The LSM might report and error. It's up to the caller to figure out
how to deal with that error. In this case we want to use the audit
system so it's up to the audit system how to handle that error. This
helper function says the audit system should log it if it work and
should audit_panic() if it doesn't. audit_panic() will just call
printk for most people and can actually panic the box for nutters who
really care. In this way we always log the information and if we
don't it's up to audit how audit handles it's inability to log info.
It's not netfilter's job to handle the error. It's not the LSMs job
to know how it's caller wants to handle the error. Audit is who has
special requirements and the code to handle the error should be in
audit code. (Maybe it wasn't clear, but I think this function should
go in kernel/audit.c, not the netfilter code. The netfilter code
should call this helper function.
Yeah, that's fair enough, though from what I remember
security_secid_to_secctx already returns a 'yes'/'no' result (I am
talking from the top of my head here as I am away at present and can't
check it out to be certain), indicating whether the conversion was
successful or not.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
