If an object is being restored which was checkpointed without an LSM label, then we should return 0 BEFORE we try to ckpt_obj_fetch a -1 objref (and obviously return error).
This makes the msg cr_tests ipc testcase fail if, for instance, CONFIG_SECURITY=y but no LSM is active. IMO this definately should be in the tree that gets sent out... Signed-off-by: Serge E. Hallyn <[email protected]> --- security/security.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff --git a/security/security.c b/security/security.c index 2b147cf..4b3f932 100644 --- a/security/security.c +++ b/security/security.c @@ -1528,14 +1528,14 @@ int security_restore_obj(struct ckpt_ctx *ctx, void *v, int sectype, if (sectype != CKPT_SECURITY_MSG_MSG) return 0; - l = ckpt_obj_fetch(ctx, secref, CKPT_OBJ_SECURITY); - if (IS_ERR(l)) - return PTR_ERR(l); - /* return if checkpointed label was "Not Applicable" */ if (secref == SECURITY_CTX_NONE) return 0; + l = ckpt_obj_fetch(ctx, secref, CKPT_OBJ_SECURITY); + if (IS_ERR(l)) + return PTR_ERR(l); + /* Ask the LSM to apply a void*security to the object * based on the checkpointed context string */ switch (sectype) { -- 1.6.1 _______________________________________________ Containers mailing list [email protected] https://lists.linux-foundation.org/mailman/listinfo/containers _______________________________________________ Devel mailing list [email protected] https://openvz.org/mailman/listinfo/devel
