Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6

Browse source 
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6:
  SELinux: one little, two little, three little whitespaces, the avc.c saga.
  SELinux: cleanup on isle selinuxfs.c
  changing whitespace for fun and profit: policydb.c
  SELinux: whitespace and formating fixes for hooks.c
  SELinux: clean up printks
  SELinux: sidtab.c whitespace, syntax, and static declaraction cleanups
  SELinux: services.c whitespace, syntax, and static declaraction cleanups
  SELinux: mls.c whitespace, syntax, and static declaraction cleanups
  SELinux: hashtab.c whitespace, syntax, and static declaraction cleanups
  SELinux: ebitmap.c whitespace, syntax, and static declaraction cleanups
  SELinux: conditional.c whitespace, syntax, and static declaraction cleanups
  SELinux: avtab.c whitespace, syntax, and static declaraction cleanups
  SELinux: xfrm.c whitespace, syntax, and static declaraction cleanups
  SELinux: nlmsgtab.c whitespace, syntax, and static declaraction cleanups
  SELinux: netnode.c whitespace, syntax, and static declaraction cleanups
  SELinux: netlink.c whitespace, syntax, and static declaraction cleanups
  SELinux: netlabel.c whitespace, syntax, and static declaraction cleanups
  SELinux: netif.c whitespace, syntax, and static declaraction cleanups
This commit is contained in:
Linus Torvalds 2008-04-21 16:01:40 -07:00
commit 19b5b517a8
17 changed files with 611 additions and 636 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
security/selinux/avc.c
View file

@ -426,7 +426,7 @@ static int avc_latest_notif_update(int seqno, int is_insert)
spin_lock_irqsave(&notif_lock, flag);
if (is_insert) {
if (seqno < avc_cache.latest_notif) {
printk(KERN_WARNING "avc: seqno %d < latest_notif %d\n",
printk(KERN_WARNING "SELinux: avc: seqno %d < latest_notif %d\n",
seqno, avc_cache.latest_notif);
ret = -EAGAIN;
}

48
security/selinux/hooks.c
View file

@ -99,7 +99,7 @@ extern struct security_operations *security_ops;
atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
int selinux_enforcing = 0;
int selinux_enforcing;
static int __init enforcing_setup(char *str)
{
@ -123,13 +123,13 @@ int selinux_enabled = 1;
#endif
/* Original (dummy) security module. */
static struct security_operations *original_ops = NULL;
static struct security_operations *original_ops;
/* Minimal support for a secondary security module,
just to allow the use of the dummy or capability modules.
The owlsm module can alternatively be used as a secondary
module as long as CONFIG_OWLSM_FD is not enabled. */
static struct security_operations *secondary_ops = NULL;
static struct security_operations *secondary_ops;
/* Lists of inode and superblock security structures initialized
before the policy was loaded. */
@ -575,8 +575,8 @@ static int selinux_set_mnt_opts(struct super_block *sb,
goto out;
}
rc = -EINVAL;
printk(KERN_WARNING "Unable to set superblock options before "
"the security server is initialized\n");
printk(KERN_WARNING "SELinux: Unable to set superblock options "
"before the security server is initialized\n");
goto out;
}
@ -1135,7 +1135,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
dentry = d_find_alias(inode);
}
if (!dentry) {
printk(KERN_WARNING "%s: no dentry for dev=%s "
printk(KERN_WARNING "SELinux: %s: no dentry for dev=%s "
"ino=%ld\n", __func__, inode->i_sb->s_id,
inode->i_ino);
goto out_unlock;
@ -1173,7 +1173,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
dput(dentry);
if (rc < 0) {
if (rc != -ENODATA) {
printk(KERN_WARNING "%s: getxattr returned "
printk(KERN_WARNING "SELinux: %s: getxattr returned "
"%d for dev=%s ino=%ld\n", __func__,
-rc, inode->i_sb->s_id, inode->i_ino);
kfree(context);
@ -1187,7 +1187,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
sbsec->def_sid,
GFP_NOFS);
if (rc) {
printk(KERN_WARNING "%s: context_to_sid(%s) "
printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
"returned %d for dev=%s ino=%ld\n",
__func__, context, -rc,
inode->i_sb->s_id, inode->i_ino);
@ -1510,7 +1510,8 @@ static int may_link(struct inode *dir,
av = DIR__RMDIR;
break;
default:
printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
__func__, kind);
return 0;
}
@ -1640,8 +1641,8 @@ static inline u32 open_file_mask_to_av(int mode, int mask)
else if (S_ISDIR(mode))
av |= DIR__OPEN;
else
printk(KERN_ERR "SELinux: WARNING: inside open_file_to_av "
"with unknown mode:%x\n", mode);
printk(KERN_ERR "SELinux: WARNING: inside %s with "
"unknown mode:%x\n", __func__, mode);
}
return av;
}
@ -1817,16 +1818,14 @@ static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
case Q_QUOTAOFF:
case Q_SETINFO:
case Q_SETQUOTA:
rc = superblock_has_perm(current,
sb,
FILESYSTEM__QUOTAMOD, NULL);
rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAMOD,
NULL);
break;
case Q_GETFMT:
case Q_GETINFO:
case Q_GETQUOTA:
rc = superblock_has_perm(current,
sb,
FILESYSTEM__QUOTAGET, NULL);
rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAGET,
NULL);
break;
default:
rc = 0; /* let the kernel handle invalid cmds */
@ -2314,8 +2313,7 @@ static inline void take_selinux_option(char **to, char *from, int *first,
if (!*first) {
**to = '|';
*to += 1;
}
else
} else
*first = 0;
while (current_size < len) {
@ -2893,7 +2891,6 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd,
*/
default:
error = file_has_perm(current, file, FILE__IOCTL);
}
return error;
}
@ -5218,8 +5215,7 @@ static int selinux_setprocattr(struct task_struct *p,
tsec->sid = sid;
task_unlock(p);
}
}
else
} else
return -EINVAL;
return size;
@ -5523,11 +5519,10 @@ static __init int selinux_init(void)
if (register_security(&selinux_ops))
panic("SELinux: Unable to register with kernel.\n");
if (selinux_enforcing) {
if (selinux_enforcing)
printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
} else {
else
printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
}
#ifdef CONFIG_KEYS
/* Add security information to initial keyrings */
@ -5672,10 +5667,11 @@ static void selinux_nf_ip_exit(void)
#endif /* CONFIG_NETFILTER */
#ifdef CONFIG_SECURITY_SELINUX_DISABLE
static int selinux_disabled;
int selinux_disable(void)
{
extern void exit_sel_fs(void);
static int selinux_disabled = 0;
if (ss_initialized) {
/* Not permitted after initial policy load. */

3
security/selinux/netif.c
View file

@ -31,8 +31,7 @@
#define SEL_NETIF_HASH_SIZE 64
#define SEL_NETIF_HASH_MAX 1024
struct sel_netif
{
struct sel_netif {
struct list_head list;
struct netif_security_struct nsec;
struct rcu_head rcu_head;

3
security/selinux/nlmsgtab.c
View file

@ -23,8 +23,7 @@
#include "flask.h"
#include "av_permissions.h"
struct nlmsg_perm
{
struct nlmsg_perm {
u16 nlmsg_type;
u32 perm;
};

39
security/selinux/selinuxfs.c
View file

@ -73,17 +73,17 @@ __setup("selinux_compat_net=", selinux_compat_net_setup);
static DEFINE_MUTEX(sel_mutex);
/* global data for booleans */
static struct dentry *bool_dir = NULL;
static int bool_num = 0;
static struct dentry *bool_dir;
static int bool_num;
static char **bool_pending_names;
static int *bool_pending_values = NULL;
static int *bool_pending_values;
/* global data for classes */
static struct dentry *class_dir = NULL;
static struct dentry *class_dir;
static unsigned long last_class_ino;
/* global data for policy capabilities */
static struct dentry *policycap_dir = NULL;
static struct dentry *policycap_dir;
extern void selnl_notify_setenforce(int val);
@ -390,8 +390,8 @@ static ssize_t sel_write_context(struct file * file, char *buf, size_t size)
return length;
if (len > SIMPLE_TRANSACTION_LIMIT) {
printk(KERN_ERR "%s: context size (%u) exceeds payload "
"max\n", __func__, len);
printk(KERN_ERR "SELinux: %s: context size (%u) exceeds "
"payload max\n", __func__, len);
length = -ERANGE;
goto out;
}
@ -643,8 +643,8 @@ static ssize_t sel_write_create(struct file * file, char *buf, size_t size)
goto out2;
if (len > SIMPLE_TRANSACTION_LIMIT) {
printk(KERN_ERR "%s: context size (%u) exceeds payload "
"max\n", __func__, len);
printk(KERN_ERR "SELinux: %s: context size (%u) exceeds "
"payload max\n", __func__, len);
length = -ERANGE;
goto out3;
}
@ -820,8 +820,8 @@ static ssize_t sel_write_member(struct file * file, char *buf, size_t size)
goto out2;
if (len > SIMPLE_TRANSACTION_LIMIT) {
printk(KERN_ERR "%s: context size (%u) exceeds payload "
"max\n", __func__, len);
printk(KERN_ERR "SELinux: %s: context size (%u) exceeds "
"payload max\n", __func__, len);
length = -ERANGE;
goto out3;
}
@ -872,7 +872,8 @@ static ssize_t sel_read_bool(struct file *filep, char __user *buf,
ret = -EINVAL;
goto out;
}
if (!(page = (char*)get_zeroed_page(GFP_KERNEL))) {
page = (char *)get_zeroed_page(GFP_KERNEL);
if (!page) {
ret = -ENOMEM;
goto out;
}
@ -991,9 +992,8 @@ static ssize_t sel_commit_bools_write(struct file *filep,
if (sscanf(page, "%d", &new_value) != 1)
goto out;
if (new_value && bool_pending_values) {
if (new_value && bool_pending_values)
security_set_bools(bool_num, bool_pending_values);
}
length = count;
@ -1055,7 +1055,8 @@ static int sel_make_bools(void)
sel_remove_entries(dir);
if (!(page = (char*)get_zeroed_page(GFP_KERNEL)))
page = (char *)get_zeroed_page(GFP_KERNEL);
if (!page)
return -ENOMEM;
ret = security_get_bools(&num, &names, &values);
@ -1083,7 +1084,8 @@ static int sel_make_bools(void)
goto err;
}
isec = (struct inode_security_struct *)inode->i_security;
if ((ret = security_genfs_sid("selinuxfs", page, SECCLASS_FILE, &sid)))
ret = security_genfs_sid("selinuxfs", page, SECCLASS_FILE, &sid);
if (ret)
goto err;
isec->sid = sid;
isec->initialized = 1;
@ -1111,7 +1113,7 @@ static int sel_make_bools(void)
#define NULL_FILE_NAME "null"
struct dentry *selinux_null = NULL;
struct dentry *selinux_null;
static ssize_t sel_read_avc_cache_threshold(struct file *filp, char __user *buf,
size_t count, loff_t *ppos)
@ -1760,7 +1762,8 @@ static int sel_fill_super(struct super_block * sb, void * data, int silent)
out:
return ret;
err:
printk(KERN_ERR "%s: failed while creating inodes\n", __func__);
printk(KERN_ERR "SELinux: %s: failed while creating inodes\n",
__func__);
goto out;
}

30
security/selinux/ss/avtab.c
View file

@ -310,8 +310,8 @@ void avtab_hash_eval(struct avtab *h, char *tag)
}
}
printk(KERN_DEBUG "%s: %d entries and %d/%d buckets used, longest "
"chain length %d sum of chain length^2 %Lu\n",
printk(KERN_DEBUG "SELinux: %s: %d entries and %d/%d buckets used, "
"longest chain length %d sum of chain length^2 %Lu\n",
tag, h->nel, slots_used, h->nslot, max_chain_len,
chain2_len_sum);
}
@ -364,19 +364,19 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
val = le32_to_cpu(buf32[items++]);
key.source_type = (u16)val;
if (key.source_type != val) {
printk("SELinux: avtab: truncated source type\n");
printk(KERN_ERR "SELinux: avtab: truncated source type\n");
return -1;
}
val = le32_to_cpu(buf32[items++]);
key.target_type = (u16)val;
if (key.target_type != val) {
printk("SELinux: avtab: truncated target type\n");
printk(KERN_ERR "SELinux: avtab: truncated target type\n");
return -1;
}
val = le32_to_cpu(buf32[items++]);
key.target_class = (u16)val;
if (key.target_class != val) {
printk("SELinux: avtab: truncated target class\n");
printk(KERN_ERR "SELinux: avtab: truncated target class\n");
return -1;
}
@ -384,12 +384,12 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
enabled = (val & AVTAB_ENABLED_OLD) ? AVTAB_ENABLED : 0;
if (!(val & (AVTAB_AV | AVTAB_TYPE))) {
printk("SELinux: avtab: null entry\n");
printk(KERN_ERR "SELinux: avtab: null entry\n");
return -1;
}
if ((val & AVTAB_AV) &&
(val & AVTAB_TYPE)) {
printk("SELinux: avtab: entry has both access vectors and types\n");
printk(KERN_ERR "SELinux: avtab: entry has both access vectors and types\n");
return -1;
}
@ -398,12 +398,13 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
key.specified = spec_order[i] | enabled;
datum.data = le32_to_cpu(buf32[items++]);
rc = insertf(a, &key, &datum, p);
if (rc) return rc;
if (rc)
return rc;
}
}
if (items != items2) {
printk("SELinux: avtab: entry only had %d items, expected %d\n", items2, items);
printk(KERN_ERR "SELinux: avtab: entry only had %d items, expected %d\n", items2, items);
return -1;
}
return 0;
@ -411,7 +412,7 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
rc = next_entry(buf16, fp, sizeof(u16)*4);
if (rc < 0) {
printk("SELinux: avtab: truncated entry\n");
printk(KERN_ERR "SELinux: avtab: truncated entry\n");
return -1;
}
@ -424,7 +425,7 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
if (!policydb_type_isvalid(pol, key.source_type) ||
!policydb_type_isvalid(pol, key.target_type) ||
!policydb_class_isvalid(pol, key.target_class)) {
printk(KERN_WARNING "SELinux: avtab: invalid type or class\n");
printk(KERN_ERR "SELinux: avtab: invalid type or class\n");
return -1;
}
@ -434,20 +435,19 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
set++;
}
if (!set || set > 1) {
printk(KERN_WARNING
"SELinux: avtab: more than one specifier\n");
printk(KERN_ERR "SELinux: avtab: more than one specifier\n");
return -1;
}
rc = next_entry(buf32, fp, sizeof(u32));
if (rc < 0) {
printk("SELinux: avtab: truncated entry\n");
printk(KERN_ERR "SELinux: avtab: truncated entry\n");
return -1;
}
datum.data = le32_to_cpu(*buf32);
if ((key.specified & AVTAB_TYPE) &&
!policydb_type_isvalid(pol, datum.data)) {
printk(KERN_WARNING "SELinux: avtab: invalid type\n");
printk(KERN_ERR "SELinux: avtab: invalid type\n");
return -1;
}
return insertf(a, &key, &datum, p);

43
security/selinux/ss/conditional.c
View file

@ -98,22 +98,20 @@ int evaluate_cond_node(struct policydb *p, struct cond_node *node)
printk(KERN_ERR "SELinux: expression result was undefined - disabling all rules.\n");
/* turn the rules on or off */
for (cur = node->true_list; cur != NULL; cur = cur->next) {
if (new_state <= 0) {
if (new_state <= 0)
cur->node->key.specified &= ~AVTAB_ENABLED;
} else {
else
cur->node->key.specified |= AVTAB_ENABLED;
}
}
for (cur = node->false_list; cur != NULL; cur = cur->next) {
/* -1 or 1 */
if (new_state) {
if (new_state)
cur->node->key.specified &= ~AVTAB_ENABLED;
} else {
else
cur->node->key.specified |= AVTAB_ENABLED;
}
}
}
return 0;
}
@ -251,8 +249,7 @@ int cond_read_bool(struct policydb *p, struct hashtab *h, void *fp)
return -1;
}
struct cond_insertf_data
{
struct cond_insertf_data {
struct policydb *p;
struct cond_av_list *other;
struct cond_av_list *head;
@ -275,7 +272,7 @@ static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum
*/
if (k->specified & AVTAB_TYPE) {
if (avtab_search(&p->te_avtab, k)) {
printk("SELinux: type rule already exists outside of a conditional.");
printk(KERN_ERR "SELinux: type rule already exists outside of a conditional.\n");
goto err;
}
/*
@ -290,7 +287,7 @@ static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum
node_ptr = avtab_search_node(&p->te_cond_avtab, k);
if (node_ptr) {
if (avtab_search_node_next(node_ptr, k->specified)) {
printk("SELinux: too many conflicting type rules.");
printk(KERN_ERR "SELinux: too many conflicting type rules.\n");
goto err;
}
found = 0;
@ -301,13 +298,13 @@ static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum
}
}
if (!found) {
printk("SELinux: conflicting type rules.\n");
printk(KERN_ERR "SELinux: conflicting type rules.\n");
goto err;
}
}
} else {
if (avtab_search(&p->te_cond_avtab, k)) {
printk("SELinux: conflicting type rules when adding type rule for true.\n");
printk(KERN_ERR "SELinux: conflicting type rules when adding type rule for true.\n");
goto err;
}
}
@ -315,7 +312,7 @@ static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum
node_ptr = avtab_insert_nonunique(&p->te_cond_avtab, k, d);
if (!node_ptr) {
printk("SELinux: could not insert rule.");
printk(KERN_ERR "SELinux: could not insert rule.\n");
goto err;
}
@ -352,9 +349,8 @@ static int cond_read_av_list(struct policydb *p, void *fp, struct cond_av_list *
return -1;
len = le32_to_cpu(buf[0]);
if (len == 0) {
if (len == 0)
return 0;
}
data.p = p;
data.other = other;
@ -375,12 +371,12 @@ static int cond_read_av_list(struct policydb *p, void *fp, struct cond_av_list *
static int expr_isvalid(struct policydb *p, struct cond_expr *expr)
{
if (expr->expr_type <= 0 || expr->expr_type > COND_LAST) {
printk("SELinux: conditional expressions uses unknown operator.\n");
printk(KERN_ERR "SELinux: conditional expressions uses unknown operator.\n");
return 0;
}
if (expr->bool > p->p_bools.nprim) {
printk("SELinux: conditional expressions uses unknown bool.\n");
printk(KERN_ERR "SELinux: conditional expressions uses unknown bool.\n");
return 0;
}
return 1;
@ -413,9 +409,8 @@ static int cond_read_node(struct policydb *p, struct cond_node *node, void *fp)
goto err;
expr = kzalloc(sizeof(struct cond_expr), GFP_KERNEL);
if (!expr) {
if (!expr)
goto err;
}
expr->expr_type = le32_to_cpu(buf[0]);
expr->bool = le32_to_cpu(buf[1]);
@ -425,11 +420,10 @@ static int cond_read_node(struct policydb *p, struct cond_node *node, void *fp)
goto err;
}
if (i == 0) {
if (i == 0)
node->expr = expr;
} else {
else
last->next = expr;
}
last = expr;
}
@ -468,11 +462,10 @@ int cond_read_list(struct policydb *p, void *fp)
if (cond_read_node(p, node, fp) != 0)
goto err;
if (i == 0) {
if (i == 0)
p->cond_list = node;
} else {
else
last->next = node;
}
last = node;
}
return 0;

5
security/selinux/ss/ebitmap.c
View file

@ -411,11 +411,10 @@ int ebitmap_read(struct ebitmap *e, void *fp)
}
/* round down */
tmp->startbit = startbit - (startbit % EBITMAP_SIZE);
if (n) {
if (n)
n->next = tmp;
} else {
else
e->node = tmp;
}
n = tmp;
} else if (startbit <= n->startbit) {
printk(KERN_ERR "SELinux: ebitmap: start bit %d"

9
security/selinux/ss/mls.c
View file

@ -305,7 +305,8 @@ int mls_context_to_sid(char oldc,
*p++ = 0;
/* Separate into range if exists */
if ((rngptr = strchr(scontextp, '.')) != NULL) {
rngptr = strchr(scontextp, '.');
if (rngptr != NULL) {
/* Remove '.' */
*rngptr++ = 0;
}
@ -449,11 +450,11 @@ int mls_setup_user_range(struct context *fromcon, struct user_datum *user,
that of the user's default clearance (but
only if the "fromcon" clearance dominates
the user's computed sensitivity level) */
if (mls_level_dom(user_clr, fromcon_clr)) {
if (mls_level_dom(user_clr, fromcon_clr))
*usercon_clr = *fromcon_clr;
} else if (mls_level_dom(fromcon_clr, user_clr)) {
else if (mls_level_dom(fromcon_clr, user_clr))
*usercon_clr = *user_clr;
} else
else
return -EINVAL;
}

44
security/selinux/ss/policydb.c
View file

@ -51,7 +51,7 @@ static char *symtab_name[SYM_NUM] = {
};
#endif
int selinux_mls_enabled = 0;
int selinux_mls_enabled;
static unsigned int symtab_sizes[SYM_NUM] = {
2,
@ -390,7 +390,7 @@ static void symtab_hash_eval(struct symtab *s)
struct hashtab_info info;
hashtab_stat(h, &info);
printk(KERN_DEBUG "%s: %d entries and %d/%d buckets used, "
printk(KERN_DEBUG "SELinux: %s: %d entries and %d/%d buckets used, "
"longest chain length %d\n", symtab_name[i], h->nel,
info.slots_used, h->size, info.max_chain_len);
}
@ -1012,11 +1012,10 @@ static int read_cons_helper(struct constraint_node **nodep, int ncons,
if (!c)
return -ENOMEM;
if (lc) {
if (lc)
lc->next = c;
} else {
else
*nodep = c;
}
rc = next_entry(buf, fp, (sizeof(u32) * 2));
if (rc < 0)
@ -1030,11 +1029,10 @@ static int read_cons_helper(struct constraint_node **nodep, int ncons,
if (!e)
return -ENOMEM;
if (le) {
if (le)
le->next = e;
} else {
else
c->expr = e;
}
rc = next_entry(buf, fp, (sizeof(u32) * 3));
if (rc < 0)
@ -1215,7 +1213,7 @@ static int role_read(struct policydb *p, struct hashtab *h, void *fp)
if (strcmp(key, OBJECT_R) == 0) {
if (role->value != OBJECT_R_VAL) {
printk(KERN_ERR "Role %s has wrong value %d\n",
printk(KERN_ERR "SELinux: Role %s has wrong value %d\n",
OBJECT_R, role->value);
rc = -EINVAL;
goto bad;
@ -1551,22 +1549,23 @@ int policydb_read(struct policydb *p, void *fp)
if ((le32_to_cpu(buf[1]) & POLICYDB_CONFIG_MLS)) {
if (ss_initialized && !selinux_mls_enabled) {
printk(KERN_ERR "Cannot switch between non-MLS and MLS "
"policies\n");
printk(KERN_ERR "SELinux: Cannot switch between non-MLS"
" and MLS policies\n");
goto bad;
}
selinux_mls_enabled = 1;
config |= POLICYDB_CONFIG_MLS;
if (p->policyvers < POLICYDB_VERSION_MLS) {
printk(KERN_ERR "security policydb version %d (MLS) "
"not backwards compatible\n", p->policyvers);
printk(KERN_ERR "SELinux: security policydb version %d "
"(MLS) not backwards compatible\n",
p->policyvers);
goto bad;
}
} else {
if (ss_initialized && selinux_mls_enabled) {
printk(KERN_ERR "Cannot switch between MLS and non-MLS "
"policies\n");
printk(KERN_ERR "SELinux: Cannot switch between MLS and"
" non-MLS policies\n");
goto bad;
}
}
@ -1633,11 +1632,10 @@ int policydb_read(struct policydb *p, void *fp)
rc = -ENOMEM;
goto bad;
}
if (ltr) {
if (ltr)
ltr->next = tr;
} else {
else
p->role_tr = tr;
}
rc = next_entry(buf, fp, sizeof(u32)*3);
if (rc < 0)
goto bad;
@ -1664,11 +1662,10 @@ int policydb_read(struct policydb *p, void *fp)
rc = -ENOMEM;
goto bad;
}
if (lra) {
if (lra)
lra->next = ra;
} else {
else
p->role_allow = ra;
}
rc = next_entry(buf, fp, sizeof(u32)*2);
if (rc < 0)
goto bad;
@ -1702,11 +1699,10 @@ int policydb_read(struct policydb *p, void *fp)
rc = -ENOMEM;
goto bad;
}
if (l) {
if (l)
l->next = c;
} else {
else
p->ocontexts[i] = c;
}
l = c;
rc = -EINVAL;
switch (i) {

84
security/selinux/ss/services.c
View file

@ -82,7 +82,7 @@ static DEFINE_MUTEX(load_mutex);
static struct sidtab sidtab;
struct policydb policydb;
int ss_initialized = 0;
int ss_initialized;
/*
* The largest sequence number that has been used when
@ -90,7 +90,7 @@ int ss_initialized = 0;
* The sequence number only changes when a policy change
* occurs.
*/
static u32 latest_granting = 0;
static u32 latest_granting;
/* Forward declaration. */
static int context_struct_to_string(struct context *context, char **scontext,
@ -415,7 +415,8 @@ static int context_struct_compute_av(struct context *scontext,
return 0;
inval_class:
printk(KERN_ERR "%s: unrecognized class %d\n", __func__, tclass);
printk(KERN_ERR "SELinux: %s: unrecognized class %d\n", __func__,
tclass);
return -EINVAL;
}
@ -499,8 +500,8 @@ int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid,
tclass = SECCLASS_NETLINK_SOCKET;
if (!tclass || tclass > policydb.p_classes.nprim) {
printk(KERN_ERR "security_validate_transition: "
"unrecognized class %d\n", tclass);
printk(KERN_ERR "SELinux: %s: unrecognized class %d\n",
__func__, tclass);
rc = -EINVAL;
goto out;
}
@ -508,24 +509,24 @@ int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid,
ocontext = sidtab_search(&sidtab, oldsid);
if (!ocontext) {
printk(KERN_ERR "security_validate_transition: "
" unrecognized SID %d\n", oldsid);
printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
__func__, oldsid);
rc = -EINVAL;
goto out;
}
ncontext = sidtab_search(&sidtab, newsid);
if (!ncontext) {
printk(KERN_ERR "security_validate_transition: "
" unrecognized SID %d\n", newsid);
printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
__func__, newsid);
rc = -EINVAL;
goto out;
}
tcontext = sidtab_search(&sidtab, tasksid);
if (!tcontext) {
printk(KERN_ERR "security_validate_transition: "
" unrecognized SID %d\n", tasksid);
printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
__func__, tasksid);
rc = -EINVAL;
goto out;
}
@ -581,15 +582,15 @@ int security_compute_av(u32 ssid,
scontext = sidtab_search(&sidtab, ssid);
if (!scontext) {
printk(KERN_ERR "security_compute_av: unrecognized SID %d\n",
ssid);
printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
__func__, ssid);
rc = -EINVAL;
goto out;
}
tcontext = sidtab_search(&sidtab, tsid);
if (!tcontext) {
printk(KERN_ERR "security_compute_av: unrecognized SID %d\n",
tsid);
printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
__func__, tsid);
rc = -EINVAL;
goto out;
}
@ -623,9 +624,8 @@ static int context_struct_to_string(struct context *context, char **scontext, u3
/* Allocate space for the context; caller must free this space. */
scontextp = kmalloc(*scontext_len, GFP_ATOMIC);
if (!scontextp) {
if (!scontextp)
return -ENOMEM;
}
*scontext = scontextp;
/*
@ -687,16 +687,16 @@ int security_sid_to_context(u32 sid, char **scontext, u32 *scontext_len)
*scontext = scontextp;
goto out;
}
printk(KERN_ERR "security_sid_to_context: called before initial "
"load_policy on unknown SID %d\n", sid);
printk(KERN_ERR "SELinux: %s: called before initial "
"load_policy on unknown SID %d\n", __func__, sid);
rc = -EINVAL;
goto out;
}
POLICY_RDLOCK;
context = sidtab_search(&sidtab, sid);
if (!context) {
printk(KERN_ERR "security_sid_to_context: unrecognized SID "
"%d\n", sid);
printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
__func__, sid);
rc = -EINVAL;
goto out_unlock;
}
@ -926,15 +926,15 @@ static int security_compute_sid(u32 ssid,
scontext = sidtab_search(&sidtab, ssid);
if (!scontext) {
printk(KERN_ERR "security_compute_sid: unrecognized SID %d\n",
ssid);
printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
__func__, ssid);
rc = -EINVAL;
goto out_unlock;
}
tcontext = sidtab_search(&sidtab, tsid);
if (!tcontext) {
printk(KERN_ERR "security_compute_sid: unrecognized SID %d\n",
tsid);
printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
__func__, tsid);
rc = -EINVAL;
goto out_unlock;
}
@ -1289,25 +1289,22 @@ static int convert_context(u32 key,
/* Convert the user. */
usrdatum = hashtab_search(args->newp->p_users.table,
args->oldp->p_user_val_to_name[c->user - 1]);
if (!usrdatum) {
if (!usrdatum)
goto bad;
}
c->user = usrdatum->value;
/* Convert the role. */
role = hashtab_search(args->newp->p_roles.table,
args->oldp->p_role_val_to_name[c->role - 1]);
if (!role) {
if (!role)
goto bad;
}
c->role = role->value;
/* Convert the type. */
typdatum = hashtab_search(args->newp->p_types.table,
args->oldp->p_type_val_to_name[c->type - 1]);
if (!typdatum) {
if (!typdatum)
goto bad;
}
c->type = typdatum->value;
rc = mls_convert_context(args->oldp, args->newp, c);
@ -1938,12 +1935,11 @@ int security_set_bools(int len, int *values)
audit_get_loginuid(current),
audit_get_sessionid(current));
}
if (values[i]) {
if (values[i])
policydb.bool_val_to_struct[i]->state = 1;
} else {
else
policydb.bool_val_to_struct[i]->state = 0;
}
}
for (cur = policydb.cond_list; cur != NULL; cur = cur->next) {
rc = evaluate_cond_node(&policydb, cur);
@ -2036,16 +2032,16 @@ int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)
POLICY_RDLOCK;
context1 = sidtab_search(&sidtab, sid);
if (!context1) {
printk(KERN_ERR "security_sid_mls_copy: unrecognized SID "
"%d\n", sid);
printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
__func__, sid);
rc = -EINVAL;
goto out_unlock;
}
context2 = sidtab_search(&sidtab, mls_sid);
if (!context2) {
printk(KERN_ERR "security_sid_mls_copy: unrecognized SID "
"%d\n", mls_sid);
printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
__func__, mls_sid);
rc = -EINVAL;
goto out_unlock;
}
@ -2136,17 +2132,15 @@ int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type,
nlbl_ctx = sidtab_search(&sidtab, nlbl_sid);
if (!nlbl_ctx) {
printk(KERN_ERR
"security_sid_mls_cmp: unrecognized SID %d\n",
nlbl_sid);
printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
__func__, nlbl_sid);
rc = -EINVAL;
goto out_slowpath;
}
xfrm_ctx = sidtab_search(&sidtab, xfrm_sid);
if (!xfrm_ctx) {
printk(KERN_ERR
"security_sid_mls_cmp: unrecognized SID %d\n",
xfrm_sid);
printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",
__func__, xfrm_sid);
rc = -EINVAL;
goto out_slowpath;
}
@ -2226,7 +2220,7 @@ int security_get_permissions(char *class, char ***perms, int *nperms)
match = hashtab_search(policydb.p_classes.table, class);
if (!match) {
printk(KERN_ERR "%s: unrecognized class %s\n",
printk(KERN_ERR "SELinux: %s: unrecognized class %s\n",
__func__, class);
rc = -EINVAL;
goto out;

6
security/selinux/ss/sidtab.c
View file

@ -156,12 +156,10 @@ void sidtab_map_remove_on_error(struct sidtab *s,
while (cur != NULL) {
ret = apply(cur->sid, &cur->context, args);
if (ret) {
if (last) {
if (last)
last->next = cur->next;
} else {
else
s->htable[i] = cur->next;
}
temp = cur;
cur = cur->next;
context_destroy(&temp->context);

5
security/selinux/xfrm.c
View file

@ -180,8 +180,7 @@ int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall)
if (!ckall)
break;
}
else if (*sid != ctx->ctx_sid)
} else if (*sid != ctx->ctx_sid)
return -EINVAL;
}
}
@ -326,7 +325,6 @@ int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
*/
void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
{
if (ctx)
kfree(ctx);
}
@ -372,7 +370,6 @@ int selinux_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *uct
void selinux_xfrm_state_free(struct xfrm_state *x)
{
struct xfrm_sec_ctx *ctx = x->security;
if (ctx)
kfree(ctx);
}