ca3db3ed79628ef296d2200c605f6c /security/selinux/include | |
| parent | selinux: allow dontauditx and auditallowx rules to take effect without allowx (diff) | |
| download | linux-dev-200ea5a2292dc444a818b096ae6a32ba3caa51b9.tar.xz linux-dev-200ea5a2292dc444a818b096ae6a32ba3caa51b9.zip | |
selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling
A previous fix, commit 83370b31a915 ("selinux: fix error initialization
in inode_doinit_with_dentry()"), changed how failures were handled
before a SELinux policy was loaded. Unfortunately that patch was
potentially problematic for two reasons: it set the isec->initialized
state without holding a lock, and it didn't set the inode's SELinux
label to the "default" for the particular filesystem. The later can
be a problem if/when a later attempt to revalidate the inode fails
and SELinux reverts to the existing inode label.
This patch should restore the default inode labeling that existed
before the original fix, without affecting the LABEL_INVALID marking
such that revalidation will still be attempted in the future.
Fixes: 83370b31a915 ("selinux: fix error initialization in inode_doinit_with_dentry()")
Reported-by: Sven Schnelle <svens@linux.ibm.com>
Tested-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security/selinux/include')
0 files changed, 0 insertions, 0 deletions