On Thu, Jan 16, 2020 at 11:41 AM Stephen Smalley <sds@xxxxxxxxxxxxx> wrote: > On 1/16/20 7:04 AM, Ondrej Mosnacek wrote: > > First, evaluate_cond_node() never returns an error. Make it just return > > void. > > > > Second, drop the use of security_get_bools() from > > security_preserve_bools() and read from the old policydb directly. This > > saves some useless allocations and together with the first change makes > > security_preserve_bools() no longer possibly return an error. Again the > > return type is changed to void. > > > > Signed-off-by: Ondrej Mosnacek <omosnace@xxxxxxxxxx> > > Dropping use of security_get_bools() means we are no longer reading the > boolean values with the policy read-lock held so they could in theory > change underneath us. However, this is presently prevented via the > fsi->mutex taken by selinuxfs so I believe this is safe. Since this code shouldn't be run very often, I think I would prefer the added abstraction and safety of preserving the call to security_get_bools(). In an effort to make sure expectations are set correctly, patches 2 through 6 are something that should probably wait until after the upcoming merge window, so no rush on a respin. -- paul moore www.paul-moore.com
