On Mon, 20 Dec 2010 08:37:03 -0500
Mimi Zohar <[email protected]> wrote:

> If security_filter_rule_init() doesn't return a rule, then not everything
> is as fine as the return code implies.
> 
> This bug only occurs when the LSM (eg. SELinux) is disabled at runtime.
> 
> Signed-off-by: Mimi Zohar <[email protected]>
> Cc: Stable Kernel <[email protected]>
> ---
>  security/integrity/ima/ima_policy.c |    2 ++
>  1 files changed, 2 insertions(+), 0 deletions(-)
> 
> diff --git a/security/integrity/ima/ima_policy.c 
> b/security/integrity/ima/ima_policy.c
> index aef8c0a..d661afb 100644
> --- a/security/integrity/ima/ima_policy.c
> +++ b/security/integrity/ima/ima_policy.c
> @@ -253,6 +253,8 @@ static int ima_lsm_rule_init(struct 
> ima_measure_rule_entry *entry,
>       result = security_filter_rule_init(entry->lsm[lsm_rule].type,
>                                          Audit_equal, args,
>                                          &entry->lsm[lsm_rule].rule);
> +     if (!entry->lsm[lsm_rule].rule)
> +             return -EINVAL;
>       return result;
>  }
>  

You've cc'ed -stable but you didn't tell us what are the user-visible
effects of this bug.  This makes it rather hard for others to
understand why you believe the patch should be backported.

_______________________________________________
stable mailing list
[email protected]
http://linux.kernel.org/mailman/listinfo/stable

Reply via email to