This is already in v20-rc1.
Oren
Serge E. Hallyn wrote:
> If an object is being restored which was checkpointed without an
> LSM label, then we should return 0 BEFORE we try to ckpt_obj_fetch
> a -1 objref (and obviously return error).
>
> This makes the msg cr_tests ipc testcase fail if, for instance,
> CONFIG_SECURITY=y but no LSM is active.
>
> IMO this definately should be in the tree that gets sent out...
>
> Signed-off-by: Serge E. Hallyn <serue@xxxxxxxxxx>
> ---
> security/security.c | 8 ++++----
> 1 files changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/security/security.c b/security/security.c
> index 2b147cf..4b3f932 100644
> --- a/security/security.c
> +++ b/security/security.c
> @@ -1528,14 +1528,14 @@ int security_restore_obj(struct ckpt_ctx *ctx, void *v, int sectype,
> if (sectype != CKPT_SECURITY_MSG_MSG)
> return 0;
>
> - l = ckpt_obj_fetch(ctx, secref, CKPT_OBJ_SECURITY);
> - if (IS_ERR(l))
> - return PTR_ERR(l);
> -
> /* return if checkpointed label was "Not Applicable" */
> if (secref == SECURITY_CTX_NONE)
> return 0;
>
> + l = ckpt_obj_fetch(ctx, secref, CKPT_OBJ_SECURITY);
> + if (IS_ERR(l))
> + return PTR_ERR(l);
> +
> /* Ask the LSM to apply a void*security to the object
> * based on the checkpointed context string */
> switch (sectype) {
_______________________________________________
Containers mailing list
Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx
https://lists.linux-foundation.org/mailman/listinfo/containers
